Investor Due Diligence Checklist: What VCs Actually Check Before Wiring (Seed and Series A)

What You'll Learn

• ✓List the complete diligence checklist VCs work through before a Series A close
• ✓Prepare a data room that preempts the typical 100+ diligence requests
• ✓Identify red flags that commonly kill deals post-term sheet
• ✓Structure financial and commercial diligence responses to support valuation
• ✓Anticipate the specific questions and document requests at each diligence stage

Direct Answer: Diligence in One Paragraph

Venture diligence runs from the signed term sheet to closing and typically takes 4-8 weeks for a Series A, 2-4 weeks for a seed round. It covers five categories: legal (cap table, IP, contracts, litigation), financial (historical statements, projections, cohort data, unit economics), commercial (customer references, market sizing, competitive analysis), technical (code review, architecture, security, scalability), and team (background checks, reference calls, equity structure). The purpose of diligence is not to find new things to love about the company — investors already decided to invest when they signed the term sheet. The purpose is to find reasons NOT to invest: hidden liabilities, fabricated metrics, IP disputes, key-person risk, or anything that would justify re-negotiating the price or walking away. Most term sheets include a 'subject to satisfactory due diligence' clause that lets investors exit gracefully if something blows up. The highest-leverage founder move is to pre-populate a data room before signing the term sheet. A complete, well-organized data room signals operational maturity and accelerates the close by 2-3 weeks. It also reduces the probability that investors discover surprise issues and use them to negotiate down the price.

Legal Diligence: The Big Four

Cap table: the complete, current ownership of the company, including all SAFEs, convertible notes, options, warrants, and founder vesting schedules. Investors will recreate this from primary documents (stock purchase agreements, SAFE documents, option grant notices) and reconcile against your stated cap table. Any discrepancy — mistakenly un-vested founder shares, missed option grants, undocumented SAFE side letters — becomes a closing condition. IP assignment: every founder and every contractor who ever wrote code or created IP for the company must have signed an IP assignment agreement. The gold standard is the PIIA (Proprietary Information and Invention Assignment) agreement, signed as part of employment. If a key engineer contributed for six months without signing one, there is ambiguity about who owns that code — a legal risk that must be cured before close. Contracts: copies of every material contract — customer agreements (especially those over a threshold, commonly $50K+), vendor agreements, software licenses, office leases, employment agreements, confidentiality agreements. Investors look for change-of-control clauses (which can trigger on Series A close), exclusivity provisions, unusual termination clauses, and any liabilities that extend beyond normal terms. Litigation and disputes: any current or threatened litigation, regulatory actions, investigation notices, or disputes that could result in financial liability. Also includes employment disputes, wage-hour claims, and any correspondence suggesting future claims. Investors want to know what liabilities they are buying with their equity. Corporate records: minute books, stock ledgers, board consents, stockholder approvals. Confirm every equity issuance was properly approved by the board. Confirm every option grant was approved and had a valid 409A valuation at grant. Missing approvals or expired 409A valuations create tax risk for employees and must be cured before close.

