Buying a software company in Florida

Small software companies usually sell one product to one kind of customer: scheduling software for clinics, a management system for marinas or storage facilities, an add-on for a popular business application, or custom systems built and maintained for a few larger clients. Revenue comes in three main forms.

• Subscriptions, billed monthly or yearly for software the company hosts. These are the most valuable because they renew without a new sale.
• Licenses and maintenance, the older model: a one-time license fee plus a yearly support fee.
• Custom development and consulting, billed by the hour or project. This works more like a services business, and it has to be sold again every year.

Most of the cost is people: developers, a support person or two, and someone who handles sales and setting up new customers. Hosting costs matter for subscription products. In many small companies, the founder wrote much of the code and is still the only one who understands parts of it.

• Most revenue comes from subscriptions or maintenance that renew, and few customers cancel.
• A niche where the product is hard to replace because it holds customers' records or runs their daily work.
• More than one developer understands the code, and it's documented, tested and kept in version control (a system that tracks every change).
• Clear ownership of the code: every employee and contractor signed an agreement assigning their work to the company.
• The product runs on current, supported technology at a reasonable hosting cost.
• New customers come through a repeatable process (search, referrals, partners who resell or recommend it), not only the founder's relationships.
• Support requests are tracked and manageable, and the product doesn't need constant hand-holding.

Florida doesn't license software companies, and no state license transfers in a sale. Expect a local business tax receipt from the city or county.

The rules that matter are about data and taxes. Florida's data breach law (section 501.171 of the Florida Statutes) applies if the product stores personal information such as Social Security numbers, financial account numbers, health information, or usernames with passwords. It requires reasonable security, notice to affected people within 30 days of determining there was a breach, and notice to the Department of Legal Affairs when 500 or more Floridians are affected. When the company holds that data for business customers, it must tell those customers within 10 days instead, and they notify their own customers. Products used by medical practices bring HIPAA duties, usually through business associate agreements.

Sales tax is the other trap. States treat software and online subscriptions differently, and a company selling across the country may owe tax in states where it has never filed. Ask an accountant to review where the company collects tax and where it should.

• Have an independent developer review the code for quality, security, documentation and outdated components.
• Have the code scanned for open-source components. Some open-source licenses put conditions on how code can be distributed.
• Confirm the chain of ownership: signed assignments from every founder, employee and contractor who wrote code.
• Read the largest customer contracts for change-of-control clauses (terms triggered by a sale), uptime promises, limits on liability and data duties.
• Look at renewals and cancellations by customer group over several years, not just total revenue.
• Check who controls the domain, hosting accounts, app store listings and code repository.
• Separate truly recurring revenue from custom work that has to be won again each year.
• Review hosting bills and the outside services the product depends on.

• Who besides you could fix a serious bug in the core code tomorrow?
• How many customers canceled last year, and what reasons did they give?
• Did everyone who wrote code sign an agreement assigning it to the company?
• What's the oldest part of the system, and what would it take to modernize it?
• Has the company ever had a security incident or data breach?
• When did you last raise prices, and what happened?
• How do new customers find you?