The working-group checklist and data room index for an IPO -- covering the S-1 package, comfort letters, FINRA filings, staged document release and quiet-period controls.
An IPO data room is not a single room. It is a structured sequence of access layers that opens to underwriters first, then to the SEC reviewer, then to analysts during the quiet period, and finally to public investors, with a different document set and permission level at each stage. Getting that sequence right is the main job of the working-group data room.
Papermark: best for IPO working groups. EU-hosted, SOC 2 Type II and ISO 27001 certified, from $99/month with unlimited data rooms, NDA gating before first access, staged permission groups, page-level analytics and dynamic watermarking. See the Papermark profile for full feature detail.
For a broader comparison of data rooms for capital markets, see Best data room for IPO.
NovaBridge is a Nashville-based B2B payments software company planning to list on the Nasdaq Global Select Market. The company has $48 million in annual recurring revenue, 90 percent gross margins and three consecutive quarters of GAAP profitability. The CFO, Dana Kim, kicked off the IPO process eight months before the target pricing date.
The working group for the NovaBridge offering is twelve people deep before any banks are added: CFO, General Counsel, VP Finance, outside securities counsel, independent auditors (a Big Four firm), a consulting firm providing the comfort letter readiness assessment, and three members of the underwriting syndicate's legal teams. The lead underwriter has two additional analysts who need read-only access to financial exhibits but must be excluded from the board minutes and the pending litigation folder.
Dana's team needs to run this group across four months of drafting, two rounds of SEC review correspondence, one FINRA filing, and a marketing period in which the preliminary prospectus is distributed to qualified institutional buyers. Each stage requires a different access configuration of the same underlying document set.
The first thing Dana does is set up the IPO data room, create seven permission groups, and upload the initial document package. The working group is invited that afternoon, and NGA-gating is activated so no one sees any document before countersigning the NDA.
An M&A data room has one primary audience: the acquirer's due diligence team. An IPO data room has four audiences in sequence, each with a different document set, a different legal relationship and a different risk of disclosure:
Working group. Full access to all draft documents, board materials, cap table, pending litigation, employment agreements and financial model. This group needs complete transparency to identify disclosure gaps before the S-1 is filed.
SEC review correspondence. The SEC Division of Corporation Finance issues comment letters on the S-1 registration statement. All correspondence with the SEC must be preserved in the data room because it becomes publicly filed once the registration is effective. This folder is typically accessible only to counsel and the CFO.
FINRA filing support. The lead underwriter files Form U-1 (or the relevant filing for underwriter compensation disclosure) with FINRA's Corporate Financing Department. Supporting documents such as the underwriting agreement, compensation schedule and lock-up agreements need to be in a separate, clean FINRA folder that legal can reference quickly.
Analyst distribution during the quiet period. After filing and during the roadshow, the preliminary prospectus (the red herring) can be distributed to qualified institutional buyers under Rule 134 and the gun-jumping rules. Documents in this stage must exclude any forward-looking material that is not in the filed prospectus itself.
Each stage requires a data room that can segment access without duplicating the document set. Version control also becomes critical because the S-1 goes through multiple amendments (S-1/A filings) based on SEC comments, and every working-group member must be reading from the same current draft.
The working-group data room for a typical small-to-mid-cap US IPO contains the following document categories.
