A buyer or lead investor says yes in principle, then asks for your data room. Many founders treat that as an afternoon upload.

In reality, the data room is where every claim you made gets tested. One missing intellectual property (IP) assignment, a skipped securities filing, or an ownership ledger that doesn’t match the signed paperwork can delay closing, hand the buyer a reason to negotiate down the purchase price, or end the deal.

I’m a startup lawyer and former software founder who reviews data rooms before buyers do. Here is my due diligence data room checklist, folder by folder.

What Is a Due Diligence Data Room?

Start with what the reviewer is actually doing in there. A due diligence data room is a secure online repository, usually a virtual data room (VDR), that holds the documents a buyer or investor needs to verify your company before they commit money.

The buyer’s lawyers, accountants, and deal team read it against their own request list. Every document you upload becomes evidence for the representations and warranties (the written promises about your business) you will make in the final agreement.

A fundraising data room and an acquisition data room share the same skeleton, but the depth is very different.

The checklist below is built for a sale, which is the deepest version. For a seed or Series A round, start with the corporate, capitalization, fundraising, financial, IP, and employee folders, then add the rest as the investor asks.

When Should You Open the Data Room?

The best time to build a data room is before anyone asks for one. Once you sign a term sheet or an LOI, I find the deal is roughly 90% decided, and an LOI usually includes an exclusivity period that stops you from talking to other buyers.

During exclusivity, every week you spend hunting for a signed contract is a week the buyer controls. I keep exclusivity in a term sheet to about 30 days where I can, and a ready data room is what makes that short window workable.

There is a second reason to build early. As I tell founders, “If you bring a problem up yourself, you can usually manage it.” A gap you find and disclose in month one is a negotiating point; a gap the buyer finds in week three becomes a reason to renegotiate.

Here is the timeline I give founders:

1. 1Six months or more before a raise or sale: build the core folders and start fixing the gaps you find.
2. 2Before you sign the LOI or term sheet: finish the index and have your lawyer review the room as a buyer’s lawyer would.
3. 3After the NDA and LOI are signed: open the room in stages, starting with the high-level folders.
4. 4Through closing: answer the buyer’s question-and-answer log, upload updates, and archive the final version at signing.

How to Set Up the Data Room Before You Upload Anything

A data room that is easy to navigate signals a company that is run well. Set up the structure first, then fill it.

Assign One Owner on Your Side

Pick one person, usually a founder, chief financial officer, or chief operating officer, who owns the room, controls permissions, and routes every buyer question. Your lawyer reviews legal folders before they open, and your accountant reviews financial and tax folders.

Number Every Folder and Write an Index

Number top-level folders and subfolders (1.1, 1.2, 2.1) so every document has a reference both sides can cite. Add a short read-me at the top that explains the structure, names the contact for questions, and shows when each folder was last updated.

Pick One File Naming Rule

Use one convention everywhere, such as date, counterparty, and document type (“2024-03-15 Acme MSA Signed”). A buyer’s lawyer reviewing hundreds of files will notice the difference between a clean index and a folder where three versions of the same contract are all labeled final.

Upload Final Signed Versions Only

Upload executed copies with every page, every exhibit, and every amendment. Drafts and unsigned versions create questions about which terms actually apply, so leave them out unless a draft is the only record and you label it clearly.

Open Access in Stages

Give each bidder or investor access by folder and by group, with view-only rights for the most sensitive files. Turn on watermarking, download controls, and the access log so you can see what each reviewer opened.

What Goes in Each Folder of Your Data Room?

Each table lists the documents a reviewer expects and what that reviewer is checking for. Where a folder does not apply to your company, keep the folder and add a one-line note saying so, which answers the question before it is asked.

1Corporate Formation and Governance

These documents show the company was properly formed, remains in good standing, and approved what it did. If the company was converted from a limited liability company (LLC), include the conversion documents too.

2Capitalization and Equity

The cap table is the ledger of who owns what, and it is usually the first thing a reviewer opens.

3Fundraising and Securities Filings

Your fundraising folder shows how you raised money and whether you followed the securities rules when you did.

4Financial Statements and Metrics

The financial folder is where the numbers in your pitch deck meet your books.

5Tax

Tax exposure tends to follow the company into a stock sale, so buyers read this folder closely.

6Intellectual Property

For a software-as-a-service (SaaS) company, the code is usually most of what the buyer is paying for, so this folder has to prove the company owns it. Buyers price ownership gaps directly, and I cover how in my guide to managing IP risk in acquisitions.

7Technology, Product, and Security

Technical reviewers use this folder to test whether the product can be maintained and secured after closing.

8Customer Contracts

Buyers are paying for revenue that continues after closing, so they read your customer contracts for anything that could stop it. Whether the deal is a stock purchase or asset purchase changes which contracts need consent, because in an asset sale each contract has to be assigned to the buyer.

9Vendor and Partner Agreements

Vendor and partner contracts show what the company depends on and what it owes others.

10Debt, Liens, and Real Property

Debt has to be paid off or consented to at closing, and leases come with their own consent rules.

11Employees and Contractors

People documents tell a buyer who runs the business and what it will cost to keep them, which matters if you plan on keeping key employees after closing.

