What is a virtual data room (VDR)?
A VDR (aka deal room) is a secure online repository for document storage, access and distribution. Typically, VDRs are used during due diligence, in advance of an investment or sale transaction. Even if a company has records “in the cloud,” using software that allows data-sharing, and utilizing a VDR built specifically for deals is best for parties seeking to control access on a document specific basis, and to have visibility into which persons have accessed which files, and when. Some VDRs have advanced features, such as digital redaction to efficiently remove sensitive data within documents, thereby mitigating the risk of violating data and privacy laws and third-party confidentiality agreements.
Most tech companies will raise capital in multiple funding rounds, with increasingly sophisticated investors. Organizing company records into a VDR will help you navigate each round with a lower risk of error or omission. To make and maintain a favorable impression on investors and their advisors, follow these top tips!
Make Sure the VDR is Secure
Not all VDRs are created equal, so evaluate the VDR’s features, especially its security. Inquire whether the VDR strictly adheres to AT 101 SOC 2 standards, including backups in the cloud and off-site. Other critical security features include: automated virus scanning, 256-bit AES SSL encryption, multifactor authentication, permissions control and invitation delays to protect from unauthorized access.
Create the Structure, then Populate
Structure your VDR into the most common diligence categories — Governance, Finance, Intellectual Property, Human Resources, Real Estate, Litigation, etc. Use sub-folders to further organize data, and create a user-friendly index of the contents. In later stage fundings and sales, the VDR may be organized to respond to the buyer’s diligence list instead.
Manage the Breadth & Depth
Investors will often send you a diligence request list that is overly broad, but they don’t know enough about your company to narrow it, yet. It’s reasonable to ask to limit the scope by date range and materiality to make the process manageable. For example, “all customer contracts” can become “customer contracts entered into in the last 3 years and valued at >$25,000 in annual revenue.”
Protect Confidential Data
Except in limited circumstances, early-stage investors, especially VC funds and other active investors, will not execute non-disclosure agreements (“NDAs”) during initial discussions. Thus, you should ensure any investors you are sharing information with are well-vetted and reputable. Also, even with an NDA, the best protection from competitive use of your most confidential information is to sensibly phase and limit access to protect against distribution to unintended recipients.
Read-Only and Redact
In the VDR, allow for “read-only” rights so that users cannot download or edit sensitive data. You may also redact data to protect confidential information while still granting investors access to information they need to evaluate whether to invest. For example, you can redact customer names and other identifying information from executed contracts, while still showing value, duration and important legalese.
Include the Bad Stuff
Omitting or manipulating information, data or documents in such a manner that you’re misrepresenting reality is a dangerous game that can have legal consequences, including charges of securities fraud. You can package and present the information in a manner that provides a more complete picture of unfavorable aspects of your company, but do not seek to deceive.
When in Doubt, Consult Counsel
Some information should simply not be shown (trade secrets, source code, proprietary formulas, 3rd party confidential data, and the like). Consult legal counsel about the protection of your intellectual property and other sensitive data prior to making information accessible.
Don’t be Late to Update
Establish a content update schedule and stick to it. In order to be accurate and not misleading, information should not be outdated, especially financial records.
