AS | Ankit Sarawagi|Founder, CFOmatrix·June 2026·11 min read | Updated Jun 2026 |
- A data room is one organised, access-controlled place for every document an investor or acquirer reviews during due diligence (DD).
- A virtual data room (VDR) is the modern, cloud-based version: it adds per-user permissions, watermarking, view-only access and an audit log a shared drive cannot match.
- The standard folder structure is consistent: corporate, financial, tax, legal, IP, HR, contracts and data privacy.
- Access is granted per person and per folder, and tightened in stages as the deal moves from teaser to deep dive.
- A clean, always-on data room can cut due diligence from weeks to days and stops surprises from re-opening price talks.
| 8 folders The core structure: corporate, financial, tax, legal, IP, HR, contracts, data privacy | Days vs weeks How much a clean data room can shorten the diligence phase | Always-on Best practice: maintain it before you need it, not after a term sheet lands |
To keep this concrete we follow one company: Brewly, a D2C coffee brand raising a ₹30 crore Series A from a lead VC, with a US subsidiary for its export business and a UAE entity for the GCC market. We use Brewly to show how the same data room serves investors across three jurisdictions.
What a Data Room Is and Why It Exists
A data room is a single, organised, access-controlled place where a company keeps every document an investor or acquirer needs to review during due diligence (DD). Instead of emailing files one by one, you point the other side to the data room and they verify your business there. In a fundraise, the investor uses it to confirm that the company is what the pitch said it was. In a sale or merger, the acquirer uses it to check what they are buying.
The reason it exists is trust at speed. An investor about to wire crores cannot take your word for the cap table, the revenue, the tax filings or the IP ownership. They need to see the evidence, fast, in one place, without giving you a chance to hide anything. A good data room lets them do that, and lets you control exactly what they see and when.
The term comes from the old practice of a literal locked room where bidders reviewed paper files. Today the data room is almost always digital, which is why you will hear the phrase virtual data room (VDR) used interchangeably with “data room”. The job is the same; only the format changed.
A data room is not just a fundraising tool. The same repository is used in mergers and acquisitions (M&A), bank or venture-debt lending, statutory audits, and even some large customer or partnership reviews. Build it once, keep it current, and it serves all of these.
Physical vs Virtual Data Rooms: What Changed
A physical data room is a secured physical location holding paper documents, where reviewers visit in person, often under supervision and with no copying allowed. A virtual data room (VDR) is the online equivalent: a secure cloud platform where the same documents live as files, accessed by invited users from anywhere. For startup fundraising and most M&A today, the VDR has fully replaced the physical room.
Physical rooms still appear in a few high-stakes deals, large public-company mergers, regulated assets, or matters where one side insists on no electronic copies. For an Indian startup raising a Series A, you will never need one. The comparison below shows why virtual won.
| Physical Data Room | Virtual Data Room (VDR) | |
|---|---|---|
| Access | In person, one visitor at a time | Anywhere, many reviewers at once |
| Speed | Slow; travel and scheduling | Immediate; review in parallel |
| Control | Physical supervision, no copies | Permissions, watermark, view-only, expiry |
| Audit trail | A sign-in sheet, at best | Logs who opened each file, when |
| Used today for | Rare, very large or regulated deals | Almost all startup and M&A diligence |
Data room = the what; VDR = the where. “Data room” is the set of documents and the discipline; “virtual data room” is the secure online tool you use to host it. In practice people use both words for the same thing.
What Goes In: The Standard Folder Structure
A fundraising or M&A data room is organised into a consistent set of top-level folders. Investors and their advisers expect this structure, so using it makes you look prepared from the first click. The eight core folders below cover almost every request you will get. For a full, downloadable list per jurisdiction, see our master due diligence checklist with free India, US and UAE templates.
