Share security documents in tiers: summaries first, detail later, and the most sensitive items only to named people at the final stage. Redact secrets and hostnames, use view only access with watermarks and logs, and record who saw what and when.
Why this needs care
Pen test reports, architecture diagrams and vulnerability lists are a map for an attacker. A deal can fail, and bidders who lose still hold what they saw. Treat the data room as an exposure.
Three tiers
Tier 1, early. Policies, compliance summaries, an executive summary of the latest pen test, SBOM statistics.
Tier 2, after an NDA and a serious bid. Full SBOM, license report, architecture diagrams with internal names removed, incident summaries.
Tier 3, final stage, named reviewers only. Complete pen test report, open vulnerability list with details, configuration exports.
Redaction checklist
- Credentials, tokens and keys, even expired ones.
- Internal hostnames and IP ranges.
- Customer names where contracts restrict disclosure.
- Personal data in log samples.
- Details of unfixed critical flaws, until the last tier.
Access controls
- Named accounts, no shared logins.
- View only by default, downloads disabled for tier 3.
- Dynamic watermarks with the viewer's name.
- Access logs reviewed during the process.
- Automatic expiry when the process ends.
Bring the buyer's reviewers in carefully
A buyer often hires outside technical reviewers. Confirm they sit under the same confidentiality terms and add them as named users.
After the deal fails or closes
Revoke access, ask for deletion confirmation if the contract provides for it, and keep the access log. If the deal closes, move on to integration, where the first 100 days begin.
Handling requests outside the room
Deals generate side requests: an email asking for one extra diagram, a call where someone shares a screen, a spreadsheet sent to a reviewer's personal address. These bypass every control you set up.
Set a rule at the start. All documents go through the room, and answers by email refer to documents rather than attach them. For live reviews, use a screen share with no recording, and have a note taker log what was shown.
Keep an index of what each party has seen. When the process ends, that index tells you what to ask them to delete and what to rotate. If a screenshot of an internal system was shared, check for tokens or hostnames in it afterwards.
Quick check
Should we share unfixed critical findings?
Describe them at a summary level early. Share detail only at the final stage with named reviewers.
Last reviewed: 19 October 2026.
