When a merger, fundraising, litigation or board pack is shared from a general-purpose drive, the organisation usually loses track of who downloaded what within days. Secure file sharing platforms and virtual data rooms (VDRs) exist for person-to-person exchange of sensitive documents with outside parties: bidders, advisers, auditors, regulators, board members and counterparties. They add granular permissions, view-only access, watermarking, detailed audit and stronger key control on top of ordinary storage. This vendor-neutral buyer's guide is for security, legal, corporate development and IT teams choosing such a platform. It covers people sharing documents; for system-to-system transfers see the Secure File Transfer Buyers Guide, and for locking down sharing in the collaboration suite you already run see the Secure File Sharing Guide.
Key takeaways
- Decide first whether you need a data room or better settings. Many routine external sharing needs can be met by hardening your existing suite; a dedicated VDR earns its cost for high-stakes, time-boxed projects with many outside parties.
- Permissions must be granular and group-based. Per-folder, per-document and per-party rights (view, print, download, upload) are the core, managed through groups so one bidder cannot see another's questions or documents.
- View-only is a deterrent, not a guarantee. Watermarks, screenshot blocking and document rights management raise the cost of leaking but cannot stop a photograph of a screen, so audit and legal terms still matter.
- Audit is the product. Page-level view logs, downloads, prints and access by IP address are what you will rely on after a leak or a dispute.
- Key control and deletion close the project. Know who holds the encryption keys, and get evidence that every copy, including backups, is destroyed or archived when the room closes.
Define requirements
- Use cases: M&A due diligence, fundraising, litigation and discovery, board and committee papers, audit evidence exchange, regulatory submissions, or ongoing client and supplier exchange. Each changes the number of external users, the duration and the sensitivity.
- Parties and segregation: how many external organisations, whether they must be invisible to each other, and who on your side administers each group.
- Document types and volume: office documents, PDFs, spreadsheets with formulas, CAD files, video, and the total size; some protection features work only on certain file types.
- Data classification and law: personal data (GDPR Article 32 security of processing, international transfer rules), inside information, export-controlled technical data, or health records.
- Identity: SSO for internal staff, and for external users whether they sign in with their own organisation's identity provider, a platform account with MFA, or one-time links.
- Retention and closure: how long the room stays open, what is archived for whom (often an encrypted archive for each party), and when everything is deleted.
Capability areas
| Area | What to look for |
|---|---|
| Granular permissions | Rights per group at folder and document level: none, view, view with watermark, print, download original, download protected, upload; bulk permission views; staged release of folders |
| View-only and rights management | Browser viewer that renders documents without delivering the original, spreadsheet viewing that preserves formulas, protected downloads that require sign-in to open and can be revoked later |
| Watermarking | Dynamic watermarks with user name, email, IP address and timestamp on screen, print and download; configurable per group |
| Audit and reporting | Logs of every view (ideally page level and time spent), download, print, upload, permission change and admin action; exports and SIEM streaming; tamper-evident storage |
| Encryption and key control | Encryption in transit and at rest, customer-managed keys in your own KMS or HSM, key revocation that makes stored content unreadable |
| Identity and access | SSO, MFA for all external users, IP and device restrictions, session timeouts, access expiry dates, NDA or terms click-through on first sign-in |
| Q&A and workflow | Question and answer modules segregated by party, approval workflows, redaction tools, version control |
| Hosting and assurance | Data residency choice, subprocessor list, independent audits such as ISO/IEC 27001 or SOC 2, penetration test summaries |
| Closure | Encrypted archive export per party, certified deletion including backups, defined retention of audit logs after closure |
The NCSC cloud security principles are a good structure for the assurance part of your questionnaire, in particular principle 3 (separation between customers), principle 9 (secure user management), principle 12 (secure service administration) and principle 13 (audit information and alerting for customers).
Evaluation criteria
| Criterion | What good looks like | How to test it | Suggested weight |
|---|---|---|---|
| Permission model | Group-based, inheritable, easy to review; one party never sees another's content or questions | Build a room with two competing bidders and check segregation from both sides | [20%] |
| Document protection | View-only for all key file types, dynamic watermarks, revocable protected downloads | Open a protected spreadsheet and PDF as an external user; revoke and reopen | [20%] |
| Audit quality | Complete, exportable, page-level, includes admin actions | Run test activity and reconcile it against the report | [20%] |
| Identity and external access | MFA enforced for every external user; SSO and federation; expiry dates | Invite an external user and attempt access without MFA | [15%] |
| Key control and closure | Customer-managed keys, certified deletion, per-party archives | Request a sample deletion certificate and archive | [15%] |
| Usability | Fast viewer, bulk upload, clear indexing; minimal friction for advisers | Time an adviser finding and reviewing a document set | [10%] |
Weights in brackets are illustrative; a board portal buyer will weight usability on tablets higher, a litigation team will weight audit and closure evidence higher.
Questions to ask vendors
- Can you show one external party being unable to see another party's documents, folders, users and Q&A, including in search results and notifications?
- Which file types can be viewed without the original being delivered to the browser, and what happens to spreadsheets and large drawings?
- How do protected downloads work offline, and can we revoke access to a file that has already been downloaded?
- What exactly does the audit log record, how long is it kept after closure, and can we stream it to our SIEM?
- Who holds the encryption keys, can we use our own KMS or HSM, and can your support staff view our documents?
- How do external users authenticate, can we enforce MFA for everyone, and can they use their own organisation's SSO?
- What is delivered to us at closure, how is deletion evidenced, and does it include backups and search indexes?
- Where are documents, backups and logs hosted, and which subprocessors handle them?
- What independent audit reports and penetration test results can you share under NDA?
Red flags
- "View-only" that streams the original file to the browser where it can be saved from developer tools or the cache.
- Shareable links that work without signing in, or MFA that is optional for external users.
- Audit reports limited to logins and downloads, with no record of views or permission changes.
- Permissions that can only be set user by user, making segregation errors likely as parties grow.
- No answer on key custody, or vendor staff with standing access to customer documents.
- Closure handled by "deleting the room" with no archive, certificate or backup commitment.
Proof of concept
- Model a real project: build a test room from a past deal or board cycle with three external parties, staged folders and a Q&A module.
- Integrate identity: connect SSO for internal users, enforce MFA for external users and set access expiry dates.
- Test segregation: sign in as each party and confirm nothing from other parties appears in folders, search, notifications or Q&A.
- Test protection: view, print and download protected files as each permission level, check the watermark content, then revoke a downloaded file.
- Test audit: run a scripted set of actions and reconcile them against the audit export and SIEM feed.
- Test closure: close the room, receive the archive and deletion evidence, and confirm external access ends at once.
- Score and clean up: score against the criteria, then delete test rooms, users and integrations.
After rollout, track the share of high-sensitivity external sharing done through the approved platform, external users without MFA (target zero), rooms past their planned closure date, and time to produce an access report on request. For sharing that should stay inside your suite, see the Unstructured Data and File Share Security Guide.
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Secure File Sharing Guide · Secure File Transfer Buyers Guide · Unstructured Data and File Share Security Guide · Email Encryption