Data Rooms Providers Find a data room
Region · Updated Oct 9, 2026

Best data room providers in the United States

Data room providers for US deals: how sale processes, HSR review and state privacy laws shape the room, with USD pricing notes and a five-room shortlist.

Shortlist

Recommended providers

  1. 1

    Ellty

    Full deal room with structured Q&A, e-signature and AI tools; published price from $149/mo and a 14-day free trial.

    4.8Editorial score 4.8 of 5 · From $149/mo
  2. 2

    Datasite

    Long-standing choice for banker-run auctions, with redaction, SSO and a mobile app.

    4.5Editorial score 4.5 of 5 · From On request
  3. 3

    Intralinks

    Security-focused room for large, regulated transactions; redaction and SSO.

    4.4Editorial score 4.4 of 5 · From On request
  4. 4

    iDeals

    Strong support and granular permissions; SSO and an API for corporate IT teams.

    4.6Editorial score 4.6 of 5 · From On request
  5. 5

    SmartRoom

    Includes redaction and suits mid-market sell-side processes.

    4.2Editorial score 4.2 of 5 · From On request

How a US sale process uses the room

A typical sell-side process in the United States runs through a banker. The adviser sends a teaser, collects signed NDAs, and opens a first-round room with a confidential information memorandum and a limited set of financials. Indications of interest narrow the field, and the second round opens the full room: contracts, employee data, IP schedules, litigation files and tax returns.

Two features matter more here than in many other markets. First, structured Q&A, because a competitive auction can generate hundreds of questions from several bidders and counsel need to route them by workstream. Second, a clean audit trail, because purchase agreements often define what was “made available” to the buyer by reference to what sat in the data room on a given date. Disclosure schedules lean on that record, so exporting the full index and an archive at signing is standard practice.

Private equity is a large share of US deal flow, which means many rooms serve repeat buyers who expect fast set-up and predictable permissions. Venture rounds and secondary sales use lighter rooms, but the same controls apply once investors see customer or employee data.

Federal review that keeps the room open

Deals above the size-of-transaction threshold need a premerger notification under the Hart-Scott-Rodino Act, filed with both the Federal Trade Commission and the Department of Justice. The threshold is adjusted every year, so check the current figure on the FTC premerger notification page rather than relying on last year’s number.

The HSR waiting period, step by step

Day 0
1Both sides file
Buyer and seller each submit an HSR notification; the buyer pays the filing fee.
Day 30
2Initial wait ends
The standard waiting period is 30 days, or 15 for cash tender offers and bankruptcy sales.
If issued
3Second request
The FTC or DOJ asks for more documents; the wait generally runs until 30 days after substantial compliance.
Clearance
4Closing
Once the waiting period expires or is ended early, the parties may close.
A second request can turn a 30-day wait into months, and the data room often becomes the production source.
dataroomsproviders.com
A second request can turn a 30-day wait into months, and the room often becomes the production source. Source: FTC premerger notification guidance.

If the agencies issue a second request, the parties produce large volumes of documents, and the data room index often becomes the starting point for that production. Cross-border buyers may also face CFIUS review for foreign investment in sensitive businesses. Public targets bring the SEC into the picture through proxy and tender offer rules, and broker-dealers involved in the sale are supervised by FINRA.

AuthorityWhere it touches a dealRoom implication
FTC and DOJHSR filing and merger reviewKeep the room open until clearance; plan for a second request
SECPublic company targets, tender offers, proxy disclosureTight access lists and insider controls
FINRABroker-dealers advising on the saleRecords of who received what, and when
CFIUSForeign buyers of sensitive US businessesPossible limits on foreign viewer access before clearance
State attorneys generalState privacy law enforcementCare with consumer and employee personal data

Privacy: a patchwork rather than one statute

The United States has no general federal data protection law equivalent to the GDPR. Personal data in a deal room is governed by sector laws (HIPAA for health information, GLBA for financial data) and by a growing list of state privacy acts. California’s CCPA, as amended by the CPRA, is the most developed, and the California Privacy Protection Agency enforces it alongside the state attorney general. Several state acts include exemptions or carve-outs for data shared in a merger or acquisition, but the wording differs from state to state, so counsel should confirm how each applies.

Cross-border note

For transfers in the other direction, EU and UK sellers sharing personal data with US buyers often rely on the EU-US Data Privacy Framework where the recipient is certified. Separately, a Department of Justice rule in force since 2025 restricts some transfers of bulk sensitive US personal data to countries of concern; check whether it affects foreign bidders before opening HR or customer folders.

Pricing in dollars

Prices on this site are quoted in USD and are indicative, so confirm them with the provider. Ellty publishes a price from $149/mo with a 14-day free trial; most enterprise rooms such as Datasite, Intralinks and iDeals quote on request, usually based on pages, storage, users or deal length. There is no federal VAT. Some states apply sales tax to software-as-a-service subscriptions and others do not, so the final invoice can differ from the list price depending on where the buyer is based. See VDR pricing for how the common billing models compare.

Calculator

Indicative room budget in the United States

Pick a billing model, then set the length of the process and the number of users.
No federal VAT. Some states tax SaaS subscriptions and others do not; enter your state and local rate if it applies.
Total in USD -
Sales tax-Often reverse charged and recoverable for registered businesses
Prices are USD list prices or typical market bands. All figures are indicative, not quotes; confirm price, currency and tax with the provider and your adviser.

