How to Prepare a Data Room When Selling a Company or Raising Money: What Goes In, in What Order, What Goes Wrong

Someone has told you to get the data room ready, and it sounds like a filing job. In fact it is where everything you have said about the company gets checked. Here is what a data room is, what goes in it, the order to build it in and what goes wrong.

IN SHORT

The short answer

A data room is the controlled set of documents that lets a buyer or investor check what you have told them. Build it from a numbered index of about eleven folders, collect what exists, repair what is missing, match every claim in your deck to a file, take personal data out, then open it in stages, with each view logged and each question answered through one channel. Most of the time goes into the gaps the room exposes; the upload is the small part.

What goes wrong is predictable: everything dumped in at once, documents that contradict each other, code nobody signed over, files named scan_0043, and employee records left where a bidder can read them. None of this is rare, and most of it can be found and fixed by you before anyone else sees it.

On timing, assembling the folders is a matter of weeks in our estimate. The preparation behind them is longer. A year is ideal, and four to six months is the minimum, for a fairly small product and a deal of a few million.

We should say where our view comes from. Our part of the room is the technical side: Valeriya Chumachenko, who has more than ten years in technology M&A, leads our technical due diligence reviews, and our developers read the code, the hosting and the data. We have also put our own companies in order, and we label those examples below; nothing here suggests either is for sale. We are engineers and not attorneys, so every legal passage in this article is general information, and your lawyer decides.

WHAT IT IS

What a data room is, and who enters when

The teaser, the deck and the memorandum make the argument. The data room holds the proof. Once it was a real room with filing cabinets and a supervisor at the door; today, as Carta notes, most are virtual. It is a selected copy of your documents for one transaction, opened to named people under an NDA, and closed when the transaction ends. Your own filing system stays where it is.

In a sale, a bidder usually gets there after several steps. Our article on presenting a company to a buyer sets out the usual order: a teaser, an NDA, the memorandum, first offers, and only then management meetings and the room for those selected. Many sellers then open it in two rounds. Intralinks, which sells data rooms, describes the standard pattern: first-round bidders see summaries, finalists get the sensitive files.

In a funding round, the timing is later relative to the deck. Y Combinator's Series A diligence checklist lists what you need ready once you sign a term sheet. The venture firm CRV, in a guide of July 2026, says the pitch materials go out early and the full room opens when an investor moves into formal diligence.

So different people arrive at different moments and read different things. An accountant may never open the code folder, and a technical auditor may never open tax. Only one person on your side has to read all of it.

DRIVE OR ROOM

Virtual room or shared drive

Owners always ask whether a shared drive will do. Sometimes it will. Here is what actually differs. The right-hand column comes largely from the vendors' own descriptions: Carta, Intralinks and Ansarada. All of them sell these tools or something close to them.

The log is the row to check first. Google's own documentation of Drive audit events says most of them are recorded only for files owned by users on supported editions, and it lists some kinds of download that are not logged at all. Before you rely on a drive, test what yours records.

Our view is simple. A seed round with a handful of friendly investors can live on a well-organized drive or a simple sharing tool. A sale with several bidders, or with any reader who competes with you, needs a real room, because per-bidder access and a reliable log are exactly what you are paying for. Either way the host holds your documents on your behalf, so it needs a proper contract: Taylor Wessing pointed out in 2020 that under the GDPR a host acts as a processor, and that setting up a room can itself count as a restricted transfer of personal data. Do not spend a week comparing vendors. The tool will not improve what you put in it.

THE MAP

Eleven folders and what goes in them

No list is universal, and when the buyer's lawyers send their request list, that list wins. But you can start long before anyone sends one, and this is the structure we would start from.

Then come the unglamorous rules. CRV's guide asks for a master index, numbered categories, dated file names and only the final version of each document. We would add a file name that says what a thing is without opening it, such as 05.14_2024-03-12_Supply-agreement_signed.pdf. Where a folder has nothing to hold, write that down and date it, because "no disputes as of this date" is an answer and an empty folder is a question.

