Virtual data rooms defined: what one actually does during a live deal

Picture the moment a buyer’s lawyer emails to ask for every customer contract over 50,000 USD a year, the last three audited accounts and the full IP assignment chain. You have nine days before the bid deadline. Four other bidders will ask for the same things, and you do not want any of them to know who else is looking.

That is the job a virtual data room was built for.

A virtual data room (VDR) is a permissioned online repository, set up for a specific transaction, in which a disclosing party lets selected outside reviewers read sensitive documents under controls it sets and logs. Strip away the marketing and it comes down to three promises: only the right people get in, they only see what you allow, and you can prove afterwards what happened.

Most explainers stop at the definition. This one follows a room through a deal, because the way a VDR earns its fee only makes sense once you watch it work.

What happens inside a data room from opening day to archive?

A typical sell-side process for a business worth 10 to 50 million USD runs for three to five months. The room is busy for most of that window and quiet at the edges. Here is how the activity usually breaks down.

Two things stand out. The room carries far more people in the middle than at the start, and the most sensitive documents arrive late. A good VDR lets you widen and narrow access group by group without rebuilding anything.

Who logs in, and what can each of them do?

Every room has two sides. The disclosing side owns the room; the receiving side reviews it. Within each side there are layers.

• Administrators on the disclosing side create folders, set permissions and invite users. Usually one person at the seller plus one at the adviser.
• Contributors upload and reorganise files but cannot change access. Finance, HR and legal leads often hold this role.
• Q&A coordinators route incoming questions to the right internal expert and approve answers before they are released.
• Reviewers on the buying side see what their group is allowed to see. A bidder’s legal team might have download rights while its commercial team is view-only.
• Observers such as lenders or insurers sometimes get a narrow slice for underwriting.

The point is that permissions attach to groups, not people. When bidder three drops out, you disable one group and every person in it loses access at once.

What separates a VDR from a folder you share by link?

Shared drives are excellent collaboration tools. They were designed for colleagues who trust each other, though, and a deal is a room full of people who do not.

We go deeper on that comparison in our guide to data rooms versus Google Drive and Dropbox. For a small, friendly transaction a shared drive can be enough. Once a third party has an incentive to misuse your data, the gaps start to matter.

What are the working parts of a VDR?

Think of a room as five layers stacked on each other.

1. Identity. Every user signs in with their own account, ideally with two-factor authentication and, for larger firms, single sign-on through their company identity provider.

2. Structure. A numbered folder tree, the index, mirrors the buyer’s diligence request list. Our index template shows a scheme you can reuse.

3. Permissions. Rules decide, per group, whether each folder is hidden, visible, viewable only in the browser, printable or downloadable.

4. Document protection. Dynamic watermarks stamp the viewer’s name, email and timestamp on each page. Some rooms add document rights management so a downloaded file stops opening once access is revoked, and some offer built-in redaction.

5. Evidence. The audit trail logs logins, views, time on page, downloads and Q&A. When a dispute arises after signing about what the buyer knew, this log is often the best record either side has.

Why do lawyers care so much about the audit trail?

In most acquisitions the seller’s warranties are qualified by what was “fairly disclosed”. If the purchase agreement treats the data room as disclosed material, the seller needs to show what was in it and when. A complete, time-stamped log, plus an archived copy of the room, does that.

The data room is not just where documents are kept. After signing, it becomes evidence of what each party knew and when they knew it.

Privacy law adds a second reason. When a room holds personal data, such as employee records, the disclosing company remains responsible for it. The GDPR asks controllers to apply security “appropriate to the risk” under Article 32, and the UK regulator’s guidance on sharing personal data expects you to limit what you share to what the recipient genuinely needs. Granular permissions and a full log are how you show you did both.

Which certifications should a serious room have?

Two names come up constantly. ISO/IEC 27001 is an international standard for running an information security management system; certification means an accredited auditor checked the vendor’s system against it. A SOC 2 report, defined by the AICPA, is an auditor’s opinion on a service organisation’s controls; a Type II report covers how those controls operated over a period, usually six to twelve months.

Of the 18 providers we score, all list SOC 2 in some form and most also hold ISO 27001. A few, including Ellty, CapLinked and SecureDocs, list SOC 2 without ISO 27001 in our data. Ellty’s listing specifically says SOC 2 at the infrastructure level, so ask any vendor which entity and scope its report covers. Our security features guide explains what to check.

Who actually uses virtual data rooms?

The obvious answer is M&A, and sell-side acquisitions are still the largest use. The list is longer than that, though.

• Company sales and mergers. The classic case; see our M&A use case.
• Startup fundraising. A lighter room holding the cap table, metrics and IP documents, shared with a handful of investors. See startup fundraising.
• Private equity. Funds run rooms for both acquisitions and their own investor reporting.
• Real estate. Portfolio sales, refinancing and syndication packs.
• Life sciences licensing. Clinical and regulatory dossiers shared with potential partners.
• Litigation and investigations. Productions shared with opposing counsel or regulators.
• IPO preparation and restructuring. Large, document-heavy processes with many advisers.

Each has different must-haves. A biotech licensing room cares about granular view-only rights on science files; a fundraising room cares about speed and cost.

How much does it cost to run one?

Prices fall into two camps. Some providers publish a monthly entry price; in our data these include Onehub at 15 USD a month, Digify at 120 USD a month, Ellty at 149 USD a month, SecureDocs at 250 USD a month and CapLinked at 299 USD a month. The large enterprise rooms, such as Datasite, Intralinks and iDeals, quote per project based on users, storage and term. All of these are indicative and should be confirmed with the provider.

As a rough guide, a small sale or fundraise can run a capable room for a few hundred to a couple of thousand USD in total, while a contested mid-market auction with dozens of bidder users often lands in the five figures. Our cost guide breaks that down by deal size.

When is a data room overkill?

Sometimes you genuinely do not need one. Before paying for a room, check these:

• Is there only one counterparty, and do you already trust them?
• Are there fewer than 50 documents, none containing personal data?
• Would a leak cause little commercial harm?
• Is there no need to prove later what was disclosed?

If you ticked all four, an encrypted shared folder with expiring links may be fine. If you missed even one, especially the last, a proper room is cheap insurance.

How is a modern VDR different from the old paper room?

Before cloud software, sellers rented a physical room near their lawyers’ office, filled it with binders and booked bidders into time slots. Reviewers were watched by a paralegal and could not photocopy. Virtual rooms kept the idea, a controlled space with supervised access, and removed the travel, the scheduling and the limit of one bidder at a time. The supervision moved from a person at the door into permissions and logs.

What has changed most recently is the tooling on top: automatic indexing, AI-assisted search and Q&A drafting, and faster setup. Several rooms in our rankings now ship AI tools, including Ellty, Datasite, Ansarada and Drooms. They save time, but they do not replace a human reading the disclosure.