Data room glossary

50 terms you will meet choosing and running a virtual data room, defined in plain language. Each entry links to the guide where the term matters.

Access log: A record of who opened the data room, which documents they viewed and when. Audit-grade access logs are exportable, timestamped and cannot be edited by the room administrator, which is what makes them usable in a dispute after closing.; Related: Audit trail
Audit trail: The complete, chronological record of actions inside a data room: uploads, permission changes, views, downloads, Q&A messages and NDA acceptances. A deal-grade audit trail can be exported for counsel, auditors or a court and is one of the main reasons a VDR replaces shared drives.; Related: Access log
Bidder: A party invited into a sale process to evaluate the target and submit an offer. Each bidder, or bidder group, normally gets its own permission group in the data room so that competing buyers never see each other or each other's questions.; Related: Buyer group, Fence view
Buy-side: The acquirer's side of a transaction, including its advisers. A buy-side data room is used to collect, review and track diligence findings on a target, in contrast to the sell-side room that distributes the target's documents.; Related: Sell-side
Buyer group: A permission group that bundles everyone working for one bidder, such as the acquirer, its lawyers, accountants and lenders, so that access rights can be set once per bidder rather than per person.; Related: Bidder, Granular permissions
Clean team: A restricted group, usually outside advisers, allowed to see commercially sensitive information such as customer contracts or pricing that the bidder's own staff must not see before closing, for antitrust or competition reasons. Data rooms implement this as a separate folder with its own permission group.; Related: Granular permissions
Confidential information memorandum (CIM): The marketing document a seller's adviser sends to approved bidders under NDA, describing the business, financials and growth case. It is usually the first document placed in the data room and the one with the widest audience.; Related: NDA gating, Teaser
Data residency: Where the data room's files are physically stored. European sellers and regulated industries often require EU data residency so that documents stay within a jurisdiction; the option is published by some vendors and quoted by others.; Related: GDPR
Data room index: The numbered folder and document structure of a room, for example 1.0 Corporate, 1.1 Articles, 2.0 Financial. A stable index lets bidders cite documents by number in questions and lets the seller track what has been added since the last update.; Related: Folder structure · Data room index template
Deal room: Another name for a virtual data room, used mostly in fundraising and mid-market M&A. The term usually implies a lighter, faster-to-launch room rather than an enterprise platform.; Related: Virtual data room (VDR)
Disclosure schedule: The exhibits to a purchase agreement in which the seller lists exceptions to its representations and warranties. Each item typically references a document in the data room by index number, so the room is frozen and archived at signing as the record of what was disclosed.; Related: Data room index
Document expiry: A control that makes a shared document or link stop working after a set date or event, such as the end of a bid round. Expiry limits the window in which a leaked link is useful.; Related: Link sharing
Download permission: Whether a viewer may save an original file or only read it in the browser. View-only access combined with watermarking is the standard setting for first-round bidders; downloads are usually enabled only for the final bidder or its counsel.; Related: Granular permissions, Watermarking
Due diligence: The buyer's investigation of a target before signing: financial, legal, tax, commercial, operational, technical and HR workstreams, each with its own request list. The data room is where the seller answers those requests and tracks who has looked at what.; Related: Request list, Q&A workflow · Best data rooms for due diligence
Dynamic watermark: A watermark generated at view time that stamps each page with the viewer's name, email, IP address and the time, so a screenshot or printout can be traced to the person who made it. Static watermarks show the same text to everyone and offer much less deterrence.; Related: Watermarking
E-signature: Electronic signing of documents such as NDAs or the purchase agreement. Some data rooms embed e-signature for NDA acceptance; the purchase agreement itself is usually signed through a dedicated tool and the executed copy archived in the room.; Related: NDA gating
Exclusivity: A period, agreed in the LOI, during which the seller negotiates with one bidder only. Data room activity during exclusivity shifts from many bidders with narrow access to one bidder with deep access, which is when permissions must be re-checked.; Related: Letter of intent (LOI)
Fence view: A viewing mode that shows only part of a page at a time behind a movable window, so a screenshot captures a fragment rather than the whole document. It is a deterrent for highly sensitive pages rather than a guarantee.; Related: Screenshot prevention, Dynamic watermark
Flat-rate pricing: A subscription that charges a fixed monthly or annual fee regardless of pages, documents or visitors. It makes cost predictable for document-heavy processes and is the model Papermark, SecureDocs and Digify publish.; Related: Per-page pricing, Per-user pricing · Pricing index
Folder structure: How documents are grouped inside the room. A good structure mirrors the diligence request list so that a bidder can find the answer to request 4.2 in folder 4.2, and it stays stable once bidders are inside.; Related: Data room index
Full-text search: Search across the content of documents, not just their titles, which depends on OCR for scanned files. Essential for rooms with thousands of documents and for bidders checking whether a term appears in any contract.; Related: OCR
GDPR: The EU General Data Protection Regulation. For a data room it means a data processing agreement with the vendor, a known sub-processor list, an EU residency option where personal data is involved, and the ability to delete data on request after the deal.; Related: Data residency · GDPR-compliant data rooms
Granular permissions: Access rights set per folder, document or user group: view, download, print, edit, upload. Granular permissions let one room serve several bidders, a clean team and internal staff without duplicating documents.; Related: Buyer group, Download permission
Information rights management (IRM): Controls that follow a document after download, such as blocking printing, forwarding or opening after a date. Also called DRM. Useful when downloads are unavoidable; otherwise view-only access with watermarks is simpler.; Related: Download permission, Document expiry