THE TECH FOLDERS

What the technical folders must hold

This is the part we know best, and usually the weakest part of a room, since nobody ever asked the technical people to write these things down for an outsider. Our article on technical due diligence before a sale explains what reviewers look for and what each finding does to a deal. Here is what should physically be in the folders.

Three things stay out of these folders. Source code is the first. Black Duck, which sells code audits, notes that targets generally do not share code with potential acquirers, so independent experts read it and report back. The folder describes the code, and access for the reviewer is arranged separately, as in our own reviews: first a confidential call, then access to the systems in scope, then a written report. Secrets are the second: search every technical document for passwords, API keys and configuration files before upload, screenshots included. The third is working attack details. A summary of a security test belongs in the folder, while the full report, with steps to reproduce each finding, goes only to named experts, since it is a map of your weak points.

On ownership, see Most Companies Don't Own Their Website and What You Own vs What You're Renting. What Building the Systems Teaches You About Buying Them asks what a reviewer brings to the room: what can be verified, and what would have to be rebuilt.

From project work, outside any deal. When we finish infrastructure work, the client gets a map of servers, services, domains, access and monthly costs, the deployment commands and server requirements, the rollback procedure, the record of the restore test and an AGENTS.md file describing the structure and the commands. We wrote that list so another team could carry on without us. It is also most of folder 08, and it is cheapest to produce while the system is being built.

From our own company, as an experiment. Offers have been reaching Peretz, and we packaged our business to see how that looks from the seller's chair. The package included all the necessary documentation and, most important, documents with all our developers confirming that the code is ours. That paper appears on no slide, and a buyer's lawyer will ask for it. The term to know is IP assignment, and a lawyer drafts it. It was an experiment, and we are offering nothing to anyone.

From our other company. DeZZign, our architecture and interior design company, periodically receives offers to buy it. We put its code, all its documentation and the company's assets in order and replaced all its SaaS with custom systems, which shortens the list of things an inventory has to mark as rented. It says nothing about any buyer or outcome.

CLAIM TO FILE

Every claim needs an address

The room has to agree with the deck, the memorandum, the model and everything said in meetings. Our article on presenting to a buyer introduced the claim register, a table of each statement you intend to make with its evidence. For the room, add one column: the index number of the file.

The chain ends in the contract because the sentences that mattered become representations and warranties, which is why the last box matters more than the first. In practice, contradictions rarely look like lies. They look like this:

• The deck gives a customer count, and the list in the room includes many who have not paid in a year.
• The deck says "mostly recurring revenue", and the contracts run one year with no renewal clause.
• The deck says "all code is ours", and an agency contract in folder 05 says nothing about rights.
• The deck says "no disputes", and folder 11, or a provision in the accounts, says otherwise.

So do what your readers cannot: have one person read everything against the deck, from the first folder to the last, before anyone outside sees it. It works best with someone who has sat on the buyer's side and did not prepare the documents. When a file changes after the room is open, say so, with a date.

A room should answer your deck line by line, before a buyer asks.

This is also why the pitch deck comes last. It can only say what the room can show, so it goes on as the crown of the preparation. We make pitch decks ourselves, and they are our favourite work, because getting to make one means the product is ready.

THE ORDER

In what order, by whom, and how long

Here is the order we would follow. The steps overlap, but moving them around tends to cost more.

Step 4 is where the calendar goes. A year is ideal, and it gives you time to let clean results accumulate as well as to fix things. Four to six months is the minimum, for a fairly small product and a deal of a few million. For a Series A, CRV suggests starting one to two quarters ahead. Steps 1 to 3 take weeks in our estimate, depending on how much was ever written down.

The data we could find is thin and old, but it points the same way. In a survey IHS Markit commissioned from Mergermarket, 37% named readying the legal, financial and technical paperwork as the greatest logistical challenge of preparing a sale, and 67% said preparation was taking longer than before. That was 30 senior executives in North America in mid-2019, in sponsored research from companies that sell information to dealmakers, so take it as a direction.

