VDR glossary

Data room and deal terms, explained

183 terms you will meet when choosing, pricing or running a virtual data room. Each one has a short definition here and a full page on how it works in a room, why it matters in a deal and a worked example.

Search the glossary

Showing all 183 terms

A

Access expiry

An end date set on a user's, group's or document's access, after which the data room automatically blocks entry or locks the files.
Permissions
Access requests

A workflow that lets a user ask for permission to see a folder or document they cannot currently open, with the request routed to an administrator who approves or declines it and the decision logged.
Permissions
Activity reports

Reports that show who opened which documents in a data room, when and for how long, summarized by user, group or folder so the owner can read interest levels at a glance.
Features
AES-256

The Advanced Encryption Standard used with a 256-bit key, a symmetric cipher published by NIST and the most common algorithm data rooms cite for protecting stored files.
Security
AI document categorization

The use of machine learning to read uploaded files and suggest where each one belongs in a data room index, along with labels such as document type, counterparty or date.
Features
AI due diligence

A review of how a target builds, buys and uses artificial intelligence, covering data rights, model ownership, regulatory exposure, performance claims and dependence on outside AI suppliers.
Due diligence
AI processing region

The geographic location where a data room's AI features actually run, which can differ from where files are stored, so data residency promises need to cover model processing too.
Compliance and privacy
AI Q&A drafting

An AI feature in a data room's Q&A module that proposes answers to bidder questions using the documents already in the room, for the seller's team to edit, approve and release.
Features
AI redaction

Redaction in which machine learning finds names, account numbers, addresses and other sensitive details across many documents and proposes blackouts, which a person then reviews and applies.
Features
AI usage credits

A billing unit some data room providers use for AI features, where summaries, questions, translations or automated redactions draw down a credit balance that is included in a plan or bought separately.
Pricing and billing
Annual subscription

A yearly contract that keeps one or more data rooms available for twelve months, usually paid upfront and suited to teams that run deals or share documents continuously.
Pricing and billing
API integrations

Connections that let a data room exchange information with other software, such as identity systems, document stores, CRM tools or signing services, through a documented programming interface.
Features
Archiving fees

Charges for preserving a data room's final contents after the deal ends, whether as a downloadable copy, an encrypted drive or a read-only room kept online.
Pricing and billing
Asset purchase agreement (APA)

A contract in which a buyer acquires selected assets and agreed liabilities of a business, such as equipment, contracts and intellectual property, rather than the shares of the company that owns them.
Legal
Attorney-client privilege

A legal protection that keeps confidential communications between a client and its lawyers, made for the purpose of legal advice, from being disclosed to opponents or authorities.
Legal
Audit trail

A time-stamped, tamper-resistant record of every action in a data room: who logged in, what they opened, printed, downloaded or changed, and when.
Security
Auto-indexing

Automatic numbering of every folder and file in a data room, so each document has a stable reference such as 3.2.14 that updates when the structure changes.
Features
Auto-renewal

A contract term that extends a data room subscription for another period automatically unless the customer gives notice before a set deadline, often 30 to 90 days before the term ends.
Pricing and billing

B

Bidder isolation

Setting up a data room so each competing bidder works in its own sealed space and cannot see the other bidders, their users, their questions or their activity.
Permissions
Binding offer

A bidder's final proposal in a sale process, usually submitted after full diligence, that states a firm price and is accompanied by a marked-up purchase agreement the bidder is prepared to sign.
Deal process
Board portal

Secure software for preparing and distributing board packs, running meetings, recording minutes and collecting director approvals, built for ongoing governance rather than a single transaction.
Features
Bolt-on acquisition

The purchase of a smaller company that is folded into an existing platform business, usually to add a product, region or customer base faster than building it.
Deal process
Breach notification

The legal duty to inform regulators, affected people or customers when personal data or confidential information has been exposed, within deadlines set by law or contract.
Compliance and privacy
Break fee

A payment one party agrees to make to the other if a signed or agreed deal does not complete for specified reasons, such as the target accepting a better offer or the buyer failing to secure approval.
Legal
Bug bounty program

A standing invitation from a software provider for independent security researchers to report vulnerabilities in exchange for recognition or payment, under published rules of engagement.
Security
Bulk upload

The ability to move many files or whole folder structures into a data room in one action, keeping the original hierarchy instead of adding documents one at a time.
Features
Buyer long list

