Starting a relationship with any business can be an experience full of uncertainty. And for a business-critical product like virtual data rooms, it can feel even more unnerving. This guide is designed to teach readers everything needed to make an informed choice when selecting a virtual data room for their business.
If you already know enough about virtual data rooms to make a confident decision, we list our top recommendations here:
We will cover these companies and what sets them apart in more detail below. We’ll also review many other options you should consider. But if you are new to using virtual data rooms or want to learn more, read on, and this guide will explain everything you need to know to make a smart decision.
Before deciding which virtual data room best fits your situation and choosing a provider, it is a must to understand exactly what a virtual data room is, and why you might want to use one.
A virtual data room, VDR, or data room is an extremely secure cloud-based environment that enables users to conveniently share, store, and collaborate on sensitive data and files. Businesses typically use virtual data rooms to comply with industry standards, to share private data with clients, or to exchange documents with other businesses during large-scale, private transactions, such as a company acquisition or merger.
Virtual data rooms, are inherently equipped with the most powerful internet security technology available, such as 256-bit encryption, multi-factor authentication, and document watermarking. With almost all data roms achieving such a high standard of security, the majority will be compliant with industry requirements in healthcare and sciences, such as HIPAA, or for the strict standards required for a company merger, like SSAE 16 Certification.
While security is key for data rooms, their fundamental purpose is to share information. So all virtual data rooms will give users the ability to manage their documents within their interface, as well as manage who can access and edit the different documents and folders. Often, the data room will provide audit logs or user access history reports as well.
Most virtual data rooms also come with basic collaboration tools to simplify the sharing of information. Examples of these collaboration features include document Q&A and data room messaging spaces.
A few data room services include features to help businesses manage a large client base, which can be very useful in industries like Law, Real Estate Lending, and Financial Advice, where a business or professional could have a large number of clients who need to privately share their documents and personal information.
Before diving too deeply, let’s briefly cover a common question for people new to VDR:
What is the difference between virtual data rooms and online file sharing tools like Dropbox, Box, and Google Drive?
Virtual data rooms are similar in many ways to online file sharing tools like Dropbox or Google Drive, but there are some key elements that make them different. These differences include:
Security Measures - Virtual data rooms are secure above all else. While modern online file sharing tools are definitely quite secure, virtual data room companies put an extra emphasis on keeping data secure. Certain features, like audit logs and granular access controls are not necessary in standard online file sharing tools, but important for companies using virtual data rooms.
Collaboration Tools - Virtual data rooms are also built for users to collaborate on the documents their sharing. Dropbox, Drive, and Box are also very much equipped for sharing files, but they don’t offer the collaboration features that some VDRs provide. Many virtual data rooms have many built in collaboration tools, such as instant messaging and the ability to comment on documents.
Industry-Specific Features - Whereas most online file sharing tools are general-purpose tools, some virtual data room providers build their products with specific industry use-cases in mind. For companies in the healthcare or real estate industries, this can be extremely helpful.
Online file sharing tools do provide very similar functionality to virtual data rooms. However, virtual data rooms are generally better equipped for enterprise and business, particularly when security or collaboration are factors.
To see just how the data room makes the process of sharing files more secure, consider the example of an individual starting a business with the help of their lawyer.
Instead of using hard copies, most modern lawyers and law firms will keep digital copies of important documents. So to start receiving private information from you, these security-minded lawyers will usually send their clients a link to their unique data room, or workspace.
Once the client visits the link they will be asked to create a secure login, which will also take advantage of multi-factor authentication.
When the client is logged in, they will be able to securely upload documents and then send them to the lawyer. This differs from sending by email, because once the client selects a document for upload, the data room immediately encrypts the document, even before it is uploaded, meaning your information is safe even if it is intercepted during transmission.
The next security measure comes when the document is actually uploaded. The document is sent over an encrypted connection, to the provider’s servers. The encrypted connection adds a second layer of encryption protection.
Once the document hits the provider’s servers, they will be physically protected by human guards, biometric entry systems, video surveillance, and securely locked vaults… seriously.
Finally, when the lawyer retrieves your documents from the data room, the documents are only sent via the same encryption process used when they were stored. And the lawyer may only access them via multi-factor authentication as well.
