In-house counsel and risk
Data room security review checklist for legal counsel
Written for the person who has to sign off, not the person choosing the software.
A data room security review covers five areas: who can see what, whether competing parties can be isolated, where data is stored and processed, whether activity produces exportable evidence, and what happens to the data at the end. Ask for a demonstration of each control rather than a description of it, and get every claim about location in writing.
31 items, 6 sectionsUpdated
Access control
- Permissions can be set per party, per folder and per document, not only per user
- Multi-factor authentication is available and can be enforced for all users
- Access can be revoked immediately, and revocation covers already-opened sessions
- Document downloads can be disabled while viewing remains possible
- Expiring access can be set on invitations
- Administrator actions require their own audit entry
Party isolation
- One bidder cannot see the existence of another bidder
- Q&A threads are visible only to the party that raised them, unless deliberately shared
- Activity reporting is scoped so parties cannot infer each other's interest
- Folder structures can differ per party without duplicating documents
Data location
- The storage location is stated in writing, naming the country and region
- Processing locations are stated separately, including support and AI processing
- Every sub-processor is named, with its location and function
- Any cross-border disclosure is identified so APP 8 can be assessed
- The provider will confirm whether residency is standard or an enterprise-only option
Evidence and audit
- Every view, download, print and permission change is logged with a timestamp and user
- The audit trail is exportable in a usable format, not only viewable on screen
- Logs are retained for a period you can state, and that period is documented
- The log can demonstrate what a specific party was able to see on a specific date
- Watermarking records who received the document that was watermarked
Vendor and contractual
- Certifications are current and verifiable on the certifying body's register, not just claimed on a website
- Incident notification obligations and timeframes are in the agreement
- Data deletion timing at termination is specified, with confirmation provided
- Data export at termination is available in a usable format, within a stated window
- Uptime commitments and support response times are stated, not implied
- Sub-processor changes require notice
Ask for a demonstration of
- Revoking a user mid-session
- Two bidder parties logged in with different views of the same room
- An audit trail export for a single document
- A watermarked document as the recipient sees it
- The permission report you would rely on after completion
Frequently asked
- Is ISO 27001 enough for a data room review?
- It covers information security management, which is necessary but not the whole picture. It does not tell you where data is processed, whether bidders can be isolated, or how AI features handle your documents. Ask those separately.
- Why does processing location matter if storage is local?
- Because a disclosure happens wherever the data becomes accessible. Support access, backups and AI processing can all move documents outside the country the storage region names, and each is a cross-border disclosure to assess under APP 8.
- What evidence should we keep after completion?
- An exported audit trail and a permission report showing exactly what each party could access and when. That is the record of your disclosure position, and it is far easier to export while the room is still open.
Want this as a PDF?
Use the print button above and choose save as PDF, or ask us and we will send a formatted copy. Either way the full checklist stays on this page.
What's next
Ready to experience the future of dealmaking?
One AI-native platform. Enterprise security by default. Turn on intelligence when you're ready.