Data Room Glossary

A secure online repository for sharing confidential documents with outside parties during a transaction, with per-user permissions, activity tracking and the ability to revoke access.

A controlled space, physical or online, where confidential documents are made available to a limited set of outside parties during a transaction or review. Today the term almost always means a virtual data room.

A secured room, often at a law firm or the seller's offices, where bidders reviewed paper documents in person under supervision. Largely replaced by virtual data rooms.

Other names for a virtual data room: documents hosted on the web with access controls, rather than paper in a physical room.

A data room set up for one specific transaction. Some sales tools also use the name for a shared buyer portal, which is a different product.

A company that supplies virtual data room software. Providers typically charge per admin, per page, per project or a flat rate.

A data room the seller or its advisor prepares so that prospective buyers can review the company in a controlled way during a sale process.

A data room an acquirer uses to organise its own diligence findings, advisor reports and integration planning for a target.

A data room a company shares with prospective investors during a financing round, usually containing the pitch deck, financial model, cap table and key contracts.

A list of the documents a data room should contain for a given transaction, grouped into sections such as corporate, financial, legal, commercial, people and intellectual property.

The numbered folder and file structure of a data room, which lets every party reference a document by the same number during diligence.

Automatic numbering of folders and files so that the data room index updates as documents are added or moved.

Keeping earlier copies of a document when it is replaced with an updated one, so the shared link stays the same and the history is preserved.

A periodic report a company sends to existing investors covering metrics, progress and requests for help, often shared as a tracked link.

Rules that set what each user or group can do with a folder or file, such as no access, view only, download or upload.

A permission level that lets a recipient read a document in the browser without downloading it.

Sets of external users who share the same permissions, typically one group per bidder, investor or advisory firm.

A restricted group, often outside advisors, that is allowed to see competitively sensitive information that the wider buyer team may not see.

Requiring a viewer to accept or sign a non-disclosure agreement before any document in a link or data room opens.

Confirming that a recipient controls an email address by sending a short-lived code before a document opens.

Limiting access to recipients whose email addresses are on an approved list or belong to approved company domains.

A share link issued to one recipient or group, so activity can be attributed to them and their access revoked on its own.

A share link that stops working after a set date.

Removing a recipient's ability to open shared documents at any time, including documents they viewed earlier.

A watermark generated for each viewer at the moment of viewing, usually showing their name, email, IP address and a timestamp, so that leaked copies can be traced.

Controls that block or record screen captures while a document is open in the viewer.

Permanently removing sensitive text, such as personal data or pricing, from a document before it is shared.

A login check that requires a second factor, such as a one-time code, in addition to a password or email address.

Logging in through a company identity provider such as Google Workspace, Microsoft Entra ID or Okta instead of a separate password.

Protecting stored data (at rest) and data moving over the network (in transit), commonly with AES-256 and TLS.

Tracking of which pages each viewer opened and how long they spent on each, used to gauge interest and prioritise follow-up.

A time-stamped log of who accessed, viewed, downloaded or changed which document, kept as a record of the process.

A structured workflow inside the data room where bidders submit questions and the seller's team routes, answers and approves responses.

A feature that answers natural-language questions about the documents in a data room, with references to the source files.

A complete export of a data room's final contents at the end of a deal, kept as the record of what was disclosed.

The investigation a buyer, investor or lender carries out before committing to a transaction, covering financial, legal, commercial, tax and technical records.

Due diligence commissioned by the seller before a sale, with the report shared with prospective buyers to speed up their review.

The detailed diligence a buyer carries out after the letter of intent to verify the assumptions behind its offer before signing.

A short, often anonymised summary of a business sent to prospective buyers before they sign an NDA.

A detailed document describing a business for sale, shared with buyers after they sign an NDA.

A preliminary, non-binding statement of a buyer's interest and price range, submitted early in a sale process to gain access to more information.

A meeting in which the target's leadership presents the business to shortlisted buyers, usually after first-round bids.

A non-binding document in which a buyer sets out the proposed price and key terms, usually followed by confirmatory due diligence.

A period, usually agreed in the letter of intent, during which the seller negotiates only with one buyer.

An accounting review that tests how sustainable and accurately reported a company's earnings are, commonly commissioned in M&A.

The binding contract for a sale. A share purchase agreement transfers the company's shares; an asset purchase agreement transfers selected assets and liabilities.

Statements of fact about the business that the seller makes in the purchase agreement, which the buyer can claim against if they prove untrue.

An attachment to the purchase agreement listing the exceptions to the seller's representations and warranties.

Part of the purchase price that is paid later, only if the business meets agreed performance targets after closing.

Funds held by a neutral third party after closing to cover potential claims under the purchase agreement.

Signing is when the parties execute the purchase agreement; closing is when ownership and payment change hands, either on the same day or after agreed conditions are met.

The final, organised set of executed transaction documents archived at the end of a deal.

A table showing who owns a company's shares, options and convertible securities, and in what proportions.

A private equity structure in which a sponsor moves one or more portfolio companies from an existing fund into a new vehicle, giving existing LPs the option to sell or roll their interest.

A pricing model that charges for the people who manage data rooms, while external viewers are free.

A legacy data room pricing model that charges by the number of pages uploaded, which makes the final cost depend on document volume.

A pricing model with a fixed monthly or per-project fee regardless of pages, storage or viewers.

A contract that sets out how a vendor processes personal data on a customer's behalf, required under the GDPR.

The EU General Data Protection Regulation, which governs how the personal data of people in the EU is collected, processed and transferred.

An independent audit report on how well a service provider's security controls operated over a period of time, typically six to twelve months. A vendor described as SOC 2 Type II-ready has aligned its controls but has not yet received the report.

An international standard for information security management systems, certified by an accredited third-party auditor.

A contract required under HIPAA when a vendor handles protected health information on behalf of a covered entity.