When Due Diligence Is the Harvest

The Technique

The name for it is competitive intelligence harvesting under the pretext of acquisition due diligence. A company approaches a smaller site in its own market with an offer. Partnership, sponsorship, acquisition, the framing varies. What matters is that the offer creates a context where asking for detailed information sounds normal. Traffic numbers. Audience breakdowns. Search performance. Access to the accounts that hold all of it. Every one of those requests, outside that context, would get a flat no. Inside an acquisition conversation, refusing feels paranoid.

The part people miss is that the offer does not have to be fake. A buyer can mean every word about wanting to purchase your site and still walk away with your private data when the deal falls through. The collection happens regardless. The only open question is whether it was the point, and that question is usually impossible to answer from the outside. I will get to that.

What Happened to Me

I am not naming the company or the person. The intent behind the requests was never established, and this post is not an accusation. It is a pattern breakdown, and I am using my own exchange because it is the one I can document.

The approach came from someone who runs a platform in this industry. Two options were offered: paid logo placement, or an acquisition where I would stay on as a paid developer. A previous acquisition of another developer's site was mentioned as precedent. Before I replied, I verified what I could. The sender was connected to me on LinkedIn. The identity checked out against public records, and I asked for confirmation from the official address on the company's website, which I got. So whoever this was, they were real.

Then the requests started. First, traffic statistics. Monthly visitors, page views, audience countries, traffic sources. Screenshots were fine. I sent reports exported from my infrastructure and search console. Next, a thank-you, followed by a request for read-only access to my search console and analytics, plus read-only access to my infrastructure analytics if my plan supported it. So the numbers could be reviewed firsthand.

I had already sent the numbers. This request was not for the numbers. It was for the accounts.

I declined and sent two more reports instead, covering the previous 24 hours and the previous 7 days. The next day I got a pass. The reasons: my backlink profile and my traffic needed to be stronger. After I pushed back, one more detail came out. The campaign was looking for sites around a hundred thousand page views a month, and that should apparently have been mentioned at the start.

Why That Sequence Is the Whole Story

Take any single request from that exchange and it sounds fine. Buyers do due diligence. Public traffic estimators really are unreliable for small sites. Read-only access sounds harmless. All of that was said to me afterward and all of it is technically true.

The sequence is a different matter. Domain age is a public record. Backlink profiles are a cheap lookup. Rough traffic bands are free. Everything cited in the rejection could have been checked before the first email was ever sent, and the launch date of my site was in my first reply, two days before the access request. A firm page-view threshold is the kind of thing a serious buyer opens with, because it ends unqualified conversations in one email. Mine surfaced after the access was refused.

And none of it required looking hard. We were connected on LinkedIn, which is the one place I announce every tool I build. The profile was right there.

Every step that was skipped was free. Every step that was taken went deeper into my accounts. You can read that two ways, and I will come back to that, but the shape of it is worth recognizing no matter which reading you pick.

Why the Data Is the Prize

Developers undervalue their analytics because analytics feel like housekeeping. They are not housekeeping. A search console export is a demand map.

It lists every query your site surfaces for, with impressions, click rates, and positions. It shows which pages turn visibility into visits, where the audience is, and how fast the site is growing. For a company in the same market, that document answers questions it would otherwise pay to approximate: what is the market searching for, which terms are underserved, where is the demand going.

Now the part that closes the loop. Public estimation tools are weak on exactly this class of site. That was given to me as the reason access was needed, and it is true. But the same weakness means the only complete copy of that demand map lives inside the owner's accounts. The fact that justifies the request is the fact that makes it valuable. Remember both halves of that sentence when you hear it.

What a Real Buyer Looks Like

Criteria come first. Traffic minimums, budget, timeline. If those numbers only appear after you decline something, you were not being measured against them.

Public research happens before contact. Age, backlinks, rankings, rough traffic. A buyer who passes on grounds like these should have known them before writing to you. If they did not, the diligence was theater or the company is bad at what it sells.

Documents are enough. Exports and verified reports answer nearly every preliminary question. The one thing documents do not give is the live window into your accounts, and the live window is the one thing with value beyond the deal.

A clean no is accepted. Decline access and watch. A real buyer works from the reports, suggests a verified data room for later, or walks away politely. Pressure, guilt, or suddenly shifting reasons are the answer to a question you did not have to ask out loud.

What I Cannot Prove

I want to be exact about this because exact is the job.

What the record shows: a company in my market approached me, requested escalating detail about my platform and my audience, asked for direct access to accounts it had no procedural need to enter, and ended the conversation on criteria that were publicly checkable before first contact. Documented, all of it.

What it does not show: intent. Harvesting is a plausible reading of those requests. It is not an established one. The same record fits a genuine buyer with a sloppy process, and the person apologized and said there was no ulterior motive. I cannot prove otherwise and I am not going to pretend I can.

It also does not matter much, because the defense is the same either way. Exports instead of access. Criteria before documents. Verification before engagement. If the approach was sincere, running it this way costs you nothing. If it was a harvest, you gave away nothing that matters. You do not have to solve the other party's intent to protect yourself. You only have to recognize the pattern.

If This Email Finds You

Verify the person first. Ask them to write from the official address on their company's website. Check the domain against registration records. Confirm the prior deals they mention by finding the other party. My sender passed all of it. That establishes identity. It says nothing about intent, and you should keep those two columns separate in your head.

Ask for their numbers before you produce yours. One sentence: happy to share figures, what traffic range and budget are you working within? A buyer answers in one reply. A harvester needs the conversation to continue, because the conversation is the collection.

Exports, never access. There is no preliminary question a platform-generated report cannot answer. If access is genuinely needed later, data rooms and escrow exist for that stage, and that stage comes after a price is on the table.

Judge the sequence, not the asks. Each request alone will sound reasonable. Screenshots to reports is normal. Reports to account access, after reports were already provided, is a different shape.

Keep the thread. Every email, dated. You will probably never need it. If you do, nothing else replaces it.

The site is still free, still not for sale, and still exactly what it was before someone tried to put a number on it. The only thing that came out of the exchange worth keeping is the pattern, and now it is yours too.

FAQ

What is competitive intelligence harvesting under an acquisition pretext?

Using a potential acquisition or partnership as the reason to request information the asker could not otherwise get. The offer creates the context. Inside that context, requests for traffic data, audience breakdowns, and account access sound like routine diligence. The deal does not have to be fake for the technique to work, which is what makes it hard to call.

How do you tell real due diligence from harvesting?

Real buyers state their criteria and budget early, check what is public before they contact you, and work from documents you generate. The harvesting pattern escalates: screenshots, then full reports, then direct access to the accounts themselves. The cleanest test is to refuse the access and watch what happens next.

Should you ever give a potential buyer access to your analytics accounts?

Not during preliminary discussions. Exported reports carry the same numbers without the live window. Access shows everything continuously, including things you did not think to redact, and it cannot be taken back. If a deal becomes real, verified data rooms exist for that stage.

Why is analytics data valuable to a competitor?

A search console export lists every query your site surfaces for, which pages turn impressions into visits, where your audience lives, and how fast you are growing. For a company in the same market that is a demand map, and public estimation tools are too weak on small independent sites to provide it any other way.