Due Diligence: 12 Essentials Startups Must Show Investors

Due diligence is the structured review investors use to test the reality behind your story: the ownership, numbers, risks, and repeatability of your business. In plain terms, it asks, “Is this company what it says it is, and can it scale without breaking?” This guide shows you exactly what to prepare and how to present it so investors can say “yes” with confidence. While comprehensive, it’s not legal, tax, or accounting advice; treat it as a practitioner’s playbook and consult qualified professionals for your specific situation.

Quick answer: what should a startup show in due diligence? The 12 essentials: (1) clean corporate records and a current cap table, (2) clear, reconcilable financials and defensible forecasts, (3) unit economics and payback math, (4) credible market sizing and competition, (5) product, tech, and IP ownership, (6) legal and data protection compliance, (7) customers, contracts, and concentration, (8) team and governance, (9) fundraising instruments and terms, (10) go-to-market engine and pipeline, (11) operational risks and security, and (12) a tidy data room with a narrative thread. Master these and you’ll accelerate diligence, reduce renegotiations, and keep momentum. The payoff: faster closes, cleaner terms, and fewer eleventh-hour surprises.

1. Cap table, equity, and corporate housekeeping

Investors begin by confirming that your company exists in good standing, that it has authority to issue the securities you’ve promised, and that every person who should have assigned their rights to the company has in fact done so. The first impression comes from your cap table—a point-in-time list of all issued and promised equity—and your corporate records: charter, bylaws, board consents, stock purchase agreements, option grants, and minute books. If this package is current, consistent, and signed, you signal operational competence; if it’s messy, diligence slows and perceived risk rises. Present a single source of truth and make it easy to answer “who owns what, when did they get it, and under which rights?”

How to do it

• Maintain a fully diluted cap table: common, preferred, options (granted/ungranted), RSUs, warrants, SAFEs/notes as if converted; show pre- and post-round ownership.
• Include board approvals, 83(b) elections acknowledgments (as applicable), and option plan docs; keep board and stockholder consents in one folder.
• Reconcile the cap table to executed agreements and banked proceeds from prior rounds.
• Document vesting and acceleration provisions and identify major investor rights (pro rata, information rights).
• For cross-border entities, include corporate structure diagrams with ownership percentages (and intercompany agreements).

Common mistakes

• Treating the cap table as a spreadsheet “best guess” rather than a ledger tied to signed docs.
• Missing invention assignment agreements from early employees or contractors (this becomes an IP issue later).
• Ignoring secondary sales and SAFEs that quietly changed the dilution picture.

Close by linking this section to your goal: a clean, authoritative equity story reduces negotiation friction and keeps attention on your growth, not your paperwork. For definitions and baseline expectations of a cap table, see reputable primers from equity platforms and finance references. Stripe

2. Financials: historicals, quality of revenue, and forecasts

Investors don’t need perfection; they need consistency. Provide income statement, balance sheet, and cash flow for the last 12–24 months (or since inception), monthly granularity where possible, with a clear revenue recognition policy. If you follow US GAAP or IFRS, state which and summarize how you apply revenue guidance (e.g., the five-step model). Forecasts should connect to hiring, pipeline, and unit economics—not wishful thinking. The fastest way to build trust: show how actuals tie to bank statements, how deferred revenue moves, and how your plan changes when assumptions shift.

Numbers & guardrails

• Revenue recognition: Align with the five-step model (identify contract, performance obligations, transaction price, allocation, recognition). Summarize your approach in one page so a reviewer can map contracts to revenue schedules.
• Forecast hygiene: Use a driver-based model. Example: If average ACV is $18,000, win rate 20%, and qualified pipeline $2,000,000, next-quarter new ARR ≈ $2,000,000 × 20% = $400,000. Sensitize ACV ±10% and win rate ±5 points to show range.
• Cash runway: Present current cash, monthly net burn, and months of runway. Include a plan for the next milestone you can hit with this round.

