Closing changes the legal owner of a business. It does not automatically change every technical owner recorded by GitHub, Vercel, a registrar or a database provider.
Post-closing verification is the point where the buyer compares the promised transfer with the system that now exists. It begins after the handover checklist has been executed; its job is to prove that those changes survive without seller assistance.
Rebuild the inventory from evidence
Start with the seller's confirmed inventory, then scan the buyer-controlled environment again. Compare repositories, deployment projects, domains, databases, integrations and environment-variable names.
New dependencies may appear. Old ones may still point to seller-owned accounts. Treat each difference as a finding to explain, not immediate proof of wrongdoing.
Confirm buyer control
For critical accounts, the buyer should be able to manage members, billing and recovery. Test the permission level instead of relying on the label displayed in an invitation email. A repository transfer and a hosting-project transfer are separate events, as the GitHub and Vercel procedures make clear.
Where ownership cannot be transferred, confirm that the new buyer-controlled resource is in production and the old resource is no longer required.
Search for residual access
Review organisation members, repository collaborators, installed applications, deploy keys, database roles and provider teams. Remove seller access when the agreed transition period ends.
Also check less visible paths: shared inboxes, recovery addresses, webhook secrets, personal API keys and machines that can still deploy through cached credentials.
Rotate what cannot be proven
If a credential may have been copied, rotate it. Focus first on production databases, deployment tokens, payment webhooks, email providers and administrative API keys.
Record that rotation occurred without storing the credential itself. The evidence should show who performed it, when it happened and which service accepted the new value.
Produce a closing record
A useful verification record contains the inventory, buyer-control evidence, residual access, credential-rotation status, operational tests and unresolved findings. Give the overall handover a plain status: verified, verified with exceptions, incomplete or failed.
This record is a technical account of what was checked. It will not replace the purchase agreement, but it can prevent the first outage from becoming an investigation into who owns the system.
The SaaS Transfer Control Register keeps the evidence, owners and open actions from this review in one local record. Return to the small-SaaS acquisition guide if a failed check reveals that an earlier stage needs to be reopened.