Due diligence data room checklist for a small business sale: what to release in each round and how to set up buyer access

Due diligence data room checklist: three rounds of release

A due diligence data room for a small sale releases documents in three rounds: the CIM (the confidential memo), management presentation and summary financials first; then detailed financials, the model and key contracts; then customer contracts, employee data and IP for the preferred buyer. The table follows Papermark's sell-side guide, which is written for an advisor-run auction; in our view a small owner-run sale can use the same controls with fewer groups.

SCORE, a nonprofit funded in part by the U.S. Small Business Administration, groups the legal folders into corporate records; contracts and leases; intellectual property; employment; and litigation and compliance.

For the money side it says buyers typically review the balance sheet, income statement and cash flow statement for at least three years, with tax returns. SCORE calls its checklist a starting point, not legal advice, and says to have a business attorney review your documents and purchase agreement before you sign.

Set up buyer access before the first upload

1. Run the room on your firm's domain and branding.
2. Verify every bidder's email before they see anything.
3. Require an NDA before the CIM loads. Papermark's terms say the NDA template is for information, not legal advice, and make no promise about its validity, so ask your counsel to review any NDA you use.
4. Create a group for each bidder with its own link, and add an allow list with that bidder's and its advisors' email domains.
5. Set default permissions so files uploaded later stay hidden from every bidder until you share them on purpose.
6. Keep downloads off until the final round, and use expiry dates as bid deadlines.

A mistake to avoid, as Papermark's guide describes it: putting the full room behind the first-round link and relying on bidders to stay in their lane.

Index, request list and Q&A

Turn on index generation, a link setting in Advanced Controls, so advisors can download a numbered index in PDF or Excel and cite documents by number. SCORE gives the same advice for a small sale: use consistent file names and keep a simple index of each folder.

The request list is a shared checklist inside the room, with a due date for each request and an assignee that is a visitor group or a link. You can import a prepared list instead of adding requests one by one. Q&A lets bidders ask questions next to the document they concern instead of emailing you.

Closing the room

At signing, expire the bidder links, export visits and audit logs, then freeze the room. Freezing permanently closes the room to all viewers and produces an archive with every document, the full audit log and the Q&A data. Freezing is irreversible, so do it last.

The plan each control needs, and when an enterprise room fits

Papermark's Data Rooms plan gives each buyer group its own link with file-level permissions, an NDA gate and a request list, and Data Rooms Plus adds the Q&A module, a visitor audit log and automatic file indexing; the best virtual data room for small business guide compares the vendors.

Data Rooms is $179 a month billed monthly or $119 billed annually for 3 team members, and Plus is $399 billed monthly or $299 billed annually for 5, as read on October 31, 2026. Freezing needs Plus, and default permissions need Data Rooms or above. Papermark's request list and NDA gate are open during its 7-day data room trial, so the first-round folders can be staged before paying.

A sale shared with a few trusted readers who need no page-by-page view data can run from a folder. A formal multi-party sale that needs project support fits Datasite, Firmex, Ansarada or Intralinks; Firmex alternatives prices the others. For a raise rather than a sale, use the startup data room checklist.