Vault IndexFundamentals
What a data room actually buys you over a shared drive
Sharing a folder is not the same as controlling a document. Here is the short list of things a room does that a drive link cannot.
Vault Index desk / 28 August 2026 / 7 min read
The question behind the question
Almost nobody sets out to buy a data room. They set out to send twelve files to a buyer, an investor or a lender without losing control of them, and they only start comparing platforms after a drive link has spread further than intended. So it is worth being blunt about what the category is for.
A shared drive answers one question: where does this file live. A room answers four more: who is allowed to see it, what did they actually look at, can I prove it later, and can I take it back. Those four are the whole product. Everything else, from branding to folder templates, is convenience.
Access is a decision, not a link
In a room, access is granted to a person rather than to anyone holding a URL. That usually means a one time code sent to a verified email address, sometimes an extra passcode, and often an agreement the viewer has to accept before the first page renders. The practical effect is that a forwarded link is worthless to the person it was forwarded to.
Of the platforms in our index, the ones aimed at auctions go further and separate bidders so that two competing buyer teams cannot see each other in the Q&A thread. If you are running a competitive process, that separation matters more than storage volume.
Analytics are evidence, not vanity
Page level analytics get sold as a dopamine feature for founders watching investors read a deck. The serious use is different. When a deal turns sour and somebody claims they were never shown the pending litigation note, the log that shows the file was opened, by which verified viewer, for how long and on which page, is the difference between an argument and a fact.
Read the numbers carefully, though. A raw visit count includes bots, previews and your own team. Only a verified viewer figure tells you a named human looked at the document.
Revocation, watermarks and the honest limits
Two controls do most of the real work. Revocation closes a link so the next attempt to open it fails, which is the only meaningful answer to a document sent to the wrong person. Per viewer watermarking stamps the recipient's identity across every page, which does not stop a leak but makes an anonymous one much harder.
Be honest about the ceiling. Nothing prevents a determined viewer photographing a screen. Screenshot deterrence, disabled downloads and dynamic watermarks raise the effort and attach a name to the copy. That is deterrence, and deterrence is worth buying. Prevention is not on sale from anyone, at any price.
How to test a platform in twenty minutes
Upload one dull document. Send it to a personal address you control. Check whether you had to verify the email, whether the watermark carries that address, whether the log names the viewer rather than an IP, and whether revoking the link actually breaks it on the next open. Then look for the export button on the audit trail.
Platforms that pass that test in twenty minutes are usually the ones that publish their prices too. The correlation is not an accident.
Sources and further reading
- 99 Data Rooms, data room versus shared drive
- 99 Data Rooms, what document watermarking cannot do
- Datasite, Diligence product documentation
Vendor figures rechecked 1 September 2026