A seller once sent his full Profit & Loss (P&L) statement, detailed traffic analytics, supplier contracts, and his entire customer list to a “highly interested buyer.”
A week later, the buyer ghosted him. A month later, the seller noticed a new competitor in his exact niche, selling the exact same products, sourcing from the exact same supplier, and aggressively targeting his custom Facebook audiences. The “buyer” was never going to buy the store. They were doing corporate espionage, and the seller handed them the blueprint for free.
Your financials are the DNA of your business. Sharing them is a necessary part of the M&A process, but doing it recklessly is the fastest way to destroy your store’s value. You need a systematic, staged approach to financial disclosure.
Know Your Numbers Before You Share Them
The Danger of the “Data Dump”
When sellers get their first bite of interest, excitement takes over. They want to prove how great their business is, so they immediately dump their entire Google Drive folder of financial records onto the prospect.
Sophisticated buyers view this “data dump” as a massive red flag. First, it shows a lack of M&A experience. If you are careless with your own proprietary data, a buyer assumes you are careless with your business operations, data privacy compliance, and accounting. Second, it destroys your negotiating leverage. Once a buyer sees everything—including your exact profit margins on every single SKU—they know exactly how hard they can squeeze you on price.
To protect your asset, you must gate your information. You only reveal deeper layers of data as the buyer makes deeper layers of commitment.
Stage 1: The Executive Summary (Pre-NDA)
At this stage, the buyer has just reached out. You have not verified their identity, and no Non-Disclosure Agreement (NDA) has been signed. You must share enough to keep them interested, but nothing that could be reverse-engineered.
What to Share
- Trailing 12-Month (TTM) Gross Revenue (rounded numbers).
- Estimated Seller’s Discretionary Earnings (SDE).
- Traffic breakdown by broad percentage (e.g., 60% Organic, 30% Paid, 10% Direct).
- General operational stats (e.g., “We use a 3PL in Texas,” or “We source from 2 main suppliers in Vietnam”).
What to Withhold
Exact URL, brand name, specific product names, supplier identities, and detailed expense line items.
At this stage, you are painting a compelling picture without revealing the canvas. The buyer should know you have a healthy, growing business. They should not know how to replicate it.
Stage 2: The Redacted Data Room (Post-NDA)
The buyer has signed a strict NDA and answered your qualifying questions about their budget and timeline. They are a legitimate prospect. Now, you can open the first layer of the data room, but you must heavily sanitize it.
What to Share
- Month-by-month P&L statements to prove revenue consistency and seasonality.
- Shopify Dashboard screenshots (showing the revenue graphs).
- Google Analytics screenshots (showing traffic trends).
- Average Customer Acquisition Cost (CAC) and Customer Lifetime Value (LTV) metrics.
What to Withhold (The Redaction Rule)
You must blur out the names of your suppliers on the P&L. If you use a highly specialized app that is the secret to your conversion rate, blur the app expense. Blur the names of your top-performing ad campaigns. You are proving how much money you make, not exactly how you make it.
This is the most delicate stage. You are providing enough financial transparency to build buyer confidence while holding back the proprietary “secret sauce” that makes your business uniquely defensible. The buyer should be able to verify your revenue claims without being able to replicate your exact operational playbook.
Stage 3: The Full Disclosure (Post-LOI)
The buyer has submitted a Letter of Intent (LOI) to purchase your business at an agreed-upon price, and you have both signed it. The dynamic has now shifted. They are no longer deciding if they want to buy your store; they have committed to buying it, and now they just need to verify that you haven’t lied to them.
This is the Due Diligence phase.
What to Share
Everything. Unredacted bank statements, full supplier contracts, complete ad account access (read-only), and tax returns. At this stage, the buyer has put legal capital on the line. If they back out without a valid reason found in due diligence, their reputation as a buyer takes a hit.
At this point, the buyer is contractually bound to complete the purchase unless they discover a material misrepresentation in your financials. Full transparency is now in your best interest—it validates the numbers you presented in Stages 1 and 2, and it accelerates the path to closing.
The Disclosure Timeline at a Glance
| Stage | Trigger | Shared | Withheld |
|---|---|---|---|
| Stage 1: Executive Summary | Initial inquiry received | Rounded revenue, SDE estimate, traffic mix | URL, brand name, suppliers, product details |
| Stage 2: Redacted Data Room | Signed NDA + buyer qualification | Monthly P&L, dashboard screenshots, CAC/LTV | Supplier names, ad campaign details, app stack |
| Stage 3: Full Disclosure | Signed LOI | Bank statements, tax returns, supplier contracts, ad access | Nothing |
By staging your financial disclosures, you weed out the spies and tire-kickers, and you ensure that only a buyer who is legally bound to purchase your store gets to see its inner workings.
Frequently Asked Questions
When should I ask a buyer to sign an NDA?
Before you share any identifying information—your store URL, brand name, supplier identities, or detailed financials. An NDA is your first line of defense. If a buyer refuses to sign one, that is an immediate red flag and you should end the conversation.
What is a Letter of Intent (LOI)?
A Letter of Intent is a formal, signed document that outlines the agreed-upon purchase price and key deal terms. It signals that the buyer is serious and legally commits them to due diligence. Full financial disclosure typically happens only after the LOI is signed.
How do I know if a buyer is legitimate?
Qualify them before sharing anything sensitive. Ask about their budget range, acquisition timeline, previous deal experience, and whether they have funds available. Legitimate buyers will answer directly. Competitors and tire-kickers will be vague or evasive.
Can I use a data room platform instead of email?
Yes, and you should. Platforms like Dropbox Business, Google Drive with restricted access, or dedicated M&A data room tools (FirmRoom, DealRoom) offer better security controls, access tracking, and watermarking than email attachments. They also create an audit trail of who viewed what.
What if a buyer insists on seeing everything upfront?
Politely decline. Serious buyers understand the staged disclosure process—they use it themselves. A buyer who demands full financials before signing an NDA or LOI is either inexperienced or has ulterior motives. Either way, you should not proceed.
Know Your Numbers Before You Share Them