A data room is the organized repository with controlled access where the company makes available to investors, and to their advisors, the documents that support what it says in the pitch deck. For a round or an issuance, it is organized by folders: corporate, financial, tax, labor, intellectual property, contracts and issuance documentation.
When to open it and to whom
The data room is not opened at the first meeting. It is opened when an investor has shown specific interest, usually after signing a letter of intent or a term sheet. Before that, the deck and, at most, a financial summary are enough.
The practical approach is to open it in phases. In the first, the investor sees the information needed to confirm their interest: accounts, cap table, main contracts. In the second, the complete one, with a signed confidentiality agreement. The third is the confirmatory review, in which their lawyers and auditors check document by document. What this means for you: prepare all three layers from the start, even if you open only the first.
If you raise with a securities issuance, the data room has two audiences. One is the transaction advisors: law firm, placement agent and the entity that will keep the register. The other is investors, who need access to the offering information on equal terms.
How to set it up: structure and rules
A disorganized data room conveys a disorganized company. These rules prevent most repeated questions:
- Numbered index. One folder per area (01 Corporate, 02 Financial…) and a numbering per document (01.03, 01.04). The PDF index goes in the root and is updated with every change.
- Self-explanatory names. Date, type and content: “2025-06-30 General meeting capital increase minutes.pdf”. No “doc_final_v3”.
- Cut-off date. All financial information refers to the same date, which is indicated in the index.
- Permissions by profile. View-only without download for the first phase, download for advisors in the confirmatory phase, and watermark with the user's name.
- Activity log. Knowing who has seen what helps prioritize investors and leaves a record of what information each one received.
- Questions and answers in a single channel. One person responds and the relevant answers are incorporated as a document.
- Personal data minimized. Employee census without names, standard contracts instead of every contract, and identity documents only for those who need them.
Every figure in the pitch deck must be traceable to a document in the data room. It is the first thing checked in the due diligence, and an inconsistency there weighs more than any slide.
Checklist of documents by folder
The list applies to an S.A. or S.L. raising equity or debt. The documents in the last folder apply only if the raise is made through a securities issuance.
1. Corporate
- Deed of incorporation and current articles of association, with the consolidated text if there have been amendments.
- Up-to-date information from the Mercantile Registry: officers, powers of attorney and registered capital.
- Register of shares in registered form or, for an S.L., register of members, up to date (arts. 116 and 104 of the Capital Companies Act). Practical guide in register of members.
- Minutes of shareholders' meetings and of the management body with relevant resolutions: capital increases, appointments, authorizations.
- Cap table reconciled with the share register, including options, convertibles and any right that could dilute.
- Shareholders' agreement in force and any side agreement.
- Group structure chart with percentages, if there are subsidiaries.
- Declaration of beneficial ownership filed with the Companies Registry (Royal Decree 609/2023).
2. Financial and accounting
- Annual accounts for the last three financial years with proof of filing with the Companies Registry (art. 279 of the Capital Companies Act).
- Audit report if the company is required to be audited or did so voluntarily (art. 263 of the Capital Companies Act).
- Balance sheet and income statement as of the cut-off date.
- Business plan and financial model with its assumptions: the same one that supports the deck.
- Detail of financial debt: loans, credit lines, guarantees granted and maturity schedule.
- Customer concentration and aging of outstanding receivables.
- Grants received and conditions that could require repayment.
3. Tax
- Recent certificates of good standing with the Tax Agency and Social Security.
- Corporate Income Tax, VAT and withholding tax returns for non-time-barred years. As a general rule, this is four years (art. 66 of the Law 58/2003, General Tax Law).
- Negative taxable bases and pending deductions, with their supporting documents. The tax authority can audit them for ten years (art. 66 bis of the General Tax Law).
- Requests, inspection records or proceedings, open or closed.
4. Employment
- Anonymized workforce census: position, seniority, contract type and cost.
- Applicable collective bargaining agreement.
- Key personnel contracts, including non-compete and retention covenants.
- Incentive plans: stock options, phantom shares or sale-linked bonuses.
- Working time record and pay record (arts. 34.9 and 28.2 of the Workers' Statute) and, with 50 or more employees, an equality plan (art. 45.2 of Organic Law 3/2007).
- Ongoing labor disputes and claims.