Mini case

If your last quarter recognized $750,000 in revenue with $150,000 added to deferred revenue and $80,000 released from prior periods, reconcile: Billings ≈ $750,000 + $150,000 − $80,000 = $820,000. Tie that to your AR aging to prove collection discipline.

Checklist

• Clear policy on revenue recognition, discounts, refunds, and credits.
• Reconciliation of bookings → billings → revenue → cash.
• Evidence of controls over spend approvals and vendor onboarding.

A crisp revenue story anchored to recognized standards avoids “quality of earnings” concerns and lets investors evaluate growth on apples-to-apples terms. BDO

3. Unit economics and payback math

This is where investors ask whether every new dollar of growth creates value. Show your gross margin, customer acquisition cost (CAC), lifetime value (LTV), payback period, and retention metrics by cohort. Use gross-margin-adjusted LTV and disclose churn definitions (logo vs. net revenue). Cohorts by start month or quarter reveal if retention improves with product maturity. The headline: your go-to-market engine consistently returns more value than it consumes.

Numbers & guardrails

• Typical payback targets for subscription models: ≤ 12–18 months on a gross-margin-adjusted basis; earlier is better for SMB motion, enterprise may tolerate longer due to higher ACVs.
• LTV/CAC heuristic: greater than 3× is often cited as a healthy benchmark when measured with disciplined inputs. Disclose your exact formula.

Mini case

Assume ARPA $300/month, gross margin 75%, net revenue churn 1.5%/month.

• LTV (simple) ≈ (ARPA × GM) / churn = ($300 × 0.75) / 0.015 = $15,000.
• CAC = $3,800. LTV/CAC ≈ 3.95×.
• Payback = CAC / (ARPA × GM) = $3,800 / ($300 × 0.75) ≈ 16.9 months.
  Now show movement over time: if you improve onboarding and churn drops to 1.2%/month, LTV rises to $18,750 and payback drops to ≈ 16.9 → 16.9 (unchanged) unless CAC also improves; tie operational initiatives to these shifts.

How to do it

• Segment by acquisition channel and cohort; compute CAC and payback by segment to spotlight efficient routes to market.
• Reconcile marketing spend to attributable pipeline; avoid “peanut butter” allocations that distort CAC.
• Pair retention curves with product engagement metrics (e.g., weekly active users against a core action).

End with the forward signal: strong cohorts and improving payback justify scaling spend; weak unit economics argue for process fixes before pouring fuel. For definitions and deeper discussion of common SaaS metrics, see established operator guides.

4. Market sizing and competitive dynamics

Great companies happen in markets that are big enough and winnable. Replace hand-wavy TAM slides with bottom-up sizing: target accounts × penetration × price. Then map competition and buyer power using a simple industry forces lens to show where profits accrue and how you’ll defend them (switching costs, data moats, network effects). The goal isn’t to claim the largest number; it’s to prove a thoughtfully chosen beachhead with credible expansion paths.

Numbers & guardrails

• Prefer bottom-up TAM (accounts × ARPU) to top-down; show SAM (serviceable available) and SOM (obtainable) explicitly.
• Competitive posture: identify 3–5 principal alternatives and candidly state your relative advantage (feature, price, channel, ecosystem).

Why it matters

Investors de-risk by asking whether structural forces favor your model or slowly squeeze it. A concise five-forces review frames entry barriers, substitution risk, and buyer/supplier power so diligence can test your defensibility rather than your rhetoric.

Mini case

Bottom-up: 40,000 target SMB clinics × $2,400/year ARPU = $96,000,000 SAM. If you credibly reach 10% over three planning cycles, SOM ≈ $9,600,000 with expansion via add-ons raising ARPU to $3,000, then SOM scales to $12,000,000 without new logos. Spell out the stepping stones to each milestone.

Close by connecting to pipeline reality: align the logo count in your plan with the account universe to show that your forecasted wins are actually there to win.