All virtual data rooms that DataRoomSearch recommends will offer these security features, and some will offer even more. This level of security is far beyond what you should expect from a standard email system.
As we covered in the section above, the main purpose of a virtual data room is secure file sharing. Why do you need a virtual data room for this? Don’t tools like Dropbox and Google Drive provide secure file sharing?
While those tools are fairly secure and can be effective ways to store, share, and collaborate on documents, they aren’t quite as powerful or secure as industry standard data rooms. Furthermore, data rooms offer an isolated workspace, specifically dedicated to the project, client, or group they were created for.
Extreme security and project compartmentalization aside, what are the reasons businesses use virtual data rooms? Here are a few scenarios where virtual data rooms are useful, if not absolutely necessary:
During any merger or acquisition, an extensive due diligence process gives companies, the opportunity to review historical and financial documents of the company they are acquiring or merging with. Of course for companies with proprietary, sensitive, or valuable information, security is very important during this process.
In M&A, the virtual data room serves as the secure online storage space and provides a secure method of sending this sensitive company information. But the data room does much more than provide security. The majority of virtual data rooms will simplify the collaboration process by providing features such as easy drag and drop upload, bulk upload, and meta-document commenting. Some virtual data rooms will go further still.
Data room companies know that one of the common uses of a virtual data room is for the due diligence process in M&A. As such, many have made custom solutions that cater specifically to the needs of companies in the midst of a merger. These M&A specific features include user permission controls, question and answer tools, and document access reports.
Virtual data rooms provide the ideal platform for M&A because they was inspired by the physical data rooms that were originally used when two companies performed the due diligence for an acquisition. Virtual data rooms were created to ease the costs associated with due diligence by providing the ability to remotely and securely view private documents. Historically, executives people who were critical to a deal were forced to coordinate their schedules and travel to a single location where they would review company information in a safe, secure, literal room.
When an individual or venture capital firm invests in a company, there is usually a due diligence period, similar to due diligence process of M&A.
The due diligence process usually begins after a formal investment offer is made. Typically this offer will contain contingencies, allowing the investor to back out of the deal if anything surprising and negative is found during this research process. Once the investor signs an NDA, they will be granted access to a virtual data room containing all of the relevant documents and data for the deal.
With most data rooms, but especially with those designed for due diligence, once investors have access, the data room administrators will be able to control their document-level permissions, make and reply to comments on documents, and view reports that summarize who is using the data room and what they access.
For some professions, like lawyer and certified public accountant, it’s very common to send or receive documents from clients to perform work on their behalf. In many cases, these documents will contain the client’s personal information like social security numbers, financial data, and other private information.
Rather than send these documents over email, which is usually only password protected (by a password that your client may be using for many accounts), it makes sense to use a virtual data room. This is because the extra security measures that data rooms employ ensure that these documents will not be accessed by outside parties.
To see just how the data room makes this process more secure, consider the example of an individual starting a business with the help of their lawyer.
Instead of using hard copies, most modern lawyers and law firms will keep digital copies of important documents. So to start receiving private information from you, these security-minded lawyers will usually send their clients a link to their unique data room (they might call this a workspace, but that is really all a data room is, so consider them one in the same).
Once the client visits the link they will be asked to create a secure login, which will also take advantage of multi-factor authentication. This is security measure number 1.
Next, when the client is logged in, they will be able to securely upload documents and then send them to the lawyer. This differs from sending by email, because once the client selects a document for upload, the data room immediately encrypts the document, even before it is uploaded. Security measure number 2.
Security measure number 3 comes when the document is actually uploaded. The document is sent over an encrypted connection, to the provider’s servers. The encrypted connection adds a second layer of encryption protection.
Once the document hits the provider’s servers, they will be physically protected by bodyguards, biometric entry systems, video surveillance, and secure locked vaults… seriously, this is true. Security measure(s) number 4.
Finally, when the lawyer retrieves documents from the data room, the documents are sent via the same encryption process as when they were stored. And the lawyer may only access them via multi-factor authentication as well.
All virtual data rooms that DataRoomSearch recommends will offer these security features, and some will offer even more. This level of security is far beyond what you should expect from a standard email system.
