Guide
How to set up a virtual data room
Published October 12, 2026
Key points
- Build the folder structure and numbering before you upload a single file, not after.
- Set permission groups before you invite anyone; add people to groups, not files.
- 10 of the 11 providers on this site ship a built-in Q&A workflow; confirm yours does before counting on it.
- Run a go-live checklist (watermarking, download rights, expiry) before sending the first invite.
A data room is easy to open and hard to reorganise once people are inside it. Most of the setup work that actually saves time happens before the first external guest logs in: structure, permissions and a clear Q&A path. The sequence below is the order that causes the fewest headaches, based on how the rooms in our 11 providers on this site are documented to work.
What folder structure should a data room use?
Mirror the due-diligence checklist your counterparty (or your own counsel) will use, not your internal company structure. A typical top level looks like: corporate records, financial statements, contracts, intellectual property, employment, litigation, and a final “closing documents” folder added near the end. Number folders (01, 02, 03) so the order stays stable as files are added; a Q&A reference to “folder 4, document 2” should mean the same thing on day one and on day forty.
11 of the 11 providers list native bulk upload, which keeps folder structure and numbering intact when you drag in a whole tree of files at once. Doing this after the structure is finalised, not before, avoids a second pass of renaming.
How should permissions be set up?
Set permission groups before you send a single invite: a typical structure is admin, internal reviewer, buyer counsel, and buyer principal, each with different view, download and print rights. Add people to a group rather than granting permissions file by file; it is the difference between a five-minute change and an afternoon of re-checking access when the buyer adds a second lawyer.
| Group | Typical access | Common restriction |
|---|---|---|
| Admin | Full room, all folders | None, but every admin action is logged |
| Internal reviewer | Full room, view and download | No permission changes |
| Buyer counsel | Assigned folders, view and print | Download often disabled on sensitive folders |
| Buyer principal | Assigned folders, view only | No download, watermark visible |
What goes into a go-live checklist?
Before you send the first invite
- Confirm watermarking is onViewer name, email or timestamp should appear on every page for guest-level access.
- Set an access expiry dateMost rooms let you set a default expiry per user; use it rather than relying on manual removal later.
- Test the Q&A path yourselfPost a question as a test guest account and confirm it routes to the right internal reviewer.
- Check the audit trail is capturing activityOpen a document as a test account, then confirm the log shows it; you want this working before, not during, the deal.
- Send a short access guide with the first inviteA one-page note on how to use Q&A and where the index sits saves a week of basic questions.
How does Q&A actually work once the room is live?
A built-in Q&A workflow lets a buyer post a question against a specific document, an internal reviewer answers or routes it to the right person, and the exchange is published to everyone with the right access once it is resolved. This keeps the same question from being asked (and answered) twice by different people on the buyer side. Not every provider on this site ships this natively; if the room you are evaluating does not, you will be managing Q&A by email instead, which is harder to keep consistent across a long process.
Who should actually set up the room: you, or the vendor?
Most of the time it should be you, or whoever on your team is running the deal. Rooms built for a self-serve setup are designed so a first-time admin can get a folder structure live the same day, without a kickoff call with the vendor. A vendor-assisted setup makes more sense for a very large, multi-advisor deal, where someone with experience structuring that specific deal type can save you a week of trial and error. Either way, confirm before you sign up: some companies bundle setup help into the price, others charge for it separately or require it on their higher plans.
What do admins get wrong the first time?
The most common mistake is treating the room like a shared drive: dumping files in loosely and sorting it out later. The second most common is not testing the guest view before inviting anyone; what an admin sees and what a guest sees are often different, especially around download rights and watermarking. The third is forgetting that access does not end itself. Set an expiry date when you create a guest account, not after someone asks why a buyer from a deal that fell through can still open files three months later.
Frequently asked questions
How long does setup actually take?
A straightforward room with a clear document checklist can be structured and permissioned in a day; most of the time goes into gathering and organising documents, not the software itself.
Should the folder structure match the data room provider’s template?
Use a template as a starting point if the provider offers one, but adjust it to the specific deal type; a fundraising room and an M&A room need different top-level folders.
Can the structure be changed after guests are already in the room?
Yes, but moving or renaming folders after Q&A references them creates confusion; make structural changes before inviting external users where possible.
Do I need IT involved to set up a room?
Not usually for a self-serve plan; IT involvement matters more if you need single sign-on tied to your company directory, which is worth asking about if your company requires it.
What happens to the room after the deal closes?
Most providers let you archive or export the room; confirm the retention period and whether there is a charge for keeping it accessible after closing.