25 questions to ask a data room provider before you sign

Most provider demos follow the vendor’s script: a tour of the interface, a slide on security, a price conversation at the end. That is fine for a first impression, but it rarely surfaces the details that cause trouble six weeks into a deal. A short, consistent question list flips the dynamic. You decide what gets covered, and you can compare three providers on the same terms.

These questions work for any kind of provider, from enterprise rooms priced on request to tools with a published monthly rate. If you are still deciding what a provider actually supplies, our explainer on what a data room provider is is the better starting point.

Which security and access questions should you ask?

Security is where vague answers are most common, because every provider describes itself as secure. Push each answer toward something you could show your own security team.

1. Which audit report or certificate covers the product we will use, and can we see it? A SOC 2 report under the AICPA’s Trust Services Criteria or an ISO/IEC 27001 certificate is the baseline. Check that the scope names the data room product and its hosting, not just the corporate IT environment.
2. How is data encrypted at rest and in transit, and who manages the keys? Expect a named algorithm and protocol version. Our guide to data room encryption explains what the answers mean.
3. Can we require two-factor login for every user, including outside parties? Optional two-factor that bidders can switch off protects much less than an enforced policy.
4. How fine-grained are permissions? You want control by group and by folder or document, with separate settings for view, print and download.
5. What control do we keep after a file is downloaded? Dynamic watermarking identifies the reader; document rights management can revoke or expire a file that has already left the room.
6. Where is the data hosted, and can we choose the region? This matters for privacy law and for some buyers’ internal policies. Ask about backups and disaster recovery sites too, which are sometimes in a different country from the primary data.

What should you ask about the deal workflow?

These questions test whether the room fits how your deal will actually run. They are best asked during a demo, with the vendor sharing their screen and doing the task live.

7. How does the Q&A module route, approve and log questions? Ask to see a question go from a bidder to an expert on your side, through approval, and back. Check whether answers can be published to one bidder or to all.
8. Can we upload a full folder tree in one go, and is it indexed automatically? Bulk upload with automatic numbering saves days on a large sell-side room.
9. What activity reports do we get on each party? Look for per-user and per-document views over time, exportable for the deal team.
10. Is redaction built in, or do we redact before uploading? Fewer than half of the providers we track offer built-in redaction. If yours does not, plan for the extra step.
11. Which AI features exist, and is our data used to train any model? Automated indexing, summaries and suggested Q&A answers can save time. Ask for the data-use terms in writing. Our article on AI in virtual data rooms covers what to check.

Which pricing and contract questions matter most?

The headline rate is the least informative number in a data room contract. What matters is how the bill behaves when the deal changes shape, which most deals do.

12. What exactly is the pricing model, and what does our tier include? Per page, per user, flat monthly or a project quote. Get the included volume in writing.
13. What triggers an overage charge, and at what rate? Pages, gigabytes, users or rooms. A low base with expensive overage is a common trap.
14. What does an extra month cost, and is there a minimum term? Deals almost always run late; the extension rate should be in the order form.
15. Are there set-up, onboarding, translation or archive fees? Ask for a full list of one-off charges.
16. Can we pause the room or switch it to read-only while a deal is on hold? Some providers offer a reduced rate for dormant rooms.
17. What are the liability, confidentiality and data processing terms? If the room will hold personal data of people in the EU, the provider acts as a processor and Article 28 of the GDPR requires a written contract covering how it handles that data.

For the numbers behind these questions, our VDR pricing guide sets out typical rates for each model.

What should you ask about support and set-up?

Support quality is hard to judge from a sales call and decisive at 11 p.m. before a bid deadline. Ask concrete questions and, if possible, test the answer.

18. When is support available, through which channels, and how fast do you respond? Round-the-clock coverage matters when bidders sit in other time zones.
19. Who builds the room? Some providers load and index documents for you; others give you the tools and a help center.
20. Do outside users get support too? Bidders who cannot sign in will call someone. It should not be your deal team.
21. What uptime do you commit to, and what happens if you miss it? A published service-level commitment with credits is better than an informal promise.

Which exit and archive questions do buyers forget?

The end of a deal is when the room’s record becomes valuable, sometimes years later if a warranty claim arises. Settle these before you sign, while you still have leverage.

22. In what format is the final archive delivered? It should include documents, the full Q&A log and the audit trail, with the index intact.
23. How long do we have to download it after the room closes? Get the window in days, in writing.
24. When and how is our data deleted, and will you confirm it? Ask for written confirmation of deletion, including backups, within a stated period.
25. Can the archive be delivered to both buyer and seller? Transaction documents often require both parties to hold an identical copy.

What does a good answer sound like?

A good answer is specific enough to check. It names a standard, a number, a document or a clause. A weak answer describes a feeling.

The pattern holds across all 25 questions. “We take security seriously” is not an answer to question one; a SOC 2 report dated within the past year is. “Very competitive pricing” is not an answer to question fourteen; a monthly extension rate is. If a provider cannot answer specifically, that tells you something too, usually that the answer depends on negotiation or that the feature does not exist.

When should you ask each group of questions?

Asking all 25 at once overwhelms a first call. Spread them across the buying process so each conversation has a purpose.

This order also filters providers early. A vendor that cannot produce an audit report before the demo, or hosts only in a region your buyers will not accept, drops out before anyone spends an hour on a walkthrough.

How do you turn the answers into a decision?

1. Send the same list to every provider

   Use one document with the 25 questions, so every answer lands in the same format and nothing is skipped.

2. Mark your must-haves

   Before reading answers, flag the five to eight questions where a 'no' rules a provider out, such as enforced two-factor login or a Q&A module.

3. Score the rest on specificity

   Give two points for a verifiable answer, one for a vague but positive answer, none for a missing one.

4. Verify the top answers in a trial

   Load a sample of your own documents, invite a colleague as an outside user, and test the features the answers describe.

5. Put the key answers into the contract

   Extension rate, archive format, download window and deletion confirmation belong in the order form, not in an email.

Scoring does not have to be elaborate. The point is to stop the decision drifting toward whichever vendor gave the best demo. Our own methodology weights security and deal features most heavily, then ease of use and value, then support; you may weight them differently for your deal, and that is fine as long as you decide the weights before reading the answers.

If you are still building the list of providers to send the questions to, our guide on how to shortlist data room providers covers that step, and the provider directory shows certifications, features and published prices side by side.

Do you need all 25 questions for a small deal?

No. For a seed round with a handful of investors, questions 1, 3, 4, 12, 14 and 22 cover most of the risk: an audit report, enforced two-factor login, sensible permissions, a clear price, the extension rate, and a usable archive. Add the Q&A questions if investors are sending formal diligence lists. For a sell-side auction or a regulated transaction, use the full set and expect your legal and IT teams to add their own.