# Due Diligence Documentation: The Complete List (2026)

- url: https://www.plox.in/blog/due-diligence-documentation
- date: 2026-06-24
- tags: Data Rooms, Due Diligence
- excerpt: The complete due diligence documentation list, organised by category with the reason each document is requested, how the list changes by deal type, and how.

Due diligence documentation is the full set of documents a buyer, investor, or lender requests to verify a company before they commit capital. It spans corporate and legal, financial, tax, commercial, contracts, IP, HR, regulatory, IT security, and litigation records. The right list depends on the deal: a seed round needs a fraction of what an M&A buyer demands.

This guide gives you the complete, copy-pasteable due diligence document list, organised by category, with the reason each item gets requested. It also covers how the list changes by deal type, how to organise everything into a [data room](/data-rooms), and how to control who sees what.

## TL;DR

- Due diligence documentation falls into roughly ten categories: corporate and legal, financial, tax, commercial, contracts, intellectual property, HR, regulatory, IT and security, and litigation.
- Use the master table below as your due diligence document list. Copy it, delete the rows that do not apply, and turn what remains into your folder structure.
- Right-size by deal type. A seed raise needs incorporation docs, a cap table, and a model. An M&A sale needs all ten categories in depth.
- Organise it once in a data room with one folder per category, then gate access with an NDA, dynamic watermarking, per-folder permissions, and an audit trail.
- Very large regulated deals (public-company M&A, banking, pharma) may need a specialised diligence or VDR platform with managed Q&A and redaction workflows.

## What due diligence documentation is

Due diligence is the verification phase of any deal. The other side has read your pitch or your teaser. Now they want proof.

Due diligence documentation is that proof. It is the paperwork that lets a buyer confirm the company exists as described, owns what it claims to own, earns the revenue it reports, and carries no hidden liabilities. Every document answers a question a counterparty would otherwise have to ask out loud.

The phrase covers a lot of ground. People also call it due diligence documents, the due diligence document list, or simply diligence paperwork. Whatever the label, the job is the same: replace trust with evidence.

The cleaner the documentation, the faster the deal. Missing or disorganised files are the single most common cause of diligence delays, and every delay gives the other side a reason to renegotiate.

## The complete due diligence document list

Use the table below as your master due diligence documents list. It is organised by category so it maps directly onto a folder structure. The third column tells you why each item is requested, so you can judge what to include and what to skip for your deal.

| Category | Documents | Why requested |
| --- | --- | --- |
| Corporate and legal | Certificate of incorporation, bylaws, operating or shareholder agreements, current cap table, stock ledger, board minutes and resolutions, prior financing documents (SAFEs, notes, equity), good-standing certificates | Confirms the company legally exists, who owns it, and that the share structure is clean and enforceable |
| Financial | Audited or reviewed financial statements (3 years), monthly management accounts, the financial model, revenue by customer and cohort, AR and AP ageing, bank statements, debt schedule, budget vs actuals | Verifies the numbers behind the pitch and tests the quality and durability of earnings |
| Tax | Corporate tax returns (3 years), sales or VAT/GST filings, payroll tax records, transfer pricing documentation, any tax rulings, notices, or open audits | Surfaces tax exposure and unpaid liabilities the buyer would inherit |
| Commercial and customers | Customer list with revenue concentration, top customer contracts, churn and retention data, pipeline, pricing and discount policy, partnership and reseller agreements | Proves revenue is real, diversified, and likely to persist after the deal |
| Material contracts | Supplier and vendor agreements, leases, loan and security agreements, change-of-control and assignment clauses, MSAs, NDAs, any contract above a value threshold | Identifies obligations and consents that survive or trigger on a sale |
| Intellectual property | Patent and trademark registrations, IP assignment agreements from every founder, employee, and contractor, domain registrations, open-source license inventory, third-party license agreements | Confirms the company actually owns its core IP, the most common deal-killer in tech diligence |
| HR and employment | Org chart, employment agreements, contractor agreements, the option or equity plan and grants, payroll summary, benefits and pension plans, key-person and non-compete agreements | Assesses retention, vesting, mis-classification risk, and who must stay post-close |
| Regulatory and compliance | Operating licenses and permits, industry registrations, GDPR or data-privacy documentation, AML/KYC policies where relevant, regulatory correspondence, ESG or sustainability disclosures | Establishes the company operates legally and is not carrying a compliance time bomb |
| IT and security | System architecture overview, security policies, penetration test results, SOC 2 or ISO 27001 reports, data processing agreements, incident history, disaster recovery plan | Tests whether the technology and data practices are sound and defensible |
| Litigation and disputes | Pending and threatened litigation, settled cases, demand letters, regulatory investigations, insurance policies and claims history, warranty and product-liability records | Quantifies legal risk and contingent liabilities that could follow the buyer |

That is the full universe. No single deal touches all of it at equal depth, which is the next thing to get right.

