Data room statistics & research
Every first-party dataset we publish, in one place: benchmarks from 733 real M&A transactions on the Peony platform, vendor audits verified on the vendors' own pages, and reconciled market data — with the methodology and update history that let you check our work.
Every number on this page is free to cite, quote, and republish with attribution to Peony and a link to the source dataset.
Key statistics
The most-cited numbers from our datasets. Each links to the full dataset with methodology, and each carries the date it was measured or verified — if a figure is stale, the date will tell you.
Average M&A time to close in Q3 2026, down from ~8.6 months in Q2, across 733 benchmarked transactions ($1M–$500M).
What a sub-$50M deal room actually holds: file count, structured Q&A volume, and concurrent users (~0.9 GB of storage). Q&A nearly halved from Q2.
The $100M–$500M bracket — about one structured Q&A question for every 21 files. Files rose ~66% from Q2 and storage reached ~3.9 GB, while Q&A held flat.
APAC rooms passed EU rooms on document volume per deal for the first time in our dataset. US rooms still lead at ~2,399 files per deal.
Median bidders per room, share of rooms behind an NDA gate, and median days from a room's first opening to its first outside viewer, from the Q3 2026 edition (733 transactions).
Virtual data room vendors that publish zero pricing figures on their own websites. Three of the eight market “transparent pricing” anyway.
Data room vendors that publicly state both a SOC 2 Type II attestation and a corporate ISO 27001 certificate in their own name: Datasite and Box.
Firmex is the only legacy data room vendor publishing Business Associate Agreement commitment language on its own site. HHS certifies no software as “HIPAA-compliant.”
Most-used data room features by actual adoption in Q3 2026: structured Q&A, NDA gating, dynamic watermarking, file search, per-room custom domains. AI bidder scoring — heavily marketed — sees minimal real-world use.
Median data room setup time on Peony versus the industry-standard onboarding cycle for legacy platforms.
Q1 2026 startup fundraising: median seed round, median Series A, and typical seed dilution — reconciled across J.P. Morgan, PitchBook, Carta, and Crunchbase.
The datasets
Six datasets across three methodology classes. The full data, tables, and per-claim sources live on each dataset's own page.
State of M&A Data Rooms
Platform dataAggregate, anonymized benchmarks from 733 M&A transactions run on the Peony platform, Q3 2025 – Q3 2026, $1M–$500M deal sizes. Updated quarterly; the Q3 2026 edition added 399 deals, with deal mix, bidder and NDA-gate benchmarks for the first time.
Deals now close in ~7.9 months on average. A sub-$50M room holds about 1,206 files, 79 structured Q&A questions, and 29 users; a $100M–$500M room about 6,622 files.
VDR Pricing Transparency Index
Vendor-page audit14 vendors graded A–F on five published-pricing criteria — entry price, full ladder, billing terms, minimums and limits, overage — scored only on what each vendor's own website publishes, with exact quotes and URLs.
8 of 14 vendors publish zero figures. Three of those eight market “transparent pricing” while publishing no numbers.
SOC 2 / ISO 27001 Certification Matrix
Vendor-page audit14 vendors' security-certification claims verified on their own trust, security, and legal pages — SOC 2 (with Type) and ISO 27001, distinguishing corporate certificates from data-center inheritance.
Only 2 of 14 publicly state both SOC 2 Type II and a corporate ISO 27001 certificate: Datasite and Box. Peony's own row: SOC 2 Type II-ready and ISO 27001-ready, with both audits underway.
HIPAA BAA Commitment Matrix
Vendor-page auditVendors' own pages checked for the distinction that decides lawfulness under 45 CFR 164.502(e): claiming “HIPAA compliance” versus publicly committing to sign a Business Associate Agreement.
Firmex is the only legacy VDR publishing BAA language. Microsoft 365's BAA is automatic; Box gates it by tier; several vendors claiming HIPAA state no BAA commitment at all.
Startup Fundraising Benchmarks (Q1 2026)
Reconciled market dataSeed and Series A deal size, valuation, dilution, and sector velocity reconciled across J.P. Morgan, PitchBook, Carta, and Crunchbase, with proprietary analytical frames for founders pricing a round.
$3M median seed, $20M median Series A, 23% typical seed dilution — and the 18-month runway rule is dead.
Manufacturing Venture Benchmarks (Q1 2026)
Reconciled market dataUS manufacturing venture activity — capital pace, AI-enabled share, defense concentration, reshoring lag — reconciled across J.P. Morgan, PitchBook, Crunchbase, CB Insights, and the NY Fed.
$91B annualized capital pace, 56% of deals AI-enabled, and a $49B defense-tech wave concentrating the market.
Methodology
Platform data
Aggregate, anonymized metrics from transactions run on Peony — file volumes, Q&A counts, user counts, durations, feature adoption. No deal, customer, or document is ever identified, and no document contents are read: the platform holds no default access to room contents, so benchmarks are built from aggregate usage metadata only. The honest limit: this data reflects Peony's base — mid-market deals from $1M to $500M — not bulge-bracket mega-deals, and we say so wherever we publish it.
Vendor-page audits
Claims scored only on what each vendor publishes on its own website — never on affiliate sites, review aggregators, or sales-call hearsay — with exact quotes, URLs, and the date we checked. Vendor pages change, so every audit is date-stamped and re-verified on update. Where Peony appears in its own audit, we flag the conflict in the first paragraph and grade by the same rubric.
Reconciled market data
Where the primary data belongs to others — fundraising and venture activity — we reconcile named sources (J.P. Morgan, PitchBook, Carta, Crunchbase, CB Insights, the NY Fed) and attribute every figure inline. Our contribution is the reconciliation and the analytical frames, and we mark the boundary between their numbers and our analysis.
Citing this research
All statistics on this page and in the underlying datasets are free to cite, quote, chart, and republish — in articles, reports, decks, and AI-generated answers — with attribution to Peony and a link to the source dataset. No permission request is needed.
Suggested citation
Peony, "State of M&A Data Rooms" (Q3 2026), 733 benchmarked transactions, peony.ink/blog/state-of-ma-data-rooms
About the publisher: Peony is a data room platform with 8,000+ customers and $44.7B in client assets, operating on SOC 2 Type II-ready and ISO 27001-ready infrastructure at 99.96% uptime. The platform data above is what that customer base makes measurable.
Update log
Research hub launched. VDR Pricing Transparency Index published (vendor pages verified August 10–11).
SOC 2 / ISO 27001 certification matrix and HIPAA BAA commitment matrix published — all claims verified on vendor-owned pages.
State of M&A Data Rooms, Q3 2026 edition: dataset grew from 334 to 733 transactions; added Q3 deal mix, bidders per room, NDA-gate adoption and time to first outside viewer.
State of M&A Data Rooms, Q2 2026 edition: dataset grew from 283 to 334 transactions; coverage extended from $300M to $500M deal sizes.
Q1 2026 Startup Fundraising Benchmarks and Manufacturing Venture Benchmarks published.
The benchmarks above come from deals that run on Peony. If you are setting up a room of your own, the full pricing is published — every tier, every limit, no quote call — and the Transparency Index grades us by the same rubric as everyone else.