Selecting a Virtual Data Room — Security and Workflow Over Brand Name

A virtual data room (VDR) is the secure online repository where all due diligence materials — financial statements, contracts, board minutes, cap table details, and legal documents — are shared with the underwriters, their counsel, and the auditors during the S-1 process. Choosing the right VDR affects how efficiently due diligence proceeds and how securely your most sensitive materials are protected.

What a VDR Is Used For in an IPO

• Underwriter due diligence: Lead bookrunner and co-managers review the full document package — typically 500–1,500 documents — as part of their 10b-5 due diligence obligation before signing the underwriting agreement.
• Legal due diligence: Underwriters' counsel and company counsel use the VDR to review material contracts, litigation, IP, employment agreements, and corporate records.
• Auditor access: The PCAOB auditor accesses financial records, contracts relevant to accounting treatment, and support for audit sampling through the VDR.
• Comfort letter process: The auditor and underwriters use the VDR to support the comfort letter process in the days before pricing (circle-up backup and bring-down diligence).

VDR Providers

What to Evaluate

• What are your security certifications — SOC 2 Type II, ISO 27001, and GDPR compliance?
• What is your pricing model — per-page, per-user, or flat fee? What is the total estimated cost for a typical IPO due diligence process?
• How do you handle permission controls — can we set granular access by party (underwriters vs. underwriters' counsel vs. auditors)?
• What is your document upload and indexing process — do you provide indexing assistance or AI-powered document categorization?
• What activity reporting is available — who accessed which documents and when?
• What happens to the data room contents after the IPO closes — how long are documents retained and how are they deleted?

Major VDR Providers

Setting Up the VDR — What Goes In

A well-organized VDR follows a standard folder structure that diligence teams can navigate efficiently. Standard top-level folders:

• 01 Corporate / Governance (certificate of incorporation, bylaws, board minutes, equity plan documents)
• 02 Cap Table (all preferred stock agreements, SAFE notes, convertible notes, option grants, warrant agreements)
• 03 Material Contracts (customer contracts above materiality threshold, vendor contracts, partnership agreements, licensing deals)
• 04 Intellectual Property (patent filings, trademark registrations, copyright registrations, software licenses, IP assignment agreements from founders and contractors)
• 05 Financial Statements (historical financial statements, management accounts, audit reports)
• 06 Tax (filed tax returns for prior years, tax assessments, any IRS correspondence)
• 07 Litigation & Insurance (pending and threatened litigation, insurance policies and claims history, regulatory investigations)
• 08 Real Estate (office leases, data center agreements)
• 09 Employment / Benefits (executive offer letters, equity agreements, benefits plan documents, HR policies)
• 10 Regulatory / Compliance (regulatory licenses, regulatory correspondence, compliance policies)

Security Standards to Require

The VDR will contain the company's most sensitive commercial, financial, and legal documents. Minimum security certifications to require from any VDR provider:

• SOC 2 Type II certification: Independent audit confirming the provider's security controls operate effectively over time — not just on a point-in-time basis
• ISO 27001: International information security management standard; indicates a systematic approach to security management
• Fence-view and dynamic watermarking: Documents viewed in the VDR should not be downloadable without a visible watermark containing the viewer's name, date, and access log
• Granular permission controls: Ability to grant read-only access to specific folders to specific user groups (underwriters' counsel sees everything; co-managers see the subset relevant to financial due diligence)
• Full audit logging: Every document view, download, and search query logged with user, timestamp, and IP address — essential for tracking which investors have accessed which information

VDR Cost and Pricing Models

VDR pricing varies significantly by provider and negotiation leverage:

• Per-page pricing (Datasite legacy model): $0.50–$2.00 per page viewed, with minimums. Can become expensive for large document packages with many reviewers.
• Per-user per-month (SaaS model — Ideals, CapLinked): $300–$1,500/month per user group. More predictable for large transactions.
• Deal-based flat fee (Intralinks, Datasite negotiated): Flat fee for the entire transaction — most common for large deals. Typically $25,000–$100,000 for an IPO-scale transaction.

If the company is using DFIN as its financial printer, the Venue VDR is often bundled into the printing contract at a discount — confirm exactly what any printer bundle includes. Evaluate whether the bundled VDR meets the security standards listed above — printing bundles sometimes use a lower-tier VDR product.

Setup and Timing

The VDR should be set up and the initial document package uploaded at least 4–6 weeks before the first due diligence session with underwriters. This gives the company time to organize the index, obtain any missing documents, and redact information that should not be disclosed (trade secrets, customer names in some contracts) before the VDR is opened to external reviewers.

Designate an internal VDR administrator — typically the general counsel or controller — who controls user access, monitors activity logs, and manages document additions throughout the process. VDR access should be terminated immediately when a reviewer's engagement ends to protect confidentiality.

VDR Provider Selection — Real Cases

Rivian — Multi-Party Diligence Across Strategic Rounds and the IPO (2019–2021)

Rivian ran diligence for strategic investors — Ford's $500 million and the Amazon-led $700 million rounds, both in 2019 — and then a full underwriter process for the November 2021 IPO: different counterparties, different sensitivities, spread over years. The permission-architecture lesson is real even though the phases were sequential rather than simultaneous: commercial partners' teams need narrow, competitively firewalled access to the documents relevant to their relationship, while IPO underwriters and counsel need comprehensive financial and legal access. Whether one data room serves every phase or each transaction gets a fresh room, the folder taxonomy and permission tiers built early pay off repeatedly.

WeWork — When the IPO Data Room Became the Restructuring Data Room (2019)

WeWork's 2019 IPO data room housed the complete due diligence package — lease agreements for 528 locations, financial statements, board materials, and the S-1 drafts — accessible to the Goldman Sachs and JPMorgan due diligence teams. When the IPO was withdrawn in September 2019, the VDR process shifted from IPO due diligence to emergency restructuring due diligence, as SoftBank conducted its own review before providing the rescue financing. WeWork's experience illustrates the VDR's role not just as an IPO tool but as a critical infrastructure for any corporate transaction — the same document repository that supports an IPO process can pivot to support an M&A sale, a private financing, or a restructuring without rebuilding from scratch.