Verify the investor and deal authorization
Encryption does not prove that the recipient is the correct investor, authorized for the current deal stage or using an approved device. Confirm identity and authorization through the data-room system, minimize the package and send any secret through a separate authenticated channel.
An investor participant changes during diligence. Startup Operations pauses the handoff, verifies the new investor identity and deal access, revokes the old link, prepares the current draft only and records receipt by the newly authorized recipient.
Run the control in five steps
- 01Verify investor identity, assignment and continuing authorization.
- 02Confirm the exact startup and draft version to be shared.
- 03Use an approved destination and protected transfer method.
- 04Separate the secret or recovery material from the file channel.
- 05Record receipt, expiry, revocation and final return.
Preserve an accountable decision trail
Keep recipient, authorization source, company/deal ID, version, destination, authorization time, transfer and secret channels, receipt, expiry, revocation and exception.
Stop and investigate when
- A forwarded message becomes the authorization record.
- The password travels with the attachment.
- An old investor retains access after reassignment.
State what the control does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Validate investor authorization, provider permissions, plaintext copies, retention and recovery separately.
Startup due diligence security questions
Does file encryption replace data-room platform permissions?
No. Manage identities, roles and provider permissions separately.
Can a shared investor mailbox receive drafts?
Only if policy explicitly authorizes it and individual accountability is preserved.
Sources for this decision
Links support specific control decisions and do not imply endorsement.