01 Corporate and Governance
01.1 Certificate of incorporation and bylaws (current and all prior versions)
01.2 Board resolutions (IPO authorization, equity plan approvals, significant transactions)
01.3 Committee charters (audit, compensation, nominating/governance)
01.4 D&O questionnaires and bios for all directors and named executive officers
01.5 Organizational chart (legal entities and subsidiaries)
01.6 Cap table and equity ledger (current, plus 12-month history of all grants and exercises)
01.7 Stockholder agreements, investor rights agreements, voting agreements
01.8 Director independence analysis (outside counsel memo)
02 Financial Statements and Audit
02.1 Audited financial statements (most recent 2-3 fiscal years, plus interim periods)
02.2 Comfort letter readiness assessment and preliminary comfort letter draft
02.3 MD&A supporting schedules (revenue disaggregation, segment data, reconciliations)
02.4 Revenue recognition policy and all significant accounting policy memos
02.5 Non-GAAP reconciliation schedules
02.6 Budget and forecast (working-group only; never distributed to analysts)
02.7 Backlog and pipeline schedules
02.8 Accounts receivable aging and bad-debt reserve support
02.9 Related-party transaction schedules
03 S-1 Drafts and SEC Correspondence
03.1 S-1 initial draft (all versions with version numbering)
03.2 S-1/A amendments (each amendment as a separate file)
03.3 SEC comment letters (all rounds)
03.4 Company responses to SEC comment letters
03.5 Supplemental SEC submissions (exhibits, acceleration request, effectiveness order)
04 FINRA Filing Package
04.1 Underwriting agreement (draft and execution versions)
04.2 Underwriter compensation disclosure schedule
04.3 Lock-up agreements (all directors, officers and 5-pct holders)
04.4 Form U-1 or applicable FINRA submission cover letter
05 Material Contracts
05.1 Customer contracts (top 10 by revenue; full text, not summaries)
05.2 Supplier and vendor contracts (material sole-source or critical-path)
05.3 IP licenses (inbound and outbound)
05.4 Real estate leases (all locations)
05.5 Credit facility, term loan, and any notes or convertible instruments
05.6 Any government contracts or grants
06 Intellectual Property
06.1 Patent portfolio (pending and granted, with prosecution history for key patents)
06.2 Trademark registrations and applications
06.3 Copyright registrations
06.4 Trade secret policy and NDAs with key employees
07 Litigation and Regulatory
07.1 Summary of pending or threatened litigation (litigation counsel memo)
07.2 Pleadings and correspondence for material pending matters
07.3 Government investigations or inquiries (correspondence and counsel memos)
07.4 Product liability claims history (past 3 years)
08 Human Resources
08.1 Organizational chart (by function, with headcount)
08.2 Executive employment agreements (all Section 16 officers)
08.3 Equity plan documents (all active plans)
08.4 Benefit plan summaries and actuarial reports (401k, pension if applicable)
08.5 Offer letters and separation agreements for key departures (past 2 years)
08.6 Any WARN Act notices or reductions in force
09 Analyst Distribution (Quiet Period)
09.1 Preliminary prospectus (each version filed with the SEC)
09.2 Analyst presentation (approved, registered version only)
09.3 Investor FAQ document (approved by counsel)
Setting up permission groups before any document is uploaded prevents the most common IPO data room mistake: granting full access to analysts before the S-1 is filed.
The seven permission groups for a typical offering:
| Group | Scope | Folders |
|---|---|---|
| Core working group | Full access | All |
| Underwriter counsel | Full minus board minutes | All except 01.2 |
| Auditors | Financial and audit folders | 02, 03.1 to 03.4 |
| FINRA reference | FINRA package only | 04 |
| Analyst (quiet period) | Prospectus and approved materials only | 09 |
| SEC correspondence | Correspondence only | 03.3, 03.4, 03.5 |
| Read-only archive | No new access, historical only | All (view only, no download) |
Configure NDA gating at the data room level, not folder by folder, so every invitee signs before seeing any index. Add a watermark configuration that stamps every viewed page with the viewer's email address and timestamp before you share the first draft.
The independent auditors issue two comfort letters: a bring-down letter at pricing and a final letter at closing. Both letters reference specific financial exhibits in the registration statement and confirm that nothing material has changed between the audit date and the comfort letter date.
To support the comfort process, the data room's financial folder needs to be organized so auditors can navigate directly to the schedules they are testing. Number the exhibits in the data room to match the exhibit table in the S-1 filing. When the S-1/A is filed, update the exhibit numbers in the data room to match. This seems administrative, but auditors and counsel lose significant time cross-referencing mismatched exhibit numbers, and a delayed comfort letter can delay pricing.
The quiet period runs from the initial filing date until 25 days after the effective date of the registration statement. During that period, any communication about the company to the investment community is a potential gun-jumping violation.
The data room enforces the quiet period in three ways. First, the analyst distribution group (folder 09) must contain only SEC-filed materials and counsel-approved FAQs. Second, the data room's view-only setting prevents analysts from downloading or printing draft materials. Third, the page-level activity log produces a contemporaneous record showing exactly which analyst accessed which page, which is the evidence a securities counsel needs if a gun-jumping issue is ever raised.
Dynamic watermarking on analyst materials adds a second layer of deterrent. A watermarked preliminary prospectus page photographed and shared externally carries the viewer's email address, making the source traceable.
Sharing the financial model with analysts. The model sits in the working-group folder for good reason: it contains non-public forward-looking information that is never registered with the SEC and cannot be shared with analysts during the quiet period. Teams that run a single access group accidentally expose the model every time.
