An online company can appear transferable because it has no storefront, but its value may depend on accounts and licenses that cannot simply be handed over. To buy an online business safely, verify who owns the domain, code, content, trademarks, customer data, payment accounts, and platform relationships before price and closing terms become fixed. The purchase agreement must identify every digital asset and make required transfers, consents, credential changes, and closing conditions.
Key Takeaways
- A domain transfer does not transfer website code, content, customer data, trademarks, social accounts, or marketplace rights.
- Platform, payment, advertising, hosting, and software agreements may prohibit assignment or require a new buyer account.
- Contractor-created code or creative work should be supported by signed intellectual-property assignments, not invoices alone.
- Revenue diligence should reconcile platform reports with processor settlements, bank deposits, refunds, chargebacks, taxes, and deferred obligations.
- Privacy notices and customer consents may limit whether personal data can move to a new buyer or be used for a new purpose.
- Closing should use a digital asset schedule, credential-transfer plan, seller-access removal, and a tested transition period.
What Are You Actually Buying?
An online business is a bundle of legal rights, accounts, data, and operating processes. The listing name is not the asset list. Break the target into identifiable items: domain names, websites, code repositories, cloud infrastructure, trademarks, copyrights, product inventory, seller accounts, payment accounts, email lists, customer contracts, vendor contracts, social profiles, analytics history, and operating documentation.
For each item, ask four questions: Who owns it? Can it transfer? What consent is needed? What evidence proves control after closing? The owner shown in a dashboard may be an employee, founder, contractor, or agency rather than the selling company.
Use the business acquisition process to connect the asset schedule with diligence, agreement terms, and closing deliverables.
Should You Buy Assets or the Existing Entity?
The structure changes that history and contracts follow the buyer. An asset purchase can let a new buyer entity acquire selected digital assets and defined obligations. An ownership-interest purchase keeps the target entity in place, along with its contracts, tax history, claims, refunds, security incidents, and liabilities.
| Question | Asset Purchase | Equity or Membership Purchase |
| Digital assets | Must be listed and transferred | Remain owned by the target entity |
| Platform accounts | May require new accounts or consent | May face change-of-control restrictions |
| Historical liabilities | Often excluded by contract, subject to legal exceptions | Stay inside the acquired entity |
| Operational continuity | More migration work | Often smoother if contracts permit control change |
Choose only after reviewing material agreements. A platform that will not transfer may force a new account regardless of the transaction label.
How Do You Verify the Domain and Brand?
Control of the website URL and ownership of the brand must be verified separately. Use the ICANN registration-data lookup to identify available domain registration data and the registrar. Request registrar screenshots, invoices, renewal records, account recovery details, and a list of every related domain.
Search the USPTO trademark database for registrations and applications. Compare the named owner with the seller and request assignments, licenses, coexistence agreements, office actions, and dispute records.
Verify:
- Registrant and registrar for each domain.
- Renewal date, transfer lock, and recovery email.
- Trademark owner and status.
- Common-law brand use and geographic scope.
- Claims, takedowns, or domain disputes.
- Social handles and account administrators.
A business can control a domain without owning the trademark, or own the trademark while a former developer controls the domain.
Who Owns the Code, Content, and Product?
Payment for development does not always prove ownership of the resulting intellectual property. Review employment agreements, contractor agreements, statements of work, invention assignments, open-source records, stock-media licenses, design files, and repository histories.
For SaaS, map source code, infrastructure code, deployment keys, databases, documentation, and third-party libraries. For e-commerce, map product photography, descriptions, packaging designs, private-label agreements, supplier data, and marketplace content.
The U.S. Copyright Office confirms that copyright ownership may be transferred and that recordation can provide legal advantages. Its transfer-recordation guidance is useful when registered or material copyrighted assets are part of the deal.
Red flags include code held only in a contractor’s repository, missing contributor agreements, copied product images, licenses tied to one person, and software components whose terms do not support the target’s commercial use.
Which Accounts and Contracts Can Transfer?
Account access is not the same as a contractual right to transfer. Read terms and signed agreements for marketplaces, payment processors, advertising platforms, hosting providers, app stores, software vendors, fulfillment services, affiliates, suppliers, and major customers.
