Fundraising Data Room: 90-Day Checklist to Pass Due Diligence Without Friction

A professional data room is not built in two weeks after the term sheet is signed. It is prepared 90 days upstream, alongside VC conversations and even before the term sheet. Founders who anticipate save on average 4 to 6 weeks at closing and avoid the downward renegotiation triggered by blind spots revealed late.

This guide targets startup CEOs preparing a Series A or B (but applies at any stage from a serious Seed round). It details the exhaustive checklist, the practical organisation, the financial KPIs to model and the common traps observed in mission.

For a diagnosis of red flags in accounting due diligence, see our dedicated article Accounting Due Diligence: 12 Red Flags.

• A data room has 8 chapters: corporate, finance, tax, HR/social, legal/contractual, IT/security, commercial, IP.
• Optimal timing: start 90 days before the expected term sheet, finalise 30 days before closing.
• Three most often deficient chapters: finance (accounting reconciliation and reporting), tax (R&D tax credit, VAT, BSPCE), legal (customer contracts and IP).
• A well-prepared data room shortens closing by 4 to 6 weeks and limits downward renegotiation (typically 5-15% of valuation).

Three reasons make 90 days the optimal window:

1. Progressive build: an exhaustive data room takes 80 to 150 hours spread between founders, the CFO (or fractional CFO) and the chartered accountant. Too fast = documentary holes; too early = stale data.
2. Iteration with advisors: lawyer, chartered accountant, M&A advisor review the documents and identify areas to strengthen before opening to investors.
3. Reporting synchronisation: the data room must reflect a closed accounting reality, ideally with an interim close reviewed 30 days before opening.

Tools#

Recommended platforms 2026: Drooms, Datasite, Intralinks, Firmex, iDeals. For pre-Series A startups, lighter solutions like DocSend, Sharetribe or Notion + Google Drive with fine-grained permissions can be sufficient if legal maturity is supervised.

Tree structure#

The structure mirrors the 8 chapters below, with:

• Two-level numbering (1.1, 1.2, 2.1...);
• A root index.xlsx listing each piece with author, date, version, notes;
• A Q&A log folder to track investor questions and answers.

Permissions#

• Read-only by default;
• Per-investor watermark;
• Download restriction on the most sensitive documents (customer contracts, source code);
• Access logs and alerts when a sensitive file is repeatedly viewed (signal of serious investor or leak).

Phasing#

• Phase 1 (D-90 to D-60): internal build with advisors.
• Phase 2 (D-60 to D-30): quality review, gap-filling, final indexing.
• Phase 3 (D-30 to D-0): progressive opening to selected investors (lead first, then co-investors).
• Phase 4 (closing): frozen final versions, compliance certificates.

• Up-to-date by-laws and all historical versions;
• Recent Kbis (< 3 months);
• Shareholder decision register and AGM minutes;
• Beneficial owner register;
• Up-to-date cap table (Excel + diagram) with capital operations history;
• Current shareholders' agreement + amendments;
• Promises of transfer, options, BSPCE issued (with history);
• Regulated agreements between the company and managers/shareholders;
• Powers of attorney in force.

Common trap: Excel cap table not synchronised with by-laws. Any gap is a major red flag.

• Last 3 annual accounts (balance sheet, P&L, notes);
• Filed tax returns;
• Year-to-date interim accounts (ideally reviewed);
• Monthly reporting for the last 24 months (P&L, cash, KPIs);
• 3 to 5-year financial plan (P&L, cash flow, working capital, capex);
• Cash detail: bank statements, term deposits, undrawn credit lines;
• Debt schedule (loans, leasing, BSA, OBSA, shareholder current accounts);
• Receivables and aged balance;
• Provisions, depreciation, amortisation policies;
• Bank-to-accounting reconciliations for the last 12 months.

Common trap: MRR / ARR / churn shown in the pitch deck not reconcilable with the accounts. Prepare an explicit reconciliation note.

• Corporate income tax: 2065 + 2058 / 2059 returns;
• VAT: CA3 returns, deductible records, past VAT audits;
• Local business taxes (CFE / CVAE / IFER);
• R&D Tax Credit (CIR): 2069-A returns, scientific and financial supporting documentation, expert certificates;
• BSPCE / free shares: decisions, registers, tax certificates;
• JEI status: maintenance conditions, URSSAF certificates;
• Notifications of tax reassessment or ongoing/past audits;
• Tax conventions (tax consolidation, transfer pricing where applicable).

Common trap: CIR file poorly documented on the scientific side (no up-to-date annual technical memo, no researcher timesheets). In due diligence this is a major cause of tax provision in valuation.