The initial set of potential acquirers or investors an adviser identifies for a sale, before contact, teasers and NDAs narrow it down to the parties who will enter the data room.
Deal process
Buy-side

The acquirer in a transaction and its advisers, who review the target's data room, ask questions and decide whether, and at what price, to proceed.
Deal process

C

California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act, amended by the California Privacy Rights Act, which gives California residents rights over personal information that covered businesses collect about them.
Compliance and privacy
Carve-out

The sale or separation of a division, product line or subsidiary from a larger parent company, which requires untangling shared people, systems, contracts and financial records.
Deal process
Change notifications

Automatic alerts, usually by email or in-app message, that tell data room users when new documents arrive, files are updated or questions they follow receive an answer.
Features
Clean team

A small group of people, often outside advisers and a few ring-fenced employees, allowed to review a target's competitively sensitive information that the wider buyer organization must not see.
Legal
Closing set

The complete, final collection of executed documents from a transaction, assembled at closing as the permanent record of what the parties signed.
Deal process
Commercial due diligence

An assessment of a target's market, competitors, customers and growth plan, testing whether the business case behind the price is realistic.
Due diligence
Confidential information memorandum (CIM)

A detailed marketing document describing a business for sale, given to potential buyers after they sign an NDA and used as the basis for their first bids.
Deal process
Confirmatory due diligence

The narrower review a preferred buyer runs after signing a letter of intent, aimed at verifying the assumptions behind its price rather than discovering the business from scratch.
Due diligence
Contract clause extraction

An AI feature that reads large numbers of contracts and pulls specific terms, such as change of control, assignment, exclusivity, termination or liability caps, into a structured table for review.
Features
Controlled auction

A structured sale in which an adviser invites several selected buyers to bid in fixed rounds, with information released in stages and deadlines set by the seller.
Deal process
Custom branding

Options that let a data room owner apply their own logo, colors, domain or welcome message to the room, so visitors see the company or adviser rather than the software provider.
Features
Customer concentration analysis

A diligence review of how much of a target's revenue depends on a small number of customers, and how secure those relationships are, to judge whether earnings could fall sharply if one customer leaves.
Due diligence
Customer-managed encryption keys (BYOK)

An encryption setup in which the client, not the data room provider, creates and controls the keys that protect its stored files, and can revoke them to make the data unreadable.
Security
Cybersecurity due diligence

An assessment of a target's security posture, incident history and exposure to cyber risk, used by a buyer to price risk, plan remediation and decide on contract protections before closing.
Due diligence

D

Data loss prevention (DLP)

A set of controls that detect and block sensitive information from leaving an organization in ways it should not, for example by flagging uploads that contain card numbers or blocking unusual bulk downloads.
Security
Data minimization

The privacy principle that organizations should collect, keep and share only the personal data actually needed for a specific purpose, and no more.
Compliance and privacy
Data processing agreement (DPA)

A contract between a data controller and a service provider that sets out how the provider may handle personal data on the controller's behalf, as required by the GDPR and similar laws.
Compliance and privacy
Data protection impact assessment (DPIA)

A structured assessment, required under the GDPR for processing likely to pose a high risk to individuals, that describes the processing, weighs the risks and records the measures taken to reduce them.
Compliance and privacy
Data residency

The physical or legal location where a data room stores its files and backups, often chosen to meet local law, client policy or a regulator's expectations.
Compliance and privacy
Data retention policy

A written rule set that says how long different kinds of records are kept and when they are archived or destroyed, applied to data room content once a deal ends.
Compliance and privacy
Data room administrator

The person, usually on the seller's side or at its adviser, who sets up the data room, invites users, sets permissions and keeps the index in order through the deal.
Permissions
Data room archive

A permanent, read-only copy of a data room's contents and history, created when the project closes and kept by the parties as a record of what was disclosed.
Features
Data subject access request (DSAR)

A request from an individual asking an organization to confirm whether it holds their personal data and to provide a copy, along with details of how and why it is used, under laws such as the GDPR.
Compliance and privacy
Data tape

A structured spreadsheet listing every loan, lease or asset in a portfolio with its key terms and performance data, so buyers can model the pool before reading individual files.
Due diligence
Deal room

An informal name for the secure workspace where parties to a transaction share documents and questions; in most contexts it means the same thing as a virtual data room.
Deal process
Deemed disclosure

