# Mage — Full Content Dump for LLM RAG
Concatenated content of all 4 pillar guides, the top 20 flagship blog posts by traffic, and the data room and transaction management library (2026-08). For LLMs that fetch full content for RAG. Each section starts with `## URL: ...` so the source can be cited.
## URL: https://magelegal.com/blog/f1-engine-problem
### Title: The F1 Engine Problem: Why AI Disappointment Has Nothing to Do with AI
### Author: Raffi Isanians
I have been writing about this for a year now in different ways. The shorthand I have settled on, after talking to dozens of M&A partners about why their AI experiments did or didn't work, is the F1 engine problem.
Every legal team in 2026 has roughly the same engine. The frontier LLMs are good. They are extraordinary at the things they are extraordinary at. The disappointment that partners report when they say "we tried AI and it didn't work" is almost never about the engine.
It is about everything else.
## The chassis is the work
A Formula 1 engine is one of the most precisely-engineered objects on earth. Bolt one to a bicycle frame and ask it to move. The bicycle gets to maybe twenty miles an hour, the bearings smoke, and the rider concludes that engines don't work. It's the obvious wrong conclusion.
Legal AI in 2026 has the same shape. The model — Claude, GPT, Gemini, whatever the current generation is — is the engine. Every serious legal AI tool is running roughly the same engine, plus or minus a generation. The model is increasingly a commodity input. The differences in user-facing quality come from everything around the model.
That "everything else" is the chassis:
- **Pre-processing.** How does a 1,200-document data room get parsed, classified, deduplicated, and prepared for the model to read? Is the OCR clean? Are tables preserved? Are amendments linked to their underlying agreements?
- **Risk checklist library.** When the model reads a contract, what is it looking for? Is the list partner-defined and configurable per deal, or baked into the tool with no override?
- **Multi-document reasoning.** What happens when a contract has been amended fifteen times? Does the system reconstruct the operative state, or does it answer based on whichever amendment shows up first in the retrieval index? (The architecture matters here. We have written about this in [Amendment Chain Resolution: The Hardest Problem in Legal AI](/blog/amendment-chain-resolution-hardest-problem-legal-ai).)
- **Output structure.** When the model produces a finding, does it cite the source clause? Does it carry confidence? Does it group by severity? Does it match firm voice?
- **Workflow.** How does the work flow from data room access to partner-reviewable memo to disclosure schedule to redline review? Does the system own that sequence, or does the user manually stitch it together?
- **Validation.** When the model is wrong, does the system catch it? Or is the team the only quality control?
This is not a list of features. It is the chassis. Without it, the engine spins furiously and goes nowhere.
## What disappointment actually looks like
The pattern I hear from partners who tried AI and stopped:
- "We typed contract questions into ChatGPT and got confident-sounding answers. Then we cross-checked and the citations were fake." (No validation chassis.)
- "We pointed our tool at the data room and it spit out generic summaries. Half were useful. We didn't have time to figure out which half." (No workflow chassis.)
- "We asked the system about a multi-amendment MSA and it gave us the wrong termination date. Read the original from 2015, not the current state from amendment seven." (No multi-document chassis.)
- "The output looked technically correct but I wouldn't send it to a client. It read like a press release." (No output-voice chassis.)
- "Our associates spent more time editing the AI's drafts than writing from scratch." (No output-quality chassis.)
These are not engine failures. The engine, in each case, did roughly what a frontier LLM does. The chassis around the engine was what failed. And the chassis is what the user actually interacts with.
## What the working version looks like
When I talk to partners whose teams are actually getting value from AI, the chassis is what they describe — not the model. They talk about:
- A data room ingesting in under an hour, with documents classified and ready for review by Day 2.
- A risk checklist that the partner configured for this specific target, this specific industry.
- Amendment chains that resolve into a single composite view of current terms, with traceability back to which amendment introduced which provision.
- A first-draft memo in the firm's voice, with citations to source clauses, ready for the partner to edit instead of write.