### How to read the table

Treat each row as a top-level folder. The middle column becomes your file list. The right column tells you what a reviewer is actually checking, so you can anticipate the follow-up questions and prepare answers before they are asked.

A few items earn disproportionate scrutiny. The cap table and IP assignments draw the most attention in venture and tech deals, because both are common places for ownership to be quietly broken. Customer concentration and material-contract change-of-control clauses draw the most attention in M&A, because both can erode the value a buyer is paying for.

## How the list changes by deal type

The biggest mistake founders make is treating every deal like an acquisition. It is not. The documentation a counterparty needs scales with how much money is at stake and how irreversible the decision is.

### Fundraising (seed to growth)

An investor is buying a minority stake in a future. They care about the team, the market, the metrics, and clean ownership. They rarely need exhaustive contract review or tax history.

A seed round typically needs: incorporation documents, the cap table, prior financing docs, the financial model, a short set of management accounts, and IP assignments. That is most of the corporate, financial, and IP rows, and little else. For the full stage-by-stage version, see the [data room checklist for fundraising](/blog/how-to-set-up-a-data-room-for-fundraising).

By Series B or C, investors dig deeper into financials, customer cohorts, key contracts, and HR. The list grows, but it is still narrower than an acquisition.

### M&A (selling the company)

An acquirer is buying the whole thing, liabilities included. They will inherit every contract, every tax position, and every lawsuit. So they want all ten categories, in depth.

This is where tax history, material-contract assignment clauses, litigation, regulatory licenses, and IT security all become load-bearing. The buyer's lawyers and accountants read everything. The U.S. [Securities and Exchange Commission](https://www.sec.gov/education/capitalraising/building-blocks/due-diligence) describes diligence as the process of confirming the facts behind an investment before money changes hands, and that is exactly what this documentation supports. Our [M&A data room guide](/blog/m-and-a-data-room-guide) breaks down what changes when you move from raising money to selling the company.

### Lending and debt

A lender is not buying equity. They are underwriting your ability to repay. Their focus narrows to anything that affects cash and collateral: financial statements, the debt schedule, bank statements, AR ageing, key contracts, and any existing security interests. Corporate and litigation records matter mainly as risk factors, not as the main event.

| Deal type | Documentation depth | Categories that dominate |
| --- | --- | --- |
| Seed / early venture | Light | Corporate, cap table, financial model, IP |
| Growth venture (Series B+) | Moderate | Financials, customers, contracts, HR, IP |
| M&A / acquisition | Full | All ten, with tax, contracts, litigation, IT security weighted heavily |
| Lending / debt | Targeted | Financials, debt schedule, contracts, collateral |

Right-sizing is not cutting corners. It is matching effort to the decision. A seed investor who asks for three years of transfer pricing documentation is wasting everyone's time, and a founder who hands an M&A buyer only a pitch deck is not ready to sell.

## How to organise due diligence documentation into a data room

A list is only useful once it lives somewhere a reviewer can navigate. That somewhere is a virtual data room: a permissioned space where every document sits in a clear folder and you can see exactly who opened what.

The structure is simple. Mirror the table.

- Create one numbered top-level folder per category, so order is intentional and stable.
- Add subfolders per line item where a category has many files.
- Name files consistently, with dates and version numbers where it helps.
- Keep one source of truth. Delete outdated drafts so no reviewer ever sees a stale number.
- Add a short index at the top of the room so reviewers know where to start.

For the exact tree, naming conventions, and a downloadable layout, follow the [data room folder structure guide](/blog/due-diligence-data-room-checklist). With Plox you can build the entire folder tree before uploading a single file, then drop documents in as they are ready. A room is live in minutes, and the share link never changes even as you update files inside it.

## How to control access to due diligence documents

Diligence paperwork is the most sensitive material a company ever shares. Customer names, salaries, source-code architecture, and litigation history all sit in one place. Access has to be a dial, not an on-off switch.

A modern data room gives you four controls that a shared drive cannot.