A clause stating that everything in the data room, or a defined part of it, counts as disclosed against the seller's warranties, so the buyer cannot later claim for matters fairly shown there.
Legal
Delegated administration

The ability for a room's main administrator to hand limited management rights to others, such as letting each bidder's lead manage their own team's users without seeing or touching other groups.
Permissions
Digital rights management (DRM)

Technology that keeps control over a file after it leaves the data room, enforcing who may open, print or copy it and allowing that permission to be withdrawn later.
Security
Disaster recovery

The plans and infrastructure a provider uses to restore service and data after a serious failure, such as the loss of a data center, within agreed time limits.
Security
Disclosure letter

A document from the seller to the buyer that lists specific exceptions to the warranties in a purchase agreement, so known issues are disclosed rather than later treated as breaches.
Legal
Distressed sale

The sale of a business or assets under financial pressure, often in or near insolvency, where speed matters more than a full marketing process.
Deal process
Document comparison

A feature that shows the differences between two versions of a document, or between two similar documents, highlighting added, deleted and changed text so reviewers can see exactly what moved.
Features
Document summarization

An AI feature that produces a short overview of a long file or a set of files, highlighting key parties, dates, obligations and figures so reviewers can decide where to read in detail.
Features
Dual-track process

A strategy in which a company prepares for an initial public offering and a private sale at the same time, keeping both options open until one offers better value or certainty.
Deal process
Due diligence

The structured investigation a buyer or investor carries out before committing to a deal, checking the target's finances, legal position, operations and risks against what it has been told.
Due diligence
Due diligence request list

A structured list of documents and information a buyer asks the seller to provide, organized by topic and used to track what has been supplied, answered or is still missing.
Due diligence
Dynamic watermarking

A visible stamp, generated at the moment a document is viewed, printed or downloaded, that shows who accessed it and when, so any leaked copy points back to its source.
Security

E

Early termination fee

A charge a provider may apply when a customer ends a data room contract before the agreed term, often equal to some or all of the fees remaining for the unused period.
Pricing and billing
Earn-out

A pricing mechanism in which part of the purchase price is paid later, only if the acquired business hits agreed targets such as revenue or profit over a set period.
Legal
Electronic signature

A legally recognized way to sign documents online, where the signer's identity, intent and the time of signing are captured electronically instead of with ink on paper.
Features
Encryption at rest

Scrambling stored files with a cryptographic key so that disks, backups and database copies are unreadable to anyone who obtains them without that key.
Security
Encryption in transit

Protection of data while it travels between a user's device and the data room servers, so anyone intercepting the connection sees only scrambled traffic.
Security
End-to-end encryption (E2EE)

Encryption in which only the sender and intended recipients hold the keys, so the service provider in between stores and relays data it cannot read itself.
Security
Environmental due diligence

An investigation of contamination, permits, emissions and environmental compliance at a target's sites, carried out so the buyer understands clean-up costs and regulatory exposure before committing.
Due diligence
ESG due diligence

A review of a target's environmental, social and governance exposures, from emissions and site contamination to labor practices and board oversight, carried out alongside the usual financial and legal checks.
Due diligence
EU AI Act

The European Union's regulation on artificial intelligence, Regulation (EU) 2024/1689, which sorts AI systems by risk and sets obligations for those who develop, supply and deploy them.
Compliance and privacy
EU-U.S. Data Privacy Framework (DPF)

An EU and US arrangement, in force since July 2023, that allows personal data to flow from the EU to US companies that self-certify to its privacy principles with the Department of Commerce.
Compliance and privacy
Exclusivity period

An agreed window, often 30 to 90 days, during which a seller promises to negotiate only with one buyer while that buyer completes diligence and contracts.
Deal process

F

FedRAMP

The US Federal Risk and Authorization Management Program, a standardized security assessment and authorization process for cloud services used by federal agencies.
Compliance and privacy
Fence view

A restricted viewing mode that hides most of a page behind a dark mask and reveals only a narrow band that follows the cursor, making screenshots and over-the-shoulder reading far less useful.
Security
Financial due diligence

The review of a target's historical results, cash flow, working capital and debt to confirm the earnings a buyer is paying for and spot adjustments that affect price.
Due diligence
FIPS 140-3

A US federal standard for validating cryptographic modules; products using a validated module have had their encryption implementation tested by an accredited lab and approved under a NIST program.
Compliance and privacy
Flat-rate pricing