5. Product, technology, and intellectual property

Diligence asks two questions here: Does it work? and Do you own it? Demonstrate that the product solves a real job-to-be-done and that your architecture scales securely. Then prove ownership: employee and contractor confidential information and invention assignment agreements (CIIAAs), contributor license agreements if you accept external code, and a register of patents, trademarks, and copyrighted assets. If you rely on open source, show your license compliance posture and third-party notices.

Tools/Examples

• Architecture diagram with data flows and key vendors (cloud, auth, payments).
• Test coverage/QA approach; uptime and incident history; roadmap with themes, not just features.
• IP assignments for all creators; template CIIAAs; list of filed or granted IP; trademark usage guidelines. Cooley GO
• Open source compliance: reference a license matrix (e.g., MIT, Apache-2.0, GPL family) and how you track obligations (SPDX IDs, NOTICE file).

Common mistakes

• Missing assignments from early contractors; unclean ownership can stall a deal.
• Using incompatible open-source licenses without realizing distribution implications.
• Under-documented security/privacy controls; push this to Section 11 but summarize here.

Tie back to outcomes: a credible product narrative plus clean IP chain gives investors confidence that growth won’t be derailed by scale, lawsuits, or takedown demands.

6. Legal, regulatory, and data protection compliance

Even if you’re not in a regulated vertical, you process personal data and likely accept payments—each with obligations. Present a compliance matrix covering privacy (e.g., GDPR principles), security attestations (e.g., SOC 2’s Trust Services Criteria), and any sector frameworks (e.g., HIPAA, PCI DSS). Include policies (privacy notice, data retention, incident response), data processing agreements with vendors, and your approach to data subject requests. This isn’t about gold-plating; it’s about proportional controls and a plan to mature as you scale.

Framework anchors (with references)

• GDPR: Lawful basis, purpose limitation, data minimization, rights (access, erasure), and cross-border transfer mechanisms.
• SOC 2: Controls relevant to security, availability, processing integrity, confidentiality, privacy; align your controls and evidence to these categories.
• NIST CSF: Use the Identify-Protect-Detect-Respond-Recover core as a roadmap for maturing security operations.
• PCI DSS (if handling card data): either minimize scope via a compliant payment provider or document how you meet the baseline controls.
• HIPAA (if handling ePHI): administrative, physical, and technical safeguards; confirm your role (covered entity vs. business associate). HHS.gov

Mini checklist

• Register of subprocessors and DPAs; records of processing activities.
• Incident response plan, tested at least once; breach notification playbook.
• Data retention schedule; key policies acknowledged by staff.

A compact, referenced compliance story shows that risk is managed, not ignored, and that customer trust won’t be traded away for short-term growth.

7. Customers, contracts, and revenue concentration

Traction is more than a logo wall; it’s contracts, cohorts, and concentration. Provide your MRR/ARR roll-forward, churn and expansion by cohort, top-10 customers by revenue, and any concentration (e.g., top customer at 18% ARR). Include standard terms (renewal, price increases, SLAs, termination, auto-renew), plus atypical clauses (most-favored nation, outsized indemnities). Flag multi-year deals, usage-based contracts, and pilots with conversion triggers.

Numbers & guardrails

• Concentration: if a single customer > 10–15% ARR, show your mitigation plan (pipeline diversification, multi-threaded relationships).
• Logo vs. net revenue churn: report both; net negative churn (expansion > churn) is a strong signal for product-market fit.
• Renewals: show gross dollar retention (GDR) and net dollar retention (NDR) by cohort. Targets vary by segment; the trend matters more than a single figure.

Mini case

If ARR is $2,800,000 and your top two customers contribute $420,000 and $280,000 respectively (25% total), your risk is elevated. Demonstrate that your next-quarter weighted pipeline includes 30 deals averaging $20,000 ACV with a 25% win rate—implying $150,000 new ARR—and that expansions from mid-market cohorts are pacing at $60,000. Together, you reduce dependence to ≈ 17% within two quarters.

