Buying a business? Run digital-asset due diligence before you sign.
Acquisition diligence is thorough about the things lawyers and accountants can see: contracts, liabilities, revenue. It is routinely blind to the layer the business actually runs on — and buyers discover after closing that the domain is registered to the founder personally, the Instagram following lives on a manager's phone, and the payment account can't legally move to the new entity at all.
You're not buying a website; you're buying control of a set of accounts. Here's how to verify that control exists and actually transfers.
The seven checks
- 1Domain: registrant vs. seller entityRun the domain through ICANN's lookup. Is the registrant the company you're buying — or the founder personally, an agency, or a defunct entity? Personal or third-party registration means a transfer has to happen, and transfers hit locks and take days (see our domain-transfer guide).
- 2Email & productivity: who holds adminGoogle Workspace or Microsoft 365 — how many super admins / global admins exist, and are any of them people who leave with the seller? Get admin transferred to accounts the new entity controls at closing.
- 3Social accounts: transferable in practice?Followers are often priced into goodwill, so verify the accounts sit in a business portfolio the company controls — not on a personal profile of someone who isn't part of the deal.
- 4Payment accounts: the entity problemPayment platforms tie accounts to a legal entity's identity, tax and banking details. Stripe, for instance, has a dedicated process for transferring an account in a business sale — it is not a login handover. Budget time for this before revenue can flow to the buyer.
- 5Customer lists & marketing toolsWho owns the email platform account, and does the consent under which the list was collected survive the transfer in your jurisdiction? Export the list as part of closing regardless.
- 6Licences, code & contentFonts, stock imagery, plugins, and any code written by contractors: bought under whose name? Licences held by an agency or a person may not convey with the sale.
- 7The people mapFor every asset above, note which individual currently holds the keys. Anyone not joining post-acquisition is a transfer task with a deadline.
Red flags that should move the price
- The domain is registered to a person or an agency rather than the company — recoverable, but it's leverage someone else holds during your transition.
- One person is the sole admin on email, cloud, or payments — key-person risk you're buying at full price.
- The seller can't produce a list of accounts, owners, and renewal dates within a week of being asked — expect surprises after closing.
- Any core account is 'managed by our old agency' — you're inheriting their breakup as well as the business.
Make transfer a closing condition, not a promise
Put the asset register in the purchase agreement as a schedule: every domain, account, and login, its current owner, and the transfer mechanism. Sequence the slow ones early — domain transfers and payment-entity changes take days to weeks — and verify each transfer has actually happened (sign in, check the role) before funds release. "Seller shall cooperate post-closing" is where digital assets go to die.
The free scan maps your domain, email, cloud, social and tools from public records — and shows what you'd lose access to tomorrow. No login, nothing to install.
Check my business