Deal types you will meet

  • Sponsor-backed buyouts and add-ons, often run by the same deal team several times a year. See private equity.
  • Banker-led auctions for founder or family-owned companies. See mergers and acquisitions.
  • IPOs and follow-on offerings, where underwriters run diligence in a room before the registration statement is filed. See IPO and capital markets.
  • Chapter 11 sales under section 363, where the room has to accommodate many bidders on a short timetable. See restructuring and bankruptcy.

For head-to-head detail, Ellty vs Datasite and Datasite vs Intralinks cover the rooms US bankers most often shortlist.

A US deal timeline, stage by stage

The order of events in a US sale is predictable, which makes it easy to plan access and budget. The less predictable part comes after signing, when antitrust review can keep the room busy for weeks or months.

Deal timeline in the United States

  1. Preparation Index and clean-up Seller and banker build the folder index and decide what to hold back.
  2. Round one NDAs and the CIM Bidders sign NDAs and see the CIM with summary financials.
  3. Round two Full diligence A shortlist gets the full room and structured Q&A by workstream.
  4. Signing Archive the record Index and archive exported to back the disclosure schedules.
  5. 30-day initial wait HSR review The room stays live; a second request turns it into a production source.
Budget the room for the whole period to closing, not just the auction: an HSR second request or a CFIUS review can add months.
dataroomsproviders.com
Most of the work happens before signing, but the room usually stays open through review and closing. Source: this guide.

The 30-day initial waiting period applies to most HSR filings (cash tender offers have a shorter one), and it can be extended by a second request. Treat the dates as a planning frame, not a promise.

Data protection obligations at a glance

Without a single federal statute, the obligations in a US room come from several directions at once. The cards below are qualitative on purpose: penalties and deadlines differ by law and by state, so a single headline number would mislead.

Data protection obligations at a glance: United States

No GDPR No single federal law HIPAA covers health information, GLBA financial data, and state acts fill the gaps.
CCPA California sets the pace As amended by the CPRA, enforced by the CPPA and the state attorney general.
50 states Breach notice laws Every state has a breach notification statute, with different triggers and deadlines.
Deal carve-outs M&A wording differs Several state acts address transfers in a merger, each in its own terms.
DOJ rule Bulk sensitive data Limits on giving countries of concern access to bulk sensitive personal data.
Minimise first: aggregated HR and customer schedules in round two, named records only for the winning bidder and only when needed.
dataroomsproviders.com
A layered system: sector laws, state acts and a federal rule on bulk sensitive data. Source: this guide.

Cross-border access options

US law places few general limits on personal data leaving the country, so the questions usually run the other way: can a European seller open its room to a US buyer, and does a foreign bidder trigger any of the newer national security rules?

Cross-border transfer options for a US room

No general export ruleDefault
Federal law does not restrict most personal data leaving the US for a commercial deal. Use when: Most foreign bidders, once the DOJ rule and your own contracts are checked.
DOJ data security ruleCheck first
Restricts some transactions that give countries of concern access to bulk sensitive data, such as health, biometric, location or financial records. Use when: A bidder or adviser has links to a country of concern, or the room holds large sensitive datasets.
CFIUS limitsDeal specific
Foreign buyers of sensitive US businesses may face access limits before clearance. Use when: Critical technology, critical infrastructure or sensitive personal data targets.
EU-US Data Privacy FrameworkInbound
European sellers can rely on it when the US recipient is certified; a UK extension covers UK data. Use when: A European or UK seller opens its room to a US buyer.
dataroomsproviders.com
Most foreign bidders raise no transfer issue under US law; national security rules and inbound European law are where the work is. Source: this guide.

Common mistakes in US rooms

  • Treating the waiting period as dead time. Licences, user seats and archive plans lapse while the agencies are still asking questions.
  • Uploading the full employee census in round one. Most bidders can value the workforce from aggregated data until the final stage.
  • Running Q&A by email. Answers that never reach the room weaken the record of what was “made available” at signing.
  • Skipping the signing archive. Disclosure schedules refer to the room, so export the index, Q&A log and documents on the day.
  • Assuming one state law. A workforce spread across several states can bring several privacy acts and breach rules into play.

Choosing a provider for a US deal

Many US bankers have a default room, and repeat buyers may know Datasite or Intralinks from earlier deals. Familiarity helps less than it seems, because bidders adapt to a clear interface within a day and the seller pays the bill. Compare the points that change outcomes instead:

  1. Q&A routing. Can questions be assigned to legal, tax and HR experts, with bidder-level privacy?
  2. Redaction. Datasite, Intralinks and SmartRoom include it; with Ellty and some others, redact before upload.
  3. Identity. Corporate sellers with an identity provider may want SSO, which Datasite, Intralinks and iDeals list.
  4. Pricing model. Ellty publishes a flat monthly price; the others quote per project, often on pages, users or term.
  5. Archive format. Ask for a sample export before signing the order form.

FAQ

Do I need a US-hosted data room for a US deal?

There is no general federal requirement to host deal documents in the United States. Specific contracts, government work or export-controlled data can impose limits, so ask each provider where files are stored and check any obligations in your own contracts.

Does the CCPA apply to data in a deal room?

It can, if the business meets the CCPA thresholds and the room holds personal information of California residents. The law contains provisions on transfers in a merger or acquisition, but the details are technical, so confirm with counsel.

How long should a US room stay open?

Plan for the full period to closing, including any HSR or CFIUS review, and keep an archive afterwards. Indemnity claims often turn on what the buyer could see in the room.

Are the prices on this page final?

No. They are USD list prices or on-request labels from our research, and they are indicative. Confirm current pricing and any state sales tax with the provider.