Guide
Data room security: the questions worth asking a provider
Updated
Security is where data room marketing is most uniform and least useful. Every provider claims encryption in transit and at rest, watermarking and document rights management, so the claims tell you nothing. The differences that matter are the ones a provider has to evidence rather than assert.
Talk to a specialist Five providers, one published price, three different billing units and the peak usage convention that decides what a diligence spike really costs you.
Attestations, not adjectives
An attestation is a third party's opinion produced under a standard, and it is the only part of a security claim that is checkable from outside. CapLinked states SOC 2 compliance on its Team plan and a 99.9% uptime SLA on Enterprise.
Ask every provider on your shortlist for the report itself, under NDA if necessary, and ask what period it covers. A SOC 2 Type II covering a period that ended two years ago is a historical document.
Revocation is the real test
Document rights management is sold on the promise that access can be withdrawn after a file has been downloaded. That is a strong claim and it depends entirely on implementation, so test it rather than accepting it.
The test takes ten minutes in a trial: download a document as a guest user, revoke access, then try to open the file offline. Then try opening it on a second device. Whatever happens is the answer, and it varies more than the marketing suggests.
The audit log is the deliverable
In a disputed deal, the audit log is evidence. What matters is not that one exists but whether it is exportable, whether it records views as distinct from downloads, and whether it survives a user being removed from the room.
That last one catches people out. If deleting a bidder's account removes their activity history, the log will not answer the question anybody will actually ask afterwards, which is what that bidder saw before they walked away.
Who else is in the building
Where a provider sells a family of products, as Brainloop does with BoardRoom, MeetingSuite, DealRoom and CollaborationRoom, ask how tenancy and permissioning separate them. A board pack and a deal room have different populations and one of them contains people who must not see the other.
None of this is exotic and all of it is answerable in writing. A provider that answers these four questions crisply is telling you as much about its engineering as any certificate does.