Raising capital forces a paradox on founders: to win an investor’s trust, you must hand over the very information that could hurt you if it escaped. Bitkom, the German digital industry association, estimated in 2024 that cyberattacks, data theft and sabotage cost the German economy about EUR 267 billion a year, and Verizon’s 2024 Data Breach Investigations Report found a human element in 68 percent of breaches. Investors, advisers and their assistants make up a long chain of people who will see your numbers. If you are a founder, CFO or managing director preparing for a funding round, this article is for you. It explains what to share and when, how to use non-disclosure agreements realistically, how a datenraum due diligence process protects documents, and how to close access once the round is done.
Why Investor Relationships Create Confidentiality Risk
Investors are not adversaries, but their process multiplies copies of your information. A single fund may pass your deck to partners, analysts, legal counsel, accountants and co-investors, often by email.
Information Investors Typically Request
During a funding round, expect requests for:
-
Financial statements, forecasts and management accounts
-
Cap table, shareholder agreements and prior financing documents
-
Customer and supplier contracts, including pricing
-
Employment contracts, key-person arrangements and option plans
-
Intellectual property registrations and technology documentation
-
Data protection records and security policies
-
Litigation, tax and compliance history
Much of this is commercially sensitive, and some contains personal data protected by the GDPR (DSGVO) and the Bundesdatenschutzgesetz.
The Limits of the NDA
Founders often assume an NDA solves the problem. In practice, many venture investors decline to sign NDAs at early meetings because they see hundreds of pitches and fear conflicts. Even when signed, an NDA only offers a remedy after a leak, and proving who leaked what is hard. The more reliable protection is controlling what is shared, when and how.
Share in Stages
Match the depth of disclosure to the depth of commitment.
-
First meeting. Share the pitch deck with market, product and traction summaries. Leave out customer names, detailed pricing and technical secrets.
-
Interest confirmed. Provide a financial summary, key metrics and an anonymised customer overview.
-
Term sheet received. Open confirmatory due diligence: contracts, detailed financials, cap table, employment and IP documents.
-
Exclusivity. Release the most sensitive items, such as source code review access or strategic roadmaps, only to named individuals.
-
Signing. Disclose remaining items against specific requests and log each one.
What to Hold Back Until Late
Keep names of key customers and suppliers, margin by contract, unannounced product plans and personal data of employees out of early materials. If an investor insists on seeing them early, ask why, and offer a redacted or aggregated version first.
Preparing Documents Before the First Investor Call
Disorganisation is itself a confidentiality risk. When documents are scattered across inboxes and personal drives, you cannot say what has been sent to whom.
-
Gather and index all diligence documents in one structure before the process begins.
-
Redact personal data where it is not essential, in line with data minimisation under the GDPR.
-
Remove metadata, hidden sheets and comments from spreadsheets and presentations.
-
Mark documents with a classification, such as “Confidential” or “Restricted”.
-
Keep a single master version, so that corrections reach everyone.
Datenraum Due Diligence: Using a Secure Repository Instead of Email
Email attachments cannot be recalled, tracked or restricted once sent. A virtual repository solves these weaknesses and is the standard tool for a datenraum due diligence process. Key capabilities include:
-
Permissions by investor and by folder, so a lead investor and a minority co-investor can see different material
-
View-only access with printing and downloading disabled for sensitive files
-
Dynamic watermarks showing each viewer’s name and the time
-
Activity logs that record each view, download and permission change
-
Q&A tools that keep questions and answers organised and approved
-
Immediate revocation if an investor withdraws
Data Residency and the GDPR
German and European companies should consider where their data is hosted and who can access it. Since the Schrems II ruling in 2020, transfers of personal data to third countries have required extra care, and the EU-US Data Privacy Framework adopted in 2023 has reopened some routes while remaining subject to legal challenge. Hosting within the EU, with clear data-processing agreements under Article 28 of the GDPR, simplifies compliance. A breach of GDPR rules can lead to fines of up to EUR 20 million or 4 percent of worldwide annual turnover, whichever is higher.
Contract Terms That Matter
Even when a full NDA is not possible, protect yourself with targeted terms:
-
Confidentiality in the term sheet. Many term sheets contain a confidentiality clause; check that it covers advisers and co-investors.
-
Named recipients. Ask the investor to list who will receive material, and to bind them to the same obligations.
-
Use restriction. Information may be used only to evaluate the investment.
-
Return or destroy. If the deal does not proceed, require deletion and written confirmation.
-
Non-solicitation. Protect your employees and key customers from being approached using diligence data.
-
Competing portfolio companies. Ask how the fund separates information when it backs a competitor, and request a clean-team arrangement if needed.
Monitoring Activity During Diligence
A logged environment gives you a second benefit: insight. If an investor spends hours on your customer contracts but never opens your financials, that tells you where their concerns lie. Unusual behaviour deserves attention, such as large downloads, access at odd hours or repeated attempts to view restricted folders. Review logs at least weekly during active diligence, and ask your lawyer to follow up promptly if something looks wrong.
After the Round: Close the Loop
Confidentiality does not end at closing, and it matters equally if the investor walks away.
-
Revoke external access and archive logs.
-
Collect written confirmation of return or deletion from investors who did not proceed.
-
Record what was disclosed to whom, which helps if a warranty question arises later.
-
Update the information you share with the new investors in regular reporting, using a controlled channel rather than ad hoc email.
-
Review which categories of information were most requested, and prepare them better for the next round.
Common Mistakes to Avoid
-
Sending the full financial model with the first email. Share the summary first.
-
Letting one person hold all the files. Use a shared, access-controlled structure with named owners.
-
Ignoring personal data. Employee and customer details need a lawful basis for disclosure.
-
Skipping the test. Log in as a sample investor and confirm exactly what they see.
-
Failing to brief your team. Employees should know not to discuss the round with outsiders or on unapproved channels.
Handling Co-Investors and Syndicates
Many rounds involve a lead investor and several followers. Agree early who will see what. The lead typically receives full diligence access, while smaller participants may need only a summary and the final documents. Ask the lead to confirm in writing which co-investors, advisers and portfolio specialists will join, and give each group separate permissions. Avoid allowing the lead to forward the whole package; instead, grant named access so that your logs show every recipient. This approach also makes it easier to withdraw access if a participant drops out.
Preparing Your Employees
Staff who know about the round can leak information without meaning to. Brief only those who must know, remind them of their confidentiality duties under their employment contracts, and give them clear guidance on what to say if customers or journalists ask. Prepare a short internal announcement for the moment the round closes, so rumours do not fill the silence.
Conclusion
Working with investors requires transparency, but transparency does not mean losing control. Share in stages, prepare and sanitise documents in advance, use contracts that bind everyone who sees your information and run diligence in a controlled environment. A structured datenraum due diligence process keeps your documents organised, your access rights precise and your record complete. Start this preparation before your first investor meeting, and review it after every round. The result is a faster process, stronger credibility and far fewer sleepless nights about where your information has gone.