Buyer's Check · pre-acquisition technical review

Conductor: what a buyer should know before wiring $1,250,000

Conductor is a real, four-year-old API business with clean infrastructure and fresh verified revenue. The two questions that decide the price are not on the website: how much of the $38.6k MRR depends on customers running QuickBooks Desktop editions Intuit no longer sells, and what the $168 average subscription actually buys.

Verdict

Revenueyellow49 months of Stripe-verified history and no pre-sale spike, but ARPU is 3.4x the only public price, so most MRR sits outside the listed plan.
TechgreenSite loads in 0.77 s from an EU server, mobile layout clean at 360 and 414 px, subscription model, no console errors.
SecurityyellowCSP, X-Frame-Options and Referrer-Policy are absent on the public site. Low impact for a marketing page, relevant if the dashboard shares the origin.
OwneryellowTeam size and code ownership are not visible from outside. The product is an API wrapper around a vendor platform that Intuit is winding down, see F-01.
Price vs. marketAsking $1,250,000 is 2.7x the last 12 months of verified revenue, 1.5x the TrustMRR median of 1.8x. Above median, but a 95 percent margin API business with four years of history usually trades above median.

84 checks run · 69 passed · 6 warnings · 0 failed · 9 could not be verified (listed below)

Listing facts

MRR
$38,570
Revenue, last 30 days
$36,434
Revenue, all time
$425,529
Active subscriptions
229
Asking price
$1,250,000
Stated multiple
2.90×
Computed multiple vs. 1.8× median
2.70× (1.50× the median)
Founded
2022-07-31
Payment provider
Stripe (API key)
Revenue last synced
10.3h ago (2026-09-04)
Domain Rating
23

Findings

F-01 Platform risk: Intuit is sunsetting QuickBooks Desktop high

What. Conductor sells an API for QuickBooks Desktop and Enterprise. Intuit stopped selling new QuickBooks Desktop Pro Plus, Premier Plus and Mac Plus subscriptions to new US customers on September 30, 2024. QuickBooks Desktop 2024 is the last version; its support ends September 30, 2027. QuickBooks Desktop Enterprise is not being discontinued and is still sold. Reproduce. Read the Intuit help article "US QuickBooks Desktop sold until July 2024 / new subscriptions" and the Intuit "QuickBooks Desktop to stop selling to new U.S. subscribers" notice. Both are public. Evidence. Intuit support pages, checked September 5, 2026. The Conductor homepage headline reads "The best QuickBooks Desktop & Enterprise API on the planet". Meaning for the buyer. The addressable market for the non-Enterprise half of the product shrinks every year and has a hard support cliff in 2027. If most of the 229 subscriptions are Enterprise customers, the risk is contained. If they are Pro or Premier shops, churn is structural, not fixable by a new owner. This is the first question to settle with the seller, before price.

F-02 Average subscription is $168 while the only public price is $49 medium

What. MRR $38,570 across 229 active subscriptions gives an average of $168.43 per subscription per month. The pricing page exposes a single self-serve tier at $49. Roughly 70 percent of MRR is therefore explained by something not on the price list: usage-based billing, enterprise contracts, or a few large accounts. Reproduce. Open the public TrustMRR card for conductor (MRR and active subscriptions are read from Stripe). Divide. Open conductor.is/#pricing and note the listed price. Evidence. TrustMRR markdown card, synced 2026-09-04 20:30 UTC: MRR 38,570, active subscriptions 229. Pricing section on conductor.is: one price, $49. Meaning for the buyer. Not a defect. It is a concentration question. If five accounts carry $25k of MRR, the business is five relationships, and each of them may be tied to the current founder. Ask for the top-5 share before anything else.

F-03 Security headers missing on the public site low

What. The response for GET https://conductor.is/ carries no Content-Security-Policy, no X-Frame-Options (and no frame-ancestors directive), and no Referrer-Policy. HSTS and X-Content-Type-Options were not flagged. Reproduce. curl -sI https://conductor.is/ and look for the three headers. Evidence. Response headers captured September 5, 2026, see the Method section. Meaning for the buyer. On a marketing site this is cosmetic. It becomes real if the customer dashboard is served from the same origin, because then the site can be framed and referrers leak to third parties. One hour of work for whoever hosts it, but it tells you nobody has run a security baseline on the public surface.

Red flags

Ask the seller

  1. Read-only Stripe access for 30 minutes on a call: monthly MRR for 24 months, churn by month, refunds. closed by: live Stripe dashboard, not a spreadsheet.
  2. Share of MRR from customers on QuickBooks Desktop Enterprise versus Pro, Premier or Mac, and how many customers churned in the last 12 months citing migration off Desktop. closed by: Stripe customer export joined with the product's own connection records.
  3. Top 5 customers as a percentage of MRR, and whether any is on a custom contract with a termination clause. closed by: Stripe export plus the contracts.
  4. What the $168 average subscription consists of: usage tiers, seats, enterprise plans. Show the price grid that is not on the website. closed by: internal pricing sheet and three anonymized invoices.
  5. Dependency on Intuit: which Intuit developer program or SDK the product relies on (Web Connector, QBXML, QBFC), the terms, and whether Intuit can revoke or change access. closed by: the developer agreement and the connector code path.
  6. Code and process: git log --shortstat for the first commit, number of authors, commits in the last 90 days; tests and CI; deployment procedure. closed by: screen share of the repository.
  7. Twelve months of invoices for hosting, monitoring and any third-party APIs. closed by: the invoices.
  8. Who writes the code today, and what support period after transfer is included. closed by: written commitment in the term sheet.
  9. What is included: domain, GitHub organization, Stripe account, docs site, support inbox, trademarks. closed by: asset list in the term sheet.
  10. Reason for selling now, in one paragraph. closed by: nothing, but compare it with the churn curve from question 1.

