What to include in a data room for investors (and how they actually read it)

You've had the first call. The investor liked what they heard. They asked for your data room. Now what?

Most founders scramble at this point - throwing documents into a shared Google Drive folder, sending a Dropbox link with no structure, or worse, emailing attachments. That's a bad look. Not because it's messy, but because a data room is the first real test of how you operate.

This guide covers everything you need to know: what a data room is, what goes in it, how investors actually read through it, and how to set one up without spending weeks on it.

What a data room actually is

A data room is a secure, organized collection of documents that investors review during due diligence. It's where you prove that everything you said in your pitch deck is real.

Traditionally, data rooms were physical rooms - literally a locked room full of binders. Banks and law firms would control access. Investors flew in to review documents in person.

Today, a virtual data room (VDR) is a secure online space where you upload documents and control who sees what. Investors access it remotely. You can track who opened what, which pages they read, and how long they spent on each section.

A pitch deck is a sales tool. A data room is a verification tool. You use your deck to get the meeting. You use your data room to close the round.

There are two main contexts where data rooms come up:

• Venture fundraising - when a VC or angel wants to do diligence before writing a check
• M&A due diligence - when a buyer wants to verify everything before acquiring your company

The core principle is the same. The documents differ a bit, and the depth of scrutiny in M&A is usually much higher.

What investors look for the moment they open it

Before they read a single document, investors are already forming an opinion. Here's what they notice immediately:

01. Is it organized?

Clear folder structure, logical naming, no duplicates. If they can't find the cap table in 30 seconds, that's a red flag.

02. Is it complete?

Missing documents get flagged. "We're working on it" wastes everyone's time and signals that you weren't ready for diligence.

03. Is it current?

A financial model that's 18 months old tells them you don't maintain your numbers. Every key doc should be dated and up to date.

04. Is access controlled?

A properly set up VDR with permissions shows operational maturity. A Google Drive link with "anyone can view" does not.

"How a founder runs their data room tells you a lot about how they'll run the company."

Investors see hundreds of data rooms per year. The ones that stand out aren't flashy - they're easy to navigate, complete, and clearly maintained by someone who knows what they're doing.

The 4 P's of due diligence

Due diligence follows a pattern. Most experienced investors and M&A advisors think about it through four dimensions - commonly called the 4 P's.

Every document in your data room fits into one of these buckets. When you're deciding what to include, run it through this filter: which P does this address?

If a document doesn't clearly address at least one P, you probably don't need it in the room.

What to include in a data room for investors

Here's the practical list. Not every document is required at every stage - use your judgment. An early seed deal has a lighter checklist than a Series B with a 12-week diligence process.

Company and legal

Financials

Product and technology

Team

Market and business

Common mistake
Don't upload everything you have. A bloated data room with 200 documents makes investors suspicious - either you're hiding something in the noise, or you don't know what matters. Be selective. 40-60 focused documents is almost always better than 200.

How to structure and organize it

Structure is underrated. Investors open your room and start navigating. If they can't find what they want in two clicks, they lose patience.

Use this folder structure as a starting point:

Number your folders so they sort predictably. Use consistent file naming - include dates where relevant. Don't use abbreviations that only make sense internally.

Naming files correctly

How investors actually review a data room - step by step

Here's what typically happens after an investor gets access to your room. It's not random.

Pass 1: the context pass (minutes 1-10)

They re-read the deck to refresh context. They're not reading for new information - they're orienting themselves before diving into documents. If your deck is in the room and well-organized, this goes smoothly.

Pass 2: the legal and ownership check (minutes 10-30)

Cap table is always early. They want to know who owns what, whether there are any weird terms, and if the equity structure is clean. Red flags here: too many tiny shareholders, unusual veto rights, founder shares without vesting, prior investors with blocking rights.

Pass 3: the numbers deep-dive (30-90 minutes, sometimes more)

This is where analysts spend most of their time. They'll open your financial model and start poking at assumptions. They cross-check your metrics against your bank statements. They calculate your burn independently. They look at cohort data if you have it.

