Gitlab’s Startup Acquisition Process
about.gitlab.com
about.gitlab.com
I know there would be non-disclosures in place, but it's easy to imagine a company less scrupulous than Gitlab basically cratering a potential competitor without the resources to go after them in court.
[1] https://www.nothingeasyaboutthis.com/lessons-from-selling-a-...
We were in the middle of raising our next round when the offer came through. The founders and the board decided to accept the offer but it was still contingent on due diligence. While going through the due diligence process all funding conversations had to stop. Luckily we were small so the due diligence process only took 2 months but we had to tighten our belts. If the acquisition had fallen through, we would’ve been in real trouble because we burned 2 months of cash and would have needed to line up funding quickly.
You mostly don't need the "don't talk to corpdev" advice once you've found product/market fit, unit profitability, whatever; it's more obvious whether the discussion is a waste of time or not. But early on, it's an especially hazardous thing to do, because you're not anchored to a specific conception of how your business is going to operate.
Like if somebody goes from working hard on a marriage to seriously investigating divorce. Even if they decide divorce was too expensive or whatever, they're never getting back to even the problematic state they were in before they called a lawyer.
I think Paul Graham pretty much has this topic locked up and can't see how you'd express it better.
Disclaimer - I'm not a GitLab employee and they are not a client of mine, but their documented processes are very synonymous with what I do.
It would he great if the HN community could comment more about this topic beyong the Gitlab's article.
[1] Fundamental Analysis of Web3 Technologies: https://blog.coinfabrik.com/fundamental-analysis-of-web3-tec...
* What are the most common gotchas?
* What tools do you use to do the technical due diligence?
* What would you suggest to prepare for it?
* What would acing it look like?
As an example - it might be better that the company doing Due Dilligence finds you awful at sales during the DD phase, because they will see that you got revenue despite poor sales technique and they will see it as an easy target for improvement / 'to generate value'. Companies want to identify ways that they would be able to help the company they are aquiring.
Not sure if this applies to Technical DD, but thought it was interesting enough to share!
source: yaddp.
One thing that appear in tech due diligence is quality of the technical architecture and implementation, and security risks associated.
Surprises! We don't like surprises, and nor do our clients. From a tech perspective - dated tech, unmanageable (or no clarity of) tech debt, NIH syndrom
* What tools do you use to do the technical due diligence?
OSS scanning and security scans mostly
* What would you suggest to prepare for it?
I'l try to answer this simply, which is - read GitLabs documentation and if you have similar and more importantly - actually operate this way, then you'll be more than prepared.
* What would acing it look like?
As I mentioned below, there is no pass/fail. Acing it is - be honest, be prepared, and have a plan (not for the tech dd itself, but rather a plan for your business).
As in, have someone good at Language X go through the target's repos and deliver a verdict on how good the actual code is, and how well it's organized etc?
- Company being acquired ("Target") built a web based application in the mid-2000's using VB.NET and each client installed the software. It requires a desktop widget to be installed at their clients locations to talk back to the VB.NET web backend. In 2016 they switched their licensing model from perpetual license to subscription and now the web application is hosted by the target and not the clients.
- Target tells acquirer they have a "SaaS" application.
So, now its a VB. NET web app with single tenants hosted on the Target's data centers. Not untenable, but the acquirer was probably expecting a multi-tenant SaaS web app in a more generally supported web framework.
And, yes I've absolutely seen this case (or something very similar) in the wild.