A billing model with one fixed fee per month or per project that covers storage, pages and users up to generous limits, so the cost does not change as the deal grows.
Pricing and billing
Folder-level permissions

Access rights set on a folder that apply to every document inside it, so a group's view of the room follows the structure of the index.
Permissions
Folder templates

Ready-made folder structures for common deal types that an administrator can apply to a new data room, giving it a standard index before any documents are uploaded.
Features
Free trial

A time-limited period, often around two weeks, during which a buyer can set up and test a data room before paying, usually with full or near-full features.
Pricing and billing
Full-text search

A search function that looks inside the contents of every document in a data room, not only at file names, and returns matching passages within seconds.
Features

G

General Data Protection Regulation (GDPR)

The European Union's General Data Protection Regulation, which governs how personal data about people in the EU is collected, used, stored and transferred, including inside deal data rooms.
Compliance and privacy
Granular permissions

Access rules set separately for each user group, folder and file, so every party in a data room sees and does only what the deal requires of it.
Permissions
Guest access

A restricted account type for outside participants, such as bidders or consultants, who can see only the content shared with them and cannot manage users, settings or other parts of the room.
Permissions
Gun jumping

Acting as though two merging companies are already combined before regulatory approval or closing, for example by sharing sensitive commercial data or coordinating prices too early.
Legal

H

Hallucination

An output from an AI model that sounds confident and plausible but is wrong or unsupported by the source material, such as an invented clause, a misquoted figure or a reference to a document that does not exist.
Features
Hardware security module (HSM)

A tamper-resistant physical device, or a cloud service built on such devices, that generates and stores cryptographic keys and performs encryption so the keys never leave protected hardware.
Security
HIPAA

The US Health Insurance Portability and Accountability Act, whose privacy and security rules govern protected health information held by healthcare providers, insurers and their business associates.
Compliance and privacy
HR due diligence

A review of a target's workforce, employment contracts, pay and benefits, pensions, disputes and culture, used to identify people-related liabilities and plan how employees transfer to the buyer.
Due diligence

I

Indication of interest (IOI)

A short, non-binding first-round offer in which a bidder states an approximate value range and its main assumptions, used by the seller to decide who moves forward.
Deal process
Initial public offering (IPO)

The first sale of a company's shares to the public on a stock exchange, which requires extensive diligence by underwriters and lawyers and a prospectus approved under securities rules.
Deal process
Intellectual property due diligence (IP due diligence)

A review of the patents, trademarks, copyrights, trade secrets and licenses a target owns or uses, confirming who holds the rights, whether they are protected and whether anyone else can challenge them.
Due diligence
Investor data room

A secure online space where a company shares its pitch, financials, legal records and metrics with prospective investors during a fundraising round.
Deal process
IP restriction

A rule that only allows logins to a data room, or to parts of it, from approved network addresses such as a firm's office or VPN.
Security
ISO 27001

An international standard for information security management systems; certification shows an independent auditor has checked that a provider runs a documented, risk-based security program.
Compliance and privacy

J

Just-in-time access

A permission approach in which elevated or sensitive access is granted only when a specific need arises and expires automatically after a short window, rather than being held permanently.
Permissions

K

Key rotation

The scheduled or on-demand replacement of the cryptographic keys that protect stored files, so that any single key protects a limited amount of data for a limited time.
Security

L

Legal due diligence

The lawyers' review of a target's corporate records, contracts, litigation, licenses, employment terms and intellectual property to find legal risks that affect price or the deal documents.
Due diligence
Legal hold

An instruction to preserve documents and data that may be relevant to actual or expected litigation or an investigation, overriding normal deletion schedules until the hold is lifted.
Legal
Letter of intent (LOI)

A mostly non-binding document in which a buyer sets out the price, structure and key conditions of a proposed deal, usually paired with binding exclusivity and confidentiality terms.
Deal process
Locked box mechanism

A pricing method in which the purchase price is fixed by reference to a balance sheet at a past date, and the seller promises that no value will leak out of the business between that date and closing.
Legal
Long-stop date

The deadline in a purchase agreement by which all conditions must be satisfied for the deal to close; if they are not met by then, either party can usually walk away.
Legal

M

Machine translation

Automatic translation of documents or passages inside the data room, letting reviewers read material in a language they do not speak without sending files to an outside translation service.
Features
Malware scanning

