Building vs. Renting: How Proprietary Storefronts Increase Company Valuation

The M&A Audit: How Private Equity Evaluates E-Commerce Tech Debt

During the early stages of an acquisition, majority recapitalisation or Series B/C round, financial diligence focuses on top-line revenue, gross margin and blended customer acquisition cost. Once the non-binding Letter of Intent (LOI) is signed, technical due diligence begins, and technology stops being a line item and becomes a list of findings.

When technical advisers examine an e-commerce brand that runs entirely on a rented SaaS theme, they see an undifferentiated marketing wrapper: a stack of third-party apps each holding its own copy of customer records, plugins that break on upstream platform updates, and little intellectual property the brand can call its own.

An off-the-shelf theme can be reproduced by a well-funded competitor in a weekend. Proprietary architecture is evidence of something an acquirer can underwrite: documented code, controlled data and a cost base that does not rise with GMV.

The Diligence Checklist: How PE Tech Auditors Scrutinize Monoliths vs. Composable Stacks

Institutional acquirers do not evaluate technology as a cosmetic website; they audit it as an operating asset that must survive scaling post-acquisition without massive capital expenditure injections. In a standard private equity technical audit, auditors evaluate five specific operational vectors:

• Codebase Provenance & IP Ownership: Does the brand own the source code outright, or is it bound to proprietary platform runtimes and restricted liquid templates? Acquirers require clean IP assignments with full copyright ownership in private Git repositories.
• Third-Party Vendor Exposure: How many external SaaS applications hold API keys to customer data? If a business relies on 18 micro-apps for search, reviews, loyalty, and checkout, an acquirer must conduct risk assessments on 18 separate vendors, multiplying compliance liabilities.
• Data Portability & Database Architecture: Can the brand export clean, normalized customer purchase records, behavioral telemetry, and inventory histories via direct SQL access, or is data throttled behind rate-limited SaaS REST APIs?
• Main-Thread Performance & Core Web Vitals: Does the storefront pass Google Core Web Vitals (LCP, INP, CLS) in CrUX field data? A store failing Web Vitals signals impending organic traffic vulnerabilities and escalating ad acquisition costs.
• Marginal Cost of Scale: Does technology overhead scale linearly with revenue through take-rates and GMV penalties, or does it operate on fixed utility compute?

An owned Next.js and PostgreSQL architecture can answer every line of this checklist with evidence: an IP assignment, a vendor list short enough to review, a SQL export, CrUX field data and a hosting bill that does not scale with GMV. Ownership alone does not pass diligence; the documentation and tests behind it do.

Capitalizing R&D Under Ind AS 38 / US GAAP ASC 350-40

The second difference between rented SaaS and owned engineering is how each lands on the balance sheet. Under Ind AS 38 / IAS 38 and US GAAP, fees for a hosted platform such as Shopify Plus are a service cost: they are expensed as operating expenditure (OpEx) as the service is consumed.

Subscription fees buy access, not an asset. When payments stop, access stops, and the balance sheet holds nothing for the money spent.

Development-stage engineering cost for software the company owns is treated differently. Where the recognition criteria are met (IAS 38 / Ind AS 38 paragraph 57 for development costs; the application-development stage under ASC 350-40 for internal-use software), it can be capitalised as an intangible asset and amortised over its useful life, commonly three to five years. Confirm the treatment with your auditor before you model it. Where it applies, three effects follow:

• Reported EBITDA: capitalised development cost is amortised below the EBITDA line instead of running through operating expense. Diligence teams know this and also look at cash spent on technology, so treat it as a presentation effect, not free earnings.
• Tax: amortisation, or depreciation on software for Indian income-tax purposes, is a deductible non-cash charge spread over several years. The rate and timing are your tax adviser's call.
• An asset on the books: three years of subscription fees leave nothing behind; three years of capitalised development leave a codebase carried at cost less amortisation. Book value is not market value, but it is an asset an acquirer can inspect.