• Personnel register (Article L. 1221-13 of the Labour Code);
• Employment contracts of all employees (with BSPCE/free-share annexes if applicable);
• Applicable collective agreement and company agreement if any;
• DSN (social declarations) for the last 24 months;
• Past URSSAF audits and audit notifications;
• Compensation policy: grid, bonuses, profit-sharing;
• Training plan and apprenticeship tax;
• Ongoing disciplinary procedures, recent contractual terminations;
• Employee representation (Social and Economic Committee, elections).

Common trap: abusive use of freelance status for collaborators in fact subordinated. Risk of reclassification as employment contract (URSSAF + employment tribunal), provisioned in due diligence.

• Customer contracts: all top-20 customer contracts by revenue, plus templates;
• Critical supplier contracts (cloud, infra, data partners);
• Commercial leases;
• Software licence contracts (in / out);
• General terms and conditions of sale and use;
• Ongoing and past litigations (tracking table, corresponding provisions);
• Guarantees and undertakings given by the company (sureties, asset and liability guarantees);
• Insurance: professional liability, D&O, cyber, property.

Common trap: change of control clauses with critical customers or suppliers. A clause requiring notification or termination on capital change can block the round. Map upstream.

• IT system map (cloud architecture, dependencies, suppliers);
• Security policy: access, authentication, encryption;
• Business continuity / disaster recovery plan (BCP / DRP);
• Recent intrusion tests / pentests;
• GDPR compliance: register of processing activities, DPIAs, DPO conventions if outsourced, legal mentions;
• GDPR sub-processors: signed DPAs;
• Past data breaches and CNIL notifications;
• AI Act documentation if high-risk AI system (since August 2026).

Common trap: GDPR register absent or out of date. The CNIL requires a register of processing. Its absence is a red flag in due diligence and a reputational risk.

• Sales pipeline with weighted probabilities;
• Customer cohorts (retention, expansion, churn);
• Marketing KPIs (CAC, LTV, LTV/CAC ratio, payback);
• Product strategy and roadmap;
• Commissioned market studies and competitive benchmarks;
• Strategic partner list and terms;
• 12-24 month marketing plan and associated budget.

Common trap: CAC understated because indirect costs (sales salaries, tools) are not allocated. Prepare a documented fully loaded CAC.

• Registered trademarks (INPI / EUIPO);
• Patents and pending applications;
• Software deposits;
• Copyright assignments between co-founders / freelancers / employees and the company (critical point);
• Open source: inventory of licences used and compliance (GPL, AGPL, MIT);
• Internet domains and umbrella brands.

Common trap: IP developed by a freelancer without explicit assignment. Without a written assignment contract, IP stays with the author. This wrecks deals at advanced stages.

For a 2026 B2B SaaS Series A, investors expect at minimum:

Document each with formula, accounting source, assumptions. This separates a "pro" from an "amateur" data room.

In mission, we systematically apply the 3-wave sequence:

• Wave 1 (D-90): pre-data-room audit. Detection of documentary gaps, tax and legal risks, accounting inconsistencies.
• Wave 2 (D-60): clean-up. Drafting of the CIR file, GDPR register update, reconciliation of commercial KPIs with accounting, alignment of cap table with by-laws.
• Wave 3 (D-30): final indexing, drafting of synthesis notes per chapter, progressive opening to investors.

This sequence transforms an endured due diligence into a founder-piloted due diligence. The difference is measurable: faster closing, valuation held, term sheet conditions preserved.

Three recurring blind spots:

• Cross-chapter consistency: numbers must match between accounting, tax, social, commercial. A different payroll mass between DSN and P&L = major red flag.
• KPI history: showing KPIs over only 6 months is suspect. VCs want to see 24 months minimum to assess trends and seasonality.
• Business plan assumption documentation: a BP without backup (no support for CAC, churn, hiring assumptions) will systematically be challenged.

• Launch data room preparation at D-90 relative to the target term sheet date.
• Designate an internal data room owner (often CFO / fractional CFO) with a 80-150 hour budget.
• Have the data room audited by chartered accountant and lawyer 30 days before opening.
• Anticipate investor questions by preparing synthesis notes per chapter.

• EU AI Act: since August 2026, certain obligations apply to startups developing or integrating high-risk AI systems. Document from the data room onward.
• E-invoicing 2026-2027 (France): from 1 September 2026, large companies must issue e-invoices. Any B2B startup interacting with large accounts is concerned by reception. Prepare an adaptation plan.
• NIS 2: French transposition effective; certain B2B startups can be qualified as "essential" or "important entity" and subject to cybersecurity obligations. To verify in the data room.
• R&D tax credit (CIR): BOFiP doctrine 2024-2026 stricter on the nature of eligible R&D work. Review the technical memo with an accredited expert.
• GDPR post-Schrems II: any data transfer to the US via a sub-processor must be documented with standard contractual clauses and impact analysis.