Startup Data Room Index Template (Seed, Series A)

Seed and Series A data room index: access tiers, redaction and personal data checklist, numbered folders by stage, readiness count, access and Q&A log

StartupStandarCommon practice; GDPR and UK GDPR Art. 5(1)(c)data room indexDiperbarui 29 Okt 2026

Buka di editorUnduh .md

Cara menggunakan: Use it when you prepare for investor due diligence. Fill the access tiers and the redaction checklist first, then load folders in the numbered order. The main pitfall is opening the full room, with employee and customer personal data, to every investor after a first meeting.

Pratinjau

Data Room Index: [Company name], [Round name]

An index for the virtual data room a startup opens for seed or Series A due diligence: access rules, a numbered folder structure with the documents investors usually ask for at each stage, status and owners, what to redact, and the access and question logs. Structure follows common venture due-diligence practice. Replace every [bracketed] value and every row marked Example. The example is fictional. This is an organising format, not legal advice; ask counsel what you may disclose and on what terms.

Document control

Field	Value
Document ID	[DR-IDX-NNN]
Version	[0.1]
Status	[Building / Open / Closed and archived]
Owner	[@ceo]
Reviewers	[@counsel], [@co-founder]
Last updated	YYYY-MM-DD
Classification	Confidential
Data room platform	[Platform name and link]
Room opened / closed	YYYY-MM-DD / YYYY-MM-DD

Revision history

Version	Date	Author	Change
0.1	YYYY-MM-DD	[@ceo]	Example: Tier 1 folders loaded
0.2	YYYY-MM-DD	[@ceo]	Example: Tier 2 opened to lead investor

1. Access rules

Rule	Setting
Confidentiality basis	[NDA signed / investor's standard confidentiality / none, share tier 1 only]
Tier 1, after first meeting	Items marked tier 1 in section 3
Tier 2, term sheet stage	Items marked tier 1 or 2
Tier 3, confirmatory, lead and counsel only	Employee-level data, customer contracts in full, source code access by arrangement
Downloads and printing	[View only / download with watermark]
Questions	Through the Q&A log in section 5 only
Access review	[Weekly], revoke when an investor passes

2. Personal data and redaction

Data minimisation: under the GDPR and UK GDPR, personal data must be adequate, relevant and limited to what is necessary for the purpose (Article 5(1)(c)); the UK ICO explains the principle at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/ (checked 2026-10-30). Other jurisdictions have their own rules; ask counsel.

Redaction checklist:

Employee names replaced with role IDs in the salary schedule until tier 3
Customer names in contracts redacted where the contract requires confidentiality, or customer consent obtained
No personal identity documents, bank details or health data
Passwords, API keys and secrets removed from technical documents
Metadata and tracked changes removed from uploaded files

3. Folder index

01 Corporate

ID	Document	Stage	Tier	Status	Owner
01.01	Certificate of incorporation and constitutional documents (articles, bylaws)	Seed	1	Example: Ready	[@counsel]
01.02	Register of shareholders and directors, company registry extract	Seed	1	[ ]	[@counsel]
01.03	Board and shareholder minutes and written resolutions	A	2	[ ]	[@counsel]
01.04	Group structure chart, subsidiaries	A	2	[ ]	[@ceo]

02 Capitalisation and financing

ID	Document	Stage	Tier	Status	Owner
02.01	Fully diluted cap table	Seed	1	Example: Ready	[@ceo]
02.02	Founder share issue and vesting documents, tax elections filed	Seed	2	[ ]	[@counsel]
02.03	Prior SAFEs, convertible notes, side letters	Seed	2	[ ]	[@counsel]
02.04	Option plan, grants register	A	2	[ ]	[@ceo]
02.05	Shareholders' agreement and investor rights	A	2	[ ]	[@counsel]