ISO 27001: The international standard for information security management. Certification means an accredited body audited the vendor's security programme; it says nothing about the specific features of the data room.; Related: SOC 2
Letter of intent (LOI): A non-binding offer that sets price, structure and exclusivity before confirmatory diligence. Signing the LOI is usually when the seller opens the full data room to the chosen bidder and its advisers.; Related: Exclusivity
Link sharing: Granting access through a URL rather than a named account. Secure link sharing adds email verification, NDA acceptance and expiry so the link is tied to a person; plain cloud-storage links are not and are the usual source of leaks.; Related: Document expiry, NDA gating
Management presentation: The meeting in which the target's leadership presents the business to shortlisted bidders. The slides and any follow-up materials are normally posted to the data room afterwards so every bidder has the same record.; Related: Confidential information memorandum (CIM)
NDA gating: Requiring a viewer to accept a non-disclosure agreement inside the data room before any document opens, with the acceptance logged against their identity. It replaces chasing signed PDFs by email and gives counsel a clean record.; Related: E-signature, Link sharing
OCR: Optical character recognition, which turns scanned PDFs and images into searchable text. Without OCR, old contracts and signed documents are invisible to search and to AI redaction tools.; Related: Full-text search, Redaction
Page-level analytics: Reporting that shows which pages of a document each viewer opened and for how long, rather than just whether the file was opened. Sellers use it to gauge bidder seriousness; founders use it to see which slides an investor lingered on.; Related: Viewer analytics
Per-page pricing: An enterprise pricing model that charges for every page uploaded, historically about $0.40 to $0.85 per page, often with user and duration fees on top. It makes large rooms expensive and is the main reason mid-market sellers move to flat subscriptions.; Related: Flat-rate pricing · Cost calculator
Per-user pricing: A subscription priced per licensed user, usually per month. Cheap for a founder, expensive for a deal team of twenty, and sometimes applied only to administrators while visitors are free.; Related: Flat-rate pricing
Permission group: A named set of users who share the same access rights, such as Bidder A, Lenders or Internal. Groups are how a room scales from five users to five hundred without per-person configuration.; Related: Granular permissions, Buyer group
Physical data room: The pre-2000s practice of putting a company's documents in a locked room for bidders to visit in person, one at a time. The virtual data room replaced it; the name survived.; Related: Virtual data room (VDR)
Q&A workflow: A structured process inside the room for bidders to ask questions about specific documents and for the seller's team to route, answer and publish responses, often with answers shared to all bidders or kept private. Email Q&A loses this record.; Related: Request list
Redaction: Permanently blacking out names, prices or other sensitive text in a document before it is shared, as opposed to hiding it with a layer that can be removed. Built-in redaction saves re-uploading files and is often AI-assisted for bulk work.; Related: OCR, Clean team
Request list: The buyer's itemised list of documents and answers it wants, usually numbered by workstream. The seller's data room index is normally built to mirror it so each request maps to a folder.; Related: Due diligence, Data room index
Screenshot prevention: Techniques that make screen captures useless, such as fence view, blurring on focus loss or disabling capture in a desktop app. None is absolute; dynamic watermarks remain the reliable deterrent because they make a leak attributable.; Related: Fence view, Dynamic watermark
Sell-side: The seller and its advisers in a transaction. A sell-side data room is built before launch, opened to bidders in stages, and archived at closing as the record of disclosure.; Related: Buy-side · Best data rooms for M&A
Single sign-on (SSO): Logging in through a corporate identity provider such as Microsoft Entra ID or Okta instead of a separate password. Usually required by banks and large corporates and usually sold on enterprise tiers.; Related: Two-factor authentication (2FA)
SOC 2: An audit report on a vendor's security controls, issued by an independent accountant. Type I covers design at a point in time; Type II covers operation over a period. Buyers' security teams usually ask for the Type II report under NDA.; Related: ISO 27001
Staged disclosure: Releasing documents in rounds that match the deal process: teaser, CIM, first-round room, confirmatory room, and finally the most sensitive material for the chosen bidder. Permission groups and folder-level rights make staging practical.; Related: Granular permissions, Exclusivity
Teaser: A one or two page anonymised summary of the target sent to potential bidders before any NDA. It lives outside the data room; the CIM and everything after it live inside.; Related: Confidential information memorandum (CIM)
Transition services agreement (TSA): A contract under which the seller keeps providing services such as IT, payroll or facilities to the sold business for a period after closing. Drafting it depends on documents collected during diligence, so the data room is usually where the TSA schedule starts.; TSA guide and checklist
Two-factor authentication (2FA): A second proof of identity at login, such as a code from an app, in addition to a password. Deal-grade rooms allow administrators to require it for every visitor, not just offer it.; Related: Single sign-on (SSO)
Version control: Replacing a document with a newer version behind the same index number and link, while keeping the history. It prevents the v7-final-FINAL problem and lets bidders see that a file changed since their last visit.; Related: Data room index
Viewer analytics: Reports on who viewed which documents, how often and for how long, usually by user and by bidder group. Sellers use them to prioritise follow-up; founders use them to read investor interest.; Related: Page-level analytics
Virtual data room (VDR): A secure online repository for sharing confidential documents with outside parties during a transaction, with permissions, watermarking, audit trails, Q&A and analytics that ordinary cloud storage lacks. Used for M&A, fundraising, IPOs, audits, restructurings and litigation.; Related: Deal room, Physical data room · Best virtual data rooms
Watermarking: Overlaying text on every page of a viewed or downloaded document to identify its source. Dynamic watermarks that carry the viewer's identity are the deal standard; a static company logo is not a security control.; Related: Dynamic watermark