No statute tells you how to run a data room. The control is entirely in the sequence: what a stranger sees before they sign anything, what they see after, and what they never see until the deal is real.
Key takeaways
STEP 01 OF 10
Build the room around categories, not chronology: corporate/governance (minute book, share register), financial (statements reconciled to filings), commercial (material contracts, customer and supplier concentration), HR and payroll, intellectual property, real property and leases, litigation and compliance, and tax. Deavo’s own description of a deal report lists a near-identical set: historical and interim financials matched to CRA and GST/HST filings, a normalized earnings summary, an asset list with condition and attached liens, lease and key-contract detail including change-of-control clauses, customer concentration, employee information, and outstanding liabilities or compliance matters.
As a floor for what should already exist, the Income Tax Act requires books and records to be kept, together with every supporting voucher, until six years from the end of the last taxation year to which they relate (ITA s. 230(4)(b)) — if a folder cannot be assembled to that standard, that gap is itself a diligence finding a buyer will make on their own.
STEP 02 OF 10
The sequence that works: an anonymous teaser with no name or address attached, then a signed NDA, then the room itself. Deavo’s own buyer flow follows exactly this shape — browse or search, sign the NDA in one click, then the seller releases the business name, financials and documents together into a deal room. On the seller side, the same platform frames it as releasing on your own terms after seeing the buyer’s budget, funding and experience — the seller, not the platform, decides when a given buyer moves from tier to tier.
A treadstonelaw guide to selling an Ontario business opens its own sequence with the same order: prepare records and get a valuation, then secure confidentiality from prospects before anything sensitive is shared, and only then move to a letter of intent.
STEP 03 OF 10
A usable NDA does more than say “keep this quiet.” Deavo’s standard form defines confidential information broadly — legal and operating names, exact address, financial statements, tax records, customer, supplier and employee information, lease and contract terms, the CIM, the contents of the deal room, and the fact that the business is for sale — with carve-outs only for information already public, lawfully known beforehand, or required by law with prompt notice. Ontario practice treats the agreement the same way: a treadstonelaw guide on business-sale confidentiality frames it as one of the first legal issues in any Ontario business sale, because a leak can cost more than a lost buyer.
The term matters as much as the coverage. Deavo’s form runs “two years, and for trade secrets, for as long as they remain trade secrets,” with injunctive relief available because damages alone may not repair the harm — build the same asymmetry into any NDA you draft yourself.
STEP 04 OF 10
The clause most sellers forget to police: no contacting employees, customers, suppliers or the landlord without prior written consent, and no using the released information to solicit any of them. This is a standard NDA term, not an unusual ask — a buyer who cold-calls a key customer “just to check” during diligence has typically breached the agreement, whether or not anything commercially sensitive was said.
Enforce it by controlling access at the source: route every request through one person on the seller’s side, and make plain in the NDA itself which specific communications require consent before they happen, not after.
STEP 05 OF 10
Deavo’s own list of what sinks a sale price starts with financial hygiene: personal expenses run through the business, cash sales that do not reconcile against GST/HST filings, and books that are not up to date top the list, alongside starting the process too late to have finished prior-year statements ready. Its 90-day framework puts the same task first in sequence: reconcile the current and prior year, match figures against GST/HST and CRA filings, and list assets including anything under lease or financing before anything else.
A buyer’s own financial diligence, per treadstonelaw’s split of the work, runs through historical statement reliability, cash-flow and profitability trends, working capital, receivables and payables aging, tax compliance, and inventory valuation — build the folder to survive exactly that review, because it is coming regardless of how the room is organized.
STEP 06 OF 10
Buyers price owner-dependence whether or not a seller documents it, so document it on your own terms. Deavo names five concrete signals: sales handled personally by the owner, key relationships that exist only through the owner with no one else on staff who has met the client, no documented processes, no second-in-command, and licensing or reputation tied to the individual rather than the business. A folder that shows cross-training in progress, written procedures, and a named second point of contact for major accounts answers the objection before a buyer raises it.
STEP 07 OF 10
Employee records tell a buyer’s counsel exactly what notice and severance exposure comes with the business, because employment standards continuity rules attribute a seller’s tenure to the buyer the moment an employee stays on. Build this folder with the reader in mind: length of service by employee, any existing employment agreements, and current compensation and benefits, matched against what a buyer’s counsel will actually test against them.