Me:
I personally have a very atypical career so please take this with a grain of salt. That being said, I think my weird background helped me to excel in this space
Here is my professional background
- SAP Consultant working for SAP (Data Analytics & Reporting)
- (Entrepreneur) Web Design Agency (failed)
- SAP Consulting (3rd Party Partner)
- (Entrepreneur) Startup (failed)
- Management Consulting (we were doing about ~15 IT Due Diligence projects a year when I joined)
- Left previous firm and started my own firm (Renna Partners), which exclusively focused on IT/Tech DDs (previous firm did IT strategy + DD was a small part of the overall biz)
- Sold my firm to my competitor (Crosslake), which is who I work for now
Experience that led to this type of work:I started as a consultant in SAP's support group. Oddly, at a young age this gave me exposure to the technical/operational challenges of M&A as I sat in on a high profile customer who bought SAP and BOBJ integrated products before the company merged, and then had to deal with the companies/tech talk to each other post close. This was more "in the trenches" than it was strategic, but it help formulate how I thought about the strategy of M&A for companies. I then taught myself to code when I tried doing a web design agency and a startup. Failed miserably, but gave me a ton of empathy about what its like to be a (1) a founder (2) an engineer and (3) a business operator. After my last startup failed, I called an old friend of mine and luckily they were hiring. Their IT DD practice was small (it was 1-2 people) but growing. I came on and basically acted as a junior partner with one of the partners who led the practice. We quickly grew that to supporting ~100 deals/year. The company wasn't strategic about the work (they wanted large scale IT strategy gigs), so we split off and I start my own firm that focused solely in on IT/Tech DD. I then sold that company to my biggest competitor. I'm now an MD/Executive at that firm. My experience with hands on development, owning/operating a business, M&A, mix of enterprise software + implementation, and consulting (this can't be understated, there is a ton of value in knowing "how to be a consultant") is probably what really helped me excel in this space. Oh and now that I've sold a company myself, I have even more perspective :)
Typical person:
There are usually two types of personas that fit well: career consultants in tech M&A (think E&Y, West Monroe, KPMG, etc.) and operational leaders (e.g. seasoned CTOs, VP of Engineering, Head of Product, etc.). People who have done both are IDEAL. Personally I look for "athletes" or T-Shaped people. You need to be able to get very technical and then translate this to a financial person who doesn't know the difference between Java and JavaScript, which is a very unique skill in itself.
P.S. I have a huge demand Product people (market + technical) who want to help do Product Due Diligence + Product Strategy consulting. Please reach out if you're interested.
Do you think there's enough demand out there to have a company that does just technical (e.g. software quality, security) due diligence?
My company (used to, we've grown to do other things) only do Tech DD and we've done really well, so the answer is yes. According to Pitchbook there are about ~3,000 software company acquisitions every year - so that might tell you how much potential business there is.
P.S. - don't really appreciate the snarky "you should do some answering"... as a fellow busy professional, I'm answering when I have the time to do so.
This subject is very dear to a lot of the HN crowd and of course you as the initiator of that process should get the first shot at answering these questions, they are all super relevant and very practical. You might even want to do a formal write-up of the answers you get in a blog post.
I’ve done DD for a small SaaS acquisition. But from the sell side. It was a decent amount of work providing access, diagrams, answering questions, etc. I would think anywhere from $150-$300/hour depending on the deal size.
The audit may encompass anything from code quality, technical debt, tech stack, architecture, infrastructure, to the product roadmap, licensing of dependencies, corporate structure, hiring/retention of talent, etc. It really just depends on what the company paying for the DD asks for (which could be either side, and that also matters a lot).
Each category in the final report will have a summary, a score, notes about risks/opportunities, suggestions on how to improve, what things are strengths, etc. It can be really, really long, and often it's broken up and worked on by multiple people based on their area(s) of expertise. Usually you'll see a high-level summary chart at the end of the report that just kind of puts everything in front of you.
Could you compare and contrast this analysis for companies with a small number of large customers, vs a large number of small customers? What are you looking for? What are examples of good or bad surprises?
However, it is completely one-sided toward the buyer (ie GitLab).
As a seller, I'd be wary of going through even a fraction of the pre-term-sheet diligence and disclosure, without getting to a ballpark on acquisition price (or price methodology) beforehand.
Also, they don't mention, but having escrow set up as an insurance in case the acquirer backs out also seems necessary (ie % of the deal held with third party). Otherwise you are basically giving away all your company secrets and time, and if they back out, you get nothing.
I'd guess YCombinator has something equivalent from the seller side. It would be great if they shared their M&A handbook at some point in the future, although I understand it's probably considered "secret sauce".
You hit the nail on the head that it's way too much work when there's not even a contingent offer on the table. A real buyout would come in with either a stated sum, or a methodology for how that sum will be calculated.
* Giving the acquirer the cap table early on seems to go against the advice I've seen.
