Startup Due Diligence: Data Room and Process Guide

Startup due diligence is the investigation an investor, lender, acquirer, or partner performs before completing a transaction. For a financing, it tests whether the company, securities, evidence, risks, and deal terms match what was presented.

The process is not just a document upload. Investors may review records, ask management questions, verify references, test assumptions, and involve legal, financial, technical, security, tax, or regulatory specialists.

Good preparation makes facts easier to verify. It does not guarantee a deal or remove the need to disclose material problems.

What investors examine

Most diligence falls into connected workstreams:

The relevant depth depends on the company and transaction. A regulated health startup, marketplace, hardware company, and consulting business need different emphasis.

When due diligence starts

Diligence begins earlier than the formal data-room request. A pitch, email, metric, demo, customer reference, and cap-table statement can all become facts an investor later verifies.

The SEC’s capital-readiness checklist tells companies to prepare a current cap table and financial statements, calculate runway, explain use of proceeds, choose investors strategically, and line up attorneys and accountants.

Prepare continuously, then tailor the room after the investor or counsel provides a request list.

Startup data-room checklist

1. Corporate formation and governance

• certificate or articles of incorporation and amendments;
• bylaws or operating agreement;
• board and stockholder consents and minutes;
• good-standing and qualification records where relevant;
• officer and director appointments;
• organizational chart and subsidiaries;
• material powers of attorney; and
• prior financing closing sets.

Check that decisions shown in the cap table and contracts have matching approvals.

2. Capitalization and securities

• current fully diluted cap table with a clear as-of date;
• stock ledger;
• founder and investor purchase documents;
• preferred-stock rights;
• option plan, grants, exercises, cancellations, and approvals;
• SAFEs, convertible notes, warrants, and side letters;
• pro rata, information, voting, transfer, and other rights;
• vesting and repurchase records; and
• models for the proposed financing.

Reconcile the cap table to executed documents, bank receipts, board approvals, and the stock ledger. Do not hide a discrepancy in a spreadsheet assumption.

For instrument-specific risks, use the convertible-note guide and startup equity guide.

3. Financial, debt, and tax

• historical income statements, balance sheets, and cash-flow statements;
• current management accounts;
• bank statements and reconciliations;
• accounts receivable and payable aging;
• budget, forecast, and assumption model;
• cash runway and use-of-funds plan;
• debt, liens, guarantees, and covenant compliance;
• revenue recognition and major accounting policies;
• tax returns, notices, elections, and material correspondence; and
• contingent liabilities and commitments.

Keep actuals separate from forecasts. Explain methodology, one-time items, related-party transactions, and changes in definitions.

4. Customers, revenue, and market

• customer list with concentration and cohort information;
• signed material customer contracts and amendments;
• pricing and discount policy;
• pipeline definitions and source records;
• churn, renewal, expansion, and retention definitions;
• customer references approved for contact;
• refunds, credits, service failures, and material disputes;
• market model and source notes; and
• key channel or partnership agreements.

Do not call a letter of intent “revenue” or an unsigned proposal “contracted pipeline.” Define every commercial label.

5. Product, technology, and security

• product roadmap and current release status;
• architecture and major data flows;
• source-code control and access process;
• critical third-party software, APIs, open-source components, and licenses;
• hosting and infrastructure dependencies;
• reliability, incident, backup, and disaster-recovery records;
• vulnerability management and security reviews;
• privacy and data-retention practices;
• technical debt and known limitations; and
• development ownership and contractor contributions.

Match claims to evidence. A planned certification is not a completed certification; a policy is not proof that the process operates.

6. Intellectual property

• founder, employee, and contractor invention assignments;
• patent, trademark, domain, and copyright records;
• licenses in and licenses out;
• open-source inventory and obligations;
• confidentiality agreements;
• disputes, claims, or demand letters; and
• evidence that the company can use training data, customer data, content, and third-party assets as represented.

IP cleanup can be slow when a former contributor is involved. Address missing assignments before a transaction creates urgency.

