Data rooms for Indian startups

The documents overlap heavily with any Western raise. Four things do not:

1. A statutory filing layer that is diligenced directly. ROC filings, FEMA/FDI compliance, statutory dues. These are closing conditions, not paperwork.
2. A data-protection law that applies to the room itself. The DPDP Act, 2023 governs the personal data inside the documents you are sharing.
3. SEBI-registered AIFs as the investor base. Domestic funds have their own compliance obligations, which shape what they must collect from you.
4. Data residency as a question that gets asked. Where the room itself is hosted is a diligence item for some investors, not a vendor detail.

A generic checklist will not mention these, and all four are routine here:

• ROC filing history. Annual returns, AOC-4, MGT-7. Late filings carry penalties and tell an investor how the company is administered.
• FEMA and FDI. Any foreign money brings FC-GPR filings, valuation certificates and sectoral-cap analysis. Missing filings genuinely delay closing.
• Statutory dues. GST, TDS, PF, ESI. Current, with no open demands. An unresolved demand becomes an indemnity negotiation.
• Related-party transactions. Anything involving founders, relatives, or entities they control. Disclose these yourself.

The full document list is in the investor data room checklist, which marks these four explicitly.

This is the one most founders have not considered. The Digital Personal Data Protection Act, 2023 governs personal data about identifiable people. Customers, employees, users. Putting a document containing it in front of an investor is processing, and processing needs a lawful basis.

You are the Data Fiduciary. The obligation is yours and cannot be delegated to a vendor. The usual practical answer is simple: share aggregates, not rows. An investor wants retention curves and concentration, and none of that requires a real name.

Covered properly in DPDP and your investor data room, with how XDrop AI maps to the Act on the DPDP page.

Some Indian investors, and more of their counsel, now ask where the data room is hosted. The reasons are a mix of DPDP cross-border provisions, sectoral rules for regulated customers, and a preference for keeping a dispute in a forum they understand.

XDrop AI runs on cloud hosting and object storage located in India (Mumbai). Cross-border processing, and every sub-processor with its location and purpose, is published in the Privacy Policy. Published rather than supplied on request, because the question gets asked and the answer should not require an email thread.

• Counsel is involved earlier. Expect a structured legal diligence request sooner than a US process would produce one.
• Compliance history carries real weight. A company with clean filings and no open dues is materially easier to invest in, and it shows in how fast terms move.
• The register is reconciled. Resolutions are checked against certificates actually issued. The gap between them is the single most common cause of a stalled first institutional round.
• Founder vesting is scrutinised. Partly because a departure leaving dead equity is harder to unwind here.

1. Build the room before the first call. Five folders; see the checklist.
2. Fix the IP assignments and the register reconciliation now, not during diligence.
3. Aggregate anything containing personal data before it goes in.
4. Grant per person, lowest useful level; raise it as conversations advance.
5. Answer in the room rather than by email, so there is one record of what was said.
6. Revoke when a conversation ends.

• What is an AI data room, the definitional piece
• What goes in an investor data room, the document list
• Seed vs Series A. How the room changes by stage
• What investors ask during diligence, and which document answers it
• Sharing a cap table. Fully diluted, and the stale-copy problem
• Should investors sign an NDA, usually not, and when they will
• Who should see what, the role ladder as a judgement
• Can you just use Google Drive, often yes, until four specific points
• Can you trust an AI with your data room, the four failure modes
• DPDP and your investor data room. What the Act requires of you

A practical summary, not legal advice. Indian company, exchange-control and data-protection obligations depend on your specific facts; take advice on your own situation.