A room is no job for an office manager alone. Collecting papers is the easy third. Deciding what a finding means, what to repair and what to disclose takes people who have worked in M&A for years, sometimes licensed, a lawyer who does deals, and analysts who understand someone else's code from top to bottom. It is neither free nor fast. A list like the one above gives an owner a first look and nothing more, and a buyer will not take your own checks as evidence.

Keep assessment and repair apart. Our Technical Due Diligence Session costs $1,500 and a full review starts from $7,500; the Exit & Succession Readiness Session costs $1,500 and its preparation program starts from $5,000; a Digital Ownership & Debt Audit starts from $1,000, and from $3,000 for larger businesses. All of these give an assessment and a direction, priced as of November 2026. The repair that follows has no honest starting price, because we have to see the product first, and the team may be large. There we have a real advantage: a large pool of vetted developers of European and Ukrainian origin at reasonable prices, available as a dedicated team for those months.

The cheapest room is the one a company keeps from early on. At Schoeffel, a pearl house founded in 1921, we hold a percentage of the company and build its processes with this in view: when you build a business the grown-up way you calculate the scenarios of its development, and here the aim is a company worth hundreds of millions and not tens of millions, with everything ready for the owner's exit. That is an aim and work in progress, and no statement of value.

WHO SEES WHAT

Stages, masks and clean teams

A bidder who does not buy has still read what you showed them, and that bidder may be a competitor. So access widens as seriousness grows.

Masking has two layers. The first is business: customers appear as Customer A and Customer B with their share of revenue, and contracts with their prices removed. The second is technical, and it fails more often than people expect. A black rectangle drawn over a PDF can leave the text underneath, which anyone can copy. Word files keep tracked changes and comments, spreadsheets keep hidden sheets, and file properties keep authors' names. A file name can give the game away too: mask the contract, then call it Largest-customer-name.pdf, and you have told the reader anyway. Export to a flattened file, then test it by trying to select the text.

When a competitor is reading, there is a legal reason as well. Parties stay independent until closing, and sharing the wrong things can itself break competition law; that is part of what gun jumping means. The FTC's guidance of March 2018 names current and future prices, strategic plans and costs as sensitive, and recommends third-party consultants and clean teams. It says clean teams should not include anyone responsible for pricing or strategy, outside counsel should vet the members, and what reaches the business should be blinded and aggregated. It cites Insilco, where customer-specific prices were exchanged, and Bosley, where chief executives repeatedly shared plans.

The largest European example we found is Altice. In April 2018 the European Commission fined it €124.5 million for acting on its purchase of PT Portugal before clearance. The core of the case was control, with veto rights and instructions on a marketing campaign, and the Commission also cited detailed commercially sensitive information sought and received outside any confidentiality agreement. In November 2023 the EU's top court confirmed the breaches and cut one of the two fines by about €10 million. Ask a competition lawyer before a competitor opens folder 04.

PERSONAL DATA

Personal data stays out by default

Start from the position that no personal data goes in, and let your lawyer argue each exception. Regulators treat data in a deal as data being shared. The UK regulator's data sharing code (version of May 2021) tells organizations to treat this as part of due diligence: know what data is moving and what it was originally collected for, establish a lawful basis, document the sharing, and consider when to inform the people concerned. Law firms go further on rooms. Taylor Wessing advises uploading only what is strictly necessary, redacting the rest and closing the room soon after completion. Stevens & Bolton, also in 2020, suggests blank model contracts in place of real employee contracts, and warns that a redacted name with the job title left in may still identify someone.

In the US there is no single rule. The FTC staff's position, stated in the Facebook and WhatsApp deal in 2014, is that privacy promises keep their force through an acquisition. Health care has its own text in HIPAA, for a lawyer to read.

