Due diligence checklist for buying a business: add the records and rights section

Why does an acquisition diligence checklist need a records-and-rights section?

Most ETA checklists cover financials, customers, legal and operations, but stop short of asking what records the business holds and what you can do with them after closing. Adding one section tells you what you will own on day one and whether the company could license its operating history.

The section below is meant to sit alongside your quality-of-earnings, legal and IT reviews. It does not replace them. It adds the questions that decide whether the target's records are a clean asset: which systems exist, how far back they go, who created the content, and what customers and employees have agreed to.

Checklist: systems and archive depth

Start with what exists. A buyer who cannot list the systems cannot judge the records.

• Request a list of every system in use, including email, Slack or Teams, CRM, accounting, ticketing, project tools, code repositories and shared drives.
• Ask for the first year of records in each system, and whether anything was migrated from an older platform.
• Identify archived or retired systems and whether exports were kept.
• Confirm who administers each system and whether that person is staying through transition.
• Check retention settings: auto-delete rules, mailbox purges, chat history limits.
• Ask whether any system is owned by a vendor, parent or former owner rather than the target.

Checklist: who created the content

Rights follow authorship and contracts, not login credentials.

• List contractors and agencies who produced documents, code or designs, and review their agreements for ownership language.
• Check employee agreements and handbooks for invention-assignment and acceptable-use terms.
• Identify content created for clients under work-for-hire or client-owned terms.
• Look for open-source or third-party license obligations in code and templates.
• Confirm whether any records came with a prior acquisition and what that purchase agreement said.

Checklist: customer and personal data limits

Operating records often contain third-party data the target cannot freely reuse.

• Read key customer contracts for confidentiality, data-use and audit clauses.
• Identify how much of the CRM and ticket history is consumer personal information.
• Ask whether any protected health information or financial account data sits in the systems.
• Check call-recording notices and consent practices where recordings exist.
• Confirm the privacy policy and employee notices match how records are actually used.

How do I read the results?

Tally the answers by section and match them to a next action.

For a quick screen on a live target, the company fit checker is a preliminary, non-binding view with no contact details needed.

When in the deal timeline should I use this?

Ask in diligence rather than after closing, because exports are easiest to arrange while the seller and the current system administrators are still engaged.

If the target joins a group, your sponsor or operating partner may handle the decision; the operating partner page and holdco decision rights explain who signs.

What to tell the team afterward

If you do pursue a license, employees should hear it from leadership. Draft your message with the guidance in how to tell employees the company is licensing data, and check the wider rights readiness checklist when you are ready to assess a specific company.

What happens if the target later explores a license?

1. Finish the three checklists and the preliminary fit screen.
2. If you are the authorized sponsor of the company you now own, you can have it apply directly at sourcex.si/apply. If you want to introduce a company you do not own, register as a partner. Check any investor or fund agreement before accepting a reward tied to a company you control.
3. SourceX qualifies the company on size, history, data breadth and rights, and the company then completes its own data inventory.
4. Price and terms are agreed with the company, buyers review, and nothing is binding until the company signs.
5. If a deal closes, the data is delivered and the company is paid.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 cumulative per referred company. The reward becomes payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed. Partners never export, upload or describe confidential records.

Red flags that stop the process

• Archives deleted or tools cancelled without an export.
• Data belongs to clients who have not agreed.
• Mainly consumer personal data or protected health information with no licensing basis.
• Data already licensed for AI training.
• Nobody can export the records.
• The owner will not consider an exclusive license.

Next step

Add the three checklists to your diligence request this week. If a target passes, register as a partner and use the referral form, or send the sponsor to sourcex.si/apply.