Secure document sharing with investors: the four controls to require
Sharing documents with investors is not just sending files. It is controlling who sees what, knowing when they opened it, and being able to close access the moment a conversation ends. A Google Drive link does none of that.
Run a fundraise and you will send your deck, financial model and cap table to thirty funds over four months. The difference between a shared folder and a proper setup is the difference between flying blind and seeing every conversation in your pipeline. This article lists what to require from any document-sharing setup before you send a single file.
Why a shared folder is not enough
Most founders start with what they know: a Drive folder, a Dropbox link, a WeTransfer. It works for the first two or three conversations. Then the problems start.
You send a link to a fund. They pass. Three months later, someone there is still opening your projections, and you have no idea. You have also updated those projections twice since, but they are looking at the old version.
Meanwhile you cannot tell which of the twenty funds you approached opened the deck, which spent twelve minutes on the model, and which never clicked. That information would tell you where to put your follow-up energy. A shared folder gives you none of it.
A fair note: Drive is not useless. If you share by email address rather than by public link, you can remove one person, and Drive keeps a version history. The limits show up at scale, with links, and with no read signal.
The four controls to require before you share anything
| Control | What it guarantees | Risk without it |
|---|---|---|
| Access per investor, revocable | Each fund has its own access, closed without affecting the others | Uncontrolled forwarding, no way to close one fund |
| Automatic link expiry | Access closes on a set date, with no manual step | Confidential files reachable long after the round |
| Read tracking | You see who opened what, and when | Blind follow-ups, effort spent on the wrong funds |
| Versioning | Every active investor sees the current version, with a history | Confusion over which numbers were seen, disputes later |
1. Access per investor, revocable
One link sent to twenty funds is one access shared by twenty funds. If one of them forwards it, you learn nothing. If you want to close access for the fund that passed, you have to close it for everyone.
The better practice is one access per investor, which you can revoke on its own. You then know exactly who opened what, and you act at the individual level.
It is also a GDPR question. As soon as your documents contain personal data, such as customer contacts, usage data or shareholder names on a cap table, you are responsible for knowing who received it and for being able to end that access. A generic link cannot document that.
Without it: a fund passes in February. An analyst who kept the link reopens it in May for another file. Your data circulates outside any contractual framework and you never know.
2. Link expiry
A document shared without an expiry date stays reachable indefinitely. Few founders weigh that when they send the link, and many weigh it six months later, when the round has closed and the due diligence files are still open to funds that never joined.
Expiry serves two needs. Security: limit the time confidential documents are exposed to people who no longer have a reason to see them. Compliance: under the GDPR, keeping personal data accessible longer than the purpose requires is hard to justify.
A reasonable baseline is 30 to 60 days for links sent during exploration, and shorter for advanced due diligence documents. You can extend an expiry if the conversation continues.
Without it: your round closes in September. In January, an analyst who changed funds reopens your cap table and customer contracts from a new desk. You cannot know, and you cannot stop it.
3. Read tracking
Knowing that an investor opened your data room is not enough. What matters is what they opened and when. Where the platform records time spent, it also shows whether they lingered on the model or skimmed the deck.
Someone who spends forty seconds on the forecast and three minutes on the competition page has questions about positioning, not about the numbers. Someone who opens the deck on a Monday night and closes it after two minutes probably read little. These signals change how you prepare the next call.
Tracking also helps you prioritize. With thirty funds in parallel you cannot follow up with equal energy. It tells you who engaged, who has not opened the link, and who came back several times. We go deeper in what an investor really looks at in your data room.
Without it: you chase a fund that read your files the night before and is simply waiting for you. You ignore a fund that never opened the link because you assume it is still thinking.
4. Versioning
A fundraise lasts months. Your forecast changes, the deck evolves, your KPIs move. Without versioning, you do not know which version an investor read, and neither do they.
Versioning makes sure every active investor sees the current version, and it protects you. If an investor challenges a number after the term sheet, you need to show which version of which document they saw and on what date. Without a version history, you cannot.
Use it to update in place rather than uploading a new file under a new name. Name files readably, with no version number: financial_model.xlsx, not model_v12_FINAL.xlsx.
Without it: you send a corrected forecast in March. Two funds downloaded the old one in February. They reach closing with different assumptions from yours, and the numbers conversation starts over.
Signed links, and what they actually protect
A signed link is a unique URL generated for one file. It is long and unguessable, and the platform checks it on every request, so an expiry or a revocation takes effect at once.
What it protects depends on how it is set up. Two cases are worth separating:
- A link that requires an account. It can be attributed to the account that opens it. That gives you an audit trail and makes casual forwarding less useful.
- A link that anyone can open. It is convenient, but it can be forwarded. Treat it as public within its expiry window, and keep it for lighter material.
Not every tool offers both, and few explain which one they use. Ask before you choose.
What to put in a secure investor data room
The controls govern how you share. What you share is a separate question. A standard seed-stage room contains the current pitch deck, a one-page summary, a financial model with visible assumptions, the cap table with all BSPCE allocations, the articles of association and any shareholders' agreement, team bios, a product demo or screenshots, and traction data such as MRR, retention or customer logos.
You do not need everything on day one. Many founders share a lighter version at first contact and open the full room once an investor is genuinely interested. That only works if you have access per investor in place. For the full breakdown by stage, see what a data room is and why every fundraise needs one.