A data room could also be an excellent option if your company simply wants to increase security around certain documents or even departments of the organization.
For example, a company may want to keep certain information safe, for instance a proprietary recipe or method. If this information ever needs to be access, members of the organization can log into the data room and view it from a completely secure environment without fear of cyber attack.
It might also make sense for a company to store all of the company accounting department’s data or their client’s data in the data room to make sure that it never leaves the organization.
Using the data room will protect it from outside attacker and even from internal threats. Features like download and access reports, screenshot blocking, user permissions, and document watermarking prevent company employees from abusing information within the data room.
Many companies have a Board of Directors who aren’t a part of the organization’s day-to-day operations. These companies will often need to make private company performance metrics and other sensitive data available to remote members of the board.
With so many security features inherently baked into virtual data rooms, they are a perfect medium for communications with board. Standard online file storage tools and email services have come a long way in terms of security in recent years, but as we’ve seen, they are not perfect. The main problem with using email a products like Box, Dropbox, or Drive for this type of communication is that they are only secure as their users. If a user often leaves their computer open and logged in or reuses passwords, there’s not much any email service or file sharing tool will do to prevent a breach there. However, with a virtual data room, administrators control session timeout password security settings, and multi-factor authentication is required for access.
The data room will also provide collaboration features that ease the flow of information between the company’s Board and Managers. For instance, the questions-and-answer features with alerts help streamline communication for time-sensitive communication. Document access summaries will also clue in the data room manager about which board members are most active in the data room and where they spend their time.
Some industries will demand that certain security standards are met. For instance, Health Insurance Portability and Accountability Act of 1996, or HIPAA, specifies several security standards that must be met for any organization or business that they work with to handle sensitive data. So healthcare companies and businesses with similar compliance requirements can benefit from using virtual data rooms that abide by these standards.
For some companies, a security breach could have a bigger impact on the company’s future because of the damage it does to their brand. For businesses who operate in the security space, a data breach could would not only put a company’s data in jeopardy, but it would hurt a company’s credibility. Would you trust a company to protect your information if they were hacked themselves?
Consider brands like Equifax who have been trusted with the public’s most private financial information, whether we want them to have it or not. In 2017, they fell victim to one of the largest data breaches in recent history when ______ customers’ data was compromised. The company’s reputation has certainly been damaged in the wake of the incident.
For businesses that handle sensitive documents for a number of different clients, virtual data rooms provide a great way to isolate your clients’ data in an organized and secure way.
Many industries can take advantage of the security and collaboration features that virtual data rooms provide. Most data rooms are flexible enough to fit many uses across multiple industries. Some providers will also offer data rooms designed specifically for use in a given industry.
Next we’ll review the different industries where virtual data rooms are commonly used. We’ll examine how each industry makes use of the technology and whether there are any special features or requirements that apply to that industry.
Lawyers / Law Firms / Legal Practices - Whether it’s a large practice or an individual lawyer, criminal lawyer or business law firm, legal practices often need to handle sensitive data belonging to their clients. Private information like social security numbers and business documents need to be shared between lawyers and their clients, and a virtual data room makes this process efficient and secure.
(ShareVault offers great features for legal entities seeking virtual data rooms specifically for lawyers)
Insurance - The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a law which covers methods for ensuring the privacy of health information. This requires health insurance companies to take certain precautions and protect their customers’ data. Virtual data rooms help them accomplish this by adhering to the standards set forth by HIPAA.
(CapLinked is a great option for companies who need a virtual data room designed specifically for the insurance business)
Biotech / Pharmaceuticals - Biotech and pharmaceutical companies are also subject to HIPAA compliance laws, and therefore must take extra security measures to protect the information of patients who participate in clinical studies. Some virtual data rooms, in addition to providing the required levels of security, will also provide features that streamline the process of sharing information with authorities that certify clinical procedures.
(iDeals stands out as a top provider for companies in the biotech and pharmaceutical industries, offering custom solutions specifically for the sciences.)
Real Estate / Loan Advisors / Mortgage Loan Companies - In real estate, many different players need a secure way to share information, including real estate agents, mortgage brokers, and mortgage lenders to name a few. To close a deal or determine the details of a mortgage loan, social security numbers and credit information are shared. Some real estate professionals will manage this all via email, but for those concerned with their clients’ security and their own liability, virtual data rooms will provide the necessary security, along with some features to streamline the information sharing process.
