Signing day feels like the end. For the data room, it is the start of its most important job.
Up to now the room has been a workspace. From the moment the purchase agreement is signed, it becomes a record: the definitive answer to “what did the buyer know, and when?” Most warranty disputes turn on exactly that question, and the seller’s main defence is often a disclosure that was made fairly in the room. If you cannot produce the room as it stood at signing, that defence gets much harder.
So the closing sequence matters more than people think. Here it is in order, then the detail.
Freeze the disclosure set at signing
Stop all uploads and edits the moment the agreement is signed. Record the exact date and time, and switch contributors to view-only. Anything added later is not part of the disclosure.
Keep the room read-only until completion
Between signing and completion, both legal teams may still need to check documents. Leave the buyer's group open in view-only mode and disable every other outside group.
Export the full archive
Export every document in index order, the full Q&A log with timestamps, and the complete audit trail of views, downloads and permission changes. Use the provider's archive export, usually to encrypted media or a secure download.
Check the export before anything else
Open the archive on a different machine. Confirm the index, spot-check twenty files across folders, open the audit report and the Q&A log, and note the file count against the live room.
Hand the buyer its agreed copy
Give the buyer the disclosed set as at signing, in the format the purchase agreement specifies. Record what was handed over and how.
Collect bidder certificates
Write to each losing bidder asking for confirmation that they have returned or destroyed confidential information as their NDA requires. File the replies with the archive.
Close the room and confirm deletion
Only after the export is checked, ask the provider to close the room and confirm in writing that hosted data has been deleted, and when.
What should a data room archive contain?
Files alone are not an archive. A complete one has five parts, and each answers a different question someone may ask years later.
| Archive component | What it proves | Typical format | Commonly missed? |
|---|---|---|---|
| Documents in index order | What was available to review | PDF and native files in numbered folders | Rarely |
| Index as at signing | The structure the disclosure letter refers to | PDF or spreadsheet with index numbers | Sometimes |
| Q&A log | What was asked, what was answered, by whom, when | PDF or spreadsheet export | Often |
| Audit trail | Who viewed or downloaded which file, and when | Spreadsheet or report export | Often |
| Permission history | Which groups could see which folders, over time | Report export, where the platform offers it | Very often |
The audit trail and permission history are what turn “we uploaded it” into “your team opened it on 14 March and downloaded it twice”. If your platform offers a permission history report, include it. If it does not, export the group-to-folder matrix at signing as a screenshot or report and keep it with the archive.
Versions matter too. If a document was replaced during the process, the archive should show both versions and the date of the swap. A disclosure made in version one and quietly removed in version two can matter a great deal.
Which archive format should you choose?
Providers offer a mix of options. They are not mutually exclusive, and on a larger deal you will usually want two.
| Option | Survives the provider contract | Searchable | Includes audit trail | Who controls access | Best for |
|---|---|---|---|---|---|
| Encrypted USB or drive from the provider | Yes | Usually, with a bundled viewer | Usually | Whoever holds the drive and key | Seller’s long-term copy |
| Secure download to your own storage | Yes | Yes | If exported separately | Your IT team | Seller’s working copy |
| Hosted read-only archive with the provider | Only while you pay | Yes | Yes, live | Provider, under contract | First year after completion |
| Copy for the buyer | Yes, on their side | Depends on format | Usually not | Buyer | Buyer’s records |
Two practical points. First, ask how the provider’s offline archive opens: some use a bundled viewer that needs a particular operating system. Test it before the room is deleted. Second, store the encryption key separately from the drive, and record where both are.
Who keeps what after the deal closes?
Four parties hold or held copies of the room’s contents. After closing, each should end up in a different place.
Where a closed data room's contents should end up
The seller keeps the full archive: every document, every version, all bidder groups, the complete Q&A log and the audit trail. On a share sale, the seller is often an individual or a fund that is about to scatter, so name a person responsible for the archive in the closing memo.
The buyer keeps the disclosed set as at signing and its own Q&A. It does not need the other bidders’ questions, activity or groups, and the seller usually should not hand those over. On an asset sale, the buyer may also take ownership of the underlying business records, which is a separate transfer handled under the purchase agreement.
Losing bidders keep nothing. Their NDA usually obliges them to return or destroy confidential information on request or when they leave the process. Ask for written confirmation; many NDAs make that a right, not a courtesy.