| Folder | What goes in it |
|---|---|
| 1. Corporate | Certificate of incorporation, MOA and AOA, board and shareholder resolutions, cap table, share certificates, prior funding documents (SHA, SSA) |
| 2. Financial | Audited financial statements, monthly MIS, the financial model, bank statements, debt and loan agreements, revenue and cohort data |
| 3. Tax | In India: GST returns, TDS filings, income tax returns and assessments. In the US: federal and state returns. In the UAE: corporate tax and VAT registrations and returns |
| 4. Legal | Litigation and notices, regulatory licences and approvals, FEMA and FDI filings (India), corporate structure chart, subsidiary documents |
| 5. Intellectual property (IP) | Trademarks, patents, copyrights, domain names, IP assignment agreements from founders and contractors, open-source usage |
| 6. HR | Org chart, key employment agreements, the ESOP plan and grants, PF and ESI compliance (India), offer letters, consultant agreements |
| 7. Contracts | Top customer and supplier contracts, partnership and reseller agreements, leases, any change-of-control or exclusivity clauses |
| 8. Data privacy & security | Privacy policy, data processing agreements, India DPDP Act readiness, GDPR position if you serve the EU, security certifications and breach history |
Because Brewly has India, US and UAE entities, its tax and legal folders carry a sub-folder per jurisdiction. The lead VC could see all three; a US-only co-investor only needed the US sub-folders. The structure stays identical across geographies, which is exactly why investors trust a well-built room: they always know where to look.
Who Gets Access? Permissions and Security
In a data room, access is granted per person and per folder, and tightened or loosened as the deal progresses. Nobody gets everything on day one. The founder, CFO or company secretary acts as the administrator and decides who sees what. A virtual data room enforces this with controls a normal shared drive cannot offer.
How access typically opens up in stages
- Stage 1, teaser: high-level financials, a one-page corporate summary and the pitch materials. Shared with several interested investors.
- Stage 2, term sheet signed: the lead investor and their advisers (lawyers, accountants, tax advisers) get the deeper financial, tax and legal folders.
- Stage 3, confirmatory diligence: the most sensitive items, key contracts, IP assignments, employee data, open under view-only and often with extra non-disclosure terms.
The security controls that matter
- Granular permissions: view, download, print or no-access set per user and per folder.
- View-only and watermarking: sensitive files open in the browser only, stamped with the viewer’s email so leaks are traceable.
- Audit log: a record of who opened which document and when, useful for spotting which investors are serious.
- Expiry and revocation: access that ends on a date, or can be cut instantly if a deal dies.
- Two-factor authentication and encryption: standard on any real VDR.
Do not open your full data room, employee salaries, customer pricing, source code, to every investor who shows mild interest. Competitors sometimes raise as “investors” to see inside. Give early-stage access only to the teaser folder, and reserve the sensitive folders for parties who have signed a term sheet and a confidentiality agreement.
Common Virtual Data Room (VDR) Tools
A virtual data room tool is software built specifically to host confidential documents with the permissions, watermarking and audit controls described above. The right choice depends on the size and sensitivity of your raise. Here is a practical view of the main categories.
| Category | Examples | Best for |
|---|---|---|
| Dedicated VDR | iDeals, Ansarada, Datasite, Intralinks, Firmex | Larger rounds and M&A; strongest controls and audit logs |
| Startup-friendly | DocSend, Notion (locked), Carta data room, Digify | Seed to Series A; quick to set up, link-level tracking |
| Secured shared drive | Google Drive or Dropbox with strict permissions | Early seed only; acceptable when low sensitivity and trusted parties |
Brewly used a startup-friendly VDR for its Series A: fast to set up, per-investor links, and an audit log that showed which funds actually opened the financial model. For a later, larger round or an acquisition, it would move up to a dedicated VDR.
Tool names change, the controls do not. Whatever you pick, confirm it offers per-user permissions, view-only and watermarking, document expiry, and a full audit log. If a tool cannot do those, it is a shared folder, not a data room.
Data Room Do and Do-Not
The difference between a data room that impresses and one that worries investors comes down to a handful of habits. Here is the practical list we give every founder before a raise.
Do
- Build it before you need it. Keep a standing, current data room from incorporation so a raise is a review, not a scramble.
- Use the standard folder structure so investors find things instantly and trust the rest.
- Name files clearly and date them (for example “Brewly_Audited_FY25.pdf”), and remove old drafts.
- Add a short index at the top folder that lists what is and is not included, with reasons.
- Match the data room to the disclosure schedule in your share purchase agreement, so what you warrant lines up with what you show.
Do not
- Do not dump everything in one folder. A flat pile of 400 files reads as disorganised and hides problems.
- Do not hide bad news. A known issue disclosed cleanly is fine; the same issue found by a diligence lawyer kills trust and re-opens price.
- Do not give blanket download access to sensitive items early. Use view-only and watermarking.
- Do not leave stale or contradictory versions of the model, cap table or contracts in the room.
- Do not forget the audit log. Check it to see who is genuinely engaged and who has gone quiet.
