Virtual Data Room for Investors: What to Require
How to design a data room or private investor portal: individual accounts, separate roles, access logs and protected downloads, set up before launch.
Anyone sharing investment project documents with third parties needs to know who can see them, who opened them and how to keep them from circulating without control. A well-designed data room answers all three from the first day.
- Each investor has an individual account, approved before entry, and sees only what is theirs.
- Every document opening is recorded, and downloads do not rely on links that can be forwarded.
- Hosting, licences and data ownership are settled before launch, not afterwards.
What a data room is and why it matters
A data room, or private investor portal, is an online space where an organisation publishes sensitive documentation for a limited group of people: project background, reports, contracts or financial material. It replaces email attachments and shared folders with open links, which lose traceability as soon as the first file is forwarded.
For the publisher, the value lies in trust: showing anyone evaluating an investment that the information is handled with the same care expected of the investment itself.
Individual accounts and prior approval
The first principle is that shared accounts do not exist. Each person signs in with their own identity, and that identity is created only after explicit approval by the organisation. Prior approval prevents an invitation link from travelling beyond its original recipient and leaves a record of who authorised each access.
Individual accounts also make it possible to withdraw one person's access without affecting anyone else, which cannot be done when several people share a password.
Separate roles: each user sees only their own
Not every investor should see the same documents. Some will have access to one part of the material and others to another; the internal team, in turn, needs administration permissions that investors must not have. Separating roles means defining these categories in advance and checking that each account sees only what its role allows.
A record of who opened which document
An access log records who opened each document and when. It serves two purposes. For the organisation, it shows which material attracts interest and helps detect unexpected activity. For the investor, and for any third party reviewing the process, it is evidence that access is managed in an orderly way.
The log should be kept somewhere ordinary users cannot alter, and it should be reviewed regularly; a log nobody reads adds little.
Protected downloads
A direct link to a file is, in practice, a key anyone can copy. In a data room, therefore, downloads are delivered only to authenticated and authorised users, without exposing addresses that work outside the session. If a document should not be downloaded, it can be offered for on-screen reading only. Defining this policy by document type is a business decision best made with the legal team.
Test before committing
Before buying licences or contracting services, it is wise to test the solution on a copy, with sample data, and confirm that roles, logging and downloads work as expected. It is the most economical way to find differences between what a platform promises and what the organisation needs. On why real data should stay out of tests, see Synthetic test data.
Ownership and separation between clients
Licences and data should be held in the name of, and owned by, the organisation that publishes, not the provider who builds the room. Where there are several clients or projects, each should run in a separate environment, so that a problem in one does not reach the others. This criterion is developed in Who owns your data: what to require from a software provider.
Practical checklist
- Define who approves each access request and put it in writing.
- List the roles and which documents belong to each.
- Decide which documents may be downloaded and which are read-only.
- Confirm that the access log is kept and who reviews it.
- Test everything on a copy before buying licences.
- Check that licences and data are held in the organisation's name.
- Keep the page unindexed until the legal team approves the text.
Frequently asked questions
Is a data room the same as a shared cloud folder? No. A shared folder usually depends on links; a data room adds individual accounts, roles, prior approval and access logging.
Who should approve access? The publishing organisation, through a defined person or committee. The technical provider carries out the decision but does not decide who is admitted.
Can it be managed with the help of artificial intelligence? It is a direction we consider for the future, always with limited permissions and under human supervision. It does not replace access decisions.
When should the page become visible? Once the legal team has approved the text. More on that order in Launching a site without surprises.
General guidance; it does not replace legal advice.
At IT Lab we have supported the design of this kind of private space, including a project currently under way with these characteristics. To keep operational information behind a portal, see Secure customer portal; to respond to assessments required by institutional customers, see Supplier security assessments.
If you would like to review how your data room should work, Let's talk.
Do you need someone to take care of your technology?
Tell us what you need to organize, protect or solve. The first conversation has no cost: we assess whether our model fits you and what the next steps would be.
Let's talk about your business