TL;DR. Due diligence is the process where an investor, acquirer, lender, or auditor verifies what you’ve claimed about your business. The data room is where that verification happens. A well-organised data room compresses UK due diligence by 2-4 weeks and reduces the risk of price retrades. This walkthrough is what to upload, in what order, and the five mistakes that cost UK founders weeks of timeline.
When you need a due diligence data room
Five UK situations:
- Investor due diligence on a fundraise — seed, Series A, Series B onwards
- M&A buyer due diligence — strategic acquirer, PE firm, family office
- Lender due diligence — debt facility, venture debt, asset-backed lending
- Audit due diligence — annual audit, regulatory audit, ICO/FCA inquiry
- Partnership due diligence — strategic partnership, JV, white-label
The structure is similar across all five. The depth varies.
The standard UK due diligence pack
For a UK seed or Series A fundraise, this is the typical request from an institutional VC.
Tier 1 — Always required
- Pitch deck (latest version)
- Financial model with 3-year forecast
- Cap table fully diluted
- Last 12 months management accounts
- Top 10 customer contracts (sanitised if NDA-restricted)
- Incorporation documents (certificate, articles)
- Founder background and CVs
Tier 2 — Frequent at Series A
- Audited accounts (if available)
- Board minutes (last 12 months)
- IP assignments (especially from founders)
- Employment contracts (key employees)
- Data protection policy + ICO registration
- Customer references (3-5 contactable)
Tier 3 — Deep due diligence
- Full contract schedule
- Litigation history
- Insurance policies
- Technical architecture overview
- Open source licence audit
- Tax compliance (corporate, VAT, R&D, EMI)
How to organise
The folder structure that works:
01-Company
├── Certificate-of-Incorporation.pdf
├── Articles-of-Association.pdf
└── Cap-Table.xlsx
02-Financials
├── Accounts-2024-Audited.pdf
├── Management-Accounts-2025-Mar.xlsx
└── Financial-Model.xlsx
03-Commercial
├── Customer-Contract-Anonymised-1.pdf
└── ...
04-Legal-IP
├── IP-Assignment-Founder-1.pdf
└── ...
05-Team
├── Org-Chart.pdf
└── Key-Contracts.pdf
06-Compliance
├── GDPR-Policy.pdf
└── ICO-Registration.pdf
Use clear filenames. Accounts-2024-Audited.pdf not final_FINAL_v3.pdf.
The 4-week schedule
Week 1 — set up the room and upload Tier 1 documents. Send the first link. Investor’s analyst reads.
Week 2 — investor’s team raises questions. You respond by adding documents to Tier 2 folders and answering in writing.
Week 3 — partner-level review. Tier 3 documents requested if going deep. Term sheet discussions parallel.
Week 4 — final clean-up. Disclosure letter referencing the data room. Move to closing.
Compress to 2 weeks for a hot round. Stretch to 8 weeks for a thorough M&A buy-side process.
NDA-gate the room
Every visitor should sign an NDA before any document opens. The capture should include:
- Full legal name
- Email address
- IP address
- Timestamp
- The version of NDA accepted
Export the audit log weekly. Store in your firm’s compliance archive. This is your defensible record if anything leaks or any post-completion warranty issue arises.
Track who’s reading what
Page-level analytics tell you which investors are seriously engaged.
A heavily-engaged investor:
- Returns to the room 3+ times in a week
- Spends 20+ minutes total per visit
- Reads the financial model assumption tab and the customer contracts
- Asks specific Q&A based on what they read
A tyre-kicker:
- Opens the room once, never returns
- Spends under 5 minutes
- Reads only the pitch deck
You don’t have to choose between investors based on this — but knowing who’s serious vs not changes how you allocate your follow-up time.
The five mistakes
1. Same link for everyone
Without per-recipient links, you can’t trace who accessed what. Use per-recipient links.
2. Email-attached documents instead of room
Email creates copies outside your control. Use the room.
3. No NDA gate
Without acceptance capture, you have no defensible record if a document leaks. Enable NDA gating.
4. Inconsistent filenames
final_v3.pdf, final_FINAL.pdf, final_FINAL_real.pdf — all in the same folder. Investor’s counsel will write you off as disorganised. Rename properly before uploading.
5. Forgetting the disclosure letter
A disclosure letter is a document that references the data room and lists everything that “but for” disclosure would be a warranty breach. UK lawyers expect this. Without it, you’re warranting things that the buyer already knows about.
How Beamprobe helps
- Per-recipient links with one-click bulk creation
- NDA gate with custom text and CSV/PDF audit export
- Page-level analytics — see who reads what for how long
- Bot filtering — Mimecast/Proofpoint scanners excluded automatically
- UK data residency — AWS eu-west-2 (London) by default
- £29/month flat — works out to £58 for a typical 8-week fundraise
Set up your due diligence data room →