Guide
Getting a data room approved by IT security: what infosec teams ask and how to answer
Published October 26, 2026
Key points
- Most IT security reviews of a data room cover the same areas: certifications, data location, access control, encryption, sub-processors, incident response and contract terms.
- Ask the vendor for its security pack (SOC 2 report, ISO 27001 certificate, security overview, completed questionnaire) before IT asks you.
- Start the review in parallel with the commercial decision, not after it; reviews often take one to four weeks.
- Some controls are on you, not the vendor: 2-step login, permissions, watermarks and offboarding.
- Of the 11 providers we review, 11 list a SOC 2 report and 9 list ISO 27001.
Many companies require a security review before any new software touches confidential data, and a data room full of financials, contracts and employee files is exactly the kind of tool infosec wants to check. Deal teams sometimes discover this only after choosing a provider, which can delay the launch of a sale or fundraise by weeks.
The review does not have to be slow. Security teams ask predictable questions, and most established data room vendors have the answers ready. This guide lists what is usually asked, what to request from the vendor and how to run the process in parallel with the deal.
What IT security usually checks
| Area | Typical question | Evidence to request |
|---|---|---|
| Certifications | Do you have SOC 2 Type II or ISO 27001? | Report or certificate, with dates and scope |
| Data location | Where is our data stored and processed? | Hosting regions, sub-processor list |
| Encryption | Is data encrypted in transit and at rest? | Security overview, key management description |
| Access control | SSO, 2-step login, role-based permissions? | Product documentation |
| Logging | Are user actions logged and exportable? | Audit trail documentation |
| Vulnerability management | Pen tests, patching, bug bounty? | Pen test summary or attestation |
| Incident response | How and when will you notify us of a breach? | Incident policy, contract clause |
| Business continuity | Backups, recovery objectives? | BCP/DR summary |
| Data lifecycle | Retention and deletion at the end of the deal? | Policy and contract terms |
| Legal | DPA, liability, confidentiality | Contract and data processing agreement |
Certifications and login controls across the 11
From each provider's public documentation. Ask for the report itself, not just the badge.
A SOC 2 report can cover the vendor’s own application or only the hosting provider underneath it. Both are useful, but they answer different questions. Read the scope section, and ask the vendor if it is unclear.
A faster approval path
Running security review alongside vendor selection
- 01 Shortlist Pick two or three vendors for the deal.
- 02 Request packs Ask each for its security pack and questionnaire answers.
- 03 Pre-brief IT Tell infosec the deal timeline and data types involved.
- 04 Review IT reviews packs; vendor answers follow-up questions.
- 05 Approve and configure Approval with conditions, then set the required controls.
Get a data room through IT security review
- Find your processAsk IT how vendor reviews work, who owns them and how long they take.
- Classify the dataTell IT what will go in the room: financials, personal data, health data, IP.
- Request the security pack earlySOC 2 report or ISO certificate, security overview, sub-processor list, standard questionnaire answers.
- Use standard questionnairesMany vendors have pre-filled industry questionnaires; IT can often accept them instead of its own.
- Agree conditionsIT may approve with conditions such as SSO, 2-step login for all users or a specific region.
- Configure and recordSet the agreed controls and keep a note of the approval with the deal file.
Controls that are your responsibility
A vendor’s certifications cover its systems. How the room is configured is up to you, and IT will often make approval conditional on it.
Customer-side controls IT usually expects
- 2-step verification required for every user, not only admins.
- Permission groups set by role, with least access by default.
- Watermarks on for guest users.
- Download and print restricted on sensitive folders.
- Access expiry dates for external users.
- Offboarding of internal and external users when the deal ends.
- Regular review of the activity log.
Deal controls across the 11
Deal controls, provider by provider
| Provider | Q&A | Audit log | Watermark | Redact | Rights | Bulk upload |
|---|---|---|---|---|---|---|
 Ellty | ● | ● | ● | ○ | ● | ● |
 Datasite | ● | ● | ● | ● | ● | ● |
 Ansarada | ● | ● | ● | ○ | ● | ● |
 iDeals | ● | ● | ● | ● | ● | ● |
 Drooms | ● | ● | ● | ● | ● | ● |
 Intralinks | ● | ● | ● | ● | ● | ● |
 Firmex | ● | ● | ● | ● | ● | ● |
 SmartRoom | ● | ● | ● | ● | ● | ● |
 ShareVault | ● | ● | ● | ○ | ● | ● |
 DealRoom | ● | ● | ● | ○ | ● | ● |
 Digify | ○ | ● | ● | ○ | ● | ● |
| Total | 10/11 | 11/11 | 11/11 | 6/11 | 11/11 | 11/11 |
Deal controls listed by each provider. Use it to check whether the controls your IT team requires are available before the review starts.
Our security checklist covers the configuration side in more depth, and each provider review lists certifications and login options.
Frequently asked questions
How long does an IT security review of a data room take?
Often one to four weeks, depending on your company's process and how quickly the vendor answers. Starting during vendor selection saves time.
What documents should I ask a data room vendor for?
A SOC 2 report or ISO 27001 certificate, a security overview, the sub-processor list, a completed standard questionnaire and the data processing agreement.
Does IT need to approve a data room for a one-off deal?
Many companies require it for any tool holding confidential data, even short term. Ask early.
Is SSO required for a data room?
Not always. Some IT teams require it for internal users; others accept enforced 2-step verification. Check your policy.
Who is responsible for data room security, the vendor or us?
Both. The vendor secures the platform; you configure access, permissions and offboarding.