5. Intellectual and industrial property
- Trademarks, patents and domains registered in the company's name, with their status.
- Ownership of the software. The exploitation rights in the program created by an employee in the course of their duties belong to the employer, unless otherwise agreed (art. 97.4 of the Royal Legislative Decree 1/1996 on Intellectual Property).
- Rights assignment contracts signed by founders and external contributors. The previous rule does not cover anyone who is not an employee: a founder who programmed as a self-employed person retains the rights if they do not assign them, and the assignment must be made in writing (art. 45 of the same text).
- Employee inventions, which belong to the employer when they result from the research activity covered by the contract (art. 15 of the Law 24/2015 on Patents).
- Third-party and open-source licenses used by the product.
6. Contracts, litigation and compliance
- Contracts with key customers and suppliers, identifying change-of-control, exclusivity and penalty clauses.
- Leases, insurance and administrative licenses for the activity.
- Litigation, claims and sanctions, with an estimate of their impact.
- Data protection: records of processing activities and contracts with processors (arts. 30 and 28 of the General Data Protection Regulation).
7. Issuance documentation
This folder distinguishes an issuance from a private round. It gathers what proves that the issuance is properly agreed, properly documented and properly registered:
| Document | Who prepares it | What it is for |
|---|---|---|
| Issuance agreement: shareholders' meeting for a capital increase, management body for bonds, unless they are convertible, grant a share in profits or the articles of association state otherwise (arts. 296 and 406 LSC) | Company and law firm | Certifies that the competent body approved the issuance |
| Directors' report if the pre-emptive subscription right is excluded and, in the S.A., a report by an independent expert appointed by the Commercial Registry (art. 308 LSC) | Directors and independent expert | Justifies the price and the entry of new investors |
| Deed of capital increase or deed of bond issuance (art. 407 LSC) | Law firm and notary's office | Formalizes the transaction and sets its terms |
| Issuance document (art. 7 Law 6/2023) | Issuer with its law firm | Determines the content of the securities and describes the registration system; it is deposited with the entity that keeps the register |
| Prospectus approved by the CNMV or analysis of the applicable exemption | Law firm | Justify whether the offer requires a prospectus or qualifies for an exemption, such as offers of less than €12M in twelve months |
| Contract with the ERIR (art. 8 Law 6/2023 and Royal Decree 814/2023) | Issuer and ERIR | Formalize the engagement with the entity responsible for managing the registration and record-keeping, which the issuer appoints in the issuance document (art. 8.4) |
| Contract with the placement entity, if involved | Issuer and ESI | Mandatory if an offer exempt on the basis of amount, number of investors or minimum investment is advertised to the public (art. 36 Law 6/2023) |
| Issuer's KYB documentation: corporate deeds, beneficial owner, identification of directors | Issuer | It is usually requested by the placement entity, the ERIR and the issuance bank. |
| Pitch deck and validated commercial materials. | Issuer, law firm and placement entity | Check its consistency with the issuance document or the prospectus |
A few nuances prevent common mistakes. Investor identification, anti-money laundering prevention and the appropriateness test are carried out by the obliged entity that places the issuance; the issuer as such is not an obliged entity under Law 10/2010. Shares in an S.L. are not securities and cannot be registered with an ERIR, although an S.L. can issue bonds (arts. 92.2 and 401 LSC). And registration of the issuance with the CNMV does not mean that the CNMV has validated its terms. You can view already registered issuances in the registry of ERIRs and issuances in Spain.
The difference between an issuance document and a prospectus is explained in CNMV prospectus vs issuance document, and the role of the registry entity in what an ERIR is.
Example: a bond issuance of €3M
Illustrative example with a fictional company. A solar energy public limited company is preparing a €3M issuance of five-year bonds, represented on a distributed ledger and aimed only at qualified investors. Before opening the data room, the law firm carries out an internal review. This is the result:
| Document | Status | What to do before opening |
|---|---|---|
| Accounts 2023, 2024 and 2025 | Deposited | Nothing |
| Share register | Without recording the capital increase of 2024 | Update it and reconcile it with the cap table |
| Plant monitoring software | It was developed by a partner who invoiced as a freelancer | Sign the assignment of rights to the company |
| Tax Agency certificate | Expired | Request a new one |
| Energy sales contracts | Two include a change-of-control clause | Flag it in the index and assess the risk |
| Prospectus exemption analysis | Pending | The law firm confirms the exemption because it is aimed at qualified investors |
| Contract with the ERIR | In draft | Sign it before the issuance is registered |
| Issuance document | Being drafted | Close terms (amount, term, interest rate, guarantees) and deposit a copy with the ERIR |
Three of the eight points are resolved in days; the software assignment and the issuance document are not. What it means for you: do this review weeks before talking to investors, because registration does not fix problems at the source. A token reflects what the documentation says; if the documentation has a defect, the token inherits it.
