Buying or selling a company with an app
Before the deal closes, confirm who owns the store accounts, the code and the signing keys, then have someone independent review what the app is built from, its open-source licences, its security and whether it can still ship an update. This is for buyers, sellers and their advisers when customers or staff depend on the app. We do it as an $8,000 audit for one app and one codebase, in 1 to 4 weeks, and you get written findings to take to your deal team and your lawyer.
For deals where customers or staff depend on the app.Audits are $8,000, in 1 to 4 weeks.
The standards a review can use
Each fact links to the group that publishes it. This is general information, not legal advice.
A software bill of materials (SBOM) is a nested list of the parts a piece of software is built from. CISA's draft guidance says it helps an organization find vulnerabilities, judge risk and decide about the software it uses.
Source: CISA
ISO/IEC 5230, from the OpenChain Project, sets out the key requirements of a good open-source licence compliance program. A company can adopt it through self-certification.
Source: OpenChain Project (Creative Commons Attribution 4.0)
OWASP describes its Mobile Application Security Verification Standard (MASVS) as the industry standard for mobile app security. Testers can use it to make sure a review is complete and consistent.
Source: OWASP MAS (Creative Commons Attribution 4.0)
MASVS groups its controls into storage, cryptography, authentication, network, platform interaction, code quality, resilience and privacy.
Source: OWASP MAS (Creative Commons Attribution 4.0)
Apple can flag an app that hasn't been updated for three years and has very few downloads. The owner then has 90 days to submit an update.
Source: Apple Developer
Google Play lists acquisitions as a permitted reason to transfer a developer account, through its official process only. Buying an account any other way is prohibited.
Source: Play Console Help
Confirm who owns the store accounts, the code and the keys.
Ask whose name is on each account, whether the code is assigned in writing, and where the signing keys are kept. Get proof, not a verbal answer.
Ask for a list of every component in the app.
That is an SBOM: every library and outside service the app is built from.
Check the open-source licences.
Ask whether the seller runs a licence compliance program, such as one built on ISO/IEC 5230. If not, have someone check the licences against the component list.
Have the security reviewed against a named standard.
OWASP MASVS gives eight areas to check, from how data is stored on the phone to privacy.
Check that the app can still ship an update today.
Apple and Google keep raising the minimum every update must meet. An app that can't meet it can't ship a fix after you close.
Look at how the app is doing with its users.
Check crash and freeze rates against Google Play's limits, and read the recent ratings.
Ask how often the team ships, and how often a release breaks.
These delivery measures show whether the app can keep going after the deal.
Get the findings in writing before closing.
Send the legal points, such as code ownership and licences, to your lawyer.
What it costs
For one app and one codebase, in 1 to 4 weeks. Larger apps, or a company with several apps, are quoted higher. The audit is paid on its own; any fix, handover or maintenance after the deal is priced separately. Prices are for remote work. On-site work is quoted separately and priced higher.
How the audit worksThe store accounts, the code assignment, the signing keys and every outside service the app depends on.
The main components and their open-source licences, with the points to send to your lawyer marked.
A review organized by the eight OWASP MASVS areas, plus crash, freeze and rating data. Not a penetration test or a certification.
Whether the app can keep shipping, and every finding ranked by risk to the deal, in plain words.
Who owns the accounts, the code and the keys; what the app is built from and under which licences; its security; whether it can still ship an update; and how the team delivers. No single standard sets this list. It is how we combine the published standards for a deal.
If the app matters to the price, it is worth it. Problems you find first are problems you can fix or explain, instead of ones a buyer's team raises late in the deal.
No. We review the app against the areas OWASP MASVS sets out and tell you what we find. A penetration test or a formal certification is specialist work, and we will tell you when you need one.
Yes. The findings come in writing and in plain words, and the legal points, such as code ownership and licences, are marked for your lawyer. We don't give legal advice.
1 to 4 weeks, and $8,000 for one app and one codebase. Larger apps are quoted higher.
A short note is enough. We reply with whether we can help and what the first step costs.