Last reviewed October 7, 2026 · By the NYBACS advisory team
Short answer
Build an investor-ready data room by organizing final, signed documents into a numbered folder structure covering corporate records, cap table and financings, financials, tax and compliance, commercial contracts, people, intellectual property and legal matters. Release it in stages: a light folder for early interest and the full set after a term sheet. Use a virtual data room with permission controls and activity logs, and keep every document consistent with the deck and model.
Key takeaways
- A data room is a diligence tool, so documents should be final, signed and dated, not drafts.
- Staged access protects sensitive information: early investors rarely need customer contracts or employee pay details.
- Investors read the financial folder against the deck, so statements, model and metrics must agree.
- Personal data about employees and customers should be minimized or redacted, particularly where privacy laws such as GDPR apply.
- Foreign-founded companies usually need extra folders for the parent or founder entities, intercompany agreements and any holding-company restructuring.
A folder structure investors recognize
Investor counsel and analysts work through diligence checklists, so a predictable structure saves time on both sides. A common layout:
| Folder | Typical contents |
|---|---|
| 1. Corporate | Certificate of incorporation, bylaws, good standing certificates, foreign qualifications, board and stockholder minutes and consents |
| 2. Capitalization | Cap table, stock ledger, SAFEs, convertible notes, warrants, option plan and grants, prior financing documents |
| 3. Financial | Monthly financial statements, audited or reviewed statements if any, model, budget, metric definitions |
| 4. Tax and compliance | Federal and state returns, Form 5472 where applicable, franchise tax and annual report filings, payroll tax filings |
| 5. Commercial | Top customer and supplier contracts, partnership agreements, standard terms of service |
| 6. People | Org chart, offer letter templates, contractor agreements, benefit plan summaries |
| 7. Intellectual property | IP assignment agreements, patents, trademarks, open-source policy |
| 8. Legal and regulatory | Litigation, licenses, privacy policy, insurance |
Number the folders and files so references in emails and Q&A ("see 2.4") are unambiguous.
Stage access instead of opening everything at once
Not every investor needs every document at every point. A practical approach is three tiers:
- Tier 1, early interest. Deck, summary financials, high-level metrics and a short company overview.
- Tier 2, active diligence. Full financial statements and model, cap table, corporate records, standard contracts and redacted customer agreements.
- Tier 3, confirmatory diligence after a term sheet. Unredacted material contracts, employee and compensation detail, and full legal files, often under a confidentiality agreement.
Most virtual data room platforms let you set permissions per folder and per user, disable downloads, watermark files and see who viewed what. Activity logs also show which investors are engaged and which documents attract attention.
Make the financial folder internally consistent
The financial folder gets the closest reading, and inconsistencies there undermine everything else. Before opening it:
- Confirm the revenue in the deck equals the revenue in the monthly statements for the same period.
- Include a metric definitions sheet and a bridge from ARR or bookings to GAAP revenue.
- Upload the model as a working spreadsheet, not a PDF, with assumptions on a clearly labeled tab.
- Include bank statements or reconciliations only if requested in confirmatory diligence, not by default.
- Date every financial file and replace superseded versions rather than adding new ones beside them.
If the company has been audited, include the full auditor's report and statements together, never selected pages. Where the company has a foreign parent, add a short note explaining any intercompany charges that appear in the statements.
What to leave out or redact
Some documents create risk without helping diligence. Leave out or redact:
- Personal identification documents of founders and employees, such as passports and home addresses, unless specifically required.
- Individual salary and health information until confirmatory diligence, and then only as needed.
- Customer personal data and full customer lists where confidentiality terms restrict sharing.
- Privileged legal advice, which may lose protection if shared.
- Drafts, internal debate emails and anything you would not want to explain line by line.
Companies with EU or UK staff or customers should consider their obligations under GDPR or UK GDPR before uploading personal data, and Indian-founded companies may need to consider India's data protection rules for data on Indian residents.
Extra items for foreign-founded US companies
Investors in a US company with non-US founders usually ask questions that need their own folder:
- Group structure chart showing the US company, any foreign parent or subsidiaries, and ownership percentages.
- Intercompany agreements for services, IP licensing and loans, with pricing support.
- Restructuring documents if the business moved from a foreign holding company into a US parent, including share exchange agreements and related filings.
- Foreign entity records such as registry extracts or certificates of incumbency, translated where needed.
- Evidence that IP developed abroad was assigned to the US company.
These answer the question investors always ask of cross-border startups: which entity owns the business they are investing in.
Common mistakes to avoid
- Uploading drafts or unsigned versions of financing documents and board consents.
- Opening the full data room to every interested investor before a term sheet.
- Letting the deck, the model and the monthly statements show different revenue figures.
- Uploading passports, salary lists or customer personal data without considering privacy obligations.
- Leaving superseded versions next to current ones so investors cannot tell which is final.
- Omitting the group structure and intercompany agreements in a foreign-founded company.
Documents and records to prepare
- Certificate of incorporation, bylaws and good standing certificates
- Board and stockholder minutes and written consents
- Cap table, stock ledger, option plan, SAFEs, convertible notes and warrants
- Monthly financial statements, model, budget and metric definitions
- Federal and state tax returns, Form 5472 where applicable, and franchise tax filings
- Material customer, supplier and partnership contracts
- IP assignment agreements and registrations
- Group structure chart and intercompany agreements for cross-border companies
NYBACS 360° support
How NYBACS helps
- Sets up a numbered data room structure and maps your existing documents into it.
- Prepares the financial folder: monthly statements, model, metric definitions and the revenue bridge, all reconciled.
- Collects tax, Form 5472, franchise tax and good standing evidence and flags any gaps before investors see them.
- Builds the group structure chart and intercompany document set for foreign-founded companies.
- Tracks investor Q&A and document requests during diligence so responses are consistent.
Frequently Asked Questions
Can we use shared drive folders instead of a paid data room?
For early conversations, a well-permissioned shared folder can work. Once multiple investors are in diligence, a virtual data room's per-user permissions, watermarking and activity logs usually justify the cost.
How long should a data room stay open?
Through closing, and often for a short period after so final documents can be added. After closing, archive a copy of exactly what investors saw, as it can matter if questions arise later.
Should the data room include our pitch deck?
Yes, usually in a top-level folder, with the version date. Make sure its numbers match the financial folder.
Who should manage investor questions?
One person, usually a founder or finance lead, should own a Q&A log so answers are consistent and can be reused. Advisers can draft answers, but the company should approve them.