In practice, swap what people tend to upload for something safer:

• In place of every employee's contract, a blank template and a list of deviations, with key people's terms late and to few readers.
• In place of payroll with names, pay bands by role, remembering that a one-person role identifies someone.
• In place of a customer list, counts, cohorts and shares, with names at the final stage only.
• In place of a database dump for the technical review, the schema, row counts and an anonymized sample.
• Directors' passport scans only where the law requires them, at the stage it requires them.

We work the same way in engineering. When we upgrade an old system, the work happens on a temporary closed copy, with anonymized data and no real client records. A data room deserves the same habit.

Nobody needs your customers' names to judge your customer concentration.

LOGS AND QUESTIONS

What the logs and the questions tell you

A proper room records who opened what and when. Ansarada describes an activity summary and a full history per person, and Intralinks says every view, download and comment is timestamped and can be exported.

Read the logs as a source of questions. A bidder whose lawyers and accountants have arrived is probably spending real money. One who stops after the summaries has probably lost interest, or gone on holiday. A sudden run on the change-of-control clauses tells you where the next difficult call will come from. An unexpected bulk download, or a person you never approved, is a matter to raise at once. Ansarada sells an AI score for bidder engagement, trained on tens of thousands of deals by its own account; we found no independent test of it. Attention is hard to interpret: DocSend's data, set out in Pitch Deck for Investors, shows that a long view can mean interest or confusion.

The log is also a record. At signing, export it with the index and the answers, because it shows what was available, to whom and from what date. Intralinks describes that use for the closing record.

For questions, a few rules hold up well:

• One channel. No side emails between a bidder's analyst and your developer. Every question goes through the room or one named person.
• Each question gets a number, an owner and a date. Room software has reports on aged questions for a reason.
• Each answer is a statement. Someone approves it, a lawyer if it is sensitive, and the wording stays the same for each bidder at that stage, so the third does not hear something different from the first.
• Answers point to files. If a good answer needs a document, add the document to the room and tell everyone at that stage.
• Technical questions go to the technical lead. If the owner answers everything, the buyer has just seen founder dependency in action.

DISCLOSURE

Why what is in the room matters for the contract

This chapter is general information and no legal advice. A purchase agreement contains warranties, and the seller lists known exceptions in a disclosure schedule. Owners often assume that a document in the room counts as telling the buyer. Whether it does depends on the law and the contract, and the answer can be no.

In US deals, as we understand the practice, the schedule counts and the room does not, unless the contract says otherwise. In February 2025, in In re Dura Medic Holdings, the Delaware Court of Chancery dealt with sellers who argued that they had told the buyer about regulatory notices on a due diligence call. Mayer Brown's summary reports that the court found the sellers had not made the disclosure about the notices at issue, and added that such a disclosure would have changed the representation only if it appeared in the deal documents. The firm reads the opinion as confirming Delaware's pro-sandbagging position, meaning a buyer's prior knowledge does not by itself defeat a breach claim. SRS Acquiom, which sells deal services and publishes data on deals it has seen, shows how rarely contracts change that.

English-law practice works differently. Bird & Bird explains that the parties normally agree in a disclosure letter that the room, or a smaller bundle, counts as disclosed, subject to a standard of fair disclosure. Even then, an important issue should be disclosed clearly and specifically, with references to the files. Hiding something under a wrong heading may not count as disclosure, and deliberate concealment could amount to fraud. CMS found wide differences within Europe, as the chart shows.

Whatever the law, the same habits protect you. Agree with your lawyer early what the room's legal status will be. Put each known issue on the schedule by name, with its file number. Freeze the index, log and answers at signing and keep a copy both sides can identify. And never count on the size of the room as cover. Presenting to a buyer adds the data on undisclosed liabilities and why saying it first works in your favour.

INVESTOR ROOM

What an investor's room needs

An investor buys a share of a future, with the founder in it; a buyer buys what stays when the owner leaves. So the two rooms overlap and still differ.