Automatic checking of every uploaded file for viruses and other malicious code before it becomes available to other users of the data room.
Security
Management presentation

A structured meeting, in person or online, where the target's leadership presents the business to shortlisted buyers and answers their questions directly.
Deal process
Material adverse change clause (MAC)

A contract term that lets a buyer walk away from, or renegotiate, a deal if something seriously damages the target business between signing and closing.
Legal
Minimum term

The shortest period a data room contract must be paid for, regardless of how soon the deal closes or the room is shut down.
Pricing and billing
Mobile access

The ability to open and work in a data room from a phone or tablet, through a mobile browser or a dedicated app, with the same security controls as on a desktop.
Features
Model training opt-out

A contractual or settings commitment that a customer's documents, prompts and outputs will not be used to train or improve a provider's AI models, or those of its model suppliers.
Compliance and privacy
Month-to-month billing

A billing arrangement where a data room is paid for one month at a time with no long commitment, so the customer can close the room and stop paying after any month.
Pricing and billing

N

NDA click-through

A screen shown at a user's first login, or before a specific folder opens, that requires the user to accept confidentiality terms before any documents become visible.
Legal
Non-disclosure agreement (NDA)

A contract in which a party receiving confidential information promises to keep it secret and use it only for an agreed purpose, such as evaluating a possible transaction.
Legal

O

Operational due diligence

A review of how a target actually runs day to day, covering processes, supply chain, facilities, systems and staffing, to test whether the business plan can be delivered and where improvements lie.
Due diligence
Optical character recognition (OCR)

Technology that turns images of text, such as scanned contracts or photographed pages, into machine-readable words so they can be searched, copied for analysis or redacted.
Features
Overage fees

Extra charges applied when a data room exceeds the pages, storage, users or time included in its plan, often at a higher rate than the base allowance.
Pricing and billing

P

Passkeys

A sign-in method that replaces passwords with a cryptographic key pair stored on the user's device and unlocked by a fingerprint, face scan or device PIN, making phishing much harder.
Security
Penetration testing

An authorized simulated attack in which security specialists try to break into an application, its servers or its network to find weaknesses before real attackers do.
Security
Permission-aware AI

AI search, summaries and answers that only draw on documents the asking user is already allowed to open, so the assistant can never become a back door around the room's access rules.
Permissions
Permission inheritance

The rule that subfolders and files automatically take on the access rights of the folder that contains them, unless an administrator sets a different rule for a specific item.
Permissions
Permission matrix

A grid that maps every user group against every folder of the data room and shows the access level each group has, used to plan and check rights before and during a deal.
Permissions
Per-page pricing

A billing model where the data room charges for each page uploaded, so the cost grows with the size of the document set rather than with time or users.
Pricing and billing
Personal data (PII)

Any information that identifies a living person or could be linked to one, such as names, ID numbers, salaries, health records or email addresses; US law often calls it personally identifiable information.
Compliance and privacy
Per-user pricing

A billing model that charges for each named user or seat with access to the room, so the bill tracks how many people are invited rather than how much is stored.
Pricing and billing
Physical data room

A secured office, usually at the seller's lawyers, where paper copies of deal documents were kept for buyers to read in person under supervision.
Deal process
Post-merger integration (PMI)

The work of combining two organizations after a deal closes, from systems, people and contracts to reporting and culture, so the expected value of the acquisition is actually captured.
Deal process
Principle of least privilege

A security rule that gives each user the smallest set of rights needed for their task, and nothing more, so a mistake or a stolen login can only reach a narrow slice of the room.
Permissions
Print and download controls

Settings that decide whether each group may print documents or download them, and in what form, such as watermarked PDF, original file or protected copy.
Permissions
Process letter

A letter from the seller's adviser that sets the rules of a sale round: deadlines, what a bid must contain, how to submit it and how diligence and contact with management will be handled.
Deal process
Project-based pricing

A pricing approach where a data room is bought for one transaction with a defined scope and term, rather than as an ongoing subscription across many deals.
Pricing and billing
Prompt injection

An attack in which text hidden inside a document or user input tries to override the instructions given to an AI model, for example to make an assistant reveal restricted content or ignore its rules.
Security
Pseudonymization

Replacing names and other direct identifiers in data with codes, so records cannot be linked to a person without a separate key that is kept apart and protected.
Compliance and privacy