Connect what you learn to your follow-ups
Document sharing and your fundraising pipeline feed each other. A fund that opened your model twice in three days is a signal to follow up. A fund you contacted six weeks ago that never opened the link is a signal to re-engage or move on.
The cleanest setup connects the two, so engagement data sits next to your investor list. Some fundraising suites combine both. If your data room does not include a pipeline, a spreadsheet works, provided you update it with what the read log tells you.
What to revoke, and when
Access management does not end when you send the link. Revoke access when:
- An investor passes on your round
- A conversation has been cold for four to six weeks with no reply
- You are closing the round and want to limit ongoing exposure
- A document has been replaced and you do not want the old one circulating
Revoking is not aggressive or impolite. It is standard practice, and investors who work with founders regularly understand it.
A note on confidentiality
Asking an investor to sign an NDA before sharing documents is, in most cases, unrealistic at the early stage. Institutional investors rarely sign one, and asking before a first conversation can look inexperienced.
The practical alternative is a well-configured data room: access per investor, expiry, an access log and versioning. These do not replace legal protection, but they give you meaningful control without adding friction to the relationship. In advanced due diligence, for detailed financials or customer contracts, a confidentiality clause in the term sheet is a legitimate step.
The main blind spot is downloading. Once a file is on someone's machine, you no longer control it. Disable downloads for the most sensitive files where the tool allows it, and take legal advice if you share proprietary technical material.
Where the data is hosted, and under which law
For a French startup raising from European funds, hosting is a fair question from an institutional investor: where are the due diligence documents stored, and who can compel access to them?
The answer has two parts. The hosting region matters, and so does the vendor's legal structure. The US CLOUD Act lets US authorities compel a US-jurisdiction provider to disclose data it controls, wherever it is stored, although in the EU such a request needs a valid legal basis under GDPR Article 48. It is not a reason to rule out a tool, but it is a question to be able to answer before due diligence starts.
How onefive handles this
onefive grants access file by file, either to a named account or through a link. Links can carry an expiry date and can be revoked at any time. Downloads are off by default, so the default is view-only, and PDFs carry a watermark with the viewer's name and email. Documents are versioned, and every opening is logged with its date and time.
It is one of several uses of the platform, which also covers a verified network, ecosystem discussions, a directory of around 400 incubators, accelerators, contests and events, and Le Tour de Table. The product is bilingual in French and English and free at launch. It is currently in pre-launch, and access goes through a free waitlist.
What it does not do today: there is no investor pipeline yet, so you keep your conversation list elsewhere until the CRM ships on the 2026-2027 roadmap. It does not claim SOC 2 or ISO 27001 certification. And storage is capped at 1 GB per data room, 50 MB per file.
FAQ
Frequently asked questions
What is secure document sharing with investors?+
It means sending documents through a system that gives you access control per recipient, link expiry, read tracking and version history. It differs from a shared folder, where you cannot see who opened what and cannot revoke access selectively.
Do I need an NDA before sharing my pitch deck with investors?+
Usually not for a first conversation. Institutional investors rarely sign an NDA at the early stage, and asking for one before a first meeting can look inexperienced. For detailed financial documents or customer contracts in advanced due diligence, a confidentiality clause, in the term sheet for example, is a legitimate precaution. The technical controls apply either way.
What is a signed link in a data room?+
A signed link is a unique, unguessable URL that the platform checks on every request, so expiry and revocation take effect immediately. Whether it is tied to a person depends on the setup. A link that requires an account can be attributed to the account that opened it. A link anyone can open can be forwarded, so use those for less sensitive material.
When should I revoke an investor's access?+
When the investor passes, when a conversation has been cold for four to six weeks, when you are closing the round, and when a document has been replaced and you do not want the old one in circulation. Revoking access is standard practice and is not considered impolite.
What documents belong in an investor data room?+
The pitch deck, a one-page summary, a financial model with visible assumptions, the cap table including BSPCE allocations, key legal documents, team bios, and product or traction data. Share a lighter version at first contact and open the full room once interest is confirmed.
What if an investor downloads a file before the link expires?+
Local downloads are the main blind spot of any data room. Two practical answers: disable or restrict downloads for the most sensitive files, since many tools allow viewing without downloading, and cover the shared documents with a confidentiality clause in your pre-contract exchanges.
Does GDPR apply to documents shared with investors?+
Yes, as soon as they contain personal data such as customer, employee or shareholder information. You are responsible for knowing who you sent it to and for being able to end that access. That is one more reason to prefer named access, expiry and an access log over a generic link.
How long should I keep access logs after the round?+
French law sets no specific duration for data room logs. The GDPR principle is to keep data only as long as the purpose requires. In practice, many founders keep logs for the length of the investor relationship and archive them for the five-year commercial limitation period (Article L110-4 of the French Commercial Code). Confirm your own policy with a lawyer.
Can I use a data room for a pre-seed round?+
Yes. Pre-seed founders often contact as many funds as a later round, over several months, so access per investor and a read signal are valuable from the start.
Do expiring links stop an investor from consulting a document after closing?+
Yes, that is the point. If an investor joins the cap table and needs ongoing access, open a specific access for the shareholder relationship, separate from the fundraising process. Mixing the two makes it unclear what was shared in which context.
Conclusion
Sharing well with investors comes down to four questions you should be able to answer for every file you send. Who has access, and can I close it alone? When does it end? What did they open? Which version did they see? If your current setup cannot answer them, you are running your raise on guesses.