Not versioning S-1 drafts. The S-1 goes through ten or more drafts before it is filed. Without version numbering in the data room, working-group members read conflicting drafts, SEC responses reference paragraph numbers that have shifted, and the final exhibit table differs from the data room index. Version every draft as "S-1 Draft v1 (2026-07-15)", "S-1 Draft v2 (2026-08-02)", and so on.
Waiting to organize until the SEC comment letter arrives. The SEC typically issues its first comment letter within 30 calendar days of filing. If the data room is not organized by that point, the company and counsel spend the comment response period reorganizing documents instead of drafting responses. Set up the full index on day one of the working-group engagement, even if many folders are empty.
Inadequate access controls during the roadshow. The roadshow brings in dozens of institutional investors. Each one signs an NDA before receiving the preliminary prospectus. The data room's NDA gate automates this, but only if it is configured for the analyst distribution group, not just the core working group. Misconfigured access is the most common audit-log anomaly an underwriter's counsel reviews before closing.
Missing the FINRA deadline. FINRA reviews the underwriting terms and compensation under NASD Rule 2110 (now FINRA Rule 5110). The filing must be made no later than one business day after the registration statement is filed with the SEC. The FINRA folder in the data room should be ready before the S-1 is filed, so the submission can be made the same day.
What documents go in an IPO data room?
The core categories are corporate governance and cap table, audited financials and audit support, all S-1 drafts and SEC correspondence, the FINRA filing package, material contracts, IP registrations, litigation summaries and HR agreements for executive officers. Analyst distribution materials sit in a separate, restricted group and contain only SEC-filed materials and counsel-approved FAQs.
How many permission groups does an IPO data room need?
Most working groups set up five to seven groups: core working group (full access), underwriter counsel (minus board minutes), auditors (financial folders), FINRA reference (underwriting package), analysts during quiet period (prospectus only), SEC correspondence (comment letters only), and a read-only archive. The specific configuration depends on the size of the working group and whether the company uses a single lead underwriter or a syndicate.
What is NDA gating in a data room?
NDA gating requires every invitee to review and countersign the nondisclosure agreement before the data room index becomes visible. It is configured at the data room level, not folder by folder, so the obligation applies to every new invitee regardless of which group they join. Papermark includes NDA gating on the Data Rooms plan from $99/month.
How does a data room support the SEC comment response process?
The SEC issues comment letters within 30 days of an initial S-1 filing. The company and its counsel draft responses that reference specific disclosures in the S-1. If the data room is indexed to match the S-1 exhibit table and every draft is version-numbered, counsel can navigate directly to the referenced paragraph, confirm the current language, and draft the response in a fraction of the time it would take with a disorganized shared drive.
Can analysts access the data room during the quiet period?
Yes, but only the SEC-filed materials and counsel-approved materials in the analyst distribution folder. The working-group documents, financial model, board minutes and any non-public forward-looking information must remain in access-controlled groups that exclude analysts. The data room's audit log produces a record of every access event, which is the contemporaneous evidence needed to demonstrate compliance with the gun-jumping rules.
What is a bring-down comfort letter, and how does the data room support it?
The bring-down comfort letter is issued by the independent auditors at the time of pricing. It confirms that the financial information in the prospectus is consistent with the audited statements and that nothing material has changed since the audit date. To support the bring-down process, the data room's financial folder must be organized to match the prospectus exhibit table, with version numbers consistent between the data room and the latest S-1/A filing. Auditors reference both simultaneously during the bring-down review.
How long should an IPO data room stay open after the offering closes?
Most securities counsel recommend keeping the data room accessible for at least three years after the effective date of the registration statement. Investor lawsuits, SEC inquiries and 10b-5 claims can arise years after the offering, and the data room's audit log and document versions are the primary evidence of what investors were told and when. Configure post-closing access as read-only for all groups except the archive administrator.
For more on preparing a data room for capital markets transactions, see Best data room for IPO, private equity exit data room: the 12-month sell-side plan, and logistics M&A due diligence checklist.
First-time acquirer? Founder preparing for an exit? Here's the practical M&A due diligence checklist you actually need, a downloadable data room index template, and how to organize everything in a data room that won't drive buyers crazy.
A practical guide to the due diligence data room for buying a dental practice -- covering production reports, PPO contracts, lease assignment and the closing pack.
A practical guide to insurance M&A due diligence covering carrier appointments, E&O history, loss reserve analysis, reinsurance treaties, and how to structure the data room folder tree for an insurance company acquisition.
Buying a franchise involves a distinct layer of due diligence on top of standard M&A work: the Franchise Disclosure Document, transfer fees, franchisor consent, and territory-specific financial data. This guide walks through each workstream and the data room setup that supports it.