Checked and clean

What was tested and came back clean, so the scope of the review is visible too.

Monthly recurring revenue (MRR)$38,570 ok
Revenue, last 30 days$36,434 ok
Revenue, all time$425,529 ok
Active subscriptions229 ok
Revenue verification sourceStripe (API key) ok
Revenue last synced10.3h ago (2026-09-04) ok
Revenue consistency (30-day vs. MRR)0.94× (30-day revenue / MRR) ok
Company age49.2 months ok
Average MRR growth pace$784/month average since founding ok
Asking multiple vs. 1.8× market median2.70× computed, 2.90× stated on the card, 1.50× the 1.8× market median ok
Pricing modelSubscription ok
Console errors, homepage0 ok
Failed network requests, homepage0 ok
Console errors, pricing page0 ok
Failed network requests, pricing page0 ok
Mobile layout, 360px viewport360px document / 360px viewport ok
Mobile layout, 414px viewport414px document / 414px viewport ok
Pricing page reachablehttps://conductor.is/#pricing ok
Terms of service pagehttps://conductor.is/terms ok
Privacy policy pagehttps://conductor.is/privacy ok
Contact channelmailto:support@conductor.is?subject=Conductor%20Support ok
Signup / trial CTA‘Sign up >’ → https://dashboard.conductor.is/sign-up ok
HTTP to HTTPS redirecthttps://conductor.is/ ok
www/apex canonical hostcanonical host: apex (apex → 200, www → 308) ok
Broken internal links9 checked, 0 broken ok
HSTS headermax-age=31536000 ok
X-Content-Type-Options headernosniff ok
CORS wildcard on homepagenot set ok
TLS certificateLet's Encrypt, expires in 34d (Oct 9 14:02:08 2026 GMT) ok
Exposed .env filenot exposed ok
Exposed .git/HEADnot exposed ok
Exposed .git/confignot exposed ok
Exposed .DS_Storenot exposed ok
Exposed backup.zipnot exposed ok
Exposed dump.sqlnot exposed ok
Exposed /server-statusnot exposed ok
Exposed phpinfo.phpnot exposed ok
security.txt (disclosure policy)not found ok
robots.txt reachablereachable ok
sitemap.xml reachablereachable ok
Exposed /swaggernot exposed ok
Exposed /openapi.jsonnot exposed ok
Exposed /api/docsnot exposed ok
Exposed /graphql endpointnot exposed ok
Exposed /adminnot exposed ok
Exposed /debugnot exposed ok
Exposed /_next/ internalsnot exposed ok
Exposed /storage/ directorynot exposed ok
Exposed /uploads/ directorynot exposed ok
Public API keys in JS bundle0 ok
Known CVEs in detected libraries1 version signature(s) detected (Framer 6ae8a13); not matched to a CVE database entry ok
DNS AAAA recordnone (IPv4-only) ok
DNS nameserversns1.vercel-dns.com, ns2.vercel-dns.com ok
CNAME for wwwsites.framer.app ok
Hosting / DNS providerVercel, Framer ok
SPF recordv=spf1 include:_spf.google.com -all ok
DMARC policypolicy=reject ok
DKIM selectorno common selector responded (12 checked); inconclusive, not proof of absence ok
Third-party hosts loaded9 host(s) loaded, 2 identified by name ok
Tech stack (as listed)Next.js, Tailwind CSS, React, TypeScript / Node.js, Prisma, Redis, Express, Stripe ok
Exotic / unusual stack flagcommon stack ok
Domain Rating (SEO backlink strength)23 ok
Founder X (Twitter) followers1,017 followers ok
Comparable listings (same category)5 comparable listing(s), MRR $39,000-$236,000 ok
robots.txt content0 disallow rule(s), sitemap listed: yes ok
URLs in sitemap.xml29 URLs ok
Blog / changelog activitylast dated post: 2026-09-01 ok
Founder personal brand reach1,017 X followers ok
Done-for-you / concierge service markersnone found ok

Could not be verified

Read-only, no login, no purchase attempted: some checks are structurally inconclusive from the outside. Listed honestly instead of silently dropped.

Cross-check vs. public API listingnot present in the public bestDeals/recentlyListed lists (top 25 each) not verified
Secrets in client-side JS0 found not verified
Public cloud storage bucketsno cloud storage buckets referenced on the homepage not verified
DNS A recordnone not verified
Domain registration expirynot available not verified
CDN / WAFno recognizable CDN/WAF headers not verified
Marketing channels listednot listed on the card not verified
Team size (as listed)not listed not verified
Solo foundernot available not verified

Method

This review is limited to what is observable from outside the product: the public marketing site, DNS and TLS records, HTTP response headers, and the listing card published on TrustMRR. No code, admin panel, database or paid API was accessed at any point, and no account was created or signed into.

Every network check in this report is a GET request; nothing was submitted, purchased or configured. Revenue figures come from the provider connection TrustMRR displays on the listing (Stripe (API key)), not from a separate audit of the seller's account. This scan ran on September 5, 2026.

Order a Buyer's Check

For a listing you are considering: independent technical review, $199, delivered in 48 hours.

Order a Buyer's Check →