Zero-Party Data Moats: Compliance with India's DPDP Act and Global GDPR

In the post-cookie landscape, where customer data lives is a diligence question, not only a compliance one. When a brand runs 15 to 20 third-party plugins on a rented store, shipping addresses, phone numbers and browsing behaviour are copied into as many external databases.

Under India's Digital Personal Data Protection (DPDP) Act, 2023, the brand as Data Fiduciary stays responsible for personal data processed on its behalf by every one of those processors, and the Act's Schedule sets penalties of up to ₹250 crore for failing to take reasonable security safeguards. GDPR imposes similar obligations on brands selling into Europe. Acquirers price that exposure.

On an owned Next.js and Supabase architecture, customer profiles and purchase histories live in one PostgreSQL database protected by Row-Level Security (RLS), and data reaches only the processors you have chosen and contracted. Fewer processors means fewer contracts, fewer breach surfaces and a shorter answer when diligence asks where personal data lives. It reduces DPDP exposure; it does not remove the obligations.

The Code Quality Due Diligence: What Technical Auditors Inspect Line by Line

An acquirer's engineering team reads the code itself, usually with static analysis tools. Template stores tend to fail the same way: edited theme files, JavaScript left behind by uninstalled apps, and no automated tests.

A Panarch Next.js production repository is built to pass that review:

• Strict TypeScript: components, route handlers and data models are typed end to end, so type errors fail the build instead of reaching production.
• Playwright end-to-end tests: add-to-cart, promo codes, Razorpay checkout and authentication run on every pull request.
• Row-Level Security in Supabase PostgreSQL: access rules are enforced by the database itself, so a request without a matching policy is rejected even if an application token leaks.
• A readable Git history: reviewed pull requests and tagged releases that show how and when the system changed.

Where Technology Findings Show Up, Deal by Deal

Multiples are set by growth, margin, retention and comparable transactions; technology is rarely the headline driver. It shows up in the adjustments. An acquirer who finds a forced re-platforming in the first-year plan prices it in, as a lower multiple or a deduction from enterprise value. An acquirer who finds documented, owned infrastructure has one less risk to price. Where that lands depends on the deal:

• Growth rounds (Series A/B): investors test whether the stack can carry the next stage of revenue without a rebuild funded from the round they are writing.
• Minority recapitalisations: technical findings can surface as conditions, warranties or escrow rather than in the headline price.
• Majority buyouts: the sponsor's model carries technology cost as a line. Costs that scale with GMV (platform take-rates, per-order app fees) lower projected margin at exactly the revenue it is underwriting.
• Strategic sales: the buyer prices integration. A codebase with clean APIs into its ERP and WMS integrates sooner than a theme store that has to be migrated first.
• Pre-IPO diligence: auditors and bankers ask for evidence of data-protection controls, and a short, documented processor list is easier to evidence than fifteen apps holding customer data.

Model the Valuation Effect as an Assumption, Not a Promise

Nobody can promise a multiple, and a published range for "tech-enabled" versus "template" brands would be invented. What you can do is model the effect with your own advisers' comparables and check whether the engineering spend clears the bar.

Take a brand with ₹5 Crore of annual EBITDA. Every turn of multiple is ₹5 Crore of enterprise value, so the only question is how much of a turn the technology findings are worth in your transaction. Adjust the assumption; the arithmetic does the rest:

• Assumption: findings worth 0.5x EBITDA. Effect: ₹2.5 Crore of enterprise value.
• Assumption: findings worth 1x EBITDA. Effect: ₹5 Crore.
• Assumption: findings worth 2x EBITDA. Effect: ₹10 Crore.

Set those figures against the build cost and the subscription and app fees it removes over your holding period. If the case only works at the top assumption, it is not a case. Replace every assumption with comparables from your own bankers before any of this reaches a board paper.

Conclusion: Stop Building on Rented Land

Brands that expect to raise or sell treat their storefront as an operating asset that will be audited, not as a theme that will be replaced after the deal closes.

Own the source code, own the customer data and remove the costs that scale with GMV, then document all three so a diligence team can verify them. If a round or an exit is on your horizon, start with a technical audit of the stack you run today: it is the same review an acquirer's advisers will run, done early enough to fix what it finds.