03 Financial

ID	Document	Stage	Tier	Status	Owner
03.01	Financial projection and assumptions (`startup/financial-projections`)	Seed	1	Example: Ready	[@ceo]
03.02	Monthly management accounts, last 12 to 24 months	Seed	2	[ ]	[@ceo]
03.03	Annual statutory accounts and tax returns	A	2	[ ]	[Accountant]
03.04	Bank statements reconciliation, debt and grants	A	2	[ ]	[@ceo]
03.05	Key metrics definitions and history (MRR, churn, CAC)	Seed	1	[ ]	[@ceo]

04 Commercial and customers

ID	Document	Stage	Tier	Status	Owner
04.01	Pitch deck (`startup/pitch-outline`) and market sizing	Seed	1	Example: Ready	[@ceo]
04.02	Customer list with revenue, start date, churn (pseudonymised)	Seed	2	[ ]	[@ceo]
04.03	Top customer and partner contracts	A	3	[ ]	[@counsel]
04.04	Pipeline report and pricing	A	2	[ ]	[@ceo]
04.05	Investor updates and board decks sent (`startup/investor-update`, `startup/board-deck`)	Seed	1	[ ]	[@ceo]

05 Product and technology

ID	Document	Stage	Tier	Status	Owner
05.01	Product overview, roadmap	Seed	1	[ ]	[@cto]
05.02	Architecture overview and hosting	A	2	[ ]	[@cto]
05.03	Security practices, incidents, penetration test summary	A	2	[ ]	[@cto]
05.04	Open-source licence inventory	A	2	[ ]	[@cto]

06 Intellectual property

ID	Document	Stage	Tier	Status	Owner
06.01	IP assignments from founders, employees, contractors	Seed	2	[ ]	[@counsel]
06.02	Registered IP: trademarks, domains, patents	Seed	2	[ ]	[@counsel]
06.03	Third-party licences in and out	A	2	[ ]	[@counsel]

07 People

ID	Document	Stage	Tier	Status	Owner
07.01	Organisation chart and hiring plan (`startup/hiring-plan`)	Seed	1	[ ]	[@ceo]
07.02	Salary and equity schedule by role ID	A	2	[ ]	[@ceo]
07.03	Template employment and contractor agreements	A	2	[ ]	[@counsel]
07.04	Named employee data, disputes	A	3	[ ]	[@counsel]

08 Legal, regulatory and data protection

ID	Document	Stage	Tier	Status	Owner
08.01	Terms of service, privacy policy, data processing agreements	Seed	2	[ ]	[@counsel]
08.02	Records of processing, data breaches notified	A	2	[ ]	[@counsel]
08.03	Litigation, claims, regulatory correspondence	A	2	[ ]	[@counsel]
08.04	Licences and permits required for the business	A	2	[ ]	[@counsel]
08.05	Insurance policies	A	2	[ ]	[@ceo]

4. Room readiness summary

Folder	Items	Ready	In progress	Not applicable
01 to 08	[Total]	[ ]	[ ]	[ ]

Example: At tier 1 opening, Verrowind had all 9 tier 1 items ready and 17 of 24 tier 2 items ready; the 2 tier 3 items were prepared during confirmatory diligence.

5. Access and Q&A log

Investor ID	Tier	Access granted	Access revoked
INV-001 (Example)	2	YYYY-MM-DD	n/a
INV-007 (Example)	1	YYYY-MM-DD	YYYY-MM-DD (passed)

Q ID	Investor	Question	Answer and document	Owner	Date answered
Q-001 (Example)	INV-001	How is churn defined?	Monthly logo churn of opening customers, see 03.05	[@ceo]	YYYY-MM-DD

Investor IDs match startup/fundraising-tracker.

Standard and licence note

Based on common venture due-diligence practice, with the data minimisation principle of Article 5(1)(c) GDPR and UK GDPR cited from the ICO's guidance. All wording and the example are original and fictional. Check the current law that applies to your disclosures and ask counsel. This is an organising format, not legal advice. Template licence: MIT.

Templat terkait

Startup