Errors that delay a funding round or an issuance
- Opening an incomplete data room and completing it on the fly. Each new document generates new questions.
- Cap table and share register that do not match. It is the most common mistake and the one that generates the most distrust.
- Different versions of the financial model in the deck and in the data room.
- Unsigned contracts or contracts without annexes, which force you to request them one by one.
- Information for only some investors. In an offer exempt from the prospectus requirement because it is addressed, for example, only to qualified investors or to fewer than 150 investors per State, important information that you give to some must reach all recipients (art. 22.5 of the Regulation (EU) 2017/1129). The data room is the simplest way to comply with this.
- Inside information without controls if the company already has securities admitted to trading on a regulated market or a multilateral trading facility. In that case, the disclosure of inside information and insider lists apply (arts. 17 and 18 of Regulation (EU) 596/2014).
If you are preparing the fundraising from the start, first get the transaction in order with the guide to funding round and review company valuation for issuing. In an issuance, investor verification, the appropriateness test and the signing can be centralized in a single account. We explain it in KYC and KYB verification and in the investor portal, where each entity has its own access.
To go further: how to create a pitch deck and how to call the general meeting and draft the minutes.
If you need a law firm to prepare the transaction, at HokenFi's partner law firms you can request proposals from the platform.
Are you preparing the documentation for an issuance and want to know what you need before speaking with the ERIR? Take the issuance assessment (2 min) or request a proposal.
This content is informative and educational. It does not constitute legal, tax, or investment advice. Check the current version of each regulation in the BOE and on EUR-Lex.
HokenFi is a software and infrastructure provider; it does not provide regulated services (CASP, ESI, EAF, or ERIR). This article is informative and does not constitute financial or legal advice.
Frequently asked questions
What are data rooms?
A data room is a repository, now almost always virtual, where a company gathers, with controlled access, the documents that investors and advisors review in a round, an issuance or a sale. It is organized in folders, with an index, user permissions and an activity log. Its purpose is that every statement in the pitch deck can be checked against a document without sending loose files by email.
What documents should a data room for investors have?
At a minimum, seven blocks: corporate (articles of association, share register, minutes, cap table, shareholders' agreement), financial (deposited accounts, audit, financial model, debt), tax (certificates and non-time-barred returns), employment (anonymized workforce census, key contracts, incentives), intellectual property (trademarks, software assignments), contracts and litigation. If you raise with securities, add the issuance documentation: agreements, issuance document, prospectus or exemption and contract with the ERIR.
What is the difference between a data room and due diligence?
Due diligence is the review that the investor and their advisors carry out to detect risks before investing. The data room is where the company places the documents that review needs. A well-built data room shortens due diligence because it reduces ad hoc requests and records what information each investor received and when they consulted it.
How is a data room set up?
Define a numbered index by area, name each file with date and content, set a cut-off date for financial information and assign permissions by profile: read-only without download at first and download for advisors in the final phase. Add a watermark, activity log and a single channel for questions. Open it in phases and only with a signed confidentiality agreement.
How much does a data room cost?
It depends on the provider, the number of users, the volume of documents and how many months it is open. For a small round, a shared folder with permissions and an access log may be enough. In an issuance or a transaction with many investors, a specific tool is worth it, because the record of who saw what information helps prove that everyone received the same information.
Is a data room mandatory to issue tokenized securities?
No rule requires a data room with that name. What is mandatory is the issuance document, which the issuer files with the entity that keeps the registry and makes it available to the public (art. 7 Law 6/2023), and, if there is no exemption, the prospectus. In offers exempt because they are addressed to qualified investors or to fewer than 150 investors per State, important information must reach everyone, and the data room makes it easier to comply.
