Vendors set defaults to make a new room easy to start, not to make your deal safe. A default that lets every guest download files, or that shows new uploads to all groups until someone hides them, saves clicks in a demo and causes problems in a live process. The admin’s job is to walk through each setting before the first invitation goes out.
This checklist follows the order in which settings matter. Earlier items protect the room itself; later ones protect individual documents and keep the configuration from drifting as the deal moves on.
Which settings come first?
Start with the accounts that can change everything else. A compromised admin account undoes every other control, so admin settings come before anything guests will touch.
| Order | Setting | Common default | Recommended | Why |
|---|---|---|---|---|
| 1 | Number of full admins | Whoever created the room, plus anyone added later | Two named people, no more | Fewer people who can change rights or delete content |
| 2 | 2-step verification for admins | Optional | Required | Admin accounts are the highest-value target |
| 3 | 2-step verification for guests | Optional | Required for all guest groups | Stops reuse of leaked passwords |
| 4 | Visibility of new folders and uploads | Often inherited from the parent folder | Hidden until released | Prevents early exposure of draft or sensitive files |
| 5 | Download and print rights | Often allowed | View-only on sensitive tiers | Limits copies leaving the room |
| 6 | Dynamic watermarks | Off or name only | Name, email and timestamp on all viewed and printed pages | Traces any copy to a person and a time |
| 7 | Session timeout | Long or none | 30 to 60 minutes idle | Covers unattended laptops |
| 8 | Invitation link lifetime | Several days or no expiry | Short, with re-send on request | Stops forwarded invitations being used later |
| 9 | IP or location restrictions | Off | On only where your policy requires it | Useful for regulated deals, disruptive otherwise |
| 10 | Activity alerts | Off | On for bulk downloads and new admin rights | Early warning of unusual behavior |
Not every platform exposes every setting, and names vary. Where a control is missing, record the gap and decide whether a process step (for example, keeping a folder out of the room until later) can cover it.
How common are these controls across data room software?
The controls in the table above are not equally available. In our facts file, viewer watermarks and activity logs are listed by all 18 platforms. File-level access rights are listed by 15, and 2-step verification by 14. In-app redaction, which matters for documents containing personal data, is listed by only seven.
How many of the 18 platforms list each control
Diligence workflow
Document protection
Integrations
The four platforms without 2-step verification in our facts file are ShareVault, Venue by DFIN, Digify and DocSend. That does not necessarily mean guests cannot be protected on them; some rely on single sign-on or other login checks. It does mean you should ask the vendor how guest accounts are secured and get the answer documented. The feature comparison shows every platform’s listed controls side by side.
How should folder rights be organized?
Setting rights file by file is how rooms end up inconsistent. Instead, sort every folder into one of three tiers and apply the tier’s rights to all groups at once.
| Tier | Typical contents | View | Download | Watermark | |
|---|---|---|---|---|---|
| Standard | Corporate records, policies, standard contracts | All active bidders | Allowed for advisers | Allowed | Yes |
| Restricted | Customer and supplier contracts, detailed financials | Bidders in the current round | View-only | Watermarked print only | Yes |
| Clean team | Pricing by customer, employee data, competitively sensitive data | Named clean team members only | No | No | Yes |
The clean team tier deserves particular care. When a buyer is a competitor, competition lawyers usually require that commercially sensitive information is seen only by a ring-fenced group under separate undertakings. The data room is how that ring fence is enforced in practice, so build the clean team group before uploading those files and check its membership against the signed undertakings.
What should you do on launch day?
Security steps on the day guests arrive
- View the room as each group
Use the view-as feature or a test account in each group. Confirm folders, rights and watermarks match the tier plan.
- Check a printed and downloaded page
Print one restricted document to PDF and download one standard document. Confirm the watermark appears and is readable.
- Confirm 2-step verification is enforced
Sign in as a fresh test guest and make sure the second step is requested before any document opens.
- Freeze the admin list
Confirm only the named admins hold full rights. Remove anyone added for convenience during the build.
- Send invitations in batches
Invite one bidder group at a time and confirm each lands in the right group before inviting the next.
Do some deals need stricter settings than others?
The checklist above is a baseline. Some processes call for tighter settings, and the reasons are usually visible before the room is built.
A competitor among the bidders. When a trade buyer competes with the target, the clean team tier stops being optional. Expect competition counsel to ask for named membership lists, no downloads and a record of every view in that tier. Build the group, test it and send the membership list to counsel for sign-off before the first upload.
Regulated or personal data. Employee files, patient information and customer records bring privacy law into the room. Redact what bidders do not need, keep the rest view-only and limit who can see it. Fewer than half the platforms in our facts file list in-app redaction, so plan for redaction before upload if your platform does not offer it.
Intellectual property. Source code, formulas, clinical data and unpublished patent filings are often shown rather than shared. Some sellers keep them out of the room entirely and run supervised sessions instead. If they go into the room, use the clean team tier, disable printing and set short session timeouts.
Many bidders in the first round. A broad auction means many users who will never progress. Keep first-round access to a narrow set of folders, release deeper tiers only to shortlisted bidders and disable groups promptly as bidders drop out.
In each case the principle is the same: decide the tier of a document before it is uploaded, not after a bidder has already seen it.
What should be reviewed every week?
Security settings drift. Advisers join and leave, bidders drop out, documents are added under deadline pressure and someone grants download rights to solve a complaint. A short weekly review catches most of it.
Weekly data room security review
- Users who have not signed in for 14 days: confirm they still need access
- Bidders who have left the process: disable the whole group, not individual users
- New folders created this week: confirm their tier and inherited rights
- Any change to download or print rights: confirm who made it and why
- Activity alerts and large downloads: review and record the outcome
- Admin list: still the same named people
Keep the review short and keep a record of it. If something goes wrong, a dated log of weekly checks is evidence that the room was managed with care.
What happens to security settings at closing?
Closing is a security event too. Bidders who lost should have lost access the day they left the process, but the winning buyer often keeps access until completion. After that, the room should be archived and access ended for every outside user. Export the activity log and the Q&A record before access is removed, because some platforms limit what can be exported once a room is closed.
The data room setup hub covers the full closing sequence, and the scoring behind the security criterion is explained in our scoring methodology.
Frequently asked questions
Should 2-step verification be mandatory for bidders?
Yes, for any process involving confidential information. It adds a few seconds to each sign-in and stops most attacks based on reused or leaked passwords.
Is view-only mode enough to stop leaks?
No. It stops downloads and printing from the browser, but not photographs or screen captures. Combine it with dynamic watermarks so any copy can be traced.
How many admins should a data room have?
Two named full admins is a common choice: enough to cover absence, few enough to keep control. Other team members can have narrower rights such as uploading to their own folders.
Should we restrict access by IP address?
Only if a regulator, client or internal policy requires it. IP restrictions often block legitimate advisers working from home or traveling, so they create support work in most deals.