Virtual data rooms (VDRs) are online repositories of information that businesses use to store and share information.
Typically, VDRs are used in specific situations related to confidential business transactions, such as mergers and acquisitions and raising capital or other sensitive deals that require a secure review of materials.
In the global marketplace, many professional fields, such as law firms, investment banks and accountants are needed to conduct research and help dealmakers complete transactions.
Prior to the rise of cloud computing, these groups would meet in-person to conduct the proper due diligence and review confidential documentation to advise executives on the business deal.
Now, the same security controls, such as permission-based access to specific documents and restricted viewing rights can be obtained through the power of cloud computing and the internet. VDRs allow businesses to conduct due diligence, collaborate over the findings and make strategic investments, while reducing costs around travel and housing during the deal making process.
There are many VDR vendors that offer secure platforms to review documentation. So how can a business leader choose the best software solution for them?
Standard Virtual Data Room Features
First and foremost, leaders should understand the basic functions and requirements that all VDR solutions should provide. There are some software providers that adapt previous cloud-based products to fit the specific VDR niche, so understanding the essentials is a worthwhile step in the decision making process.
At the core of a virtual data room is the ability to track activity.
In particular, VDRs are leveraged during the sales cycle. Managers need to track activity to report to other stakeholders about the level of interest in potential customers or buyers if the company is for sale. Additionally, managers should know the status of the legal review and financial review.
Look for a virtual data room platform that enables comprehensive audits and page-level reporting. These standard features will allow project managers to track activity at the page level.
The standard features that every VDR platform should include breakdown into a few groups, such as audit tracking, permission-based access and document control.
If a VDR does not have standard audit trails and tracking, then the VDR is a non-starter. Data rooms need to track activity, as noted, to determine who can access documents, when they access them and how long they review them.
This functionality is two-fold: project managers can keep the project moving and ensure the appropriate parties (bankers, lawyers and accountants) have reviewed relevant information.
Secondly, VDRs function to store and track sales information. Whether the company is up for bid or potential clients are conducting due diligence, executives need to be able to track usage and allocate time accordingly.
- Audit Logs – Record of everything uploaded, viewed or downloaded in the virtual data room. All actions with files are logged including file viewing, secure downloading, printing and downloading.
- Detailed Data Room Reports – Record of every entry and every activity in the virtual data room is time-stamped and documented. Automatic audit reports are automatically sent to a system administrator at the end of a specified period.
- Notification – Updates managers, administrators and users when documents are updated or new files are uploaded.
In general, virtual data rooms should provide comprehensive reporting capabilities and audit trails for every action or activity that occurs within a data room. Administrators and managers must be able to track all actions within the files.
Virtual data rooms host confidential and sensitive business materials in the cloud. This means executives must trust the individuals with access to the materials to not share with outside parties.
Often, trust is difficult for some executives, so VDRs include permission-based access to help.
- Restricted Viewing – Block parts of the screen while the viewing the document in the internet browser to help prevent security breaches such as unsolicited viewing in public places, camera-based attacks, or screen capture.
- Document Access Restrictions – Administrators specify custom levels of document protection to restrict the rights to print, view, share, edit, or download the original or watermarked document for every user with access to the VDR.
- Granular Access – Control who has access to each file or folder based on the user’s role in the deal or position in the company.
- Multiple Levels of User Permissions – Set levels of document access for different users and user groups to help improve data room security and provide auditable trail of data room activity.
- Group Permissions – Administrators can create groups with predefined sets of access permission levels to help control user management and add an extra level of security.
In general, virtual data rooms should ensure that administrators and managers can control and restrict access at the user and document level.
Document control relates to maintaining proprietary control of the materials posted and stored within the VDR. Managers and administrators need easy to use tools to load, search and search for documents to provide important information to busy executives and expensive attorneys when they need it.
- Bulk Uploads – Allow importing or exporting multiple files or folders at once. Look for the virtual data room provider which doesn’t set the cap on the upload file size.
- Drag and Drop Function – Allows users to virtually grab files from their device and drop them into the virtual data room to upload automatically.
- Full Text Search – Allows users to easily search through document titles, meta-tags, and content for specific keywords related to search, including scanned documents.