If your numbers don't reconcile across documents, they notice. If your financial model's revenue assumptions don't match your actual reported MRR, they'll flag it.

Pass 4: product and team verification

They verify that the team actually exists and has the background you claim. They'll Google founders, check LinkedIn, and sometimes call references before you even know it's happening. On product, they want to see it - either a live demo link or screenshots. The roadmap gets scanned but not analyzed in depth unless the product is the core of the thesis.

Pass 5: the question list

After the initial review, most investors send a list of follow-up questions. This is normal. A long list doesn't mean they're skeptical - it means they're doing real work. A short list or no list often means they weren't that interested.

Set up a trackable data room in minutes and see exactly how investors engage with your documents - page by page, in real time. Start free, no credit card needed.

How investors review a data room in M&A deals

M&A due diligence is a different beast from VC fundraising diligence. The intent is different (buying vs. backing), the timeline is longer, and the depth of scrutiny is significantly higher.

Key differences

In M&A, the buyer's legal team will review every customer contract for change-of-control clauses. Their finance team will rebuild your model from scratch and test it against actual bank statements. Their technical team may do a code audit. Their HR team will look at employment agreements, benefits, and key-person risk.

This is why M&A data rooms often require features like:

• Granular access permissions (which user sees which folder)
• Dynamic watermarking on every document
• NDA acceptance before access is granted
• Full audit logs of every action taken in the room
• Q&A management tools for coordinating questions across multiple workstreams

If you're going through M&A, a basic file-sharing tool won't cut it. You need a proper VDR with the right permission controls.

Data room best practices

These are the things experienced founders do that most first-timers skip.

Keep it updated continuously

Don't build your data room when you start fundraising. Maintain it as a living resource. Update financials monthly, keep contracts current, and refresh the deck whenever you make major changes. That way, when an investor asks for access, you can share it same day.

Don't share it too early

Some founders share their data room at the first sign of interest. That's premature. Share your pitch deck first. Only open the data room when there's a real signal - a verbal indication of interest or a term sheet in play. Sharing too early devalues it.

Use separate access levels

Not everyone needs to see everything. Give a potential investor early access to your deck, market analysis, and team bios. Only unlock financials and legal when you're further along in the conversation. This is especially important if you're talking to multiple investors simultaneously and some are competitors of each other.

Track engagement - and use it

If you're using a VDR with analytics, treat the data as signal. If an investor hasn't opened your room after 5 days, follow up. If they spent 45 minutes on your unit economics and went quiet, offer a call to walk through the assumptions. The analytics give you information - use it.

Have a Q&A process ready

When follow-up questions come in, respond quickly and thoroughly. Create a running Q&A document and add every answered question to it. If one investor asks something, others likely will too.

Remove documents investors don't need

An overfull data room is as bad as an empty one. Cut anything that's outdated, redundant, or irrelevant to the investment decision. Less is more. Investors appreciate founders who know what matters.

Self-hosted data room vs. SaaS VDR

Some teams try to self-host their data room - usually using a combination of Google Drive, Notion, or even a password-protected section of their own website. Here's an honest look at both approaches.

A self-hosted data room can work for a pre-seed round with two friendly angels. But once you're dealing with institutional investors, a formal Series A, or any M&A process, the lack of controls and analytics becomes a real liability.

You won't know if your lead investor spent 3 minutes or 3 hours in your room. You can't see if they forwarded the link to someone outside the firm. You can't watermark documents to trace leaks. And you'll spend time manually managing access instead of fundraising.

Virtual data room comparison

There are a lot of VDR options. Here's how the main categories break down.

Enterprise VDRs like Datasite and Intralinks are priced for banks and law firms. They're powerful, but you're often looking at $1,000+ per month, sometimes with per-user and per-page pricing. That's fine if you're running a $500M acquisition. It's not the right tool for a founder raising a $3M seed round.

For most startups, the realistic choice is between a simpler VDR built for founders or stitching together Drive + a document analytics tool. Ellty sits in the former category - data room features with flat monthly pricing, no per-user fees, and analytics included from the start.