- A disclosure schedule drafted from the underlying agreements, with the team verifying rather than assembling.
The model under the hood is, again, roughly the same model everyone else has. The chassis is what produces the experience.
## Why the chassis is hard
It is tempting to think the chassis is the easy part. The hard part is building the engine, right? It isn't.
The engine is built by Anthropic, OpenAI, Google. Their teams have thousands of researchers and billions of dollars and a generation of compute. The engine, for our purposes, is sold by the API call.
The chassis is built by us, by Harvey, by Legora, by Kira, by Luminance. The hard parts are: deeply understanding the domain (M&A diligence as practiced by attorneys, not as imagined by engineers), building infrastructure for multi-document reasoning that isn't off-the-shelf RAG, integrating with the document management and data room systems firms actually use, and producing output a partner would sign their name to.
That is years of engineering and domain work, mostly invisible to the buyer because the engine is what gets the marketing budget. The buyer evaluates what they can see (model name, demo flash) and misses what they will actually use (workflow shape, output quality, validation rigor).
## The buyer's takeaway
Stop comparing legal AI tools on which model they use. The model is the same engine.
Compare them on:
1. **The chassis.** How does the workflow work end to end on your deals?
2. **Output quality.** Is it partner-grade, or does the team rewrite it?
3. **Hard cases.** How does the tool handle multi-amendment contracts, jurisdictional carve-outs, custom indemnity, contracts in non-English languages?
4. **Validation.** When the tool is wrong, what catches it?
Run the comparison on a real deal. Vendor demos are designed to win. Real deals are designed to ship. The chassis comparison shows up the moment you stop looking at the marketing.
We laid out the framework in our [buyer's guide for evaluating legal AI tools](/blog/legal-ai-tools-for-manda-evaluation-framework). The TL;DR: the model is commodity, the chassis is the work, and the chassis is what you should be evaluating.
## Where to read more
- [Legal AI for M&A: The Practitioner's Guide](/blog/topics/due-diligence) — the master view of how legal AI fits into the M&A workflow.
- [Amendment Chain Resolution: The Hardest Problem in Legal AI](/blog/amendment-chain-resolution-hardest-problem-legal-ai) — the technical deep dive on one of the hardest chassis problems.
- [LLM Hallucination in Contract Analysis](/blog/llm-hallucination-in-contract-analysis) — how to architect chassis that catches model errors.
- [Legal AI vs. Harvey vs. Generic AI](/blog/harvey-vs-kira-vs-infrastructure-legal-ai) — how the chassis comparison plays out across vendors.
If you want to see the Mage chassis on a real deal: [request a demo](/request-demo). Bring the data room. The engine is the same. The chassis is what we built.
---
## URL: https://magelegal.com/blog/legal-native-intelligence
### Title: Most 'Legal AI' Is Just a Foundation Model Behind a Brand. Here's Why That's Not Enough.
### Author: Raffi Isanians
Alex Su posted something last week that got 80,000 views: "At this point I can't tell if Harvey is in the business of selling technology to lawyers or equity to VCs."
That got me thinking. Not about Harvey specifically, but about what most "legal AI" actually is under the hood. Strip away the brand, the enterprise pricing, the sales deck. What's left? A foundation model. The same Claude or GPT anyone can use, pointed at your data room.
These models extract text fine. But lawyers don't think like regular people, and foundation models think like regular people. When an amendment uploaded a week after the parent agreement supersedes a termination clause, a foundation model doesn't know. It has no concept of what an amendment *is*. No one engineered it to understand that.
We spent years doing exactly that. We call it Legal-Native Intelligence. A purpose-engineered reasoning layer, calibrated against thousands of real M&A transactions, that gives foundation models the legal eye they lack on their own.
- Most legal AI products are thin wrappers around foundation models with no legal reasoning layer
- Legal-Native Intelligence is a purpose-engineered reasoning layer calibrated against thousands of real M&A transactions
- Foundation models cannot reliably resolve amendment chains, cross-references, or document families without this infrastructure
- Combined with Model Fusion Technology, Legal-Native Intelligence delivers materially higher accuracy than any single-model approach
## Extraction Is a Commodity. Understanding Is Not.
Any LLM can pull words from a PDF. That's table stakes. The real question: does your AI understand how legal documents actually work?
