Startup Fundraising: Setting Up a Secure Data Room for Investors

What goes in a startup data room

Investors' lawyers work from a due diligence checklist. Matching their order saves days of back-and-forth. Number the top-level folders so they sort the same way for everyone.

Keep a short index document in the root folder listing every section, what's in it, and what is still to come. Investors appreciate knowing a gap is known rather than discovering it.

Singapore company documents investors will ask for

Many corporate records live with ACRA. According to ACRA's company registers page, electronic registers update automatically when you file changes through Bizfile, and the public can access the registers except the register of registrable controllers, nominee directors and nominee shareholders. Section 196A of the Companies Act requires the Registrar to keep an electronic register of members for every private company.

• Business profile and registers: officers and members can download free copies of their company's registers from Bizfile, according to ACRA's guide.
• Register of registrable controllers (RORC): since 30 July 2020, companies must also file RORC information with ACRA's central register, per ACRA's announcement. Share your internal RORC with investors' counsel, not publicly.
• Resolutions and minutes for share allotments, option grants and director appointments.
• Signed agreements: keep the executed versions with signature pages, not drafts. If you signed electronically, include the certificate or audit trail.

If past documents were signed electronically, our e-signature guide explains what the Electronic Transactions Act accepts.

Google Drive, SharePoint or a dedicated data room?

For Google Drive, Google's sharing settings let you set expiration dates on access for files in My Drive, but Google notes this isn't supported the same way for files in shared drives, so check where your data room lives. By default, viewers and commenters can download, print and copy; turn off that option per file or use an admin data protection rule. In SharePoint, share with "specific people" and set link expiry; admins can force expiry on Anyone links in the SharePoint admin centre, as Microsoft's anonymous sharing best practices explain.

Setting up secure access step by step

1. 1

   Use a company account, not a founder's personal drive

   Create the data room in your Google Workspace or Microsoft 365 tenant so the company keeps control if a founder leaves.

2. 2

   Turn off anyone-with-the-link sharing

   Share only with investors' named email addresses. Ask each fund for the exact people who need access.

3. 3

   Default everyone to view-only

   Disable download, print and copy for viewers where your tool supports it. Allow downloads only for specific documents when counsel asks.

4. 4

   Set expiry dates

   Give access for a set period, such as 30 days, and extend if diligence continues.

5. 5

   Stage sensitive folders

   Open detailed contracts, salaries and source code only to the lead investor at term sheet stage, not to everyone in first meetings.

6. 6

   Check activity regularly

   Review who opened what. A sudden bulk download from someone outside the deal team is worth a question.

Enterprise customers ask similar questions about your security later; our security questionnaire guide helps you prepare the security documents for folder 07.

Personal data in HR and customer files

Employment contracts, payroll and customer lists contain personal data under the PDPA. PDPC's framework for collection, use and disclosure lists a business asset transaction exception to consent, but whether and how it applies to your round depends on the transaction, so get legal advice before sharing identifiable staff or customer data.

After the round: clean-up checklist

Data rooms are forgotten the day the money arrives. Old links stay live for years, which is how confidential documents end up in places they shouldn't. Our sharing links clean-up guide shows how to find old links in Microsoft 365.

Do it yourself or get help?

Most founders can build a seed-stage data room themselves in a day using the folder structure above and Google Drive or SharePoint sharing controls. The parts that go wrong are tenant-wide sharing defaults and forgetting to revoke access afterwards.

Our Microsoft 365 / Google Security Lockdown (S$590) sets external sharing defaults, MFA and link expiry policies before you invite investors. The Access Review & Leaver Tool (S$1,200) gives you a dashboard of who outside the company can reach which files, so clean-up after the round takes minutes.