The startup fundraising data-room checklist.

A startup data room is a controlled collection of the documents a prospective investor needs to evaluate the company. More files do not automatically create more confidence. Start with a clear index, remove duplicates, and share only material you can explain.

1. Name one ownerGive one person responsibility for structure, freshness, access decisions, and the final publish check.
2. Separate draft from publishedPrepare privately and publish a stable version rather than reorganizing a live room underneath investors.
3. Use an obvious indexA reader should understand the room in under a minute and know which document answers which diligence question.

The final set depends on stage, jurisdiction, and the investor’s process. The categories below are a working checklist, not legal advice.

1. Company and roundCurrent pitch deck, concise company overview, round terms or financing summary, use of funds, and the key fundraising narrative.
2. FinancialHistorical statements, current management view, forecast and assumptions, cash position, runway, and material liabilities.
3. Product and technologyProduct overview, roadmap, architecture or security material appropriate to the stage, and material intellectual-property context.
4. CommercialPipeline or customer summary, material contracts, pricing, retention or usage evidence, and concentration risks.
5. TeamOrganization chart, key biographies, employment or advisor arrangements that matter, and open critical roles.
6. Legal and ownershipFormation documents, cap table, previous financing documents, option plan, material agreements, disputes, and regulatory matters where applicable.

A fundraising room is not a public file share. Give access to named people, make revocation immediate, and preserve enough history to understand what happened without retaining more personal data than necessary.

1. Invite deliberatelyChoose each guest or approved group. Do not turn the whole CRM into a default audience.
2. Verify accessUse time-limited codes or another deliberate authentication step for private guest paths.
3. Scan before sharingDo not accept an uploaded file for publication until malware scanning completes cleanly; fail closed when scanning is unavailable.
4. Revoke immediatelyRemove access when the process changes while preserving the prior activity record for the workspace owner.

The last pass should test the room as a guest, not as the founder who built it.

1. Open every pathTest the invitation, one-time code, room landing view, each important document, and the intended download policy.
2. Check names and datesRemove stale filenames, contradictory versions, internal comments, and ambiguous date ranges.
3. Confirm mobile readabilityInvestors will open the room on phones. Verify navigation, document previews, and primary actions at a narrow viewport.
4. Know the rollbackBefore publishing, know how to unpublish, revoke a guest, replace a document through a new version, and delete the room when the process ends.