Security reviews and SOC 2 evidence.
A security review asks the startup to prove how it protects data: a SOC 2 report or ISO 27001 certificate, penetration test results, policies, and answers to a questionnaire. Keep this evidence in a dedicated folder set, share it under NDA with view-only access and watermarks, and track who read it.
Security review room
- 01 Overview
- 02 Attestations
- 03 Penetration tests
- 04 Policies
- 05 Questionnaires
- 06 Infrastructure
- 07 Privacy
How it works for a startup.
Security reviews come from three directions. Enterprise customers send questionnaires before they sign. Investors at Series A and later ask for the same evidence as part of diligence. Acquirers run the deepest version, often with their own security team or an outside firm.
SOC 2 is an attestation by a licensed CPA firm under AICPA criteria. A Type I report covers controls at a point in time; a Type II report covers how controls worked over an observation period, commonly between three and twelve months. Many startups start with a Type I to unblock early deals and move to Type II.
Auditors' reports carry use restrictions and are not public documents. Customers and investors normally get them under NDA, so the room should require NDA acceptance before access and keep a log of who opened each report.
Top 10 data rooms for this job.
Our five measures, re-weighted for security review. Places 11 to 17 are listed below the cards.
- Setup speed 21%
- Investor experience 16%
- Access control 31%
- Diligence tools 16%
- Startup pricing 16%
- 1 9.0/10First-rate
- $149 monthly
- 14-day free trial
- 8/12 feature checks
- Investor Q&A
- NDA e-signing
- Dynamic watermarks
- View-only and download control
- SOC 2 (hosting)
- 2 8.3/10Strong pick
- Quote only
- Free trial offered
- 9/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- GDPR
- 3 8.1/10Strong pick
- Quote only
- Free trial offered
- 7/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- 4 8.1/10Strong pick
- Quote only
- Demo, no trial
- 10/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- GDPR
- 5 8.1/10Strong pick
- Quote only
- Free trial offered
- 8/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- 6 8.0/10Strong pick
- $250 monthly
- Free trial offered
- 8/12 feature checks
- Investor Q&A
- NDA e-signing
- Dynamic watermarks
- View-only and download control
- SOC 2
- 7 7.8/10Strong pick
- $55 monthly
- Free trial offered
- 9/12 feature checks
- NDA e-signing
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- HIPAA
- 8 7.8/10Strong pick
- Quote only
- Demo, no trial
- 8/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- 9 7.8/10Strong pick
- Quote only
- Demo, no trial
- 7/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- 10 7.8/10Strong pick
- Quote only
- Demo, no trial
- 8/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- GDPR
Show places 11 to 17
- CapLinked 7.7
- DealRoom 7.5
- ShareVault 7.2
- Onehub 7.2
- Digify 7.0
- Venue by DFIN 6.7
- DocSend 6.6
Folder index.
A starting structure for this room. Rename folders to fit your company and keep the numbers.
Security program summary, trust page content, contact for security questions.
SOC 2 Type I or Type II report, ISO 27001 certificate, bridge letters.
Latest third-party test summary, remediation status, retest letters.
Information security, access control, incident response, vendor management, data retention.
Completed SIG Lite, CAIQ or customer questionnaires for reuse.
Hosting provider, regions, encryption at rest and in transit, network diagram.
Privacy policy, DPA template, subprocessor list, data maps.
Incident history summary, breach notifications if any, postmortems.
Backup policy, disaster recovery plan and test results.
Cyber insurance certificate and coverage summary.
Need every file by stage? Use the startup data room checklist.
Must-have features.
| Provider | NDA e-signing | Dynamic watermarks | View-only and download control | Viewer activity log | Two-step login |
|---|---|---|---|---|---|
| Ellty | |||||
| iDeals | |||||
| Firmex | |||||
| Datasite | |||||
| Ansarada | |||||
| SecureDocs | |||||
| Citrix ShareFile | |||||
| Intralinks | |||||
| SmartRoom | |||||
| Drooms |
- NDA e-signing
- Investors sign the NDA or click-through terms before the room opens.
- Dynamic watermarks
- Stamps the viewer email and the time across every page, so a forwarded screenshot points back to its source.
- View-only and download control
- Set each file to view only, print or download, and change it later without resending anything.
- Viewer activity log
- Shows which investor opened which file, for how long and when, and exports the record.
- Two-step login
- Every login needs a one-time code or an app approval as well as the password.
Set up the room in 6 steps.
- 1
Collect current evidence
Gather the latest SOC 2 report, any bridge letter covering the gap since the period ended, and the most recent pen test summary.
- 2
Write standard answers
Fill out one standard questionnaire, such as SIG Lite or CAIQ, and keep it current. Most custom questionnaires can be answered from it.
- 3
Require an NDA at the door
Set the folder so each viewer accepts an NDA or confidentiality terms before the first document opens.
- 4
Share view-only with watermarks
Block downloads and printing on the attestation and pen test, and add dynamic watermarks with the viewer email.
- 5
Track and expire access
Watch who opened which report and set access to expire after the review or deal window.
- 6
Refresh on a schedule
Replace reports each audit cycle and archive the old ones so no one reads an expired report by mistake.
Common mistakes.
- Emailing the SOC 2 report as a PDF attachment with no NDA or tracking.
- Sharing a report whose period ended long ago without a bridge letter.
- Answering each questionnaire from scratch instead of keeping a standard set.
- Including raw pen test findings that have not been fixed or explained.