Consulting - Depending on the nature of one’s consulting business, a virtual data room may be more security than needed. However, some virtual data room solutions offer an added benefit of allowing for siloed workspaces, making it easy to keep clients’ documents isolated, secure, and easily accessible.
Financial Management & Accounting - Accountants, tax professionals, and financial managers of companies all have a need for extremely secure and collaborative file sharing tools. For accounting firms and tax professionals, who likely serve many different clients, the ability to isolate different clients’ documents into separate, secure workspaces is very useful.
For accountants and financial managers of large businesses and public companies, keeping financial documents shareable with select members of the organization and secure are extremely important. Multiple company executives and financial professionals may need to access the company’s financial information, but data breaches could influence the company share price or investor support. Data rooms allow businesses to share these files selectively, securely, and conveniently.
Venture Capital / Private Equity - Often, when companies seek additional capital, they need to share data with many different venture capital or private equity firms. Prepared companies can set up their own virtual data room with multiple workspaces to share information with each firm they pitch.
On the flip side, some VDR providers like SecureDocs make solutions for private equity firms.
Investment Banking - Investment banks assist companies with initial public offerings, mergers and acquisitions, and other instances where new equity or debt is created. In any of these situations, investment banks can benefit from use of virtual data rooms. In all of these cases, it is important to keep data private and to work with many different individuals. VDR tools keep things orderly, even when an investment bank works with dozens or hundreds of clients.
Media - Media companies, such as recording studios, production companies, record labels, and artist managers, can protect intellectual property with the top-of-the-line security that virtual data rooms can provide.
We recommend OneHub for media companies seeking the security and organization of a virtual data room.
IPO - For companies that are going public, using a virtual data room is borderline essential. Many different professionals and individuals must access various documents during the initial public offering process. Well equipped data rooms will allow very granular access rights and permission settings, which will simplify the sharing and collaboration process.
Our top choice for companies who need a virtual data room to use for the go-public process is SmartRooms.
Once a company knows that it needs a virtual data room, what factors should it consider when weighing the options? What sets virtual data room providers apart from each other? Let’s explore the different features, pricing models, and other aspects that differentiate virtual data rooms.
When evaluating virtual data rooms, in addition the things that you require for your company’s data room, there are 4 major areas worth considering when comparing data room companies, which are (1) security and compliance features, (2) collaboration & document management features, (3) costs and pricing model, (4) integrations, and (5) company reputation and customer service.
Most vdr providers offer similar top-of-the-line digital security features, but there are some cases that vendors go above and beyond. Let’s review the different features that data room vendors offer.
256-bit encryption is one of the most secure file encryption techniques available, and it involves using a 256-bit “encryption key” to encrypt and decrypt data. “Encrypted” data is scrambled up and unreadable without unscrambling, or “decrypting”, it using the encryption key. Every time data is passed to-and-from a server using SSL encryption, it is encrypted so documents cannot be stolen, even over an unsecure network.
Document watermarking allows data room administrators to put translucent images, logos, or messages on private documents. The reason to use a watermark on a document is to prevent it from being saved and used outside of the data room. Watermarked documents indicate to anyone else who sees the document that the document is not intended to be shared.
Document expiration is the ability to set an expiration date on a document, at which point the virtual data room platform deletes the document so it will no longer be available. This is helpful to make sure files are not left indefinitely available on accident, or if there are particular documents for which you only want to allow very limited access.
Any time a document is opened, it will be encrypted so that it is still unreadable if accessed over a secure network. On save encryption is simply encrypting the documents before storage in the virtual data room.
SOC 2 is an auditing procedure, developed by the American Institute of CPAs, that ensures that data center service providers manage customer data based on the principles of security, availability, processing integrity, confidentiality and privacy. To achieve SOC certification, several best practices and standards must be followed, including two-factor authentication, user access control, encryption, firewall protection, breach detection, performance monitoring, disaster recovery, and more. In fact, seeing that a data room provider has SOC 2 certification tells you that they meet strong baseline level of security. Most virtual data room providers will be SOC 2 compliant and certified.
