Guide
Data room security: a checklist before you share documents
Published October 12, 2026
Key points
- 11 of the 11 providers list at least one of SOC 2 or ISO 27001; 9 list both.
- Certification is necessary but not sufficient: access controls and watermarking matter just as much day to day.
- Ask a vendor for the actual attestation document, not just a badge on a marketing page.
- Run this checklist yourself before documents go in, rather than relying on a vendor’s own security page.
A security page on a vendor’s website tells you what they claim. This checklist is what to actually verify before sensitive documents go into a room, whether you are setting one up for the first time or reviewing one a counterparty picked.
Start with certifications, but do not stop there
| Certification | What it signals | What to still check yourself |
|---|---|---|
| SOC 2 | An independent auditor reviewed the vendor’s security controls over a period of time. | Ask for the actual report (Type II, not just Type I) and its date. |
| ISO 27001 | A certified information security management system is in place. | Confirm the certificate covers the specific product you are using, not just the parent company. |
| None listed | No independent attestation published. | Ask directly what internal security practices are in place and whether a report exists under NDA. |
11 of the 11 providers we review list at least one of these two certifications in their public documentation; 9 list both. A missing certification is not automatically disqualifying for a lower- stakes share, but it changes what you should ask for in writing before relying on the room for anything sensitive.
Marketing pages often display a certification badge without a date or scope. Ask the vendor for the actual attestation letter or report and check when it was issued; a certification from several years ago with no recent renewal is worth a direct question.
What to check beyond certification
Run this before documents go into the room
- Confirm watermarking is on by default for guest-level access, not an optional add-on you have to remember to enable.
- Confirm per-folder access rights, so a buyer’s financial adviser and legal counsel do not automatically see the same folders.
- Confirm the audit trail logs downloads and prints, not just views.
- Ask whether two-step verification is available, and turn it on for every admin account.
- Confirm what happens to access and data after the deal closes or falls through.
What about redaction?
If a document needs sensitive data removed before a wider group sees it, in-platform redaction avoids a round trip of exporting, editing and re-uploading a file, which itself creates a security gap (an edited copy sitting outside the room). Check whether redaction happens inside the platform on the specific provider you are evaluating; not every room on this list includes it.
Security score, all 11 providers
Darker bars hold both SOC 2 and ISO 27001. Full formula on our scoring page.
What about the people who log in, not just the files?
Document controls get most of the attention, but a weak login is just as real a risk. Turn on two-step verification for every admin account, not just guest accounts; an admin login usually has the broadest access in the room. If your company already uses a central identity system, check whether the provider supports single sign-on so staff log in with the same credentials they already use, rather than a separate password to manage and eventually forget. Not every provider on this list offers this; check each one’s review for the specifics before you rely on it.
How this applies differently by deal type
An M&A room generally needs the deepest security posture, given the number of parties and the sensitivity of the documents; see our M&A due-diligence guide for the deal-control side of that. A fundraising room can run a lighter version of this checklist; see our fundraising guide for what to prioritise there instead.
Frequently asked questions
Is SOC 2 or ISO 27001 more important?
They measure different things and are not directly interchangeable; ISO 27001 certifies an ongoing management system, SOC 2 reports on controls over a specific period. Ask which one matters to your own compliance requirements.
Is a password-protected PDF a safe alternative to a data room?
No. A password-protected file has no access logging, no per-user revocation and no watermarking once it is downloaded; it does not give you the controls this checklist covers.
How often should certifications be re-checked?
At least once a year, or before any deal where security is material; certifications can lapse or narrow in scope.
Does single sign-on matter if we are a small team?
Less than for a large company, but it still removes one more password to manage and forget. For a small team, consistent two-step verification matters more than SSO.
Who should own the security review, legal or IT?
Both, ideally. Legal usually cares about the certification and data-handling terms; IT usually cares about login security and integration. A quick review by each before you commit catches different things.