The Ideal Data Room Folder Structure and Index (2026)

Why the index matters more than the documents

Investors and acquirers do not read your data room front to back. They scan the index, jump to the three or four folders that decide the deal, and form a view in the first ten minutes. A messy room signals a messy company. A clean, numbered index signals that you run a tight operation, which is exactly the impression you want during diligence.

The index is also the thing reviewers screenshot, reference in their internal memos, and use to build their own diligence checklist. Get it right and the rest of the process moves faster. Get it wrong and you spend the next two weeks answering "where is the…" emails.

There is no single legally mandated layout. But there is a strong convention, and reviewers expect it. The ten-folder structure below follows that convention and maps cleanly onto a standard due diligence data room checklist, so the people reviewing your room find what they expect, where they expect it.

The ideal data room folder structure (copy this)

Here is the full numbered index. Each top-level folder is a section; the right column lists what goes inside. Copy it, delete what does not apply to your stage, and you have a working room.

#	Top-level folder	What goes inside
01	Overview	Read-me / index document, one-page company summary, current pitch deck, executive summary, link to product demo or recorded walkthrough, process timeline for the raise or sale
02	Corporate & legal	Certificate of incorporation, bylaws / articles, board consents and minutes, shareholder agreements, cap table summary (full detail in 04), good-standing certificates, prior financing docs (SAFEs, notes, term sheets)
03	Financials	Historical P&L, balance sheet, cash flow statements, monthly management accounts, current budget and forecast model, bank statements, AR/AP aging, audit or review reports if any, key metrics dashboard (MRR/ARR, burn, runway, gross margin)
04	Cap table & fundraising	Detailed cap table (fully diluted), option pool and grant ledger, SAFE/note schedule with conversion terms, prior round documents, current round materials (SAFE or term sheet, use of funds), 409A or valuation reports
05	Product & tech	Product overview and roadmap, architecture diagram, tech stack summary, security overview, uptime / SLA history, key integrations, data-handling and infrastructure notes, demo environment access
06	Market & traction	Market sizing (TAM/SAM/SOM) with sources, competitive landscape, growth charts, cohort and retention analysis, pipeline summary, key traction metrics, customer logos or case studies
07	Team & HR	Org chart, founder and key-hire bios, employee census (roles, start dates, comp bands), key employment and advisor agreements, option grants summary, open roles / hiring plan
08	Customers & contracts	Top customer contracts (redacted as needed), MSAs and order forms, churn and renewal data, customer references list, partnership and reseller agreements, terms of service and SLAs
09	Legal & IP	Trademarks and patents (filed/granted), IP assignment agreements (founders, contractors, employees), domain registrations, open-source license summary, litigation history (or a "none" statement), insurance policies
10	Compliance	Data privacy posture (GDPR/CCPA), SOC 2 / ISO reports or roadmap, DPAs, security policies, regulatory licenses if applicable, NDA on file, prior diligence reports

That is the spine. Most rooms need eight of these ten folders well populated and two that are thin. The thin ones are fine, as long as the index makes clear they exist and were considered.

Numbering and naming conventions

The structure only works if the naming is disciplined. Reviewers should never have to guess what is inside a file before opening it.

Number top-level folders with a leading zero. Use 01, 02, 03, not 1, 2, 3. Once you pass nine folders, single digits sort wrong (10 lands between 1 and 2). Leading zeros keep the order correct everywhere.

Number sub-folders within sections too when a section gets deep. Inside 03 Financials you might have 03.1 Statements, 03.2 Management accounts, 03.3 Model. The dotted scheme keeps the parent visible and the order fixed.

Name files so they self-describe. A good pattern: Company_DocType_Period_vVersion. For example Acme_PnL_2025_FY.pdf or Acme_CapTable_2026-06_v3.xlsx. Avoid final, final2, FINAL_v3_real. Use dates in ISO format (2026-06) so versions sort chronologically.

One canonical version per document. Do not upload three drafts of the model. If you use a link-based platform, you can update the underlying file without changing the link, so reviewers always see the current version and you never juggle duplicates. That is one of the practical advantages of sharing via a trackable link instead of attachments.

Keep the index document at the top of 01 Overview. It restates the folder list, flags anything intentionally omitted ("audited financials not applicable, company is pre-audit"), and gives a contact for questions. This single page prevents most of the "is this missing or just not here yet?" friction.