Any attorney who has been doing this long enough can tell whether an agreement is well-drafted or amateur hour with a quick skim of the headers and formatting. They don't need to read every clause. Pattern recognition built from years of practice tells them instantly: this was drafted by someone who knows what they're doing, or it wasn't.
That's legal intuition. Foundation models don't have it. We engineered it.
Legal-Native Intelligence is a purpose-engineered reasoning layer, calibrated against thousands of real transactions, that encodes that same legal intuition into infrastructure. Document relationship detection, amendment chain resolution, cross-reference linking, defined term propagation. Not a prompt. Not a wrapper. Years of engineering distilled into systems that give models the pattern recognition lawyers develop over careers.
We wrote about this in [The F1 Engine Problem](/blog/f1-engine-problem). The most powerful engine in the world is not useful without the right chassis. In legal AI, that chassis is Legal-Native Intelligence.
## The Amendment Problem
Here is a scenario that plays out in every data room.
A Master Services Agreement is uploaded on day one. A week later, Amendment No. 3 shows up as a separate, unlinked file. The amendment states: "Section 4.2 is hereby deleted in its entirety and replaced with the following..."
**Every other AI** treats these as two unrelated documents. It extracts the original MSA provisions. It confidently reports a 30-day termination clause that was superseded two years ago. The output looks clean. It is wrong.
**Mage** recognizes the amendment as a modification to the parent agreement, even when uploaded separately and unlinked. It reads them together. It extracts the *current effective terms*: 90-day termination per Amendment No. 3. It flags the change.
This is not a prompt engineering problem. You cannot instruct a generic model to reliably do this. It requires understanding what an amendment *is* as a legal concept, how it modifies a parent agreement, and what "deleted in its entirety and replaced" means for the enforceability of the original provision.
That understanding has to be purpose-engineered. We built it.
## Beyond Amendments: The Legal Eye
Amendment chain resolution is one example. Legal-Native Intelligence handles the full spectrum of document relationships that lawyers navigate instinctively but foundation models miss entirely.
**Document family recognition.** A commercial lease, its guaranty of lease, and an estoppel certificate are not three unrelated documents. They are one family. When reviewing the lease, you need the guarantor's obligations and the estoppel's representations in context. Legal-Native Intelligence recognizes these relationships and presents them together.
**Cross-reference resolution.** "Subject to Section 12.1" appears in a termination clause. A foundation model extracts the termination clause and moves on. Legal-Native Intelligence follows the reference, reads Section 12.1, and surfaces the actual constraint on termination rights. The extracted provision is complete, not truncated at the cross-reference.
**Defined term propagation.** "Material Adverse Effect" is defined in Section 1.1. That definition controls the entire agreement. Every representation, every closing condition, every indemnification threshold references it. Legal-Native Intelligence traces this defined term across every provision where it appears, ensuring the extracted meaning reflects the actual contractual definition rather than the model's generic understanding of the words.
## Why Prompts Can't Fix This
You can tell a model "look for amendments." You cannot make it understand what an amendment does to a parent agreement's enforceability. You can tell it to "follow cross-references." You cannot make it understand that "subject to Section 12.1" fundamentally changes the meaning of the clause it appears in.
Lawyers develop this intuition through years of practice. Thousands of agreements. Hundreds of transactions. The patterns become automatic: see an amendment reference, check the chain. See a defined term, trace it to the definition. See a cross-reference, follow it.
We distilled that intuition into infrastructure. Systems calibrated against thousands of real transactions that encode how lawyers actually reason about document relationships. You cannot replicate this with a system prompt. The reasoning has to be built into the architecture.
## Legal-Native Intelligence + Model Fusion Technology
Legal-Native Intelligence is the purpose-engineered reasoning layer that gives models a legal eye. [Model Fusion Technology](/technology) is the statistical rigor that ensures accuracy.