Financial Diligence: The Metrics Deep-Dive

Historical financial statements: monthly P&L, balance sheet, and cash flow for the past 12-24 months. For seed companies without formal accounting, bank statements plus a Quickbooks export is common. For Series A, audited or reviewed financials are increasingly expected. Investors reconcile revenue to bank deposits, expenses to receipts, and cash position to bank balances as of the most recent close. Revenue waterfall: for SaaS, a monthly breakdown of new MRR, expansion MRR, contraction MRR, churned MRR, and net new MRR. This waterfall should tie to the P&L revenue. For e-commerce, monthly orders, AOV, returning vs new customer split. For services, project count, project value, and utilization. Anything that cannot be tied back to source data (payment processor export, CRM export, invoicing system) is a red flag. Cohort analysis: how customers acquired in Month 1 are behaving in Months 2, 3, 6, 12. Reveals retention and LTV patterns that aggregate metrics hide. A company with 90% monthly gross retention looks great until the cohort analysis shows that 60% of the revenue is from a handful of customers acquired 18 months ago. Investors want to see that recent cohorts retain as well as or better than old cohorts. Customer concentration: percentage of revenue from top 1, top 5, top 10 customers. A single customer representing 30%+ of revenue is a concentration risk. Investors may either re-price the round, require the founder to sign a retention covenant with that customer, or walk away if the customer contract has a short remaining term. Projections and budget: the forward 18-24 month forecast with assumptions. Investors stress-test the revenue assumptions (CAC, conversion rate, churn), cost assumptions (headcount plan, variable costs), and cash runway. The test is whether the plan is achievable with the capital being raised. If the plan requires another raise in 12 months, the economic cushion is thin and investors may negotiate a larger round size or better terms. Unit economics: CAC, LTV, payback period, gross margin per customer, contribution margin per customer. For SaaS specifically: Magic Number, CAC payback in months, net revenue retention (NRR) — the trio that investors evaluate against benchmarks (Magic Number > 0.7, CAC payback < 18 months, NRR > 110% for top-quartile SaaS).

Commercial Diligence: Customer References and Market Truth

Customer references: investors will call 5-10 customers of varying sizes to validate the product, the value, the competitive landscape, and the decision-making process. They ask: How did you find the product? What were you using before? What problem does it solve? What would you replace it with if forced to? How has the vendor relationship been? Would you recommend it to a peer? Two failure modes here. First, reference customers who give lukewarm endorsement — not negative, but not enthusiastic. Investors read this as signal that the product is a nice-to-have, not a must-have. Second, reference customers who describe a different product than what the founder pitched. If the founder pitched 'AI-powered forecasting' and customers describe it as 'a spreadsheet template', there is a narrative gap that kills conviction. To preempt: prepare your reference customers. Tell them that they will be contacted by the investor, what the investor will ask, and what you are hoping they will emphasize. This is not coaching — it is warming up the conversation so the references are well-rested and thoughtful. Market sizing: validate TAM, SAM, SOM claims from the deck. Investors check bottom-up (number of accounts × ACV) and top-down (published market reports, analyst estimates) and often find the founder's estimate is 2-5× too high. Unrealistic market sizing undermines the entire thesis and sometimes triggers re-pricing conversations. Competitive landscape: investors build a matrix of the company vs its top 5 competitors, evaluating feature parity, pricing, target customer, and go-to-market motion. Conversations with ex-employees of competitors, industry analysts, and former customers yield an unvarnished view that founder decks often soften. If the competitive advantage claimed by the founder cannot be substantiated by this triangulation, the round gets re-negotiated. Churn reasons: investors want to understand WHY customers churn, not just the rate. If churn is driven by product gaps that are being fixed in the roadmap, that is a story investors can get behind. If churn is driven by fundamental misfit with the stated ICP, that suggests the company is selling to the wrong customer — a bigger problem than a churn rate number.

Technical Diligence: Code, Architecture, and Security

At seed, technical diligence is often informal — a conversation with the CTO, a brief demo, and a check of the tech stack. At Series A, it escalates significantly. Some Series A firms hire third-party technical diligence consultants (companies like Kobalt.io, Prime8, or boutique firms) to do a multi-week review. Codebase review: access to the Git repository for a limited time, with analysis of code quality (linting scores, test coverage, commit patterns), architectural soundness, technical debt, and key dependencies. Investors look for anti-patterns (monolithic spaghetti, no testing, single-developer bottlenecks) and for signs of scalability concerns. Architecture review: diagrams of the system architecture, infrastructure, data flow, and key integrations. Investors evaluate scalability (will this work at 10× current load?), reliability (uptime history, incident response), and data handling (PII, PHI, financial data handling). Security posture: SOC 2 status (Type I or Type II), penetration test reports, security policies, incident history, compliance certifications (HIPAA if healthcare, PCI if payments). A company with no SOC 2 and a 'we plan to do it next year' answer is acceptable for seed but problematic for Series A, especially in enterprise SaaS. Key-person risk: how concentrated is technical knowledge? If one engineer holds 80% of the institutional knowledge, investors want to know the succession plan. Documentation, runbooks, and cross-training matter here. The founder should be able to describe what happens operationally if any single engineer leaves — it is not a judgment of their loyalty, it is a risk assessment. Third-party dependencies: audit of all external services the company depends on. OpenAI API for an AI-first company, Stripe for a payments company, AWS for infrastructure. Investors look for single points of failure and concentration risk. A startup fully dependent on the OpenAI API would be asked how they would respond if OpenAI raised prices 5× or restricted access.