Contract hygiene

• Keep a contract register: start/end dates, renewal terms, pricing, special obligations.
• Standardize order forms and riders; centralize executed versions.
• For regulated sectors, align data terms with Section 6 and your SOC 2 scope.

In sum, you’re proving that revenue is durable and diversifying, not a one-off spike that vanishes at renewal.

8. Team, culture, and governance practices

Investors back people. Show a clear org chart, named leadership with short bios, and how governance works: board composition, observer rights, cadence, committees, and information rights. Include offer letters, CIIAAs, equity grants, and handbook/policies (code of conduct, anti-harassment, conflicts). Clarify compensation philosophy and hiring plans aligned to your model (e.g., additional SDRs to support pipeline targets).

What investors look for

• Execution history: shipped product milestones, sales learnings, customer references tied to leaders.
• Decision hygiene: consistent board materials, clear KPIs, and post-mortems on misses.
• Culture of ownership: option participation and internal communications that match your values.

Mini checklist

• Board and investor communication calendar with templates.
• Succession/risk map: single points of failure identified and mitigated.
• Compliance training acknowledgments correlated to Section 6 policies.

Close by reinforcing that governance isn’t bureaucracy—it’s the scaffolding that lets you climb faster without falling.

9. Fundraising instruments and terms (SAFEs, notes, equity)

Every investor will examine what’s already been promised to others. Collect all SAFEs (including side letters), convertible notes, equity rounds, warrants, and any secondary transactions. Summarize conversion mechanics (valuation caps, discounts, MFN clauses), pro rata rights, and most-favored terms. If you’re using NVCA-style documents for priced rounds or referencing Y Combinator SAFE templates for earlier raises, keep the exact versions visible to avoid needless back-and-forth.

Pro rata clarity

Define which investors have pro rata (and any “super pro rata”) and how you plan to allocate in this round. Ambiguity here causes friction at the worst time; set expectations early, especially if you intend to reserve room for strategic newcomers. For standard language, see NVCA model documents and explain any deviations. NVCA

Mini checklist

• A summary table for all instruments: date, amount, terms (cap/discount), outstanding principal, conversion triggers.
• A working model showing how instruments convert at multiple pre-money valuations.
• Board approvals and stockholder consents for each issuance.

This transparency prevents closing-table surprises and protects your credibility when negotiations get technical.

10. Go-to-market engine and pipeline quality

Diligence probes whether your pipeline is real and repeatable. Show each stage definition, conversion rates, and average cycle length. Describe your qualification framework (e.g., MEDDIC or BANT) and how sales and marketing collaborate on sourcing and nurture. Provide a current pipeline waterfall with aging, owner, stage, and next step; then map this to forecast categories and your operating plan.

Numbers & guardrails

• Illustrative SaaS funnel: MQL→SQL 25–35%, SQL→Opportunity 50–70%, Opportunity→Closed-Won 20–30%. Emphasize your actuals and trend lines.
• Pipeline coverage heuristic: 3–4× of next-quarter new ARR target; explain variance by segment and seasonality.

Mini case

You target $500,000 new ARR next quarter. With historical win rate 22% and ACV $25,000, you need ≈ 91 opportunities ($2,275,000 pipeline). If current qualified pipeline is $1,900,000, the gap is $375,000. Detail the plan: 6 field events, 3 partner webinars, outbound to 600 named accounts, and pricing experiments to lift ACV by 5%.

How to de-risk

• Implement stage exit criteria tied to buyer verifiables (e.g., access to the economic buyer).
• Track cohorted pipeline by source; prune stale deals; publish forecast variance weekly.
• Align enablement with top loss reasons; link content to deal stages.

The message: you run a system, not a hero-driven scramble, so more fuel should yield proportionally more bookings.

11. Operational risks, security, and vendor dependencies

Investors aren’t only buying your upside; they’re buying your downside too. Present a concise risk register: top operational, technical, legal, and vendor risks with likelihood, impact, and mitigation owners. Summarize your security stack and roadmap using a recognized framework (e.g., SOC 2 categories or NIST CSF). If you process payments or health data, show how you reduce scope or comply with relevant baselines (PCI DSS, HIPAA).

