What belongs in a data room

A data room is a staged disclosure, not a folder. The whole design question is what a given buyer has earned the right to see at this point in the conversation.

Three tiers work. Public: the things a buyer needs to decide whether to keep reading — what the product does, roughly how big it is, roughly what it costs to run. NDA-gated: the operating detail that would let a competitor copy you but that a serious buyer genuinely cannot proceed without — cohort data, customer concentration, unit economics. Request-gated: the things that identify actual people or expose live credentials — customer lists, contracts naming clients, anything touching production access.

The third tier should never be a file sitting in a folder waiting to be downloaded. It should require a specific request, a specific approval, and leave a log entry.

The test for any document is simple: if this leaked to your closest competitor tomorrow, what breaks? If the answer is "a lot", it does not belong in a tier the buyer can reach by clicking.