Where Ellty fits in

Ellty is built for founders who need a secure, trackable place to share documents - primarily pitch decks and data rooms - without the pricing model of enterprise VDRs.

What Ellty offers

Ellty works well when you're raising a seed or Series A round and you need more than a Google Drive link but less than an enterprise VDR. The analytics on pitch deck sharing are particularly useful - you can see which slides investors lingered on before they even reply to your email.

It's not the right tool if you're running a large M&A transaction with dozens of external advisors, complex Q&A workflows, and the need for legal-grade audit trails. For that, you'd look at Datasite or iDeals.

But for the majority of founders going through a standard fundraising process, Ellty offers data room features without per-user pricing, which keeps costs predictable as you add team members or expand investor access.

FAQ

What should I include in a data room for investors?

At minimum: pitch deck, cap table, financial model, unit economics, product overview, team bios, and key legal documents (incorporation, IP assignments, prior investment docs). At Series A and beyond, add historical financials, key customer contracts, and a detailed market analysis. The exact list depends on your stage and what the investor is focused on.

What are the 4 P's of due diligence?

People, Product, Performance, and Potential. People covers the team and their ability to execute. Product covers the technology, IP, and roadmap. Performance covers the financial metrics and unit economics. Potential covers the market size and competitive positioning. Most documents in a data room map to at least one of these four categories.

What should I expect in a data room review?

Expect investors to start with your pitch deck, move to the cap table and legal section, then spend significant time on your financial model and metrics. They'll cross-reference numbers across documents and follow up with specific questions. The whole initial review can take anywhere from a few hours to a couple of weeks depending on the investor's process and the complexity of your business.

How is a data room used in M&A vs. venture fundraising?

In venture fundraising, a data room is usually reviewed by 1-3 people over a few weeks. In M&A, entire deal teams - legal, finance, technical, HR - review a much larger set of documents over months. M&A data rooms require stronger access controls, full audit logs, NDA gating, and often Q&A management tools. The document volume is typically 5-10x larger than a fundraising data room.

Can I use Google Drive as a data room?

You can, but it comes with real limitations. Drive has no document-level analytics, no NDA gating, no watermarking, and basic access controls. For a pre-seed round with friendly angels, it might work. For any formal institutional raise, a proper virtual data room gives you meaningful advantages - mainly the ability to track investor engagement and control access more precisely.

What is a self-hosted data room?

A self-hosted data room is one you set up and manage yourself, usually using existing tools like Google Drive, Dropbox, Notion, or a password-protected website. It costs less upfront but lacks the security features, analytics, and access controls that a purpose-built VDR provides. Most founders start here and upgrade as their fundraising gets more serious.

How do investors use data room analytics?

Some VDRs give investors visibility into their own activity summaries, but the analytics are primarily a tool for founders. You can see which documents were opened, which pages were viewed, how long each session lasted, and who accessed what. This helps you gauge interest level, prepare for the right follow-up conversation, and identify if there are sections investors aren't engaging with.

When should I send an investor my data room?

Not at the first meeting. Share your pitch deck first. Open the data room only when there's a genuine signal of interest - a verbal indication they're moving forward, a request for more detailed information, or a term sheet in play. Sharing too early devalues the data room and risks distributing sensitive information to investors who aren't serious.

Do I need an NDA before sharing my data room?

Most experienced VCs won't sign NDAs before reviewing a data room - it's common practice not to, because they see hundreds of decks in overlapping spaces. For less sensitive early-stage materials, an NDA isn't necessary. But for detailed financial data, unreleased product information, or customer contracts, you may want NDA gating enabled. Some VDR platforms (including Ellty Data Room plan) let you require NDA acceptance before anyone can access the room.

How long does it take to set up a data room?

If your documents are already organized, setting up a structured data room takes a few hours - maybe less. The longer part is gathering and updating the actual documents. If you maintain your documents continuously rather than scrambling before each raise, you can have a data room ready to share within an hour of receiving interest from an investor.