Here is how they work together: multiple frontier models analyze the same document, each operating through legal-native infrastructure calibrated against real transactions. The best outputs are fused together. The result is extraction that is both legally sophisticated and statistically verified.
Legal-Native Intelligence ensures the models understand amendment chains, cross-references, and document families. Model Fusion ensures the extracted values are accurate through multi-model consensus. This is why our accuracy is [materially higher](/blog/accuracy-methodology) than anyone else's. Not because we use a better model. Because we instrumented the models with legal reasoning and then verified the output through statistical consensus.
## The Stakes
The difference between "Termination: 30 days written notice" and "Termination: 90 days written notice, per Amendment No. 3" is not academic.
One is the superseded provision from the original agreement. The other is the current effective term. Report the wrong one, and your client plans for a 30-day exit that doesn't exist. That could mean post-closing liability, a failed transition, or a deal term that unravels.
Every provision in a data room exists in a web of amendments, cross-references, and defined terms. Foundation models see isolated documents. Legal-Native Intelligence sees the web.
---
Legal-Native Intelligence is Mage's purpose-engineered reasoning layer that gives foundation models the ability to understand legal documents the way lawyers do. It handles document relationship detection, amendment chain resolution, cross-reference linking, and defined term propagation. It is calibrated against thousands of real M&A transactions.
Prompt engineering tells a model what to look for. Legal-Native Intelligence encodes an understanding of how legal documents actually work into infrastructure. You can instruct a model to "look for amendments," but you cannot make it understand what an amendment does to a parent agreement's enforceability through a prompt alone. That understanding has to be engineered.
Model Fusion Technology is Mage's multi-model consensus system. Multiple frontier models analyze the same document through legal-native infrastructure, and the best outputs are fused together. This produces results that are both legally sophisticated and statistically verified, achieving materially higher accuracy than any single model.
Mage orchestrates multiple frontier foundation models through our proprietary Legal-Native Intelligence layer. The foundation models provide raw capability. Legal-Native Intelligence provides the legal reasoning, document understanding, and domain expertise that makes the output reliable for M&A diligence.
## See Legal-Native Intelligence in Action
Upload your data room and see how Mage resolves amendment chains, links document families, and extracts current effective terms.
Request Demo
---
## URL: https://magelegal.com/blog/everything-you-need-to-know-about-prompting-ai-you-learned-in-law-school
### Title: Everything You Need to Know About Prompting AI You Learned in Law School
### Author: Raffi Isanians
Everything I really need to know about how to prompt AI, I learned in law school.
The Socratic method that gave you anxiety attacks in Contracts. The IRAC structure you thought was just a straitjacket for your legal writing assignments. The issue-spotting instinct that made 1L exams feel like a fever dream. All of it turns out to be training for the skill the rest of the world is now calling "prompt engineering." You just did not know it yet.
But you do not have to take my word for it. Recent research from Wharton, Anthropic, and NeurIPS has quantified which prompting techniques actually work. Every single one maps to something you learned before you passed the bar.
Here it is.
1. **Say precisely what you mean.** *(Contracts drafting)*
2. **Tell the reader what you want before you tell them what you know.** *(IRAC)*
3. **Curate ruthlessly. Include only what matters.** *(Brief writing)*
4. **Show, don't just tell.** *(Precedent and analogical reasoning)*
5. **Never accept the first answer.** *(The Socratic method)*
6. **Ask the specific question, not the general one.** *(Issue spotting)*
7. **Change one fact and see what breaks.** *(Hypo-shifting)*
8. **Argue the other side.** *(Moot court)*
9. **"You are a legal expert" is worth exactly nothing.** *(The anti-lesson)*
## Say Precisely What You Mean
Every contracts professor who ever circled the word "reasonable" in red ink and wrote "reasonable to whom, under what standard, measured when?" in the margin was training this skill. Legal drafting is the art of eliminating ambiguity. You learned to replace "promptly" with "within five business days," to specify governing law instead of leaving it implied, to define every capitalized term because you understood that undefined words invite disputes.
