THE SHORT ANSWER
Choose a data-room arrangement by the controls your transaction needs, then test the actual configuration. Confirm named recipients, authentication, file permissions, logging, export and support. “Read-only” does not necessarily disable downloading, copying or screenshots. Vendor claims and access logs do not guarantee security or prove buyer intent. Coordinate sensitive disclosures with counsel and your security team.
Write requirements before comparing vendors
List the audiences and information categories you must keep separate: internal preparation, approved bidder materials, professional review and any restricted clean-team work. Describe what users should be able to see, upload, download or export. Identify the administrator and the person approving new access.
Ask for the actual terms covering user limits, storage, duration, support, archives, renewal and exit. Obtain a quote for the expected use rather than publishing a generic platform price. A brand name or an M&A label does not prove that a particular subscription includes the controls you need. General storage and dedicated platforms should both be assessed on demonstrated settings and the transaction’s requirements.
Test permissions with non-sensitive sample files
| Control to test | Question to verify |
|---|---|
| Named account and authentication | Can the intended user sign in through the required controls? |
| Folder or document visibility | Can this role see only its approved material? |
| Download and sharing | What can be exported, forwarded or accessed through a link? |
| Access change | What happens when permission or a role is removed? |
| Archive and support | Can authorized staff preserve the agreed records and get assistance? |
Have an authorized technical person test the intended roles before loading sensitive copies. Verify what “view only” means in that product and subscription. Blocking a download button does not make screenshots or manual copying impossible. Keep the test results and unresolved limitations with the platform decision.
Review security and disclosure responsibilities
The FTC recommends necessary access, appropriate authentication and encryption, and review of service-provider practices.
(FTC: protecting personal information in business)Map those responsibilities to the actual account and transaction. Protect administrators as well as invited recipients, and use a process for approving role changes. Determine what information should remain outside the general room and which copy is permitted for a specific audience. Counsel should assess personal, contractual and privileged records before disclosure.
For competitor information, the FTC describes additional staged and clean-team safeguards.
(FTC: information sharing during merger negotiations)A standard bidder role is not a substitute for a protocol tailored to competitively sensitive material.
Treat logs as activity evidence, not a buyer score
Understand what an event means: opened, downloaded, failed login or permission change. Log coverage can vary by product and configuration. A long viewing time may reflect an idle browser or an advisor’s workflow; it does not prove concern, enthusiasm or financial capacity. Discuss substantive questions directly instead of inferring negotiation leverage from a folder count.
Plan what happens when the process pauses, a bidder leaves or the transaction closes. Coordinate access removal, contractual return or destruction provisions, necessary archives and any legal holds with responsible professionals. Preserve required evidence rather than automatically deleting the entire room. Use the response register to connect activity with actual requests and approved answers. Periodically review the permissions as people and transaction stages change.
Owner questions
Does read-only mean no downloads?
Not necessarily. Test the actual product, settings and role; copying or screenshots may still be possible.
Do logs show which buyer is most serious?
Logs describe recorded activity. They do not prove intent, concern, available funds or approval.
Is a dedicated VDR automatically secure enough?
No. Assess the subscription, configuration, people, data and applicable disclosure requirements.
Sources and review scope
Source review completed . The sources below support the identified concepts or rules; they do not validate hypothetical amounts or a valuation of your business.
- FTC: protecting personal information in business
Information inventory, necessary access, authentication, encryption, service-provider oversight, retention and incident planning. General security guidance; not an M&A privacy-law compliance certification.
- FTC: information sharing during merger negotiations
FTC staff guidance on continued independence, sensitive competitor information, staged disclosure and clean-team safeguards. Older conceptual guidance; not merger clearance or an NDA safe harbor.
Confirm tax, legal, accounting and lending applications with the relevant professionals. Historical market observations describe the stated period and reported sample.
This is educational material. Industry figures and program rules can change; check the original sources and your advisors before applying them to a transaction. Calculator scenarios are not appraisals, lending decisions, or offers.
Our content and calculator methodology →