- Dynamic Watermarks – Automatically embed date of download, name of project, name (and IP address) of user into each document downloaded.
- Document Expiry – Allows administrators to revoke the right of access to the document at any time, even after the user has already downloaded the file. This document protection feature helps prevent unwarranted document distribution and is often called “self-destructing document” or “remote destruction” feature.
- Document Version Control – Monitor automatic saving of document settings to track all changes through version history and ensure users have the latest document version.
In general, virtual data rooms should ensure that companies can truly “own” materials on the platform.
These are the essentials that all virtual data room software solutions should include, however, there are other standard features that may meet specific business needs.
For example, VDR providers focus on security and collaboration. Depending on the desire or need to improve sharing and collaboration during the deal making process, there are Q&A features to allow users with easy access to provide updates.
Many companies look to leverage VDRs as a central document repository for the company as well. The need to share and collaborate to ensure everyone is on the same page may be more important compared to small firms looking to complete deals.
Regardless of your specific business need, there are three critical and important features that require evaluation during the VDR decision-making process.
There are reports of hackers stealing company information on a daily basis, which means security is critical to data room providers. Many of the standard features are at the heart of data security.
For example, permission-based access and document control ensure only specific users can review or obtain extremely sensitive or important documents. While audit trails and the ability to revoke access ensures any potential perpetrators are tracked and business can quickly understand the extent of the breach.
Proper security addresses two components.
VDR providers must secure documents and data centers.
Virtual data rooms are commonly utilized during confidential business transactions and house sensitive or proprietary documentation. Protecting access to the VDR and ensuring standard encryption of documents is critical.
- Multiple Factor Verification – Requires users to verify their identity on another device to gain access to the data room to prevent access to the data room from hacked or stolen devices.
- Two-Factor Authentication – Provides an extra level of protection and common among commercial application, users can log in using a password and a unique code sent to the user’s cell phone.
- 256-Bit SSL Encryption – Provides the highest data encryption during data transit or at rest, 256-bit AES SSL encryption is the golden standard.
- Data Backup – Assures documents uploaded can never be lost or destroyed. Look for the VDR providers that offer real-time file backup through encrypted VPN tunnels.
- Virus Scanning – Automatically scans all uploaded documents for viruses or other defects to ensure defective files are not uploaded.
- On Save/On Open Encryption – Automatic encryption upon opening to prevent unauthorized access over unsecured network.
In general, virtual data rooms should adhere to industry standard encryption technology and user authentication standards.
Additionally, VDR providers must maintain on-site data security. Virtual data rooms leverage cloud computing technology to store client information in an external environment, which means the servers and hard drives that house the documents are secure as well.
Virtual data rooms should be located in physically secure data centers with numerous protective measures that restrict access to confidential data.
- SOC 2 Certified – Provides statement of best practices related to internal controls that verify security, availability and privacy of the data room repository, the SOC 2 is critical for data center certification.
- ISO 27001 Certified – The most stringent international certification for the IT sector, the ISO 27001: 2013 certificate, ensures appropriate controls help prevent security threats or vulnerabilities.
- SSAE 16 Certified – The Statement of Standards for Attestation Engagements 16 (SSAE 16) is one of the strictest standards that requires an audit of internal controls over financial reporting.
- Data Center Security – Ensure that data centers employ physical security, stringent access policies, such as: biometric entry authentication systems, armed guards, 24/7 surveillance, secure vaults and cages, with access to uninterruptible power, backup systems, and fire/flood prevention systems at data center sites.
In general, ensure the VDR provider proudly shares the data center certifications and security measures.
- Mobile Access
In today’s business world, people move fast. Potential deals happen at the speed of light and executives are constantly on the go. Companies must leverage a VDR solution that moves at the pace of their business, which means sufficient mobile access built with the web in mind.
Virtual data rooms will be accessed by multiple parties from various different devices from Apple to Android and smartphone to tablet, which means it is vital VDR software works on all devices and operating systems.
Look for a VDR platform that was designed for the modern executive that relies on mobile access. Modern web-enabled technology typically means no plug-ins, no Flash, Java or Silverlight components that create bloat and require updates.