7. People and compensation

• employee and contractor list with role, location, start date, and compensation;
• employment, consulting, confidentiality, and invention agreements;
• bonus, commission, and benefit plans;
• option promises and grant records;
• key hires, vacancies, and dependencies;
• handbooks and material policies;
• disputes, claims, investigations, or terminations; and
• immigration or work-authorization matters where relevant.

Worker classification, employment, privacy, and benefit rules vary by jurisdiction. Obtain specialist review.

8. Material legal and regulatory matters

• material vendor, lease, loan, insurance, and partnership contracts;
• licenses and permits;
• privacy notices, data-processing agreements, and consent records;
• industry-specific approvals and compliance materials;
• litigation, threatened claims, investigations, and settlements;
• related-party agreements;
• sanctions, export, anti-bribery, or other applicable compliance records; and
• insurance policies and claims history.

The checklist is a starting point, not a complete legal request list.

A practical diligence process

Phase 1: readiness review

Assign one owner for the room and one owner per workstream. Build a master index, reconcile core facts, and identify missing or inconsistent documents.

Phase 2: controlled access

Use sensible permissions, watermarks or access controls where appropriate, and a confidentiality strategy advised by counsel. Do not upload credentials, secrets, unnecessary personal data, or material you do not have the right to share.

Phase 3: request and Q&A

Track every request with owner, status, response, source file, and date. Answer the question asked, provide context, and avoid speculative promises.

Phase 4: issue resolution

Maintain an issue log:

Do not backdate, alter, or fabricate records. Correct mistakes transparently with counsel.

Phase 5: transaction documents and closing

Commercial and diligence findings flow into representations, warranties, disclosures, conditions, covenants, price, and governance terms. The NVCA model legal documents show common U.S. venture-financing document categories, but NVCA itself states that the forms are starting points and not legal advice.

Phase 6: post-closing obligations

Add reporting, information rights, board dates, filings, option-pool actions, investor notices, and covenants to the operating calendar. A clean closing set should become part of the permanent corporate record.

How long does startup due diligence take?

There is no dependable universal timeline. Duration depends on transaction type, company complexity, investor process, legal issues, data quality, regulatory work, and how quickly both sides respond.

Founders can control:

• document accuracy;
• response ownership;
• consistent definitions;
• visibility of known issues;
• availability of advisers; and
• speed of follow-up.

They cannot control every investor committee, reference, market event, or legal negotiation. Plan cash runway accordingly and do not treat verbal interest as a closing date.

Red flags that slow or stop a deal

• Cap table does not match executed securities.
• Important IP was created without assignment.
• Revenue, pipeline, retention, or user metrics change definition between materials.
• Material customer concentration or churn is hidden.
• Forecasts do not connect to hiring, sales capacity, or cash.
• Legal disputes or regulatory exposure appear late.
• Founders provide contradictory answers.
• Documents are missing, altered, or backdated.
• The company shared confidential customer information without authority.
• A team claims compliance, security, or performance evidence it does not have.

The best response to a real issue is not a polished explanation. It is accurate disclosure, a realistic remediation plan, and appropriate professional advice.

Founders should diligence investors too

Ask for references from founders whose companies succeeded, struggled, and raised follow-on rounds. Understand:

• who makes decisions;
• how the investor behaves after a missed plan;
• board style and response time;
• reserves and follow-on strategy;
• conflicts with portfolio companies;
• reporting expectations;
• reputation with later investors; and
• fund timing or constraints that may affect support.

The angel versus VC comparison provides a structured set of fit questions. Reverse diligence is not an accusation; it is part of choosing a long-term counterparty.

Securities-law boundary

Private financings involve securities law. The SEC’s private-placement bulletin explains that private placements can involve limited disclosure and substantial risk. For issuers, the offering must be registered or qualify for an exemption, and disclosures must be accurate.

Use qualified startup counsel and accountants. This article is general educational information, not legal, tax, accounting, investment, security, privacy, or transaction advice.