Technology solutions for the transfer, storage and management of electronic files and other digital content is vitally important for organizations to meet compliance obligations, ensure adequate data security and to administer company data generally. Companies that provide solutions in this space – including in managed file transfer (MFT), file transfer protocol (FTP), cloud content storage and management and file sync-share, among others – are therefore very attractive targets for buyers in the “software-as-a-service” space. Given that these businesses are charged with safeguarding their client’s precious data, however, there are unique issues in doing deals involving these types of businesses, which both potential buyers and sellers must be aware of.
Appropriate Rights to IP
Given the importance of intellectual property in any software business, buyers will need to know that the target has the right, either through ownership or a valid license, to use the IP necessary for the underlying software. Buyers will also want to confirm that any personnel involved in the creation of IP have signed an agreement assigning any IP created to the company. This is an key area of diligence review for buyers, and sellers should conduct a preemptive review prior to a sale process in order to identify any issues and clean up documentation as necessary.
Open Source Software
One item that buyers particularly focus on is the use of open source materials in the software’s code. Open source materials are, of course, commonly used in many commercial software applications. But improperly using open source materials could substantially reduce the potential value of the software by limiting its ability to be commercialized. Buyers will accordingly conduct key due diligence on this matter, including retaining a third party to conduct a thorough code audit.
Data Privacy
Given that companies in this space are involved in the transfer of customer records, data privacy, cybersecurity and data breach issues are particularly relevant for buyers to review and for sellers to preemptive be aware of. A buyer will want to understand the target company’s IT and data security policies, including how the company gathers data and personal information and how it uses, stores, encrypts (or protects) and destroys that data. If there have been historical breaches, the buyer will want to understand what notices were given, what remediation was done, and if there have been any suits, enforcement actions or settlements related to such breaches.
OFAC and Export Control
One issue that many businesses involved in file management are not aware of is the potential that providing the software to users outside the US could result in the company being subject to US sanctions and export control laws. Buyers will review customer lists, including IP addresses, to determine potential violations, and may also review the target company’s compliance procedures. Of particular concern will be confirming that the software is not accessed from certain restricted countries like Iran and North Korea. If a business has not been focused on these issues in the past and accordingly do not have robust compliance procedures in place, this issue should be reviewed with legal counsel in advance of a sale to determine what corrective action should be taken, including the possibility of making a voluntary disclosure of past violations to government authorities (which often reduces the possibility of resulting disciplinary action).
Key Engineers
Often, in transactions in this space, the retention of key engineers in the business going forward is a key concern for a buyer. The buyer may require that certain key team members sign employment agreements as a condition to the transaction (which could give these team members leverage to hold up a deal). In circumstances where there is particular risk of employee departure, the buyer may want to consider holding back part of the purchase price and subjecting that payment to ongoing employment of certain individuals. Sellers should be aware that this could, depending on the facts and circumstances, result in adverse tax consequences.
Conclusion
Buying and selling a business involved in the management, storage of and transfer of files is complex, and the issues listed above are only a subset of the total number of issues that needs to be resolved in the overall transaction. Buyers and sellers should be aware of the key concerns before doing a deal so that any thorny issues can be surfaced and resolved in advance of the anticipated closing.