STEP 08 OF 10
At minimum: the minute book, the share register, any unanimous shareholder agreement, and corporate filing history. If a USA exists, its terms bind a purchaser of the shares automatically — CBCA s. 146(3) deems a purchaser or transferee of shares subject to a unanimous shareholder agreement to be a party to it, and s. 146(4) gives that purchaser 30 days to rescind if they were not given notice of it before buying. An incomplete corporate folder is not just an inconvenience — it can hand the buyer a rescission right they would not otherwise have had, which is a reason to get this folder right rather than fast. See the full legal-diligence checklist for the standard this folder needs to meet.
STEP 09 OF 10
A deal-room platform’s access log is the practical version of the paper trail a lawyer would otherwise build by hand: who requested access, what was released to them, and when. That record has value beyond the sale — a seller who can show precisely what was disclosed and on what date has a materially stronger position if a buyer later claims something was not disclosed. Route every release through one gatekeeper and log it, whether the room is a folder structure or a dedicated platform.
STEP 10 OF 10
Decide up front what happens if the deal falls through. Deavo’s NDA term requires return or destruction of released material on request, with one narrow exception — an archival copy the recipient’s own professional advisors may retain where required by law or professional standards. If the deal does close, decide who keeps the permanent copy that will support the disclosure schedules in the definitive purchase agreement, because the data room does not simply disappear at signing — it becomes part of the record the representations and warranties are measured against.
Suppose a hypothetical seller runs a teaser to 60 prospective buyers — a scenario for arithmetic only, not a market benchmark, since no Canadian source publishes a typical funnel-conversion rate for private business sales. Of those 60, 18 sign the NDA and move to the CIM tier (a 30% conversion). Of those 18, 6 are admitted into the full deal room after the seller reviews their stated budget and financing (33% of the NDA tier). Of those 6, 2 submit a letter of intent (33% of the room tier). The arithmetic that matters is not the ratios themselves — they will differ for every business — but the fact that each tier is a genuine filter: the seller is doing less work per prospect at each successive stage, and disclosing more only to buyers who have already shown they are serious.
This is also why the tiers should not be collapsed to save time. A seller who releases full financials to all 60 teaser recipients has traded a manageable NDA-enforcement problem across 18 counterparties for an unmanageable one across 60, most of whom were never going to make an offer.
Two models exist for the very first disclosure, and they differ on when the business’s identity is revealed. A blind-listing platform keeps the business name and exact address unpublished by default until a buyer clears an NDA. An intermediary working a curated list may instead name the target directly to a small number of pre-vetted buyers before any signature, trading broader confidentiality for a faster, narrower approach to people the intermediary already trusts.
Neither approach is wrong, but they carry different risk: a blind listing protects against a broad leak at the cost of screening every inbound NDA request; a named, narrow approach concentrates the confidentiality risk on fewer people the intermediary vouches for. Decide which trade-off fits before the first document goes out — see choosing and briefing an intermediary for how that choice interacts with who runs the process.
No. Nothing in the Canada Business Corporations Act, the Excise Tax Act or provincial employment standards legislation requires a data room. It exists because staged, controlled disclosure protects the seller — the requirement is practical, not statutory.
Either can work; what matters is that one party owns the gatekeeping decision at each tier. A platform automates the NDA-and-release mechanics; a lawyer typically curates what goes into each folder and reviews disclosure-schedule implications — many sellers use both, with the lawyer controlling content and the platform controlling access.
Not automatically. A letter of intent’s diligence period is a negotiated term, not a statutory one — see preparing the marketing documents for a sale for how the LOI stage sets that clock, and confirm any extension in writing rather than assuming it.
Under a standard NDA the recipient must return or destroy released material on request, with a narrow allowance for one archival copy their own professional advisors may keep where law or professional standards require it. Confirm this term explicitly rather than assuming it — not every NDA is drafted the same way.
A 30-minute call is enough to tell you whether AI pays for itself here.
Nobody publishes Canadian transaction data, so every valuation in this country quotes an American benchmark. We are building the Canadian one — multiples, asking-to-sale spreads and days on market, by sector and by city. Leave an email and you will see it first.
No pitch, no listings. One email when the first report lands.