- NDA gating. Require a signed agreement before anyone opens the room. With [one-click NDA](/one-click-nda), a visitor accepts terms inline and you keep a timestamped record of every signature.
- Dynamic watermarking. Plox stamps each page with the viewer's email and the access time, applied per viewer on every page. A leaked screenshot points straight back to whoever leaked it. This is what [dynamic watermarking](/dynamic-watermarking) is built for.
- Per-folder permissions. On the Data Rooms plan you grant access folder by folder, so outside counsel sees contracts while a junior analyst sees only the summary. Sensitive rows like HR and litigation stay locked until the deal is serious.
- Audit trail. Page-by-page analytics show who opened each document, how long they spent on each page, and whether they finished. Real-time notifications tell you the moment a buyer opens the cap table.

That combination is what separates a real data room from a folder of files. You decide who sees the customer list, who sees the lawsuit, and who only sees the index. For a wider look at the security side, the [document control](/document-control) feature page covers passcodes, email verification, link expiry, and revocation.

## When a specialised platform makes sense

Plox is built for founders and dealmakers running fundraises and mid-market M&A. For most deals, it is faster, cleaner, and far cheaper than the legacy alternatives, and the free plan covers secure links, analytics, and real-time notifications with no time limit.

But be honest about scale. A multi-billion-dollar public-company merger, a regulated banking or insurance transaction, or a pharma deal with thousands of documents and dozens of bidder teams has needs that go beyond any general tool. These deals often require managed Q&A workflows, large-scale redaction, formal access reporting for regulators, and a dedicated project manager from the VDR vendor.

That is the home turf of enterprise VDRs like Datasite, Intralinks, and iDeals. They are quote-based and sales-gated, and they are genuinely good at the heavyweight, highly regulated end of the market. Ansarada, for instance, layers structured deal-readiness workflows on top of the room, which large sell-side advisors value. If your deal looks like that, talk to one of them. For everything from a seed raise to a mid-market acquisition, a tool like Plox is the right fit. Compare the options in our guide to the [best data room for due diligence](/blog/best-data-room-for-due-diligence).

## Common mistakes that slow diligence

- Dumping everything into one folder. Reviewers should never have to hunt. Structure signals quality.
- Leaving stale drafts in the room. Two versions of the model with different numbers is a red flag.
- Over-sharing too early. Do not expose customer names and salaries before an NDA is signed and the deal is real.
- Under-preparing IP assignments. A single missing founder or contractor assignment can stall a venture round or kill an acquisition.
- Ignoring change-of-control clauses. In M&A, a key contract that terminates on a sale can reprice the entire deal.

A clean room does not just speed the process. It tells the other side you run an organised company, which is the cheapest leverage you will ever get.

## Put your due diligence documentation in Plox

You can stand up your room today. Build the folder tree from the table above, gate it with an NDA, watermark every page, set per-folder permissions, and share one secure link that shows you exactly what each reviewer reads.

Start free, with secure links and full analytics on every plan, and add data rooms when the deal gets real. See the [data rooms](/data-rooms) and [due diligence](/solutions/due-diligence) pages, or open your first room and start uploading.

## Frequently asked questions

### What documents are needed for due diligence?

At a minimum: incorporation documents, the cap table, financial statements and model, key customer and supplier contracts, IP assignments, employment agreements, tax filings, regulatory licenses, and any litigation history. The exact set depends on whether you are raising money, selling the company, or borrowing.

### What is the difference between due diligence documentation for fundraising and M&A?

Fundraising focuses on team, market, metrics, and clean ownership, so the list is lighter and weighted toward corporate, financial, and IP documents. M&A covers all ten categories in depth because the buyer inherits every liability, with tax, contracts, litigation, and IT security becoming far more important.

### How do I organise due diligence documents?

Mirror the category list with one numbered folder per category and subfolders per line item. Name files consistently, keep a single source of truth, and add a short index so reviewers know where to start. A data room lets you build this once and reuse it.

### Do I need an NDA before sharing due diligence paperwork?

For most fundraising and M&A processes, yes. An NDA protects confidential information and creates a record of who agreed to terms. Plox supports inline one-click NDA acceptance before anyone can open the room, so the agreement is signed before any document loads.

### How much of the due diligence document list does a seed round actually need?

A small fraction. A seed raise usually needs incorporation documents, the cap table, prior financing docs, a financial model, light management accounts, and IP assignments. Exhaustive tax, contract, and litigation review belongs to later-stage and M&A deals, not a first round.

### Can a free tool handle due diligence documentation?

For a seed or early-stage raise, yes. Plox's free plan covers secure trackable links, page-by-page analytics, and real-time notifications with no time limit, which is enough to share a lean diligence set. Full data rooms with per-folder permissions and watermarking sit on the paid Data Rooms plan, with a 14-day trial.