A deal room for a small business sale is a private set of folders, built around an index, that opens to each buyer in stages. The seller's broker or attorney decides what each stage holds and when a buyer moves up, and the room keeps a dated record of what each buyer could see. This guide covers the room itself. What a buyer should check, how the sale runs and what the purchase agreement says stay with the seller's broker, attorney and accountant.
"Deal room" and "data room" overlap as names. Here the room means the shared folders plus the settings that control who sees them.
The index comes first
The index lists every file in the room. It is the first file a buyer sees. Before each stage opens, the broker or seller checks the index against the folders.
| Column | What goes in it |
|---|---|
| Number | The folder number and file number, such as 02.01 |
| File | A short name in everyday words |
| Stage | The stage at which a buyer can see it |
| Added | The date the file went in |
| Replaced | The date a newer version replaced it, if one did |
| Note | The one line a buyer needs to read the file, such as the period it covers |
Top-level folders carry numbers, so they sort the same way on every buyer's screen, and there are few enough of them to fit on one screen. Which folders a buyer in a given industry expects is a question for the broker. The index format stays the same whatever the folders are.
A made-up example: four rows from the index of a landscaping-supply company.
| Number | File | Stage | Added | Note |
|---|---|---|---|---|
| 01.01 | Company overview | First look | 2026-03-02 | Written by the seller for this sale |
| 02.01 | Profit and loss statements | First look | 2026-03-02 | Summary by year, three years |
| 02.02 | Monthly profit and loss detail | Closer look | 2026-03-16 | Same three years, by month |
| 04.03 | Equipment list | Closer look | 2026-03-16 | Owned and leased, with ages |
File names that sort
One naming rule covers every file: the index number, a short name and the date in year-month-day order, for example 02.01-profit-and-loss-2025-12-31. The W3C note on date and time formats uses that order, with 1997-07-16 as its example, and a list sorted by name then keeps the versions of a file in date order.
A changed file goes in as a new version with its own date, while the index marks the old one as replaced and the old one moves to an archive folder that buyers cannot open. The word "final" stays out of file names, because the next version makes it false.
Access in stages
A buyer at the first look has no use for payroll detail or customer contracts. A staged room shows each buyer only what their stage calls for, and this guide uses three stages for a small sale.
| Stage | Opens when | For example |
|---|---|---|
| First look | The buyer has signed the confidentiality agreement | An overview of the business and summary financials |
| Closer look | Seller and buyer agree to go further, at a gate the broker sets | Monthly financial detail, main contracts, equipment lists |
| Final check | The sale is headed to closing | The documents the attorneys and lenders ask for |
The broker and the attorney decide what goes in each stage and when a buyer moves up. Each file's stage is in the index before the file is uploaded, so moving a buyer up is one change for that buyer, and every other buyer stays where they were.
Personal data held back until it is needed
Payroll reports, leases and customer lists carry personal information that a buyer has no use for at the first look. The Federal Trade Commission's guide to protecting personal information makes keeping only what a business needs one of its five principles, and it limits Social Security numbers to required and lawful purposes, such as reporting employee taxes.
In February 2024 the commission announced an order requiring Blackbaud, a software company, to delete data it no longer needed. According to the commission's release of February 1, 2024, Blackbaud held data far longer than it needed, including data belonging to former customers. A hacker who got into a Blackbaud-hosted customer database in early 2020 went undetected for three months and took unencrypted data that included Social Security numbers and bank account information. The order requires Blackbaud to keep a data retention schedule that says why it holds personal data and when it deletes it.
In a deal room, early-stage files have employee Social Security numbers, home addresses and birth dates redacted. An unredacted version goes in only at the stage where someone on the buyer's side states a need for it, and the index note records when it went in and for whom.
Separate access for each buyer
Each buyer has separate access. No buyer sees another's name in the room, and when one buyer moves to a new stage, the room opens nothing new for anyone else looking at the same business. Each person on a buyer's side is invited by name to the folders that stage allows, since a file sent through an open link opens for whoever holds the link, signed in or not.
Drive's expiration dates work only on eligible work or school accounts, Google's help page says. Elsewhere the broker removes each buyer on the closing date in the access log.
Before the first buyer arrives, a colleague signs in with a test account set to the first stage. The test passes when the colleague sees the first-stage files and nothing else.
The access log
A short access log sits beside the index: the buyer, each person on their side, the stage, the date access opened and the date it closed. When a question comes up later about what a buyer was shown and when, the log and the dated index answer it. A seller's own log also survives a change of tools, which a tool's built-in activity record may not.
When the sale ends
A buyer who drops out loses access that day. At closing, the seller keeps a copy of the index as it stood at signing, and access closes for everyone who no longer needs it. How long to keep the room's records is a question for the seller's attorney.
Before the first buyer
- Agree the stage gates with the broker.
- Write the index with every planned file and its stage.
- Name and redact the files, then upload them.
- Test the first stage with a colleague signed in as a buyer.
- Start the access log.
The same access rules run a client portal, and who sees what in a client portal covers them.
Sources
- W3C, "Date and Time Formats", note by Misha Wolf and Charles Wicksteed, August 27, 1998: w3.org
- Federal Trade Commission, "Protecting Personal Information: A Guide for Business", October 2016: ftc.gov
- Federal Trade Commission, "FTC Order Will Require Blackbaud to Delete Unnecessary Data, Boost Safeguards to Settle Charges its Lax Security Practices Led to Data Breach", press release, February 1, 2024: ftc.gov
- Google, Drive Help, "Share files from Google Drive", undated help page: support.google.com