Team Diligence: Background Checks and Reference Calls

Founder background checks: formal background checks (criminal, employment verification, education verification) are standard for Series A and above. Most firms use services like HireRight or Checkr. Issues found are not always disqualifying — a DUI from ten years ago is usually not — but they must be disclosed and explained before diligence rather than discovered by the investor. Reference calls on founders: investors call former colleagues, former employees, and sometimes former business partners. The specific questions: How is this person to work with? How do they handle disagreement? What are their blind spots? Are they honest? Would you invest in them again? Investors can tell within three calls whether a founder has created a culture of trust or of fear. Reference calls on team: key executives (CTO, head of sales, head of product) are typically referenced as well, though less intensively. The goal is to validate that the claimed experience and accomplishments match the reality. Equity and vesting: founder vesting schedule (typically 4-year with 1-year cliff for new founders; acceleration on termination or acquisition for established founders). Employee option pool size (10-20% is typical for seed; 15-20% for Series A). Investors want to ensure the option pool is adequate for the next 18-24 months of hiring. If not, the option pool will be increased pre-money at close, which dilutes the founders but not the new investor — a painful and common outcome of Series A diligence. Key employee agreements: offer letters, stock option grants, PIIA signed, non-solicitation agreements where applicable. Investors want to confirm that key employees are incentivized to stay — insufficient equity for key people is a red flag for retention risk. Disputes and departures: any employee departures under contested terms, any disputes over equity, any previous lawsuits from former employees. These come up in reference calls and must be addressed before they surface from the investor's side.

Red Flags That Kill Deals

Category 1 — Fabricated or inflated metrics. The founder claimed $500K ARR but diligence reveals $280K of actual signed contracts, with the difference being 'pipeline' or 'verbal commitments'. This is dishonest and kills trust. Once discovered, the deal does not recover — investors walk even if the underlying business is sound, because they cannot trust the founder. Category 2 — Hidden cap table issues. An undocumented founder departure three years ago that left ambiguity about vesting. A missed 409A valuation that triggered Section 409A penalties. A SAFE side letter that grants super pro rata rights the founder forgot about. These are curable but expensive — they often require legal cleanup and sometimes re-pricing. Category 3 — Customer concentration that was not disclosed. Founder said 'our largest customer is 8% of revenue' in the pitch. Diligence reveals one customer is 35% of revenue and the contract expires in six months. Investors either re-price significantly or walk. Category 4 — Litigation or regulatory issues not disclosed. Founder did not mention a pending wage-hour lawsuit from a former employee. Investors read this as either a judgment issue (they did not think it mattered) or a trust issue (they hid it intentionally). Neither helps the deal close. Category 5 — Technical debt or architecture issues far worse than described. Codebase has zero tests, uses deprecated frameworks, depends on a single engineer's knowledge, and has had two outages per month for the last six months. Investors either insist on CTO hires pre-close, require a technical debt paydown plan, or walk. Category 6 — Reference calls that contradict the narrative. A former employee describes a toxic culture with high turnover. A former customer describes the founder as difficult to work with and quick to blame. These are hardest to cure because they are about people, not documents. Category 7 — Mismatched CEO statements in diligence vs pitch. The founder said one thing in the deck and something different in the follow-up call. Investors take notes carefully and flag inconsistencies. A founder who says 'we have 50 customers' in the deck and 'we're at about 35 active paying customers' in the Q&A has a gap that creates skepticism about every other number.

Check Your Understanding

More Guides