Technical due diligence for startups.
Technical due diligence checks whether the product works the way the pitch says, whether it can scale and whether the code carries legal or security risk. Prepare architecture documents, an open source inventory, security policies, uptime and incident history and a plan for supervised code access, and keep them in a separate folder group with tighter permissions.
Technical due diligence room
- 01 Architecture
- 02 Codebase overview
- 03 Open source
- 04 Security
- 05 Reliability
- 06 Infrastructure costs
- 07 Data and privacy
How it works for a startup.
Investors at Series A and later, and almost every acquirer, either assign an in-house engineer or hire a technical due diligence firm. The reviewer reads documents first, then interviews the CTO and key engineers, and in larger deals runs a code scan. In an acquisition the review often includes a software composition analysis that lists every open source package and its licence.
Questions fall into a few groups: architecture and hosting, code quality and test coverage, the development process, security and privacy, scalability and cost, and the people who hold the knowledge. A reviewer also checks that the company owns its code, which means invention assignment agreements for every employee and contractor who wrote it.
Source code is the most sensitive item in any startup room. Many founders never upload it at all and instead offer a screen share, read-only repository access for a named reviewer for a fixed period, or a third-party scan whose report goes into the room.
Top 10 data rooms for this job.
Our five measures, re-weighted for technical due diligence. Places 11 to 17 are listed below the cards.
- Setup speed 20%
- Investor experience 16%
- Access control 29%
- Diligence tools 21%
- Startup pricing 14%
- 1 9.2/10First-rate
- $149 monthly
- 14-day free trial
- 8/12 feature checks
- Investor Q&A
- NDA e-signing
- Dynamic watermarks
- View-only and download control
- SOC 2 (hosting)
- 2 8.4/10Strong pick
- Quote only
- Free trial offered
- 9/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- GDPR
- 3 8.2/10Strong pick
- Quote only
- Demo, no trial
- 10/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- GDPR
- 4 8.1/10Strong pick
- Quote only
- Free trial offered
- 8/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- 5 8.1/10Strong pick
- Quote only
- Free trial offered
- 7/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- 6 8.0/10Strong pick
- $250 monthly
- Free trial offered
- 8/12 feature checks
- Investor Q&A
- NDA e-signing
- Dynamic watermarks
- View-only and download control
- SOC 2
- 7 7.8/10Strong pick
- Quote only
- Demo, no trial
- 8/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- GDPR
- 8 7.8/10Strong pick
- Quote only
- Demo, no trial
- 8/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- 9 7.8/10Strong pick
- Quote only
- Demo, no trial
- 7/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
- ISO 27001
- 10 7.7/10Good option
- $299 monthly
- Free trial offered
- 7/12 feature checks
- Investor Q&A
- Dynamic watermarks
- View-only and download control
- Viewer activity log
- SOC 2
Show places 11 to 17
- Citrix ShareFile 7.7
- DealRoom 7.5
- ShareVault 7.2
- Onehub 7.0
- Digify 6.7
- Venue by DFIN 6.7
- DocSend 6.4
Folder index.
A starting structure for this room. Rename folders to fit your company and keep the numbers.
System diagram, service map, data flow, hosting regions, third-party services.
Repository list, languages, size, test coverage, CI/CD setup, branching model.
Software bill of materials, licence report, any copyleft components and how they are used.
Security policies, last penetration test summary, vulnerability management, access reviews.
Uptime history, incident log and postmortems, backup and disaster recovery plan.
Monthly cloud bills, reserved capacity and committed spend contracts, cost per customer.
Data inventory, retention rules, privacy policy, DPAs with subprocessors.
Product roadmap, known technical debt, planned rewrites or migrations.
Engineering org chart, key person list, on-call rotation, contractor arrangements.
Invention assignment agreements for engineers and contractors, licences for third-party code.
Need every file by stage? Use the startup data room checklist.
Must-have features.
| Provider | View-only and download control | Dynamic watermarks | Viewer activity log | Investor Q&A | Two-step login |
|---|---|---|---|---|---|
| Ellty | |||||
| iDeals | |||||
| Datasite | |||||
| Ansarada | |||||
| Firmex | |||||
| SecureDocs | |||||
| Drooms | |||||
| Intralinks | |||||
| SmartRoom | |||||
| CapLinked |
- View-only and download control
- Set each file to view only, print or download, and change it later without resending anything.
- Dynamic watermarks
- Stamps the viewer email and the time across every page, so a forwarded screenshot points back to its source.
- Viewer activity log
- Shows which investor opened which file, for how long and when, and exports the record.
- Investor Q&A
- Funds and buyers ask questions against a file; you assign, answer and publish replies, and the thread stays on record.
- Two-step login
- Every login needs a one-time code or an app approval as well as the password.
Set up the room in 6 steps.
- 1
Write the architecture brief
Two to five pages that explain how the system fits together, where it runs and what it depends on. Reviewers read this before anything else.
- 2
Run an open source scan
Generate a software bill of materials and a licence report before the buyer does. Note how any GPL or AGPL code is used and whether it is distributed.
- 3
Collect the security evidence
Policies, the latest penetration test summary, the SOC 2 report if you have one, and a short list of open findings with fix dates.
- 4
Decide how code is shown
Choose between a live walkthrough, time-limited read access for a named reviewer, or a third-party scan report. Put the agreed method in writing.
- 5
Lock down the folder group
Give the technical folders to the reviewer only, view-only with watermarks, and turn on download blocking for architecture and security files.
- 6
Prepare the interviews
Brief the CTO and lead engineers on likely questions about scaling limits, outages and technical debt, and add any follow-up answers to the Q&A log.
Common mistakes.
- Discovering an unassigned contractor contribution to the core codebase during the review.
- Uploading a full source code archive to a room that every investor contact can open.
- Hiding known technical debt that the reviewer then finds in the code scan.
- No incident history, which reads as no monitoring rather than no incidents.