Y Combinator's checklist, by Aaron Harris and Jason Kwon, covers board and stockholder minutes, the IP list and assignments, all securities records and contracts above $25,000. It says having this ready before signing can take as much as a week off closing, and that closing a Series A can run past a month, much of it spent hunting for documents. CRV's guide says investor counsel usually starts with the cap table, the certificate of incorporation and IP assignments, and asks for two to three years of financials where they exist.

Do not overbuild it early. At seed, as we noted in Pitch Deck for Investors, the advice on Y Combinator's site warns against too much of this. What holds at every stage is that the numbers in the deck, the model and the room must be the same.

Our closest experience here is MEDPRESSO, an international medical education platform. It is expanding and needs investment, so we are working on that with them, the pitch deck included. The material is the company's to show, so we describe none of it.

WHAT GOES WRONG

What goes wrong

• Dumping everything. It feels transparent, but it costs each reader days, multiplies the questions and shows that nobody selected anything. As we saw, it does not necessarily protect you either.
• Documents that contradict each other. IMAP, an M&A adviser, lists inconsistencies between the teaser, the memorandum and the room among the common mistakes.
• Missing signed papers. In the IHS Markit survey, 78% had seen bidders find missing contract agreements, and 67% issues with employee documents such as unsigned agreements (30 executives, 2019). For a technology company, the classic case is the assignment from a contractor who left years ago, and one who hears about a sale when you ask for a signature has leverage.
• Unnamed files and many versions. A folder of scans called final_v2 forces the reader to guess which one is valid, and the guess goes into a report.
• Personal data and secrets left in. They come along by accident: a passport in the corporate folder, salaries in a board pack, an API key in a screenshot.
• Opening too early. You can correct a file later, but you cannot take back a first impression.
• No single owner. When finance, legal and technology each fill their own folders, no one sees the contradictions between them.

A room full of "to be uploaded" has already told its story.

After closing, these documents become the buyer's starting map, as we describe in How to Integrate Two Companies' IT Systems.

QUESTIONS

Frequently asked questions

What is a data room in M&A?

A controlled set of company documents that a buyer or investor reviews during due diligence, opened under an NDA to named people, with access recorded. The teaser and deck make the argument; the data room holds the evidence behind it.

What should be in a data room when selling a company?

Corporate records, finance, tax, customers, contracts, people, IP and code, technology, security, data protection and disputes, under a numbered index. The buyer's request list then shapes the details. Real customer data and passwords stay out, and source code goes only to independent reviewers under separate terms.

Can I use Google Drive as a data room?

For a small seed round, often yes, with care. For a sale with several bidders, a real data room is worth paying for, because per-bidder permissions and a reliable log are hard to get right on a drive. Check what your plan actually records.

When does a buyer get access to the data room?

Usually after an NDA and a first offer, and in stages: summaries first, sensitive files for the finalists. An investor typically sees the deck early and the full room when formal diligence starts, often around the term sheet.

How long does it take to prepare a data room?

Assembling the folders takes weeks, in our estimate. The repairs it reveals take far longer: a year of preparation is ideal, and four to six months is the minimum, for a fairly small product and a deal of a few million. People with long M&A experience are part of that work.

Does putting a document in the data room protect me from a warranty claim?

Not automatically. In US practice the disclosure schedule generally matters, and English-law deals often treat the room as disclosed, subject to fair disclosure. Important issues should be stated specifically in either case. Ask your deal lawyer how your contract treats it.

Sources

• UK Information Commissioner: Data sharing code of practice, version 1.3, May 18, 2021 (copy deposited in Parliament)
• FTC: Avoiding antitrust pitfalls during pre-merger negotiations and due diligence, March 20, 2018
• Mayer Brown on In re Dura Medic Holdings, Harvard Law School Forum on Corporate Governance, April 7, 2025
• Bird & Bird: Disclosure against warranties in UK corporate transactions, 2021
• Y Combinator: Series A diligence checklist, Aaron Harris and Jason Kwon