Data room terms, defined for buyers

A preset end date or time after which a user, group or document is no longer accessible, without the administrator having to remove it manually.

Summaries built from the audit trail that show logins, document views, downloads and time spent, broken down by user, group, folder or document.

The Advanced Encryption Standard with a 256-bit key, a widely used symmetric cipher that most data rooms cite for encrypting stored files.

Machine learning features that sort uploaded files into folders, tag them by type or suggest an index automatically, sometimes alongside summarizing or answering questions about documents.

A documented programming interface that lets other systems create rooms, move files, manage users or pull reports from the data room automatically.

The room's running log of who did what and when. Every sign-in, file open, save, print, upload, rights change and question is stored against a person, and ordinary users cannot edit it.

Automatic assignment of index numbers to folders and documents based on their position in the room, renumbered as the structure changes.

Reporting that ranks or scores bidders and investors by how actively they use the room, based on logins, documents opened, time spent and questions asked.

Keeping competing bidders fully separate in one room, so no group can see another group's users, questions, answers, uploads or activity.

Uploading many files and folders at once, typically by dragging a whole directory into the browser, with the folder structure kept intact.

Email or in-app notices that tell users when documents are added or updated in folders they can see, or when a question they follow is answered.

A small, ring-fenced group, often outside advisers, allowed to review competitively sensitive information that the buyer's business staff may not see before a deal closes.

A connection that imports or keeps folders in step between the data room and a company's existing storage, such as SharePoint, Google Drive, Box or Dropbox.

The marketing document a seller and its banker prepare to describe a business to qualified buyers, covering the history, market, financial summary and investment case.

The late, narrower round of review after a preferred bidder is chosen, in which the buyer verifies the points that support its offer before signing.

A sale process in which an adviser runs several qualified bidders through the same staged timetable, usually with first and second round offers, to create competition on price and terms.

An option in which the client, not the provider, controls the encryption keys for its data, often through its own cloud key service. Sometimes called bring your own key.

The contract annex in which the room vendor promises how it will treat personal information on your behalf: safeguards, who else it may use, cross-border moves and deletion at the end.

Which jurisdiction physically hosts a room's files, and whether the customer can pick it, for instance an EU, UK, US or Australian region chosen when the room is created.

The frozen copy of everything that was in the room, handed over after signing or shutdown on an encrypted drive or as a secure download, ideally with the index and activity history attached.

The numbered table of contents of a data room, listing every folder and document with a reference number such as 3.2.4, so readers and lawyers can cite files precisely.

The attachment to a purchase agreement in which the seller lists exceptions to its representations and warranties, often by referencing documents placed in the data room.

Protection that stays attached to a file after it is downloaded, so the owner can still limit opening, printing or copying, and can revoke access later. Also called digital or information rights management.

Settings that decide whether a user may save or print a document, often with options such as download as protected PDF, original format or not at all.

A setting that keeps newly uploaded documents invisible to outside users until an administrator publishes them, sometimes called staging or unpublished status.

The checking phase before money changes hands: the acquirer or backer works through the target's accounts, contracts, disputes, systems and staffing, largely by reading what the seller has posted.

An overlay stamped on a document at the moment it is viewed, printed or downloaded, showing details such as the reader's name, email, IP address and the time.

Signing documents electronically inside the data room, or through an integrated signing service, so NDAs, consents and closing documents can be executed without leaving the platform.

Scrambling stored files, backups included, so that anyone who walks off with a disk or a backup set gets unreadable data unless they also hold the keys.

Protecting data while it moves between a user's device and the provider's servers, normally with TLS, so it cannot be read or altered on the way.

A viewing mode that hides most of the page and shows only a narrow band around the cursor, so the full document cannot be captured in one screenshot or read over a shoulder.

A fixed fee per month or per project for the room, with no charge per page, per user or per gigabyte within the plan's stated limits.

The nested folder layout of a data room, usually organized by workstream such as corporate, financial, legal, commercial, HR, IT and tax.

A limited period, often 7 to 30 days, in which a buyer can set up and use a data room before paying, usually with some limits on users or storage.

Search that looks inside the content of documents, not only at file names, and returns matches only from files the user is allowed to see.

The EU's privacy law since 2018. It applies whenever a deal room holds information that identifies people in the EU, or is run by an organization established there, which in practice means most HR folders and many customer lists.

Rights that the administrator can tune down to one document and one bidder group, instead of a single on or off switch for everybody in the room.

The 1996 US federal law, with its Privacy and Security Rules, covering patient records held by health plans, providers and their vendors. A room that stores such records needs a business associate agreement in place.

A data room a company keeps for fundraising, holding the pitch deck, financial model, cap table, key contracts and corporate records that investors ask for during a round.