Q

Q&A module

A built-in workflow for submitting, routing, answering and publishing due diligence questions inside a data room, with each question tied to the documents and people involved.
Features
Quality of earnings (QoE)

An accountant's analysis that adjusts reported profit to show the recurring, cash-backed earnings a buyer is really paying for, usually stated as adjusted EBITDA.
Due diligence
Quote-based pricing

A pricing approach where the provider publishes no fixed rates and sets a custom price for each customer after a sales conversation about deal size, users and term.
Pricing and billing

R

Redaction

Permanently removing or blacking out sensitive text, numbers or images from a document before it is shared, so the hidden content cannot be recovered by anyone who receives the file.
Features
Red flag report

A short diligence report that lists only the significant issues found in a review, rather than describing the whole business in detail.
Due diligence
Regulatory due diligence

A review of the licenses, approvals and regulatory relationships a target depends on, checking compliance history and whether the deal itself needs consent or will change the target's regulatory status.
Due diligence
Remote shred

The ability to revoke access to files a user has already downloaded, so protected copies on their device can no longer be opened.
Security
Representations and warranties

Statements of fact about a business that the seller makes in a purchase agreement, such as the accuracy of accounts or the absence of litigation, which give the buyer a remedy if they prove untrue.
Legal
Retrieval-augmented generation (RAG)

An AI technique in which a system first searches a document collection for passages relevant to a question, then gives those passages to a language model so its answer is grounded in the actual files.
Features
Reverse due diligence

Due diligence carried out by the seller or target on the buyer or investor, typically checking its financing, track record, reputation and plans before agreeing to sell or to take its money.
Due diligence
Role-based access control (RBAC)

A permission model in which users receive rights according to their role, such as administrator, uploader or reviewer, rather than having each capability granted individually.
Permissions

S

Screenshot protection

Measures that try to stop or deter users from capturing document pages with screenshot tools, such as blocking capture keys, blanking the viewer when it loses focus or overlaying traceable marks.
Security
Secondary sale

A transaction in which existing shareholders sell their shares to new investors, so the money goes to the selling holders rather than to the company itself.
Deal process
Secure document viewer

The in-browser or in-app reader that displays documents without handing over the original file, so the data room can enforce rules on viewing, printing and copying.
Security
Sell-side

The seller of a business or asset and the advisers working for it, who prepare the information, run the sale process and own the data room that buyers review.
Deal process
Semantic search

Search that matches the meaning of a query rather than its exact words, so asking for 'termination rights' can also find clauses that talk about ending the agreement or notice to cancel.
Features
Separation of duties

A control that splits sensitive tasks between different people, so no single user can, for example, upload a document, release it to bidders and erase the record of having done so.
Permissions
Session timeout

An automatic sign-out after a set period of inactivity, so an unattended browser does not leave the data room open to whoever sits down next.
Security
Setup fee

A one-time charge some providers add when a room is opened, covering onboarding, configuration, branding, initial upload help or training, on top of the ongoing subscription or usage cost.
Pricing and billing
Share purchase agreement (SPA)

The main contract in a company sale where the buyer acquires the shares of the target entity, taking the business as a whole along with its assets, contracts and liabilities.
Legal
SIEM integration

A connection that streams a data room's security events, such as logins, failed attempts, permission changes and downloads, into the customer's own security information and event management system.
Security
Signing and closing

The two legal milestones of a transaction: signing, when the parties execute the purchase agreement, and closing, when conditions are met and ownership and money actually change hands.
Deal process
Single sign-on (SSO)

A login method that lets users enter a data room with the account they already use at work, verified by their company's identity provider instead of a separate password.
Security
SOC 2

An attestation framework from the American Institute of CPAs in which an auditor reports on a service provider's controls for security and, optionally, availability, confidentiality, processing integrity and privacy.
Compliance and privacy
SPA markup

A bidder's edited version of the seller's draft share purchase agreement, showing every proposed change in tracked form so the seller can compare legal terms across competing offers.
Deal process
Specific indemnity

A promise by the seller to reimburse the buyer for losses from a particular, identified risk found during diligence, such as a known lawsuit or tax exposure, regardless of whether it was disclosed.
Legal
Staged disclosure

Releasing documents to buyers or partners in planned steps, so the most sensitive information becomes visible only as a counterparty proves serious intent.
Permissions
Stalking horse bid

