Due diligence is the part of fundraising where the investor stops listening to your story and starts reading your paperwork. Everything up to that point — the pitch, the partner meeting, the term sheet — is a hypothesis. Diligence is where they test it. And the test is not "is this company good." The test is "did these founders run a tight enough ship that wiring two million dollars won't surface a surprise in month four." Those are different questions, and founders who prepare for the first one and not the second learn the difference at the worst possible moment.
Here's the timeline, because nobody lays it out plainly. You sign a term sheet. The clock starts. Diligence typically runs two to four weeks for a Series A — sometimes faster at seed, sometimes slower if your paper is a mess — and it all has to finish before closing, because no fund wires money against documents it hasn't read. During those weeks the investor's counsel, and often an analyst or two, will work through a request list that covers your corporate records, your financials, your IP, your people, your contracts, your litigation exposure, and your regulatory posture. Every day the process drags is a day your runway shrinks and your leverage leaks out through the floorboards. Remember the no-shop clause you signed? It's running the whole time. So speed is not a courtesy to the investor. Speed is self-defense.
The founders who close in two weeks are not smarter than the founders who close in six. They just built the data room before anyone asked for it. This guide is the checklist I wish I'd had, organized the way the request lists actually arrive. It's long. Skim it now, bookmark it, and come back section by section as you build.
Corporate Documents: The Skeleton of the Deal
Corporate diligence comes first because everything else hangs off it. If the company itself isn't properly formed and properly documented, nothing downstream matters. The request list will ask for, at minimum: your certificate of incorporation (the charter) with every amendment ever filed, your bylaws, your stock ledger, a fully diluted capitalization table, every stock purchase agreement and SAFE and convertible note ever signed, all board meeting minutes and written consents, and your equity incentive plan with every grant made under it.
Let's take them one at a time, because each has a failure mode I've watched in the wild. The charter seems boring until counsel finds that your 2019 amendment increasing authorized shares was approved by the board but never properly filed with Delaware, which means half your later issuances sit on a foundation that technically doesn't exist. Fixable, but now you're paying Delaware counsel to paper a ratification while your term sheet ages. The bylaws get skimmed, mostly, but they're checked against how you actually governed — if your bylaws require annual stockholder meetings and you've never held one, expect written consents to be drafted retroactively.
The stock ledger is where deals get quiet. The ledger is the authoritative record of who owns what — not your cap table spreadsheet, not Carta, the ledger. Every issuance should trace to a board approval, a signed agreement, and consideration actually paid. I've sat in a diligence call where an associate read off three issuances that had agreements but no board consent in the minutes. The founders had to reconstruct approvals for stock issued two years earlier. Nobody accused anyone of bad faith. But the investor's mental model of the team shifted from "sharp operators" to "people we'll need to watch," and that shift shows up later, in the protective provisions they insist on.
And the cap table. Oh, the cap table. It must reconcile perfectly: ledger to agreements to option grants to your spreadsheet, down to the share. If your spreadsheet says 10,000,000 shares outstanding and the sum of signed agreements says 10,007,500, diligence stops until the 7,500 are explained. Model the fully diluted picture too — every option, every SAFE at its cap, every warrant. Investors don't just want to know what exists today; they want to know what exists the second after their check converts everything. A cap table that can't answer that question in one view tells them you don't know what you own. Our SAFE guide has the conversion math if the SAFE rows are the ones scaring you.
Board minutes and the stock plan round it out. Minutes don't need to be literary — they need to exist, cover every material decision (option grants, financings, executive hires, big contracts, any related-party anything), and be signed. If you've been running on unanimous written consents instead of meetings, that's fine and common, but the consents have to be collected and complete. The stock plan file needs the plan document itself, board and stockholder approval of the plan, and every individual grant agreement with its vesting schedule. A grant that was promised in an offer letter but never approved by the board is, in the eyes of counsel, an unissued promise hanging over the cap table. Close those gaps before the request list finds them.