Create an account-transfer matrix:
| Account or Contract | Current Owner | Transfer Rule | Closing Action |
| Domain registrar | Seller or target | Registrar transfer process | Move to buyer-controlled account |
| Payment processor | Target entity | Consent or new underwriting | Confirm before closing |
| Marketplace | Target or individual | Platform-specific | Obtain written path or exclude |
| Cloud hosting | Target or founder | Assignment or account migration | Test access and billing |
| Customer contract | Target entity | Assignment/change-of-control clause | Obtain consent if required |
Do not accept a promise that the seller will “hand over the login.” The buyer needs a lawful, durable operating path.
How Should Revenue and Customer Metrics Be Tested?
Reconcile reported performance to cash and obligations. Compare storefront or subscription dashboards with payment-processor settlements, bank deposits, tax returns, refunds, chargebacks, discounts, affiliate commissions, shipping costs, app-store fees, and sales tax.
For SaaS, separate annual prepaid revenue from monthly revenue and identify service obligations after closing. Test churn, customer concentration, failed payments, trial conversions, discounts, support burden, uptime commitments, and credits. For e-commerce, test returns, unsold inventory, supplier dependency, advertising efficiency, and stockouts.
Read the business valuation considerations alongside the legal review. A high revenue figure may not support the price if the business depends on one marketplace, one paid channel, or one supplier who can terminate.
What Data Privacy and Security Issues Matter?
Customer data is an obligation as well as an asset. Review privacy notices, consent language, cookie practices, vendor contracts, data-processing agreements, security policies, incident logs, access controls, backups, deletion requests, and regulatory correspondence.
Map what personal data the business collects, where it is stored, why it is used, who receives it, and how long it is retained. Determine whether the transaction and the buyer’s intended use fit the promises already made to customers.
Ask about breaches, ransomware, account takeovers, lost devices, unauthorized exports, and payment-card issues. Require the seller to disclose known incidents and preserve relevant logs. If a security problem is discovered, address remediation, customer notice, cost allocation, insurance, and closing timing in the agreement.
What Should the Purchase Agreement Cover?
The agreement should name digital assets precisely and allocate transfer failure risk. Attach schedules for domains, repositories, trademarks, content, accounts, data sets, hardware, inventory, contracts, and credentials.
Representations should address ownership, authority, infringement, open-source use, platform compliance, privacy, cybersecurity, customer metrics, refunds, chargebacks, taxes, and undisclosed liabilities. Closing conditions should include required consents, account migration, repository access, administrative control, and tested recovery methods.
Use escrow or a holdback when transfer steps continue after closing. Define transition support, response times, documentation, seller access, and the point at which the seller must permanently delete retained credentials or data.
Holmes Law can review the transaction documents and proposed deal structure before the buyer commits to nonrefundable payments.
How Should a Digital Closing Work?
A digital closing should transfer legal title and operational control in a controlled sequence. Prepare a live checklist and test low-risk access before funds move.
At closing:
- Sign the purchase agreement, assignments, consents, and corporate approvals.
- Release funds according to the agreed funds flow.
- Transfer domains to a buyer-controlled registrar account.
- Transfer repositories, cloud accounts, administrator roles, and recovery methods.
- Rotate passwords, API keys, security tokens, and billing contacts.
- Confirm processor, marketplace, and app-store continuity.
- Remove seller and agency access after the transition plan permits.
- Preserve logs and evidence of every transfer.
Schedule a post-closing test covering checkout, subscription billing, email, analytics, backups, deployment, customer support, and account recovery. A signature without working access is not a complete handoff.
FAQs
It can be safe when ownership, transfer rights, revenue, data practices, and operational access are verified before closing.
It depends on the platform’s current terms and approval process, so obtain a written transfer path or plan for a new account.
No. A domain registration is separate from code, content, hosting, databases, trademarks, and customer information.
Reconcile subscription data with processor settlements, bank deposits, refunds, failed payments, churn, discounts, and deferred service obligations.
Ownership depends on the contract and applicable law. Request signed assignment language and repository evidence rather than assuming payment transferred all rights.
Possibly, but the transfer and future use must be assessed against privacy notices, consents, contracts, and applicable law.
The answer depends on platform continuity, contracts, tax treatment, historical exposure, and the practicality of transferring each digital asset.
Access should follow a documented transition plan, then be removed while the buyer rotates credentials, recovery contacts, and security keys.
Conclusion
Begin by identifying the assets and accounts that create revenue. Then verify legal ownership, transfer restrictions, cash performance, privacy obligations, and the buyer’s ability to operate the business after closing. The purchase agreement should make every required consent and transfer a deliverable, not a post-closing hope. If you are reviewing an online acquisition, have the asset schedule and proposed agreement assessed together before a deposit becomes nonrefundable.