Set up a diligence room before the first bidder arrives
An hour spent on the index and the permission matrix buys back a fortnight of answering the same question in four different email threads.
The XDocs team4 min read
Diligence rooms are nearly always built in a hurry, by somebody who has six other jobs, the week the process starts. That is why the common failure is not a leak — it is a room where nobody can tell which bidder has seen the customer contracts, because everything was shared with everybody and the index was improvised as files arrived.
The work that prevents it is dull and takes about an hour. Here it is in order.
Build the index first, upload second
1
Write the folder structure before you have the files
Corporate, financial, commercial, people, IP, litigation — whatever the deal needs. Decide it once, while you are thinking about the process rather than about the twelve PDFs somebody has just emailed you. An index built around what arrived is an index only its author can navigate.
2
Create a viewer group per audience, not per person
One group per bidder, one for their advisers, one for your own team. Permissions attach to groups, so adding the fourth person from a bidder's side later is a single decision rather than a fresh set of guesses.
3
Fill in the permission matrix folder by folder
Each group gets view and download rights per folder and per file. This is the step people skip, and it is the one that makes the whole room defensible: a bidder's access is a row you can read off a screen, rather than a recollection of which links were sent in which week.
4
Decide the gates once, at the room
A diligence room usually wants email verification, so a visitor is a known address rather than a claimed one, and an NDA before viewing, taken from the agreements library so the wording is the one your counsel approved. Set them on the room and every document inside inherits them.
5
Compose the watermark
The reader's own email, the date, the time, the IP. Downloads carry the same mark as the screen. This is the difference between a document that must not be forwarded and one whose forwarding would be traceable.
6
Write the intro page and the welcome note
Two paragraphs saying what the room is, what the process is, and who to ask. It is read by every bidder, it costs ten minutes, and it prevents the first four questions. Add your logo, colours and layout while you are there — not for vanity, but because a room that looks like it belongs to you is one bidders treat as a controlled environment.
If you cannot say what one bidder can see without opening three email threads, the room is not set up yet.
Then stop managing it by hand
A room that works generates a lot of small questions — who has looked at what, is anybody stuck, did the new file land — and answering them manually is how the week disappears.
- A per-room digest arrives weekly: who read what, and what they skipped. The second half is the half that changes conversations.
- Viewer questions arrive in one inbox and are answered from it, so the same clarification is not given three different ways by three different people.
- Visitors are scored on breadth, depth, return and commitment, with the weights shown and a note of what the top visitor never opened.
- Replace a file under the same document when a version changes, and every link already sent keeps working while every pinned version keeps the old pages.
- Reading is attributed per file, so "they have been in the room" becomes "they read the customer contracts twice and have not opened the pension note".
If somebody on the other side of the deal needs to work inside the room rather than just read it, a member can be narrowed to particular rooms: they reach those rooms and the documents filed in them, and no workspace-wide page, link, template or folder outside them. That restriction is enforced on every path, not only on the pages the navigation leads to.
When the process ends, say which kind of ending it is
| State | What happens to the contents | What happens to the links |
|---|---|---|
| Live | Editable; files can be added and replaced. | Serving, subject to their gates. |
| Frozen | Locked — nothing can be added, removed or replaced. | Still serving. Readers see a fixed room. |
| Archived | Kept, and restorable if the deal comes back. | Closed. Nothing answers. |
Freezing is the one most people have never used and most often want: the process has closed, you are not going to change anything, and the bidders still need to refer to what they were shown. Archiving is for when it is genuinely over — and because deals come back, it is reversible rather than destructive.
And signing happens in the same place
The purchase agreement is sent from the workspace the room lives in, to the same people, with the same audit trail. That is less a feature than the absence of one: no export, no upload into a second product, no reconciling two lists of counterparties at the point in the deal when a mistake is least affordable. If this is most of what your week looks like, XDocs for Finance and M&A is the short version of this article.
Read next
A link should carry its own rules
The same document goes to an investor, a procurement team and a competitor's analyst. Permissions belong to the link you gave each of them, not to the file.
Read itReading time only counts when somebody is reading
Most document analytics measure tabs, not attention. Fixing the measurement is the easy half; the hard half is making the number answer a question.
Read itHow to set up a startup data room for a seed round
A seed data room is not a miniature M&A room. It is a dozen documents, a sensible index and two levels of access — and most founders put too much in it, too early.
Read it
One place for every important document.
Create, sign, share and understand your documents with XDocs.

