Independent certification before SaaS sale: why it has become indispensable in 2026

Certifying a tech asset before putting it on the market is a recent practice, it did not exist in its current form before 2020. It addresses a structural market need: acquirers (PE funds, search funds, family offices) face a growing number of assets presented on the market with unverified metrics, incomplete data rooms, and undocumented IP/security risks. Third-party independent certification solves this information asymmetry problem.

The 4 dimensions of the Aegryn Grade protocol

• C dimension, Code: source code quality audit (test coverage, technical debt, documentation, CI/CD), technical architecture evaluation (scalability, third-party dependencies, cloud infrastructure), and technology obsolescence score. Duration: 5–8 days. Tools: SonarQube, OWASP ASVS, manual analysis by senior engineers.
• I dimension, IP (Intellectual Property): code ownership verification (freelancer contractor agreements, developer employment contracts), registered trademark audit (INPI, EUIPO, USPTO depending on geographic scope), open source licences used and their compatibility with a commercial sale, client data protection.
• F dimension, Finance: ARR audit (reconciliation with banking and invoicing data month by month), calculation of actual NRR and GRR, restatement of adjusted EBITDA (normalisation of below-market founder charges), client concentration analysis, validation of MRR bridge over 24 months.
• S dimension, Security: external penetration test (OWASP Top 10), access security policy review (IAM, MFA, secrets management), GDPR compliance (processing register, sub-processor DPAs, privacy policy), and since Q1 2026: AI Act compliance for AI assets.

Aegryn grades and their impact on valuation

• Grade A+ (Overall score ≥ 90/100): asset without material risks identified across 4 dimensions. Documented multiple premium: +35–45% vs comparable uncertified asset. Access to premium acquirer deal flow (Tier 1 PE funds, institutional family offices).
• Grade A (Score 75–89/100): asset with minor risks identified and documented remediation plan. Multiple premium: +20–30%. Access to all Aegryn deal flow.
• Grade B (Score 55–74/100): asset with moderate risks. Access to standard deal flow. Limited multiple premium (+5–15%). Recommendation: remediation plan to reach Grade A before sale.
• Grade C or below (Score < 55/100): significant risks in one or more dimensions. Aegryn recommends not putting on sale before remediation. Typical remediation duration: 3–6 months depending on the dimensions concerned.