12Privacy and Data Protection

Privacy rules depend on where your users and employees are, so this folder shows a buyer which laws apply and how you comply.

13Litigation, Insurance, and Regulatory

The litigation folder answers one question for the buyer: what claims could follow the business.

14Deal Documents

The last folder tracks the transaction itself and is often visible to your side only.

Which Gaps Do Buyers and Investors Flag First?

Most of what a buyer’s lawyer flags falls into a short list of legal gaps, and each one has a fix if you find it early. How I solve this: I review the room the way the buyer’s lawyer will, list every gap with its fix, and close as many as possible before the LOI is signed.

1. 1Contractor code with no written IP assignment. Under the Copyright Act’s definition of a work made for hire, an employee’s work within the scope of employment is a work made for hire, but a contractor’s work qualifies only in a short list of categories and only with a signed written agreement. Custom software generally does not fit those categories, so the fix is to go back and have every contractor and employee sign an IP assignment to the company now.
2. 2A missed 83(b) election. The Internal Revenue Code requires the 83(b) election to be made within 30 days of the stock transfer, and there is no late filing. If a founder missed it, the fix is to disclose it and work with a tax advisor on the consequences, because the founder may be taxed on the value of the shares as they vest.
3. 3A late or missing Form D. The SEC requires Form D within 15 days after the first sale, and the SEC dates that sale from the moment the first investor becomes irrevocably bound by contract to invest. If a filing was missed, have securities counsel file it and assess any consequences before the buyer asks.
4. 4Delaware franchise tax behind schedule. Delaware corporations file an annual report and pay franchise tax on or before March 1, and Delaware’s Division of Corporations charges a $200 penalty plus 1.5% interest per month on the tax and penalty when that is missed. The fix is to file, pay, and order a fresh good standing certificate before the room opens.
5. 5Contracts that cannot be assigned without consent. An anti-assignment clause can stop a contract from being assigned to the buyer, and a change-of-control clause can let the customer terminate on a sale, which makes the contract worth less to a buyer. Getting the customer’s consent to assign the contract remedies it, so build the consent list early.
6. 6A cap table that doesn’t tie to the paperwork. “Every share on your cap table needs to match a signed document,” as I tell founders. The fix is a reconciliation: match each line to a signed agreement and board approval, and document anything missing.
7. 7Unapproved grants or handshake equity. Equity promised in an email or a conversation, or options granted without board approval, will show up in the buyer’s questions. Work with counsel to approve or document each one properly, or resolve it in writing with the person it was promised to.
8. 8Open source licenses nobody tracked. Some open source licenses can require you to release your own source code if you distribute software built on them. Run a scan, document each license, and replace or comply with any problem component before the buyer runs its own scan.

What Should You Hold Back or Redact?

A complete data room still has limits on what goes in and when. The question is who sees what, at which stage, and with which safeguards.

If the buyer is a competitor, the stakes go up. The Federal Trade Commission (FTC) has warned that sharing competitively sensitive information such as pricing, costs, customer-specific data, and strategic plans before closing can create antitrust exposure, and that harm can occur even if the deal never closes.

The FTC’s suggested safeguards fit a data room well. Use clean teams that exclude anyone responsible for pricing or strategy, aggregate data and mask customer names, block downloads of confidential material, and share less at early stages when more bidders are looking.

Personal data needs its own care. Depending on where your users and employees are, privacy laws such as the California Consumer Privacy Act (CCPA) and the EU’s GDPR can govern how personal information is shared, so redact or aggregate it and confirm with counsel which laws apply.

Before anyone gets access, they sign an NDA. Read it for how long confidentiality lasts, whether the buyer may contact your employees or customers, and what happens to your documents if the deal falls apart.

How Does the Data Room Protect You After Closing?

The data room does its most important work after the purchase agreement is signed. In the agreement, you make representations and warranties about the business, and the disclosure schedules list every exception to them.

I tell founders to treat the disclosure schedules as their insurance policy. If an issue is disclosed, the buyer generally cannot later claim a breach of the representation it was disclosed against. So if in doubt, disclose everything, and describe each exception with enough detail to identify it. Don’t try to hide any bad news from the buyer; put everything in the data room and make full disclosure. If you don’t, it will come back to bite you in the a** once the buyer learns about it and starts making indemnification claims against your sale proceeds.

The data room is the evidence behind those schedules. When a schedule says an item was disclosed, a dated copy of the room shows where the buyer could find it and when it went up.

Two habits keep the evidence clean:

• ●Ask your lawyer how the purchase agreement treats documents “made available” in the data room, including any cutoff date before signing.
• ●Archive a complete, dated copy of the final data room at signing, held by both sides, so there is a record of exactly what the buyer saw.

Coordinating this through closing is part of the transaction support I offer sellers, alongside negotiating the purchase agreement itself.

Frequently Asked Questions

Founders usually raise these once the folders start filling up.

Start Your Data Room Before the Term Sheet or LOI

A due diligence data room is where a buyer or investor decides whether your company is what you said it is. Build it early, number it, fix the legal gaps before anyone else finds them, and stage what you share.

If you are six to twelve months from a raise or a sale, now is the time to start the index.