Buying a Swiss software company: twelve technical questions to answer before you sign

Small software companies change hands for the same reason as other SMEs: the founder wants to retire or move on. According to figures published on the SME portal of the Swiss Confederation, about 101,000 companies were looking for a successor in 2024. For a buyer, a software company has a particular trap: most of its value sits in code, in a few people's heads and in customer contracts, none of which appear in the financial statements.

These are the twelve questions we would want answered before you sign.

Product and code

1. Who can change the code tomorrow? Count the people who could fix a critical bug in production without the founder. If the answer is one, the key-person risk belongs in the price and in a transition agreement with the seller.

2. What is out of support? List frameworks, runtimes, databases and operating systems with their support dates. A product built on AngularJS, for example, has been on a framework without official support since January 2022. Out-of-support components mean security exposure today and a rewrite tomorrow, and the rewrite has a price.

3. How much is built for individual customers? Customer-specific branches, modifications and versions multiply maintenance cost. Ask how many versions are in production, and how far the oldest is behind.

4. Can the product be built and released without its author? A documented, automated build and deployment pipeline is the difference between owning software and owning a dependency on one person's laptop.

Security and compliance

5. When was the last security test, and what happened to its findings? A penetration test report with open critical findings is a liability. No report at all is a question you have to answer yourself.

6. Is personal data handled lawfully? The revised Swiss Data Protection Act has applied since 1 September 2023, and EU customers bring the GDPR. Check where data is stored, who processes it on whose behalf, and whether the processing agreements exist.

7. Which open-source licences are in the product? Copyleft licences can oblige the owner to publish source code or restrict how the product is distributed. A dependency scan answers the question in hours; ignoring it can cost a deal.

8. Which regulatory changes will hit your customers? Software follows its customers' obligations. If the product issues invoices for German customers, for example, it must handle structured e-invoices: in Germany, all businesses have had to be able to receive them since 1 January 2025, and issuing becomes mandatory from 2027 for larger companies and from 2028 for all. If the product uses AI, the EU AI Act may apply as well.

Operations and customers

9. Where does it run, and who could run it without the founder? Hosting, backups, restore tests, monitoring and on-call duty. Ask when a restore was last tested, not whether backups exist.

10. What do the customer contracts promise? Service levels, liability, source-code escrow and change-of-control clauses. A change-of-control clause can let key customers walk away when you take over.

11. What is the revenue made of? Licences, maintenance, hosting and custom development behave very differently. Recurring maintenance revenue from a shrinking base of old installations is worth less than it looks.

Team and plan

12. What will the next three years of development cost? Compare the roadmap with the team that is supposed to deliver it. If the plan needs people who do not exist yet, the cost of hiring them belongs in your business plan.

Turning answers into price, terms and plan

Findings are only useful if they change something in the deal:

• Price: deduct the estimated cost of known fixes, such as a framework migration or security remediation.
• Purchase agreement: ask for specific warranties and indemnities, for example on open-source compliance and on known security incidents, and consider a source-code escrow.
• Transition: tie part of the price to the seller's knowledge transfer, with defined deliverables rather than a number of days.
• 100-day plan: put the remaining findings into the first plan after closing, with owners and budget.

A red-flag scan answers the most important of these questions in five working days, before you commit to exclusivity.