Financials: Numbers That Survive a Second Reader
Financial diligence for a Series A is not an audit, but it borrows the audit's posture: trust nothing that can't be tied to a source document. The baseline ask is historical financial statements — income statement, balance sheet, cash flow — for every period since inception. Audited statements if you have them, and most pre-A companies don't, which is fine; CPA-reviewed or even clean, internally consistent books are acceptable at this stage. What's not acceptable is a gap between your bookkeeping and the numbers you pitched. If the deck said $110K MRR and QuickBooks says $96K, you will spend a painful afternoon explaining the $14K, and every other number you ever said out loud gets discounted by association.
Projections come next: a three-year model with the assumptions visible. Investors know your year-three revenue is fiction. That's not the point. The point is whether the model reveals how you think — whether headcount drives costs, whether your revenue build matches your pipeline math, whether you've ever connected the two. A model where revenue triples while support headcount stays flat tells them the spreadsheet was decorated, not built. Burn rate and runway get checked against actual bank statements, so have those ready, and make sure the runway you've been quoting matches the runway the statements imply. "Eighteen months of runway" is a sentence that dissolves the moment someone divides cash on hand by the trailing three-month average net burn.
Two more financial items quietly matter. Accounts receivable aging, if you invoice: big old receivables from your two biggest customers suggest the revenue is softer than the P&L claims. And any debt — venture debt, credit lines, a note from your uncle — needs full documentation, because lenders' liens and covenants can rank ahead of the new investor's money, and nobody likes discovering a lien in week three. Disclose it all up front. The only thing worse than a liability is a liability that reads like a secret.
Intellectual Property: Prove the Company Owns the Company
IP diligence answers one question: does the company actually own the thing it's selling? The first document class is invention assignment agreements — a signed PIIA (proprietary information and invention assignment agreement) from every founder, every employee, every contractor, every advisor who ever touched the product. Every one. The classic failure is the departed co-founder who wrote the original prototype in month one, left in month eight, and never signed. His equity vested partially; his IP assignment never existed. Investors will require that signature before closing, and now you're negotiating with someone who has no reason to hurry and every reason to ask for a check. I've seen that check clear five figures. I've heard of six.
Patents and trademarks are simpler but slower to fix. If you've filed patents, produce the filings, office actions, and the assignment paperwork showing the inventors assigned to the company — a patent filed in the founder's name instead of the company's is a fixable mess, but it's a mess on the clock. Trademarks: your registrations or applications for the company name and product names, in the company's name. And then the part engineers skip: the open-source inventory. List every OSS dependency in your product with its license type. MIT and Apache are fine. But a GPL-licensed library statically linked into your core commercial product can, in the strict reading, create an obligation to open-source your own code — and "GPL contamination" is one of the phrases that makes venture counsel put down their pens and start a different conversation. Run a scan with a tool like FOSSA or Black Duck before diligence does it for you, and remediate what's flagged.
Finally, third-party claims. If anyone — a former employer of a founder, a vendor, a random patent entity — has ever asserted that your product or code belongs to them, that claim gets disclosed with its full history. The founder who built v1 while employed at a bigger company will be asked what his employment agreement said about inventions. Have the answer and the document. IP diligence kills more deals than any other category except bad financials, and it kills them quietly, in a memo you never see.
HR and Employment: People Paper With Teeth
Employment diligence is about two exposures: wage-and-hour liability and equity surprises. The document set is employment agreements or at-will offer letters for everyone, the employee handbook if you have one, benefit plan documents (401(k), health plans, any equity refresh programs), and — this is the one founders forget — your 409A valuations. Every option grant priced off a stale or missing 409A is a potential tax disaster for your employees and a diligence finding for you. Get a 409A done before you grant options, refresh it every twelve months or after any material event like a new round, and keep every report in the data room. A current 409A costs a few thousand dollars. A cheap one done wrong costs more than not having one.
Misclassification is the trap that scales with you. That "contractor" who works forty hours a week, uses your laptop, reports to your VP of Engineering, and has been with you for two years is, in the eyes of California and the IRS, an employee — with back taxes, benefits exposure, and penalties attached. Diligence will ask for a list of every contractor, what they do, and how they're paid. If the honest answer is "they're employees we didn't want to put on payroll," fix it before a fund's counsel finds it, because the fix they require will be on their terms and priced into the deal. The same file should include any severance agreements, any change-of-control promises made in offer letters, and any visa sponsorships. An offer letter that quietly promises a departing VP six months of severance is a liability your investor is buying whether you mention it or not — so mention it.