Numbers & guardrails

• Target posture examples: MFA for all staff and admins; least-privilege IAM; encrypted data at rest/in transit; quarterly vulnerability scans; annual tabletop incident test.
• Third-party risk: maintain a list of critical vendors with SLAs and exit plans; diversify for single points of failure.

Mini case

If a single cloud region outage could cause 4 hours of downtime at $6,000/hour in lost revenue and SLA credits, your expected loss per incident is $24,000. Compare that to the cost of multi-region failover (say $2,000/month). Framing this as a risk-adjusted ROI decision demonstrates disciplined operations.

Evidence that matters

• Recent pen test summary and remediation list.
• Access reviews and audit logs for systems holding customer data.
• Incident metrics: mean time to detect and resolve; root-cause analyses.

End with confidence: you can show investors you’ve identified material risks and have a pragmatic plan to shrink them over time.

12. Data room setup, narrative, and diligence process

A great data room doesn’t bury reviewers in files; it answers questions with a clear structure and short context notes. Think of it as the movie and the script: organized folders plus a one-page narrative that tells investors where to look and why it matters. Use consistent naming (e.g., YYYYMMDD_Title_Version internally—dates in filenames are fine for you but do not display them externally here), read-only permissions, and watermarking for sensitive PDFs. Provide a Q&A log and a change log so reviewers see progress.

Suggested folder structure (compact table)

Mini checklist

• Put a short README at the top of each folder explaining what’s inside and how to read it.
• Keep one master Requests Tracker with owners and due dates; update daily during active diligence.
• Enable Q&A within the data room; consolidate answers into the tracker to avoid repeating yourself.

A data room that respects the reviewer’s time signals operational excellence and can cut weeks off diligence. For practical checklists, see curated resources from startup libraries and experienced practitioners.

Conclusion

Investor diligence is not a test of perfection; it’s a test of clarity, consistency, and control. Clean corporate records show you respect ownership. Reconciled financials and defensible forecasts prove you understand the machine you’re building. Unit economics, cohorts, and pipeline quality reveal whether more spend makes you stronger. Product and IP documentation demonstrate that your advantages are both real and yours. Compliance artifacts and security controls show that you manage risk commensurate with your stage and promises to customers. Customer contracts and concentration reveal durability. Team and governance show maturity. Fundraising instruments and rights reduce closing friction. And a crisp, navigable data room accelerates everything.

You don’t have to do it all at once. Start by shoring up the weakest link from the twelve essentials, then work down the list until you can confidently share a data room that tells a coherent story. When diligence begins, you’ll be ready to guide investors through exactly what matters—and close on terms that reflect the true quality of your company. If you want a one-page checklist version of this playbook, say the word and I’ll craft it for your stage and business model.

FAQs

1) What’s the minimum financial package I should share if my startup is very early?
Provide monthly cash balance and burn, a simple P&L by major line items, invoices supporting revenue, and a 12-month driver-based forecast. Include a short revenue recognition memo even if it’s simple; it reassures investors that numbers are recorded consistently with the five-step model used in major accounting frameworks. If you don’t have a formal closing process yet, explain how you reconcile bank cash to your books and who reviews it.

2) How detailed should my unit economics be if I serve multiple segments?
Break them out by segment (SMB, mid-market, enterprise) and by channel (inbound, outbound, partner). Compute CAC, LTV, and payback for each, and explain the operational levers that change these numbers—pricing, onboarding, support model, product usage. Cohorting by acquisition month/quarter will surface retention patterns that help investors believe the efficiency is repeatable rather than accidental. Benchmarks are directional; your trend lines matter more. For Entrepreneurs

3) We use open source extensively—what will investors scrutinize?
They’ll look for a list of open-source components and licenses, your compliance approach (SPDX IDs, NOTICE/ATTRIBUTION), and whether any copyleft obligations could affect distribution. A short memo explaining why you choose permissive licenses where possible and how you meet obligations under stronger copyleft licenses reduces legal uncertainty. A well-curated third-party notices file and policy page go a long way.