The provider keeps nothing once you have confirmed the export. Ask for written confirmation of deletion, including backups, and the date. If you want a standard to point to, the US NIST guidelines for media sanitization are the common reference for what proper deletion means.
How long should you keep the archive?
As long as anyone could bring a claim that depends on it, plus a margin.
In practice, look at three clocks and keep the archive until the longest one has run out:
- The claim periods in the purchase agreement. General warranties often run for 12 to 24 months after completion; tax warranties and fundamental warranties commonly run much longer. Your lawyer will know the exact dates.
- Tax record rules. In the US, the IRS guidance on how long to keep records sets periods of three years in most cases, six years in some, and seven for certain claims. Other countries set their own periods.
- Any regulatory or litigation hold. If a dispute or investigation is reasonably expected, the archive must not be destroyed while it is live.
The opposite risk is keeping personal data for longer than needed. A room full of employee files, customer contracts and medical records is a privacy liability as well as an asset. In Europe, the GDPR sets a storage limitation principle, and similar rules exist elsewhere. Set a review date when the longest claim period ends, and delete or minimise then rather than keeping everything forever by default.
The archive protects the seller for as long as claims can be brought. After that, it becomes a store of other people’s personal data.
What about the bidders who did not win?
Their access should already be closed, usually at exclusivity rather than signing. Closing is the point to tidy up the paperwork.
Send each losing bidder a short, formal letter or email that:
- Refers to the confidentiality agreement by name and date.
- Requests return or destruction of all confidential information, including copies and notes derived from it, as the agreement provides.
- Asks for written confirmation by a set date, often within ten business days.
- Notes any carve-outs the NDA allows, such as copies held under a legal or regulatory retention obligation or in automatic backups.
File the replies, and the audit trail showing each bidder’s downloads, with the archive. If a leak surfaces later, the combination of watermarked downloads and a signed certificate tells you where to look. Our security features guide explains how dynamic watermarking makes that trail usable.
Choosing a room for your next deal? Our ranking shows which providers offer archive export, audit reports and Q&A logs.
See the rankingWhat goes wrong at closing?
The same five mistakes come up again and again.
Cancelling first, exporting second. Someone in finance sees the deal has closed and cancels the subscription. The room is deleted on the provider’s schedule. Always export and check before cancelling, and tell finance so.
Exporting files without the logs. The documents are on the drive; the audit trail and Q&A are not. Two years later the buyer says a document was never disclosed and you have no way to show it was opened.
Letting the archive drift after signing. Someone uploads a corrected schedule the day after signing “for completeness”. Now the archive does not match what was disclosed. Freeze at signing and put anything later in a separate, clearly labelled folder outside the disclosure set.
Nobody owns the archive. The deal team disbands, the drive sits in a drawer, and the key is in the inbox of someone who has left. Name an owner and record the location of both drive and key in the closing memo.
Forgetting the provider’s backups. A deletion confirmation that covers live data but not backups is half a confirmation. Ask about backup retention specifically.
How does the index make archiving easier?
A well-numbered index pays off twice. During the deal it lets bidders cite documents precisely; at closing it lets the disclosure letter refer to “document 4.3.2” and the archive prove what that was. If the room was built on a numbered structure from day one, the archive is a clean export. If it was not, someone spends days renumbering after the fact.
Our data room index template sets out a numbering system that survives into the archive. If you are still negotiating the room’s contract, add the archive format, export cost and deletion confirmation to your list of terms; our guide to negotiating a data room contract covers the clauses worth asking for.
Frequently asked questions
When should a data room be closed after a deal?
Keep it read-only between signing and completion so both legal teams can check documents, then export and check the archive. Close the room and ask for deletion only once the export has been verified.
What should be included in a data room archive?
All documents in index order with their versions, the index as at signing, the full Q&A log, the audit trail of views and downloads, and a record of which groups could see which folders.
Does the buyer get a copy of the data room?
Usually yes, a copy of the documents disclosed to it as at signing, in the format the purchase agreement specifies. It does not normally receive other bidders' questions, groups or activity.
How long should a seller keep a data room archive?
At least until the longest claim period in the purchase agreement has expired, and until any tax record retention period has run out. Tax and fundamental warranty periods often run several years.
What is a return-or-destroy certificate?
A written confirmation from a losing bidder that it has returned or destroyed the confidential information it received, as its confidentiality agreement requires. File each one with the archive.