Commercial: Revenue That Can Defend Itself
Commercial diligence is where the pitch deck meets paper. Every customer contract gets read — not by you, by an analyst building a spreadsheet. What they're extracting: contract value, term, renewal and termination rights, whether there are side letters changing the standard terms, exclusivity clauses, most-favored-nation clauses, change-of-control provisions that let a customer walk if you're acquired, and liability caps. That generous unlimited-liability clause you gave your first enterprise customer to close the deal? It's in the spreadsheet now, next to a note about your insurance limits.
The metrics file matters as much as the contracts. MRR or ARR broken out by cohort — the customers who joined in each month or quarter, and what happened to their revenue afterward — is the single most informative table you can hand an investor, because it shows retention instead of claiming it. Churn gets computed from this, so don't present a churn number the cohort data contradicts. Top-ten customer concentration is next: what share of revenue sits in your biggest accounts. If customer number one is 35% of ARR, expect questions about that contract's renewal date, termination rights, and your relationship with whoever signs it. Concentration isn't fatal — plenty of Series A companies are concentrated — but concentration plus a weak contract plus a renewal window before closing is a real problem, so know your exposure cold.
And the pipeline. Yes, they'll want it: stage-by-stage, with conversion rates and time-in-stage. The pipeline isn't checked for optimism — everyone expects optimism — it's checked for coherence. If you claim a 25% close rate from demo but the historical data says 9%, the discount they apply won't stop at the pipeline. Present the real funnel with the real conversion math. A fund would rather underwrite an honest 9% with a plan than discover the 9% themselves and re-underwrite everything else you said.
Litigation and Regulatory: The Confession Booth
Every request list has the litigation question, and the answer founders want to give is "none." If that's true, wonderful — say so in writing. If it's not true, disclose everything, including the frivolous stuff. A demand letter from a former contractor, a threatened wage claim, a patent troll's fishing expedition — disclose each with a one-paragraph summary, current status, and your counsel's opinion on exposure. The finding itself rarely kills a deal. What kills deals is the investor finding it first, because now the question isn't the lawsuit, it's what else didn't make the list. Undisclosed litigation discovered in week three reads as either dishonesty or chaos, and both are priced.
Regulatory diligence depends entirely on your sector, so map yours honestly. Health tech touching diagnosis or treatment means FDA questions — is your product a device, does it need clearance, and what have you been telling customers it does. Anything radio-emitting means FCC equipment authorization. Fintech means a thicket — state money transmitter licenses, and FINRA or SEC questions if you're anywhere near securities. If you handle European users' data, GDPR compliance gets a worksheet: your lawful basis, your data processing agreements, your deletion procedures. And SOC 2 has become table stakes for B2B SaaS selling to enterprises — if your customers' security reviews already required it, produce the report; if you're mid-audit, produce the engagement letter. The mistake is treating regulatory as "we'll deal with it later." Later is now. An investor pricing regulatory risk they can't see will price it at the worst case, so give them the documents that let them price the real case.
The Data Room: Ten Folders, Zero Mysteries
Organization is a signal all by itself. A data room that opens cleanly, with every file named and dated, tells the investor's team that the rest of the company probably runs the same way. The standard structure is ten top-level folders, and you should set them up before you need them:
- Corporate — charter and amendments, bylaws, board minutes and consents, stockholder consents, good standings, foreign qualifications.
- Financings — every prior round's documents: SAFEs, notes, purchase agreements, side letters, and the ledger and cap table, current to the day.
- Financial — historical statements, the three-year model with assumptions, bank statements, AR aging, debt documents, tax returns.
- IP — all signed invention assignment agreements, patent and trademark filings and assignments, the OSS inventory with license types, any inbound licenses.
- HR — offer letters and employment agreements, contractor agreements, 409A valuations, benefit plan documents, the employee census with titles and compensation.