How to handle permissions per folder

Not every viewer should see every folder. A first-call investor needs the overview and high-level financials. A lead doing real diligence needs the cap table, customer contracts, and IP. Set access at the folder level so you grant depth as the conversation gets serious, rather than exposing everything on day one.

Here is a sensible default permission posture, from most open to most restricted:

Folder	Typical access	Controls to apply
01 Overview	Open to all invited viewers	Light: real-time view notifications on
02 Corporate & legal	Invited viewers	Watermark, download off for sensitive docs
03 Financials	Invited viewers, summary first	Watermark, email verification
04 Cap table & fundraising	Leads / serious diligence only	Watermark, download off, passcode or NDA gate
05 Product & tech	Invited viewers	Watermark; gate security/architecture docs
06 Market & traction	Open to all invited viewers	Light controls
07 Team & HR	Leads only (contains personal data)	Watermark, download off, restricted
08 Customers & contracts	Leads only, often redacted	Watermark, download off, NDA gate
09 Legal & IP	Leads / serious diligence only	Watermark, download off
10 Compliance	Invited viewers; reports gated	Watermark, NDA on first access

A few rules of thumb that hold across deals:

Gate the personal and the proprietary. Folders 07 (Team & HR), 08 (Customers & contracts), and 09 (Legal & IP) carry personal data and trade secrets. Keep these to serious counterparties, watermark every page, and turn off download. Dynamic watermarking that stamps each viewer's email on every page is a strong deterrent against leaks, and it works per viewer so a forwarded screenshot still points back to whoever leaked it.

Open the overview, gate the rest by stage. There is no reason to passcode-protect your one-pager. There is every reason to gate the cap table behind an NDA. Plox supports a one-click NDA that a viewer signs before the folder opens, so you get a record without chasing signatures over email.

Use email verification on financial folders so you know exactly who opened the model, not just that "someone with the link" did. Combined with page-by-page analytics, you can see which investor spent eight minutes on the burn-rate page and follow up while it is top of mind.

Set link expiry and keep revoke handy. When a process ends or a party drops out, revoke their access. With a link-based room, access is a switch you control, not a file already sitting in someone's downloads folder.

Match the structure to the deal and stage

This is the part most templates skip. The ten-folder index is a maximal structure. You should not blindly copy all of it. The right room for your situation is a subset, sized to the deal type and stage.

Seed / pre-seed raise. Keep it lean. You realistically need 01 Overview, 03 Financials (a simple model and metrics), 04 Cap table & fundraising, 05 Product & tech (light), and 06 Market & traction. Folders 07 through 10 are usually a single document each or omitted. A seed investor diligencing a five-person company does not expect a SOC 2 report. Padding the room with empty folders looks worse than a tight room with five strong sections. See how to set up a data room for fundraising for a stage-appropriate build.

Series A / B raise. Now all ten folders earn their place. Financials get historical depth, the cap table gets fully diluted detail, customers and contracts become a real diligence area, and compliance starts to matter. This is the canonical case the structure above is built for.

M&A / acquisition. The deepest room. Buyers' counsel will want exhaustive 02 Corporate & legal, 08 Customers & contracts, 09 Legal & IP, and 10 Compliance, often with sub-folders per contract and per IP filing. Expect more redaction, tighter permissions, and a longer-lived room. This is where folders 08 through 10 carry the most weight, because reps and warranties hang on what is in them.

A quick gut check: if a top-level folder would contain zero or one document for your deal, fold it into a neighbor or drop it. A seed room with a one-file 10 Compliance folder should just put that file in 02 Corporate & legal. Structure serves the reader; it is not a box-ticking exercise.

A worked example: a seed-stage room

To make this concrete, here is what a real pre-Series-A SaaS company raising a seed round would actually upload. Six folders, no fluff.

01 Overview
   Acme_ReadMe_Index.pdf
   Acme_Deck_2026-06.pdf
   Acme_OnePager.pdf
03 Financials
   Acme_Model_2026.xlsx
   Acme_Metrics_2026-05.pdf   (MRR, burn, runway, gross margin)
04 Cap table & fundraising
   Acme_CapTable_2026-06_v2.xlsx
   Acme_SAFE_PriorRound.pdf
   Acme_RoundDeck_UseOfFunds.pdf
05 Product & tech
   Acme_Product_Overview.pdf
   Acme_Security_Overview.pdf
06 Market & traction
   Acme_Market_Sizing.pdf
   Acme_Traction_Cohorts.pdf

That is a complete, credible seed room. Eleven files, six folders, every one of them load-bearing. The overview is open, the cap table is gated behind email verification and watermarked, download is off on the model and the SAFE. A seed investor can review it in fifteen minutes and come back with real questions instead of "can you send me the…".