Think of the time math. A founder who scrambles after the term sheet typically loses two to four weeks gathering old resolutions, share certificates and contracts. At a burn of, say, ₹40 lakh a month, a three-week delay is roughly ₹30 lakh of runway spent on avoidable admin, before counting the risk that the deal cools off.
How a Clean Data Room Speeds Up a Raise
A clean, complete data room shortens due diligence because it lets investors verify your story without endless back-and-forth. Every question they would otherwise email is already answered in a folder, so diligence becomes a review, not an investigation. In our experience that can compress the diligence phase from weeks to days.
Beyond raw speed, a strong data room does three things that protect your deal:
- It signals quality. A well-run room tells the investor the rest of the company is well run too. First impressions in diligence shape final terms.
- It prevents surprises. The most expensive moment in a raise is a problem found late, because it re-opens valuation and terms. Disclosing cleanly up front removes that lever.
- It keeps momentum. Deals close on energy. Every week of delay is a week for the market to move, the lead to get distracted, or a competing deal to appear.
For Brewly, the standing data room meant the lead VC finished confirmatory diligence in nine days instead of the four-to-six weeks the founders feared. The terms held, and the round closed before the quarter ended.
“A data room does not just survive diligence; it sets the tone for it. The founders who win the best terms are usually the ones who walk in already organised.”
Ankit Sarawagi, CFOmatrixFrequently Asked Questions
What is a data room?
A data room is a single, organised, access-controlled place where a startup keeps all the documents an investor or acquirer needs to review during due diligence: corporate records, financials, tax filings, legal contracts, intellectual property, HR and data privacy documents. Today this is almost always a virtual data room (VDR), a secure online folder system rather than a physical room of paper files.
What is a virtual data room (VDR)?
A virtual data room (VDR) is a secure cloud-based document repository used to share confidential files during fundraising, mergers and acquisitions (M&A), or audits. Unlike a normal shared drive, a VDR adds per-user permissions, watermarking, view-only access, expiry dates, and an audit log that records exactly who opened which document and when.
What should be in a fundraising data room?
A fundraising data room is usually organised into folders for corporate and company secretarial records, financials and the model, tax filings (GST, TDS, income tax in India), legal contracts, intellectual property, HR and ESOP records, key customer and supplier contracts, and data privacy and security policies. The exact depth depends on stage, but the structure stays the same from seed to growth. See our master due diligence checklist for the full list.
Who gets access to a data room?
Access is granted per person and per folder. Early in a raise, investors typically see a teaser-level data room with high-level financials and corporate basics. As the deal progresses, the lead investor and their advisers (lawyers, accountants, tax advisers) get access to deeper folders. The founder, CFO or company secretary controls who sees what, and a VDR logs every view.
Is a data room the same as a shared Google Drive folder?
No. A shared drive can hold the same documents, but it lacks the controls that matter in due diligence: granular per-user permissions, view-only or no-download settings, watermarking, document expiry, and a full audit trail. For early seed rounds a well-structured Drive can work, but for priced rounds, M&A or anything sensitive, a purpose-built virtual data room is safer.
How does a clean data room speed up a fundraise?
A clean, complete data room lets investors verify your story without endless back-and-forth, which shortens due diligence from weeks to days. It signals that the company is well run, reduces the number of follow-up questions, prevents surprises that re-open price negotiations, and keeps momentum so the deal closes before conditions change.
When should a startup build its data room?
Build and maintain the data room before you need it, ideally as an always-on habit from incorporation. Founders who assemble it only after a term sheet lands lose two to four weeks scrambling for old board resolutions, share certificates and contracts. A standing data room that you keep current turns due diligence into a review rather than a fire drill.
Tool names and cost ranges are general market guidance as of 2026 and vary by stage, scope and jurisdiction. This is general information, not financial or legal advice. Indian, US and UAE deals involve specific regulatory requirements; speak to a qualified adviser about your specific situation.
- Due Diligence for Startups: The Complete Founder’s GuideDue Diligence · CFOmatrix Series
- The Due Diligence Checklist: Free India, US & UAE TemplatesDue Diligence · CFOmatrix Series
- SHA & SSA Explained: The Guide for Indian FoundersDue Diligence · CFOmatrix Series
AS | Founder, CFOmatrix | Finance Strategy & Equity Compliance CFOmatrix is a knowledge platform focused on how finance actually works inside growing companies. Every insight is shaped by real operating experience across startups and growth-stage companies, including cross-border setups. |