The data room is not a filing exercise. It is the evidence base for every claim in your pitch, and an experienced investor reads it as a signal about management long before they finish reading it as a set of facts. A complete, well-indexed room says these people run a tight business. A room assembled in a panic over eleven days says something else, and it is remembered.
What diligence is really testing
Four things, in roughly this order of severity.
- Are the numbers real? Does reported revenue reconcile to cash actually received, under a recognition policy an auditor would accept.
- Do you own what you say you own? Intellectual property, customer contracts, domain names, the code — assigned to the company, not sitting with a founder personally or a contractor who never signed anything.
- What is hiding in the structure? Convertible instruments, side letters, unusual shareholder rights, guarantees, related party arrangements, undocumented loans.
- What breaks when you scale it? Customer concentration, key-person dependency, unpriced contract obligations, a cost base that grows faster than revenue.
Every document in a good index maps to one of those four questions. If you cannot say which question a document answers, it is probably clutter, and clutter slows diligence down as surely as an omission does.
The index, section by section
Ten sections. Numbered, because diligence questions arrive as "can you point me to 4.3" and you want that to be a ten-second answer.
| § | Section | Contents | What it is testing |
|---|---|---|---|
| 1 | Corporate | Certificate of incorporation, constitution, shareholders' agreement and every amendment, share register, director and shareholder resolutions, board minutes for 24 months | That the entity is properly constituted and the board has actually been governing |
| 2 | Capitalisation | Cap table with a full transaction history, option plan rules and grant register with vesting, SAFEs and convertible notes with conversion mechanics modelled, warrants, side letters | Who owns what today, and who owns what after this round |
| 3 | Financial | Annual accounts for three years, monthly management accounts for 24 months, trial balance, aged receivables and payables, bank statements and reconciliations, the three-way model | Whether the numbers reconcile and whether the forecast connects to them |
| 4 | Revenue | Revenue recognition policy, top-20 customer contracts, standard terms, pricing schedules, cohort retention analysis, churn definition in writing, deferred revenue schedule | Quality, durability and concentration of revenue |
| 5 | Tax | Filed returns for all entities, GST and PAYE reconciliations, correspondence with Inland Revenue and any foreign authority, transfer pricing documentation, R&D claim support | Whether there is an undisclosed liability attached to the company |
| 6 | Legal & contracts | Material supplier agreements, leases, licences, insurance policies, litigation history, anything with a change-of-control clause | What binds the company, and what this transaction triggers |
| 7 | Intellectual property | IP assignment deeds from every founder, employee and contractor, trade marks, domains, open-source licence register, third-party dependencies | Whether the company owns the thing being valued |
| 8 | People | Employment agreements, contractor agreements and classification analysis, org chart, remuneration schedule, incentive plans, key-person arrangements | Employment risk, and how dependent the business is on three individuals |
| 9 | Commercial | Market sizing with sources, competitive analysis, pipeline by stage, unit economics with the calculation shown, product roadmap | Whether the growth story survives contact with someone who knows the sector |
| 10 | Technical | Architecture overview, security posture, sub-processor list, privacy and data handling, incident history, disaster recovery | Whether the platform is a liability |
One document per line, named as 4.03 Customer contract — [Name] — executed 2025-11-14.pdf. Dates in the filename, executed versions only, drafts in a clearly separate folder or not at all. An investor should never have to open a file to learn what it is.
The six that derail processes
Across capital mandates the same handful of gaps cause most of the delay — and delay is what costs you leverage, because your alternatives get worse every week the process runs long.
1. IP assignment from contractors
The single most common one. A developer built a core component in year one, invoiced as a contractor, and never signed an assignment. Under New Zealand law the position is not automatically in the company's favour, and the investor's lawyer will find it. Fixing it retrospectively means locating someone who now has leverage they did not previously know they had. Get assignments signed by everyone who has ever touched the product, and do it while relations are warm.
2. Cap table that does not reconcile
The spreadsheet says one thing, the share register says another, and there is a SAFE from 2023 that nobody modelled. Every founder believes their cap table is clean until someone reconciles it to the Companies Office record and the executed instruments. Do that reconciliation yourself, in advance, and keep the working.
3. Revenue that will not survive its own definition
Annual recurring revenue including one-off implementation fees. Bookings presented as revenue. A churn definition that quietly excludes downgrades. None of this is fraud; most of it is optimism that hardened into a habit. But when the investor recalculates on their own definition and the number drops by a fifth, you spend the rest of the process defending your credibility instead of your valuation.
4. Contractor classification
Long-serving "contractors" who work set hours, use company equipment and have no other clients. If they should have been employees, there is unpaid PAYE, holiday pay and KiwiSaver behind it. It is a quantifiable liability, and quantifiable liabilities come straight off the price.
5. Missing board minutes
Not because anyone reads them closely, but because their absence says governance has been informal — which raises the question of what else was decided without record. Two years of even brief, competent minutes is a very cheap signal to have already produced.
6. Customer concentration nobody flagged
If one customer is 34 per cent of revenue, the investor will find it in the first hour. Far better that it appears in your own materials with a named mitigation than that they discover it and wonder what else you chose not to mention.
Access, tracking and staging
Use a proper virtual data room rather than a shared drive. The reason is not security theatre — it is that you get an access log, and knowing which investor spent forty minutes in section 4 and never opened section 9 tells you exactly where the conversation is heading.
- Stage the access. Sections 1 to 4 and 9 at first serious interest. The rest on receipt of a term sheet or a signed exclusivity. Commercially sensitive customer pricing goes in a clean room, late.
- Watermark per user. Dynamic watermarking with the viewer's name is standard and costs nothing.
- One question log. Every diligence question, its owner, its status and the answer given. Multiple investors will ask the same twenty questions; answer each one once, properly, and reuse it.
- Version control that is visible. If a document is superseded during the process, replace it and note the change. Silent substitution is the fastest way to lose trust.
Build it before you need it
The data room is not a fundraising task. It is a governance artefact that happens to be useful when you raise. Every document in that index either already exists or should. If it does not exist, that is a finding about how the company is run, discovered in the least convenient possible circumstances.
Maintain it continuously. Board minutes filed after each meeting. Contracts filed on execution. The cap table updated on each issue. Annual accounts added when signed. Kept that way, the data room takes an afternoon to open rather than six weeks to build — and those six weeks are the difference between running a process and being run by one.
The preparation is the leverage. By the time you need the room, the terms have already been shaped by whether you had one.
XLCFOWe maintain data rooms continuously for clients on the Command tier, and run investor-readiness diagnostics against this index as a standalone engagement.