Common mistakes that make a clean index look messy

Even with the right folders, a few habits undo the work:

• Alphabetical or upload-order sorting. Without numbers, "Cap table" lands before "Financials" and reviewers lose the diligence flow. Always number.
• Duplicate and draft files. Three versions of the deck in 01 Overview reads as disorganized. Keep one canonical file per slot.
• A flat dump with no folders. Forty files in a single directory is not a data room, it is a download folder. The folder structure is the product.
• Over-gating the obvious. Passcoding your public one-pager just adds friction. Gate the cap table, not the summary.
• No index document. Without a read-me at the top, reviewers cannot tell missing from not-applicable. One page fixes it.

Where this approach is not the best fit

Honest limitation: a numbered ten-folder index is built for venture diligence and mid-market M&A. It is not the right shape for every situation. A regulated, multi-hundred-million-dollar M&A process with dozens of workstreams, redaction logs, and a formal Q&A module may need an enterprise VDR like Datasite or Intralinks, where the folder taxonomy is dictated by legal counsel and the platform is built for that scale. If you are running that kind of process, structure is the least of your concerns and you should follow your advisors' template.

For founders, operators, and most growth-stage and mid-market deals, though, the ten-folder index is the right level of structure: rigorous enough to look professional, light enough to actually maintain.

Build this room in Plox

Plox lets you build the exact structure above as folders inside a virtual data room, then control access per link and per folder. You get page-by-page analytics (who opened the cap table, how long they spent on the burn page), real-time view notifications, dynamic watermarking applied per viewer on every page, one-click NDA gating, email verification, download controls, and link expiry. Ploxie, the built-in AI assistant, can answer a viewer's questions directly from the documents in the room, so reviewers self-serve instead of emailing you.

You can start on a genuinely free plan (secure links, analytics, and notifications, no credit card, no time limit), and there is a 14-day trial for the full data room experience. Pricing is flat and published, so there is no sales call to build your first room.

To go deeper on the surrounding process, see how to set up a data room for fundraising, the due diligence data room checklist, and real-world data room examples. When you are ready to build, the Plox data rooms product page has the full feature set.

DocSend deserves credit here: its sharing-and-analytics model is genuinely good and set the standard for link-based document sharing. Plox extends that model with a real free plan, an AI layer inside the room, and dynamic per-viewer watermarking baked in rather than reserved for top tiers.

For a neutral, deeper read on what diligence covers beyond the room itself, the SEC's overview of going public and disclosure is a useful authoritative reference on the kinds of records that matter at later stages.

Frequently asked questions

How many folders should a data room have? Around ten top-level folders is the convention for a full venture or M&A room, but most rooms only need five to eight well-populated ones. Use the numbered structure as a maximum and delete sections that would be empty for your deal. A seed room with six strong folders beats a ten-folder room where four are thin.

Should I number my data room folders? Yes. Numbering with leading zeros (01, 02) fixes the sort order, mirrors a standard diligence checklist, and lets reviewers jump straight to the section they need. Without numbers, folders sort alphabetically and the diligence flow breaks, with "Cap table" appearing before "Financials".

What goes in the overview folder? A read-me / index document, a one-page company summary, the current pitch deck, an executive summary, and a link to a demo or recorded walkthrough. The index document should also flag anything intentionally omitted, so reviewers can tell "not applicable" from "missing".

How do I control who sees which folder? Set permissions per folder, not per file. Keep the overview open, gate sensitive folders (cap table, customer contracts, team data, IP) behind email verification, NDA, or watermarking, and grant deeper access as a deal gets serious. Plox lets you apply these controls per link and per folder and revoke access at any time.

Is the same structure right for a seed round and an M&A deal? No. A seed room is leaner (overview, financials, cap table, product, traction), while an M&A room is deeper, with exhaustive corporate, contracts, IP, and compliance sections, often sub-foldered per document. Match the structure to the deal type and stage rather than copying all ten sections by default.

Do I need a separate folder for the cap table if it is in corporate documents? For anything past a seed round, yes. The cap table and fundraising materials get their own folder (04) because reviewers scrutinize fully diluted ownership, the option pool, and SAFE/note conversion terms closely. Keep a summary in corporate (02) and the full detail in 04, gated and watermarked.