Due diligence checklists
What to ask before you sign — and what to ask for in writing. Free to use, kept current, and written for the person who has to justify the choice afterwards.
Why these are shaped the way they are
Most of what a supplier tells you while selling is true and beside the point: it describes the arrangement working. Diligence is about the days it does not. So every question below asks for something a supplier can hand over in a week if it exists — a certificate number, a clause, an incident history, a named person — and cannot produce at all if it does not. The absence is the answer.
Each item says what to ask, why it matters, what evidence settles it, and what should give you pause. Items marked deal-stopper are the ones worth walking away over.
Due diligence on a SaaS vendor
What to ask, what to ask for in writing, and what should stop the deal — before you sign for a piece of software your team will depend on.
28 questions13 deal-stoppersv1.0Due diligence on an IT services provider
What to verify about a firm before you hand it a project: who will actually do the work, what is committed in writing, and what happens when the delivery date moves.
22 questions13 deal-stoppersv1.0Due diligence on an offshore development partner
The questions that only apply when the team is in another country: who employs them, whose law governs the work, whether the IP actually reaches you, and what the hours really overlap.
16 questions8 deal-stoppersv1.0Due diligence on a supplier that processes personal data
The privacy review, for the person who has to sign it off: what the law requires you to have in the contract, what to check before you rely on it, and what to do about transfers.
17 questions10 deal-stoppersv1.0Security review of a supplier
A technical review for the person who has to sign off the risk: how the thing is built, who can reach your data, what happens when something goes wrong, and which answers can be checked rather than believed.
16 questions13 deal-stoppersv1.0
Check the record yourself
Certificates sit on a registrar's register, companies on a public registry, patents on a patent office search. Every one of those takes a minute and occasionally contradicts the sales deck.
Ask for the clause, not the page
Marketing pages promise uptime; contracts often promise nothing. Where a checklist says to get something in writing, it means the clause itself.
Weigh the refusals
How a supplier declines a reasonable question tells you more than most answers. Note the refusals — they are findings.
These checklists are general guidance, not legal, security or financial advice, and they do not replace your own advisers on anything contentious. Each carries the date it was last reviewed — the set above was last reviewed on 19 September 2026. Spot something missing or wrong? Tell us and we will fix it.