Restricting room access to approved network addresses, such as a firm's office or VPN ranges, so logins from anywhere else are refused.

ISO/IEC 27001 sets out how an organization should run its security program as a managed cycle of risk assessment, controls and review. A certificate means an outside registrar has audited that cycle.

A largely non-binding document in which a buyer sets out the proposed price, structure and key conditions of a deal, often paired with a binding exclusivity period.

Automatic checking of uploaded files for viruses and other malicious code before they become available to other users of the room.

The shortest period a buyer must pay for under the contract, such as three months for a project room or twelve months for an annual subscription.

A native phone or tablet application for reading documents, answering questions and checking activity in the data room, as opposed to using the website in a mobile browser.

A screen that shows confidentiality or access terms when a user first enters the room, or a folder, and requires them to accept before going further, with the acceptance logged.

A contract in which a party receiving confidential information agrees to keep it private and use it only for evaluating the deal. Signing one is usually the condition for entering a data room.

Software that reads the text inside scanned documents and images, so a data room can search them like ordinary text files.

Fees for going past the limits included in a plan or quote, such as extra pages, storage, users or rooms.

A hired security team tries to break into the platform with the owner's permission, then reports the holes it found so they can be closed. Often shortened to pen test.

An older model in which the room is billed by the number of pages uploaded, with a rate per page or per block of pages, often on top of a base fee.

A price charged for each user account, or each administrator seat, per month. Outside guests may be counted separately or included without charge, depending on the vendor.

Named sets of users, usually one per bidder or per adviser firm, that share the same access rights, so permissions are managed once per group instead of per person.

The pre-internet version: binders of deal paperwork in a guarded office, which each bidder's team booked by the day and read under supervision.

The security rule that each user should get only the access needed for their task, for only as long as they need it.

A letter sent by the seller's adviser to bidders that sets the rules and deadlines of a sale process, including what an offer must contain and how questions are handled.

A module that replaces the question spreadsheet: bidders raise points from inside the room, the seller's experts draft replies, someone approves them, and every thread stays linked to the file that prompted it.

A limit on how many questions each bidder or user may submit, sometimes per day or per round, set by the seller to keep the Q&A process manageable.

Sending each incoming diligence question to the right person on the answering side, such as finance, legal or HR, based on its category or the folder it refers to.

Pricing that is not published and is set per project after a scoping call, usually bundling size, users, term, features and service level into one figure.

Blacking out names, figures or personal details so they are gone from the shared copy itself, not just hidden behind a box.

Withdrawing a user's access to documents after they have already viewed or downloaded them, sometimes called remote shred when it covers files saved on their device.

The buyer's list of documents and information it wants from the seller, organized by workstream and tracked item by item until each request is fulfilled.

An access model in which rights come from a user's role, such as administrator, contributor or viewer, rather than being granted to each person one by one.

The person, usually on the sell side or at the adviser, who builds the room, invites users, sets permissions and publishes documents.

Measures that try to stop or deter screen captures of documents in the viewer, such as blanking the page when a capture tool is detected or when the window loses focus.

The in-browser document viewer a data room uses to display files without handing the reader the original, so protections such as watermarks and copy limits can apply.

A one-time charge for opening a room, configuring it or receiving onboarding and training, billed on top of the monthly or project price.

Logging in to the data room with an existing company identity, through a provider such as Microsoft Entra ID or Okta, usually over the SAML or OpenID Connect standards.

An attestation from a licensed CPA firm, under AICPA rules, that a software company's security controls are designed well (Type I) or also worked over several months (Type II). Extra criteria such as availability or privacy can be added.

Releasing information in planned steps, for example a summary set in round one and full contracts in round two, by opening folders to each group at the right moment.

Charging for a data room by the amount of data stored, usually as a tier with a gigabyte allowance and a fee for each extra gigabyte.

Keeping a project room open beyond its committed term, billed per extra month at a rate set in the original contract or in a new quote.

The full cost of a data room over the life of a deal, combining the base price with extensions, overage, extra seats, setup, archive and the internal time spent running it.

A login that needs a second proof of identity besides the password, such as a code from an authenticator app, a text message or a hardware key.

A service level agreement in which the provider commits to keeping the platform available for a stated share of time, such as 99.9 percent, usually with service credits if it falls short.

Diligence that the seller commissions on itself before a sale, so bidders receive independent reports up front instead of each running the same work separately.

Retaining each superseded copy of a file, stamped with who replaced it and when, so it is possible to show later exactly which draft sat in the room on a given day.

A permission that lets a user read a document in the room's viewer but not download, print or edit it.

Deal software that lets one side publish sensitive files to a vetted audience, such as bidders, lenders or a fund's analysts, while deciding folder by folder who may open what and logging each open.