Also known as ISO/IEC 27001:2013, ISO 27001 is an international standard for information security management system best practices. Certification means that a third party has confirmed that best practices laid out by ISO 27001 are being followed by the company. Meeting these standards is actually required to meet some local and global security laws, including the GDPR.
Multi-factor authentication requires users to verify their identity when logging in by using additional verification methods besides login credentials.
Below is a list of the top data room providers, based off of research and product trials by the DataRoomSearch team.
CapLinked is one of the highest quality data rooms on the market. They offer a breadth of features and are one of the most fairly priced data rooms as well. CapLinked also stands out when considering the customizability of the data room and the workflow. The company has only been around since 2010 and they do not have a large track record of reviews or a profile with the BBB. However, they do offer fantastic resources on their website and have a very responsive team managing their customer service, so expect high quality service as a user. CapLinked also integrates with top enterprise software, like Salesforce CRM, Dropbox, and Google Drive, and even allows for custom integration. CapLinked is a strong product in almost every aspect, including security, reporting, customization, and ease of use.
SecureDocs is a powerful virtual data room that keeps an emphasis on simplicity. This simplicity also extends to SecureDocs' flat rate pricing model, which starts at $250 / month. They also offer price breaks for committing to a longer contract or to organizations using a high volume of project spaces. Even with a simple interface and straight-forward pricing, SecureDocs is top-tier in terms of security, with key security features like two-factor authentication, watermarking, and strong user permission options.
You wouldn't use a spreadsheet to manage the union of two major corporations. Using a tool that is too simplified won’t get the job done.
So before choosing which provider is best suited for your business need, it’s important to define exactly what that need is. Why do you need a virtual data room? Is this need related to compliance requirements or best practices of your industry? Many VDR providers actually offer their products packaged into unique solutions, with features specific to each industry. For instance, businesses within the pharmaceutical industry are held to strict compliance standards, and certain virtual data rooms are designed to help ensure that these companies follow these standards. And legal practices may use different virtual data rooms for a number of different clients. Lucky for them, there are providers that offer platforms to manage multiple clients and multiple data rooms.
Find more information about VDR solutions for your industry:
Similarly, providers frequently design data rooms with specific business use cases in mind, rather than for a particular industry. In fact, business of all industries often use virtual data rooms to share information with board members or to handle the private data sharing associated required during major corporate events, such as mergers and acquisitions or initial public offerings.
Read more about the VDR solutions for specific business needs:
Even when catering to specific business needs or industries, virtual data rooms may differ in the features that they offer. Read on to learn about the features of virtual data rooms…
When comparing different virtual data rooms, it’s helpful to have an understanding of which features are industry standard and which are actually unique to a select group of providers. It can be difficult to identify which features are truly special or just basic when learning about a product on the vendor’s website. Reviewing the full spectrum of capabilities available to you from all providers will make it much easier to spot where certain VDR fall short.
While the full list of possible features is very long, most capabilities of a virtual data room can be grouped into a few categories. For some, strong security and some basic file sharing flexibility are enough. However, some providers offer very advanced features, which you should be aware of before making your decision, as some of these features can be major time and money savers.
Below are the broad feature categories. Click to learn more about what is available in each group:
How much you should expect to pay for your virtual data room will again go back to your use case. However, there is no simple formula for calculating a “fair price” for your virtual data room. But understanding how providers typically define pricing for their products will help you find the right price and spot expensive packages during your research.
Most providers will charge their users on a monthly basis, and charge based on the # of users and/or storage space. Sometimes, providers will offer a number of ‘specialty’ features that cost more, but could be very helpful in certain circumstances. To figure out a reasonable cost, evaluate where you fall on the spectrum of these factors:
For reference, it might help to look at two products on either end of the spectrum. OneHub offers a smaller package that includes 3 users and 1 terabyte of storage for less than $30/month. On the other end, Citrix ShareFile has a large package with unlimited users and unlimited storage for $295/month. Neither of these packages are tailored to a specific industry, nor do they include add-on features. However, these products demonstrate the range of pricing most companies should expect for basic VDR use cases.
The information here is greatly simplified for succinctness. If you’d like more information about how to evaluate the cost of virtual data rooms, check out our complete VDR pricing guide…