A seller can show you anything. A dashboard screenshot, a Google Analytics session, a PDF of "verified" numbers with a logo on it. None of it is proof, because none of it is the actual data the money moves through. Due diligence is the process of getting past the screenshot and into the order ledger, the ad account, and the supplier invoices, so every number in the listing either checks out or gets caught before you wire anything.
This checklist runs in four phases: financial, traffic, operational, legal. Work them in order. Each phase can end the deal on its own, and the earlier phases are where the biggest problems tend to hide.
Why due diligence starts with data, not screenshots
Every check below answers the same question: does the money the seller claims actually exist in the data? Not in a screenshot, not in a story about a "slow month," not in a promise about next quarter. In the order system, in the ad account, in the bank statement. If a number cannot be traced back to a source you can read yourself, treat it as a claim, not a fact, until someone reads the source and tells you otherwise.
That is also why access matters more than paperwork. A seller who hands over a polished PDF but will not grant read-only access to Shopify or the ad manager is telling you the PDF is the whole story. A serious seller grants the access without a fight, because their numbers survive the look.
Phase one: the financial checklist
This is where most of the real risk lives, and where most buyers stop too early.
- Order-ledger reconciliation, month by month. Pull twelve months of raw order data and compare it against the revenue the listing claims for each month. Aggregated totals hide a lot. A single bad quarter buried inside a good year does not show up until you look month by month.
- Refunds and chargebacks. These quietly erase claimed profit. A store with a high refund rate is a store with a product or fulfillment problem the topline revenue number never shows.
- Ad spend against claimed profit. Get the real numbers from the ad account itself, not a spreadsheet the seller compiled. Ad spend is usually the largest cost in the business, and it is also the cost sellers most often understate.
- Margin math. Work out gross margin and net margin from the order data and the supplier invoices, then check whether the seller's discretionary earnings figure actually follows from them. If the arithmetic does not hold, ask why before you ask anything else.
- Supplier invoices. Match cost of goods against what the supplier actually billed. A margin claim built on an old price list, before a supplier increase, is a margin claim that will not survive your first order as the new owner.
None of this requires trust in the seller's word. It requires read access to the order system and the ad accounts, and enough time to do the arithmetic yourself.
Phase two: the traffic checklist
Revenue without healthy traffic behind it is revenue that will not repeat for you.
- Source mix. Know exactly how much of the traffic is organic search, paid ads, email, and social, and how that mix has moved over the last year. A store that quietly shifted from organic to paid is a store whose margin is quietly shrinking.
- Bot inflation. Analytics tools count visits, and visits can be bought or faked. Cross-check traffic spikes against actual orders. Traffic that moves without orders moving with it is a number, not a customer.
- Organic versus paid dependence. A store that lives on ads is renting its customers from an ad platform every month. That is not a flaw by itself, but it changes what you are buying: an audience, or a subscription to buying one.
- Email list quality. Check list size against open rate and click rate, not just the count. A list of 80,000 addresses that nobody opens is worth less than a list of 8,000 that reliably buys.
Phase three: the operational checklist
This is the part that turns "the numbers look fine" into "the business actually transfers."
- Supplier agreements and transferability. Read the actual agreements. Some supplier relationships are personal to the current owner and do not survive a change of hands without a fresh negotiation, at different terms.
- Inventory ownership and valuation. Confirm the seller actually owns the stock being sold, not consigned or already pledged elsewhere, and price it honestly at cost, not at the seller's optimistic retail estimate.
- Owner hours and key-person risk. Ask how many hours a week the business actually takes, and whether any part of it depends on a skill or relationship only the current owner has. A "passive" store that needs sixty hours from a specific person is not passive. It is a job you have not been told about yet.
- Staff and contractors. Find out who does what, who gets paid how, and who is willing to stay after the sale. A store that runs on one contractor who plans to leave is a store you may be buying twice: once for the assets, once to rebuild the team.
Phase four: the legal checklist
The least glamorous phase, and the one that ends deals fastest when it is skipped.
- Trademark. Confirm the brand name is actually registered, and to the entity selling it, not to a related party who is not part of the deal.
- Business registration. Check the business is properly registered and in good standing, and that the entity selling the assets is the entity that legally holds them.
- Platform account standing. A Shopify store built on a Meta ads account with an active policy strike, or a marketplace account with an unresolved suspension, is worth less than the numbers suggest, because the account itself is part of what you are buying.
- Outstanding disputes. Ask directly about open chargebacks, supplier disputes, customer lawsuits, or platform investigations. Anything unresolved at close becomes your problem the day after.
What to demand before you wire anything
Read-only access to the order system and the ad accounts, not a shared screen and not a folder of screenshots. Read-only access lets you or a professional pull raw data, run the reconciliation, and see the numbers move the way real money moves. A seller who will not grant it is telling you something, whatever they say out loud.
Do not lean on a marketplace's badge instead of doing this yourself. Most marketplaces verify far less than you would assume, and it pays to know how marketplaces verify store revenue before you treat any badge as a substitute for reading the data.
If you can read a Shopify order export and an ad account dashboard without help, this checklist is a weekend of work for a small store. If you cannot, or the store is large enough that a mistake is expensive, pay for a professional read. Kairos runs a paid due diligence service: a human reads the store's raw data and delivers a written report within five working days, and it works for stores on any marketplace, not only stores listed on Kairos. Listings on Kairos itself are verified from read-only Shopify order data before they go live, which is the same standard this checklist asks you to apply to anything you buy elsewhere.
The one question every check answers
Strip away the phases and the checklist collapses into a single question, asked over and over: does the money the seller claims actually exist in the data? Order data answers it for revenue. Ad account data answers it for spend. Supplier invoices answer it for margin. Analytics, read correctly, answer it for traffic. Legal filings answer it for whether the thing you are buying is actually theirs to sell.
A screenshot answers none of it. It is a claim wearing the costume of proof, and the costume is the whole reason to be careful. Before you browse listings or negotiate a price on one you have already found, decide that you will not wire money against a number you have not personally traced back to its source, or paid someone qualified to trace it for you. That single habit catches more bad deals than any amount of negotiating skill ever will, and it is safe to buy an online store precisely when you apply it without exception.