- Commercial — customer contracts, the cohort MRR/ARR table, churn analysis, concentration summary, pipeline export, standard paper (MSA, DPA, SLA).
- Regulatory — licenses, filings, SOC 2 reports, privacy policy history, anything sector-specific from FDA to FINRA.
- Litigation — disclosures, demand letters, settlement agreements, counsel summaries — or a one-line memo stating there are none.
- Real Estate — office leases, amendments, estoppels if your landlord ever provided them. Even a WeWork membership agreement goes here.
- Misc — insurance policies, press that matters, key advisor agreements, and anything that doesn't fit elsewhere but someone will ask for.
Name files like a person who expects a stranger to read them: 2023-06-15 Board Consent Series Seed.pdf, not final_v2_USE_THIS.pdf. Watermark-sensitive documents if your tooling supports it. And when a request comes in for something that doesn't exist — say, board minutes for a decision you made over email — don't fabricate retroactively-dated paper. Draft a ratifying consent, date it honestly, and note the gap. Counsel sees reconstructed minutes constantly, and honest ratification reads as cleanup; backdating reads as fraud.
Red Flags That Actually Kill Deals
Most diligence findings cost you time or a few points of price. A short list of them kill the deal outright, and you should know the list before you're on it. The first is the missing invention assignment from a co-founder or early engineer who left on bad terms — not because it can't be fixed, but because the fix requires cooperation from someone holding leverage over your closing date, and funds have watched that movie end badly. The second is outstanding litigation with a customer. A lawsuit from a vendor is survivable; a lawsuit from the people who pay you calls the revenue itself into question, and no model survives that question.
Third: GPL or similarly copylefted code in the core commercial product with no remediation plan. It's not that the license is fatal — it's that fixing it may mean re-architecting the thing the investor just agreed to buy, and nobody underwrites a rewrite. Fourth: more than twenty percent of revenue from a single customer who has no signed contract — a handshake relationship carrying a fifth of your ARR isn't revenue, it's hope with an invoice. And fifth, the quiet killer: a material adverse change in the last ninety days that you didn't volunteer. The churn spike in the month you signed the term sheet. The VP who quit last week. If it would change the price and they find it themselves, the deal is dead and your reputation in a small industry walks out with it. Disclose early, frame it, and keep the deal alive on honest terms — or lose it on discovered ones.
Prepare Early: The Data Room Is a Habit, Not a Project
Here's the whole strategy in one sentence: start the data room at your seed round and never let it get stale. The ten-folder structure costs you an afternoon to set up the day you incorporate. After that, the maintenance is mechanical — every board meeting, drop the minutes in folder one; every grant, the paperwork goes in folder five; every signed customer contract, folder six; every month, refresh the financials. Thirty minutes a month, maybe less. Then the term sheet arrives and your "data room preparation" consists of sending a link. While the other founders in the fund's pipeline are spending three panicked weeks scanning documents, you're answering questions, and the process that takes them six weeks takes you ten days.
Tooling matters less than the habit. At seed, a well-organized Google Drive or Dropbox folder with view-only sharing is completely adequate — investors at that stage expect it. By Series A, graduate to a real virtual data room: DocSend for lighter processes, or a proper VDR like Intralinks or Firmex when the request list runs to hundreds of items and you need per-document permissions, watermarking, and an audit trail of who read what. The audit trail is quietly useful — knowing that the fund's counsel spent four hours in your IP folder on Tuesday tells you where their concern lives before they say it out loud. Whatever the tool, version control everything: when the model updates, the old one leaves the room. Two versions of the financial model in one folder is how you spend a Thursday explaining which numbers are real.
So the checklist is long, but the posture is short. Paper the company as you build it, file everything the day it happens, disclose before you're asked, and run your own diligence on yourself every quarter — pull a random folder and try to find the three documents a stranger would want. If you can find them in five minutes, a fund's analyst can find them in five minutes, and diligence becomes what it should be: a fast confirmation of a company that was always under control. The founders who get re-traded in week four are the ones who treated the paperwork as homework. Treat it as part of the product. It decides who owns the product.