What goes in an investor data room

Five folders: Corporate, Financials, Cap table, Legal & contracts, Team. A sixth, Product & traction, if you have metrics worth showing.

Most rounds die of slowness, not of a missing document. A room assembled before the first call turns diligence from weeks of email into days of reading.

• Certificate of Incorporation and the CIN
• Memorandum and Articles of Association, with every amendment
• Board and shareholder resolutions. Especially any authorising this round
• Statutory registers: members, directors, charges
• Prior-round documents: SHA, SSA, and any side letters
• PAN, TAN, GST registration

The one founders forget: the share certificates actually issued, not just the resolutions authorising them. Counsel reconciles the register against the certificates, and a gap there stalls the round while it is traced.

• Audited financials for every completed year
• Management accounts to the most recent closed month
• Monthly P&L, burn and runway, ideally one workbook, not twelve
• Bank statements for the last 12 months
• GST returns and TDS filings
• Your financial model, with assumptions visible rather than hard-coded

Investors reconcile your model against your bank statements. If the two disagree, explain why in the room, an unexplained gap reads as either sloppiness or concealment, and you do not get to choose which.

• Current cap table, fully diluted
• ESOP pool: size, grants issued, vesting schedules, the scheme document
• Convertibles (CCPS, CCDs, SAFEs) with conversion mechanics spelled out
• Founder vesting and any reverse-vesting terms

Fully diluted, not issued-only. An investor computing their post-money stake from an issued-only table arrives at the wrong number, discovers it later, and reopens terms at the worst moment. More on the mechanics in sharing a cap table safely.

• Customer contracts, at least the largest by revenue
• Supplier and vendor agreements with real commitments
• Property leases
• IP: trademark and patent filings, and assignments from founders and contractors
• Any litigation, notices or disputes, including ones you consider trivial
• Licences specific to your sector

IP assignment is the one that bites. If a founder or an early contractor wrote code before any assignment was signed, the company may not own it. This is found in nearly every first institutional round and is far cheaper to fix before diligence than during it.

• Founder employment agreements
• Key-employee contracts and any non-competes
• Headcount by function, with cost
• PF and ESI registration and current compliance status
• Contractor agreements, with IP assignment clauses present

Most checklists online are written for US companies. These four are routine here and absent there:

1. FEMA and FDI compliance. If you have taken foreign money or intend to, expect FC-GPR filings, valuation certificates and sectoral-cap analysis. Missing filings are a real closing condition, not a formality.
2. ROC filing history. Annual returns, AOC-4, MGT-7. Late filings carry penalties and signal how the company is run.
3. Statutory dues status. GST, TDS, PF, ESI. Current, with no outstanding demands. An unresolved demand becomes an indemnity negotiation.
4. Related-party transactions. Anything involving founders, relatives or entities they control. Disclose these yourself; they will be found, and finding them undisclosed costs more than the transaction ever did.

Flat folders, numbered, one level of nesting at most. Diligence is done by associates under time pressure; a room they can navigate without asking you is a room that moves fast.

Name files so the name alone identifies them:2026-03_Audited_Financials.pdfnot final_v3.pdf. Every question you answer by email instead of by document is a question answered outside the room, with no record of what was represented to whom.

XDrop AI scaffolds this folder structure when you create a boardroom, so the skeleton exists before you start filling it.

A data room is not an archive. Four things to keep out until a specific, named person needs them:

• Customer personal data. Your users did not consent to being shown to investors. Under the DPDP Act this is a processing purpose you almost certainly have no basis for. See DPDP and your investor data room. Share aggregates, not rows.
• Employee salary detail by name. Share bands by function.
• Other investors’ term sheets. Usually confidential, and showing them tells the reader what you will do with theirs.
• Anything you have not read. You will be asked about it.