4) Do I need SOC 2 to raise a round?
Not necessarily. Many teams raise ahead of a formal report, but investors will want to see a security roadmap and evidence of controls (MFA, least-privilege IAM, logging, incident response). If your customers demand trust reports, scoping a SOC 2 against the Trust Services Criteria and collecting evidence now will shorten sales cycles later.

5) How should I present my market size if I’m creating a new category?
Use a jobs-to-be-done lens and bottom-up math based on replacement behavior or adjacent budgets. Then show early proof: win rates against incumbents, price realization, and customer stories. Frame competitive dynamics with an industry forces view to show why your wedge can defend margin long enough to grow.

6) What belongs in customer contracts to make diligence smoother?
Keep a standard MSA with balanced IP, warranty, limitation of liability, and data protection terms. Use clean order forms, avoid bespoke clauses that create one-off obligations, and track renewals, SLAs, and auto-renew provisions. Provide a contract register so reviewers can quickly answer “who, how much, how long, any gotchas?”

7) How do I handle a top customer that represents a big chunk of ARR?
Don’t hide it. Quantify the exposure, show your multi-threaded relationship within the account, and present a pipeline plan that reduces concentration over the next two quarters. Include expansion opportunities already identified and marketing programs aimed at look-alike accounts. The aim is to demonstrate momentum away from single-customer risk.

8) Are SAFEs and convertible notes a red flag?
No—if summarized clearly. Create a one-pager showing amounts, valuation caps, discounts, MFN clauses, and any side letters. Include a conversion model at multiple pre-money valuations and explain your allocation approach for investors with pro rata rights in the next round. Using widely recognized templates (e.g., YC SAFE; NVCA forms for priced rounds) reduces friction.

9) What evidence do I need for privacy compliance?
Provide your privacy notice, data map, records of processing, DPA templates, subprocessor list, and a log of subject access requests (if any). Show how you minimize data, legitimize processing under the applicable legal bases, and handle international transfers. Keep it proportionate; investors care that you understand the rules and follow a process.

10) Which sales qualification framework should I use?
Use the one your team can execute consistently. Many B2B teams adopt MEDDIC (or MEDDPICC) for complex deals and BANT for lighter qualification. Whatever you choose, define exit criteria for each stage, instrument it in your CRM, and coach to it. Consistency beats brand. Salesforce

References

• Model Legal Documents — National Venture Capital Association (NVCA). NVCA. NVCA
• SAFE (Simple Agreement for Future Equity). Y Combinator. https://www.ycombinator.com/documents/ Y Combinator
• IFRS 15 — Revenue from Contracts with Customers. IFRS Foundation. IFRS
• Revenue from Contracts with Customers (Topic 606). FASB (ASU 2014-09 Summary). https://www.fasb.org/page/document fasb.org
• General Data Protection Regulation (GDPR) — Full Text. EUR-Lex / European Union. https://eur-lex.europa.eu/eli/reg/2016/679/oj EUR-Lex
• Guide to the UK GDPR. Information Commissioner’s Office (ICO). https://ico.org.uk/for-organisations/uk-gdpr-guidance/ ICO
• SOC 2® — Trust Services Criteria Overview. AICPA. AICPA & CIMA
• NIST Cybersecurity Framework — Core Guidance (CSF 2.0). NIST. https://www.nist.gov/cyberframework EUR-Lex
• PCI DSS — Payment Card Industry Data Security Standard. PCI Security Standards Council. PCI Security Standards Council
• The Five Forces. Institute for Strategy & Competitiveness, Harvard Business School. isc.hbs.edu
• Choose an Open Source License. ChooseALicense.com (GitHub). Choose a License
• Series A Diligence Checklist. Y Combinator Startup Library. Y Combinator