Virtual data rooms built on a web-based platform are typically the most compatible across devices and operating systems because they run in the browser and are not reliant on third party applications. VDR providers may have specific applications, which may meet security requirements, but businesses should note that updates to the underlying operating system may require application updates and put data at risk.
VDR providers must allow access with standard control and review functionality of secure documents through mobile access.
- No Plug-Ins Required – Ensure users can upload and view documents without the need to install any additional applications or third-party plugins on devices.
- Multi-Device Support – Confirm essential functionality works across all major devices, including Apple, Android, Windows and BlackBerry.
- Mobile Device Interface – Ensure there is a mobile-optimized interface that allows users to easily access materials from mobile devices.
In general, virtual data rooms should provide the same functionality on mobile as desktop.
Complicated software impacts efficiency and causes delays, along with significant amounts of frustration.
During the VDR evaluation process, it is important to find a provider that offers a flexible solution.
What does this mean?
Select a VDR solution that fits within your specific operational process and is easy to use.
The number of qualified VDR vendors continues to increase and they all aim to increase usability and ease of use through intuitive design. Look for easy-to-use features that meet your criteria.
Frequently, VDR providers showcase the user interface (UI) that simplifies business processes and speeds up routine tasks or eliminates the need for a learning curve.
Only the executives, managers and administrators that will utilize the system will know if the UI works within their current workflow to simplify processes.
During the evaluation process, then consider a trial period because it will provide actual feedback on ease of use and the UI. Plus, it will help answer some standard questions, such as:
- How is the data room set up?
- How long will it take to get up and running?
- How does the upload process work?
- How does mobile use work?
- Is the UI intuitive?
- Can I find the right documents?
- How is the customer support and help desk?
The experts agree that companies should “look before they leap” during the evaluation process.
“One of the main benefits of a SaaS solution is that you can give it a fair trial with minimal commitment, since you can simply plug and play using an internet connection, which is not the case with on-premise software, where you have to depend on product demonstrations.”
During the trial, key IT decision makers should review the following to ensure the solution easily integrates with existing business operations.
- Determine the Data Host Credentials Meet Your Demands.
- Confirm the Security Protocols and Encrypted Data Meets Industry Standards.
- Ensure Credentials and Permission Access Aligns with Company Processes.
- Review Audit Trail Capabilities.
- Test Complete Integration with Additional Software Solutions (like your CRM tool).
- Properly Test Customization with Current Workflow.
- Perform Cross Platform Compatibility.
- Conduct Extensive Test for Mobile Usage.
- Call Customer Service Desk to Understand Response Time and Overall Knowledge.
Additionally, to truly test the flexibility, then use the trial period or evaluation process to determine what matters to your company.
- Will the VDR be used for collaboration?
If yes, then ensure the Q&A and commenting process is tested on desktop and mobile. Administrators should set up some notifications and ensure they are customizable to avoid the spamming feel, but provide noteworthy updates.
- Will the VDR be used for deals?
If yes, then ensure the vendor provides proper support and project management capabilities. During the due diligence process, people may be on edge because time is of the essence. Ensure the provider has 24/7 support to help project managers keep the review and transaction on track.
- Is the UI intuitive?
Kick the tires of the data room to ensure the main users find it easy to use. If the set-up process is cumbersome, then it might not be the right solution for your business. Administrators should test the limits of the bulk upload and/or drop and drag options to ensure it documents are ready for review within minutes.
In general, software aims to simplify routine or repetitive processes. In the VDR world, there are many options, so find a vendor that provides a flexible solution that meets your needs and can grow with your company.
At the end of the day, founders and business executives need to determine how any software solution meets their needs.
There are many variables that go into the decision making process. All business leader need to evaluate the multiple VDR companies that are on the market.
But how does an executive decide what is best for their company?
Ensure the VDR solution adheres to the highest level of encryption and data center security measures.
- Mobile Access
Ensure the VDR solution provides functional mobile access that allows users to access and review documents in a secure environment.
Ensure the VDR solution meets your specific business needs and key internal users are comfortable with the design and workflow. Find more about us here.