Key points
- Set permissions by group, not by person: one group per investor firm or bidder, plus groups for your own team and advisers.
- Use four levels: no access, view-only, view and print, and download. Most investor files should be view-only.
- Open sensitive folders in stages: teaser, full diligence, then a clean-team folder for the final investor.
- Turn on watermarks and 2-step login before the first invite; changing them later is easy to forget.
- Review access weekly and remove investors who passed.
Permissions are where a data room earns its price. The same folder tree can serve a seed fund, a lead investor’s lawyers and a co-investor, each seeing only what they need. Done badly, every investor sees everything on day one and nobody knows who downloaded the cap table.
Build groups first
| Group | Members | Typical access |
|---|---|---|
| Owners | Founders, CFO | Full control, all folders |
| Internal team | Finance, legal, ops staff who upload | Upload and edit in their folders |
| Advisers | Your lawyers, bankers, accountants | View all, answer Q&A |
| Investor A (lead) | Partners, associates, its counsel | Staged: teaser, then full diligence |
| Investor B, C… | Each co-investor or bidder | Teaser; full access by decision |
| Clean team | Named individuals at the final investor | Competitively sensitive folder only |
One group per investor firm keeps names, questions and activity separate. In a sale process, bidders must not see each other at all: not in user lists, not in Q&A threads, not in folder names.
Four access levels
| Level | What the investor can do | Use it for |
|---|---|---|
| No access | Folder is hidden | Files not yet released to this group |
| View-only | Read in the browser, watermarked | Cap table, contracts, payroll, financials |
| View and print | Read and print, watermarked | Long legal documents counsel wants on paper |
| Download | Save a copy | Deck, public filings, non-sensitive summaries |
Most rooms also let you set an expiry date per group, so access ends automatically when a term sheet deadline passes.
Permission features across the 16 data rooms we review
Count of platforms listing each feature.
Stage the disclosure
- TeaserDeck, one-page summary, product overview. Open to every investor after a first call.
- DiligenceFinancials, cap table, legal and IP folders. Open to investors who are working towards a term sheet.
- ConfirmatoryCustomer contracts, employment files, detailed security documents. Open to the lead investor and its counsel after the term sheet.
- Clean teamPricing, named customer data or anything competitively sensitive. Open to named individuals only, often under an extra NDA.
Staging protects you if a round or a sale falls through, and it makes the activity log more useful: an investor who opens the diligence folders within a day of getting access is moving; one who has not opened them in a week probably is not.
Settings people forget
- Watermarks turned on for every group, with name, email and time.
- 2-step login required for investors, not only admins.
- Download disabled by default at the room level, then allowed per folder.
- Expiry dates on investor groups.
- Q&A visibility set so one investor cannot read another's questions.
- Notification emails that do not reveal file names to people without access.
- Access removed for investors who passed, the same day they pass.
Funds and LP rooms
Fund managers raising from limited partners use the same model with different folders: offering documents for all prospects, track record detail after a first meeting, side letters and capital account statements only for investors who have committed. See the venture capital and hedge fund pages for typical folder plans.
A permission plan on one page
Example: Series A room with a lead, a co-investor and counsel
| Folder | Lead investor | Co-investor | Lead's counsel | Clean team |
|---|---|---|---|---|
| Pitch and strategy | Download with watermark | Download with watermark | View only | View only |
| Financials | View only | View only | View only | View only |
| Cap table and securities | View only | View only | Download with watermark | No access |
| Customers and revenue | View only | No access | View only | View only |
| Legal and IP | View only | No access | Download with watermark | No access |
| Pricing and named customers | No access | No access | No access | View only |
No accessView onlyDownload with watermarkFull
Permissions by type of deal
| Deal | Groups | Staging | Special rule |
|---|---|---|---|
| Seed round | One per fund or angel group | Teaser, then full | Download only for the deck |
| Series A | Lead, co-investors, counsel | Teaser, diligence, confirmatory | Counsel may print legal files |
| Fund raise with LPs | One per LP, plus consultants | Offering pack, then track record | Capital accounts per LP only |
| M&A sale | One per bidder | Round one, round two | Bidders never see each other |
| Co-investment | One per co-investor | Curated view only | No downloads of adviser reports |
Watermark settings that work
| Setting | Recommended | Why |
|---|---|---|
| Content | Name, email, date and time | Traces any copy to one person and moment |
| Placement | Diagonal across the page | Hard to crop out of a screenshot |
| Opacity | Light enough to read through | Investors still need to read the file |
| Applies to | Viewing, printing and downloads | Every route out of the room |
The life of an access request
From first call to removed access
- 01Invite
After a first call, add the investor's team to its own group with teaser access.
- 02NDA
Click-through NDA at first login, signed NDA for sensitive stages.
- 03Stage up
Open diligence folders when a term sheet is in discussion.
- 04Monitor
Read the activity log weekly; follow up on engagement.
- 05Remove
Disable the group the day the investor passes or the round closes.
A weekly access review
- Export the user list and check every group still needs access.
- Remove investors who passed or went quiet for more than two weeks.
- Check that no investor group has download rights on sensitive folders.
- Confirm new files landed in the right folders, not at the top level.
- Read the activity log for unusual downloads or late-night bulk viewing.
- Check that Q&A answers went to the right group.
Mistakes that leak information
- Folder names that give things away. “Project Falcon offer from Acme” tells every user who the other bidder is. Use neutral names.
- Notification emails with file names. A notice that “Customer list with pricing” was added reveals content to people without access.
- One shared login for a whole firm. The activity log becomes useless and access cannot be removed per person.
- Permissions set on files, not folders. New files dropped into the folder inherit nothing and may be open to everyone.
Should investors be able to download files?
Only non-sensitive ones such as the deck or public filings. Keep the cap table, financials and contracts view-only with watermarks; investors can still read everything they need.
Can I see what each investor looked at?
Yes, if the room has an activity log. It shows which files and pages each user opened and for how long, and most rooms can export it.
What is a clean team in a data room?
A small group of named people at the buyer or investor who may see competitively sensitive information, such as pricing or customer terms, under stricter rules than the rest of their firm.
How do I remove an investor from the room?
Disable the user or the whole group. Access ends at once; watermarked copies they printed earlier still carry their name.
Should permissions be set per file or per folder?
Per folder, by group. File-level exceptions are hard to track and new files may not inherit them.
Can I give an investor's lawyer different access from the investor?
Yes. Put counsel in its own group; lawyers often need full legal folders and print rights that the deal team does not.
Do watermarks stop screenshots?
No, but they make every screenshot traceable to one person and time, which deters leaks.
