Checklist

The due diligence checklist

Every document a fundraise or M&A process will ask for, in the six categories diligence teams actually use — and which phase of the process each belongs in.

Diligence requests are more standard than they feel. Whether it is a Series A, a growth round, or a sale, the request list converges on the same six categories — so build the room before the process starts, not folder by folder as requests arrive. The full reasoning behind the structure is in our guide to building a data room; this page is the list itself.

1. Corporate & Governance

The first thing counsel opens. Gaps here don’t kill deals, but they stall them for weeks while documents get hunted down and re-signed.

  • Certificate of incorporation and every amendment
  • Bylaws or articles of association, current version
  • Cap table, fully diluted, reconciled to the signed documents behind it
  • Shareholder and investor rights agreements
  • Board minutes, board consents, and shareholder resolutions
  • Stock option plan, the grants register, and outstanding promises not yet papered
  • Prior financing documents — SAFEs, convertible notes, share purchase agreements
  • Corporate structure chart if there are subsidiaries or holding entities

2. Financial Information

Where the most questions land. The test is not whether the numbers are good — it’s whether they reconcile with each other everywhere they appear.

  • Annual financial statements for the last three years (or since founding)
  • Monthly P&L, balance sheet, and cash flow for the last 24 months
  • Financial model, with the assumptions visible rather than buried
  • Revenue recognition policy, in one paragraph if that is all it takes
  • Accounts receivable and payable aging
  • Tax returns and any open disputes or rulings
  • Audit reports, if audited; say plainly if not
  • Budget versus actuals for the current year
  • Debt schedule: facilities, terms, covenants, and what is drawn

3. Commercial & Customers

The category most likely to carry genuinely sensitive material — customer names in front of a strategic buyer are not a phase-1 disclosure.

  • Revenue broken down by customer, product, and geography
  • Customer concentration analysis — the top-10 table they will build anyway
  • Material customer contracts, and the standard form (MSA / terms of service)
  • Churn and retention data, with the definition used to compute it
  • Sales pipeline snapshot, staged honestly
  • Pricing documentation and the actual discounting practice
  • Material supplier, vendor, partnership, and reseller agreements

4. People & Organization

Buyers are acquiring the team’s output; investors are underwriting its continuity. Both read this folder more carefully than founders expect.

  • Organization chart, current
  • Employment agreements for key people, and the standard offer template
  • Compensation structure, including bonus and commission plans
  • Option grants by employee, reconciled against the cap table
  • Contractor and consultant agreements
  • Employee handbook and material HR policies
  • Any employment disputes, claims, or separations with terms

5. Technology & IP

One missing founder IP assignment can hold a closing hostage. This folder is cheap to complete early and expensive to complete late.

  • IP assignment agreements from every founder, employee, and contractor who touched the product
  • Patents, trademarks, and domain registrations
  • Open-source usage inventory and license review
  • Architecture overview, written for a technical reader outside the company
  • Material third-party software licenses and dependencies
  • Security practices summary, and any incident history stated plainly
  • Data protection and privacy compliance position (GDPR and equivalents)

6. Legal & Compliance

The folder that exists to answer one question: is there anything that bites later? Disclose it here, on your terms, rather than in a rep-and-warranty claim.

  • Litigation — current, threatened, and settled
  • Regulatory licenses and permits
  • Privacy policy and terms of service, as published
  • Insurance policies and coverage summary
  • Material contracts not covered elsewhere — leases, loans, guarantees
  • Related-party transactions, disclosed even when they are boring

Don’t release it all at once

A complete data room is not one you open fully on day one. Diligence has stages, and disclosure should match them — every document above gets a phase along with a folder:

Phase 1 — first conversations

What you would show before an NDA: the deck, a product overview, high-level metrics, market material. Everything here should be safe in a forwarded email, because it will be in one.

Phase 2 — serious interest

Post-NDA, post-IOI: detailed financials, commercial data with customers anonymized, the model, the org chart. Enough to price the deal, not enough to hurt you if the deal dies.

Phase 3 — confirmatory diligence

Named customer contracts, employee-level compensation, security detail, litigation files. The material you show the party you expect to sign — and only that party.

The staging only works if it is invisible: a counterparty who can see that phase-3 documents exist will ask for them on day one. That is why our product hides above-phase documents entirely — absent from listings and counts, with a direct request returning 404, not 403. How that is enforced is on the security page.

Skip the folder setup

Every new data room on YourDataRoom.app can seed this exact structure in one click, then tag and organize your uploads as they arrive. Plans are flat monthly — pricing is published here, and the live demo is open if you want to see a finished room first.