An initial offer for a distressed company or its assets, agreed in advance with the seller, that sets a minimum price and terms which other bidders must beat at a court-supervised or structured auction.
Deal process
Standard contractual clauses (SCCs)

Model contract terms approved by the European Commission that let personal data be transferred from the EU to countries without an adequacy decision, by binding the recipient to EU-level protections.
Compliance and privacy
Standstill agreement

A commitment, often inside an NDA, in which a potential buyer agrees not to acquire the target's shares, launch a hostile bid or solicit shareholders for a set period without the target's consent.
Legal
Storage-based pricing

A billing model where the room is priced by the volume of data stored, usually in gigabytes, with users and pages included or priced separately.
Pricing and billing
Subprocessor

A third party that a data room provider engages to process customer data on its behalf, such as a cloud hosting company, an email delivery service or an AI model provider.
Compliance and privacy

T

Tax due diligence

A review of a target's tax filings, structure and positions to identify unpaid tax, risky arrangements and opportunities that affect the deal price or structure.
Due diligence
Teaser

A short, usually anonymous profile of a business for sale, sent to possible buyers to gauge interest before any confidential information changes hands.
Deal process
Technology due diligence

An examination of a target's software, infrastructure, security practices, technical debt and engineering team, to judge whether its technology can support the plan the buyer is paying for.
Due diligence
Term sheet

A short summary of the main terms of an investment or deal, such as valuation, amount, investor rights and governance, agreed before the full legal documents are drafted.
Deal process
Total cost of ownership (TCO)

The full amount a data room costs over its whole life, including setup, overage, extensions, add-ons and archiving, rather than only the advertised monthly or per-page price.
Pricing and billing
Transfer impact assessment (TIA)

A documented review, required in some cases under EU data protection law, of whether personal data sent to a country outside the EU will be adequately protected there in practice, despite the safeguards in the contract.
Compliance and privacy
Transport Layer Security (TLS)

The standard protocol that encrypts and authenticates connections between browsers and servers; it is what puts the padlock in the address bar when you open a data room.
Security
Two-factor authentication (2FA)

A login check that asks for a second proof of identity, such as a one-time code from an app or a hardware key, on top of the password.
Security

U

Uptime SLA

A contractual promise about how much of the time a data room will be available, usually stated as a percentage per month, with service credits if the provider falls short.
Security
User groups

Collections of users, usually one per organization or function, that share the same access settings in a data room, so rights are set once for the group instead of person by person.
Permissions

V

Vendor due diligence (VDD)

Diligence commissioned by the seller before a sale, with independent advisers producing reports that bidders can read and, often, rely on.
Due diligence
Version control

A system that keeps every earlier copy of a document when a newer one is uploaded, shows which version is current, and records who replaced it and when.
Features
View-only access

A permission level that lets users read documents inside the data room viewer but not download, print or copy them out.
Permissions
Virtual data room (VDR)

A secure online workspace where a company stores confidential documents and lets outside parties review them under controlled, logged access, most often during a transaction or audit.
Features

W

Warranty and indemnity insurance (W&I)

An insurance policy that covers losses from breaches of warranties in a purchase agreement, letting the buyer claim against an insurer rather than, or in addition to, the seller.
Legal

Z

Zero trust architecture

A security model that treats every login, device and request as untrusted until it is verified, instead of assuming that anyone inside a network or holding a password is safe.
Security

Put the terms to work

From vocabulary to a shortlist

Provider directory

Every rated provider with certifications, security controls and features side by side.

VDR pricing

The billing models from this glossary, with a calculator and indicative budgets.

Comparisons

Two rooms, one table, and where each one fits better.

Find a data room

A few questions about your process and a matched shortlist.

Glossary FAQ

Who is this glossary for?

Founders, finance teams, lawyers, bankers and IT staff who are about to open or use a virtual data room and meet deal jargon for the first time. Each entry explains the term, how it shows up inside a data room and why it matters during a transaction.

Are these definitions legal or tax advice?

No. Legal, tax and compliance entries are general explanations. Rules differ by country and change over time, so confirm anything that affects a live transaction with your own advisers.

How do I use the glossary when comparing providers?

Use it to decode feature lists and quotes. Once the terms are clear, the provider directory, the pricing guide and the head-to-head comparisons show how each room handles them.