M AND A AND COMPLIANCE

Sell side open source cleanup before a sale.

Exposure a buyer finds first is exposure the buyer prices. Cleaning your dependency tree before diligence opens turns a potential discount into a documented, defensible position. This is the seller side of the same work an acquirer runs on you.

Sell side open source cleanup before a sale is the work you do on your own software before a buyer ever looks at it. The logic is simple. In a transaction, whoever finds an exposure first controls what it costs. If a buyer's diligence surfaces a relicensed component or an untested copyleft obligation, that finding becomes a lever: a lower price, a larger escrow, a broader indemnity, or a closing condition. If you find and resolve the same issue months earlier, it is not a lever at all, because it is no longer there. The cleanup is how a seller takes that lever off the table before the negotiation starts. None of this is legal advice, and interpretation of any license belongs with your own counsel.

Why the seller should move first

Most founders and finance leaders assume open source is the buyer's problem to investigate. It is, but the order of discovery decides the price. A buyer who opens a data room and finds a clean, complete, dated inventory reads it as evidence of a well run company and moves on quickly. A buyer who finds gaps, stale records, or a component that quietly changed terms reads it as a reason to dig, and digging is rarely good for the seller. The cost of a problem is set far more by when it is found than by how serious it is. Resolved before the process, a relicensed dependency is a footnote. Found during exclusivity, the same dependency can shave real value off the deal or stall it entirely. The seller who moves first keeps control of the narrative.

Rebuild the real inventory, not the one you remember

The first step is an honest inventory. The list your engineers maintain captures the components they chose on purpose, the direct dependencies. It rarely captures the full transitive tree, the components pulled in automatically several layers down, and that is where the exposure hides. Cleanup begins by rebuilding the dependency tree from the code itself rather than trusting the existing record, then recording the current license state of every node with a date. A buyer will rebuild this tree during diligence whether you do or not. Doing it first means you see what they will see, and you see it while you still have time to act. The discipline behind this is the same one set out in the open source due diligence checklist, applied to yourself.

Find the components that relicensed under you

The exposure that most often surprises a seller is a component adopted years ago under an open license that has since moved to source available terms. The pattern is well documented. MongoDB moved to the Server Side Public License in 2018. Elasticsearch and Kibana moved to the Server Side Public License and the Elastic License in 2021. HashiCorp moved Terraform, Vault, Consul, Nomad, and Packer to the Business Source License in August 2023, before IBM later acquired the company. Redis moved to a source available model in 2024. Each of these has a community fork: OpenTofu for Terraform, Valkey for Redis, OpenSearch for Elasticsearch. If your product depends on any of these and your records still show the original license, your inventory understates your obligations. Cleanup means checking each component against its license today, as of a stated date, not against the license it carried when you first pulled it in. Source available is not open source, and the two carry very different obligations.

Test copyleft obligations against how you actually ship

The second exposure to clear is copyleft. A strongly copyleft component, for example one under the GNU AGPL, can attach distribution or network obligations depending on how your product reaches users. A component can be entirely secure and still carry a condition that, triggered by the way you deploy or offer the software, would require source disclosure you never intended to make. A buyer's counsel will test this against your deployment model. Better that you test it first. Where the obligation is real, you can reroute to a permissively licensed alternative, isolate the component behind a boundary that does not trigger the condition, or document why your specific use does not engage it. The mechanics of when these obligations bite are set out in copyleft distribution obligations explained. Clearing it quietly before a sale is far cheaper than explaining it under deal pressure.

Remediate, then document what you cannot remove

Not every exposure can be removed before a sale, and that is acceptable. What matters is that each one is either resolved or documented. Where a relicensed component can be replaced with a fork or an alternative inside the available timeline, replace it. Where a commercial license is the cleaner answer, secure it on your terms before the buyer's leverage enters the room. Where an item cannot be changed in time, write it up plainly: what it is, why it is there, what the obligation is, and what it would cost to address. A documented, quantified residual exposure is a manageable line item. An undocumented one that the buyer discovers is a credibility problem that colors the whole data room. The goal is not perfection; it is the absence of surprises.

How cleanup protects price and terms

A clean position pays for itself in the negotiation that follows. When a buyer cannot find a license problem, they have less to bargain with on price, less reason to enlarge the escrow, and less room to demand a sweeping open source indemnity. The seller who has already mapped, dated, and documented the tree negotiates from evidence rather than from assurances. This is the same exposure the buyer will try to translate into a valuation adjustment, the subject of open source risk and deal valuation, and it directly shapes the open source indemnities and warranties you are asked to sign. Every exposure you retire before diligence is one fewer clause working against you at closing. The full set of resources sits in the M and A and compliance pillar.

The buyer side view, applied to your sale

We run the acquirer's diligence on companies for a living, which is exactly why we are useful to a seller. We rebuild your transitive tree, check every component against its current license, test copyleft obligations against how you ship, and hand you the same findings a buyer's adviser would produce, but early enough to act on. We are independent and paid only by you, never by an acquirer or a vendor, so the work serves your sale and nothing else. We deliver it through our open source M and A due diligence service, with the exposure quantified in language a board and a buyer will both accept.

CLEAN THE TREE FIRST

Find your exposure before the buyer does

We run the acquirer's diligence on your own tree, early enough to resolve what we find. Independent, buyer side, paid only by you.

Not ready to talk? Read the free open source license risk guides first.

COMMON QUESTIONS

Questions sellers ask.

CONTAINMENT

Clean your tree before the data room opens.

Confidential open source M and A due diligence. Independent, buyer side, paid only by you.