* This is a ton of time investment for a company that has no idea if an offer will be forthcoming, or if it would be in a ballpark where a deal would happen?
The acquiree is supposed to go through 12 stages of diligence a code review, detailed financials, employee review, give out their roadmap, customers, vendors, cap table, source code, financial assets all before seeing any hint of what the offer will be or whether there will be one?
Is that right? Wouldn't getting an idea of whether you're in the same neighborhood be sensible before demanding so much?
Why?
Captables are for the most part just process documents, you need to know who has which quantity of shares to be able to put a proposal for a deal on the table. If you don't know who holds the shares you may not even be able to make a proposal at all, and you may not be able to verify that the person that makes the offer to sell has the right to do so.
It also lets them craft a minimal price deal, and do things like split out different shareholders based on what they'll likely accept.
Not particular to the cap table, but the same with the financials here. If gitlab sees they have only one month's runway, why wouldn't they lowball?
Generally speaking, if gitlab sees 40 million in revenue potential, shouldn't that be how they craft what they offer?
There's probably a distinction here between "selling" your business, and "being acquired."
I mean, it's someone else's code, your engineers are going to say it's rubbish, it needs a full rewrite and throwing away, warn us up front before you even think about acquiring such terrible code, etc. But if it's a built a company to the point of raising sufficient revenue/profit it's surely good enough.
There are many variations to this kind of 'vendor dd', you can prepare it beforehand or you can push to have the process modified until it is to your liking depending on how desirable you are.
It's much quicker and often not that much more expensive (after you tally up all the engineering and marketing costs and adjust for the risk of failure) to acquire a company that already has a working product, customers, marketing, documentation and usually you get a team of domain experts included in the purchase.
The cap table tells a story about the company. For starters it identifies the decisionmakers. More importantly, a hairy complex cap table says an acquisition process may be difficult and unpredictable. A straightforward cap table is like a well maintained roof on a house. It doesn't prove that the rest of the company is in order, but its highly correlated
Start by sending a summary cap table of major holders with the breakdown among classes of stock
But the work can be reused for other candidates, and... this is about multi-million deals, the work will pay itself off.
I heard about a financial guy working his ass off (nights, weekends) for weeks if not months on end on getting part of the company acquired or sold off; in the end the deal was worth €100M, and I'm confident he owned a significant chunk of the part sold. I wouldn't mind working weekends / evenings for a while if it was for a "you can retire" sum of money.
I was not familiar with these roles before this article. Are they more colloquially known in the M&A world ?
"Stage leaders" is specific to GitLab, referring to the stages of the DevOps lifecycle [1]. Stages are part of the product hierarchy definition [2], with sections, stages, groups, categories, features. Maybe the term is similar to "product group leader" in other areas.
FYI, created a merge request to link the product handbook from the acquisitions handbook, providing more context on stage leaders. [3]
[1] https://about.gitlab.com/handbook/product/categories/#devops...
[2] https://about.gitlab.com/handbook/product/categories/#hierar...
[3] https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...
The champion will often lead (1) but if they’re too busy may have a defined stage leader to make sure the trains keep moving well. In the later stage of (2) the stage leader will typically be someone with experience integrating companies. It’s an art.
I wouldn’t say they’re agreed on definitions, but I got what they meant from my exposure to M&A.
A good acquisition target company should be "willing to sunset old customers within 90 days or less, with an option to transition to GitLab" [1]
Given the pattern of startups being acquired, announcing "nothing will change", then sunsetting their original product [2], it's interesting to see this spelled out so plainly.
[1] https://about.gitlab.com/handbook/acquisitions/#acquisition-...
[2] https://ourincrediblejourney.tumblr.com/ is the canonical repository of these emails
I have found that as a customer of products acquired by larger companies, the customers of products being acquired and integrated into a larger product are often forgotten and sidelined.
“Outline a simple integration timeline for those features, considering an MVC release on the first month …”
I’m only familiar with this meaning Model-View-Controller. In this context I’d probably expect “POC”.
https://about.gitlab.com/handbook/product/product-principles...
I've created an MR to link MVC in the handbook: https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...
(GitLab team member here)