That instinct is the single most valuable skill in AI prompting.
[Wharton's Prompting Science research](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5165270) and [Anthropic's own documentation on Claude](https://docs.anthropic.com/en/docs/build-with-claude/prompt-engineering/overview) both converge on the same finding: specificity is the highest-impact prompting technique. The quality of the task specification itself matters more than any other variable. Not the model. Not the prompt template. Not the persona you assign. The precision of your instruction.
Consider the difference between these two prompts:
**Vague:** "Review this NDA."
**Precise:** "Identify all non-compete, non-solicitation, and non-disclosure obligations in this NDA. For each, specify the restricted activity, geographic scope, duration, and any carve-outs. Flag any provision that would survive a change of control."
The first prompt is the contractual equivalent of "best efforts." It sounds like something, but it means almost nothing. The second prompt does what every good contract does: it defines the scope of the obligation, specifies the deliverable format, and identifies the trigger condition.
LLMs narrow the probability space of their output based on input constraints. A more precise prompt constrains the output in productive ways, the same way a well-drafted definition section constrains how terms are interpreted throughout an agreement. Vague prompts get vague answers for the same reason vague contract terms invite disputes: they leave too much room for interpretation.
Your contracts professor was not pedantic. Your contracts professor was teaching you prompt engineering twenty years before prompt engineering existed.
## Tell the Reader What You Want Before You Tell Them What You Know
IRAC was the first legal framework most of us ever learned, and most of us resented it. Issue, Rule, Application, Conclusion felt like a straitjacket. Why can't I just write the analysis the way it flows in my head?
Because structure is not a constraint on thinking. It is a tool for communication. And it turns out that what researchers call "structured framework prompting" is exactly what IRAC teaches: decompose the problem, provide the governing standard, point to the facts, and specify the output you need.
Here is IRAC as a prompt framework, mapped one to one:
- **Issue** = State the task. "Analyze the indemnification provisions in the Stock Purchase Agreement between Buyer Corp and Target Inc."
- **Rule** = Provide the standard or criteria. "Identify cap amounts, basket mechanisms, survival periods, and carve-outs for fundamental representations and fraud."
- **Application** = Point to specific facts or documents. "Review Sections 7.1 through 7.5 of the attached SPA."
- **Conclusion** = Define the output format. "Present findings in a table with columns for provision type, specific terms, and page citation."
That four-part structure gives an AI the same context you would give a junior associate when delegating a research assignment. It answers the questions that every associate asks (and every AI needs answered): What am I looking for? What standard am I applying? Where should I look? How should I present what I find?
For complex tasks, break IRAC into sequential prompts. First: "Identify all indemnification provisions and their section numbers." Then: "For each provision you identified, extract the cap, basket, survival period, and carve-outs." Then: "Flag any terms that deviate from market standard for a middle-market acquisition."
This mirrors how you would actually delegate to a junior associate. One step at a time, checking each deliverable before moving on. You would never hand a first-year a 200-page SPA and say "tell me everything." You would break the assignment into discrete tasks. AI works the same way.
The straitjacket, it turns out, was training wheels for structured thinking. You can take them off now. But the structure stays.
## Curate Ruthlessly. Include Only What Matters.
Brief writing taught you one of the hardest skills in professional communication: the discipline of exclusion. Page limits forced you to decide what mattered and what did not. Every sentence had to earn its place. You learned that including a weak argument does not add to your case. It dilutes your strongest points.
This discipline maps directly to how you should provide context to AI.
Research on context quality shows that LLM performance degrades as input length grows. A [Stanford study published in TACL](https://arxiv.org/abs/2307.03172) documented what researchers call the "lost in the middle" effect: models attend more carefully to the beginning and end of a prompt, with information in the middle receiving significantly less weight. Chroma's ["context rot" research](https://research.trychroma.com/context-rot) found that performance drops noticeably as input tokens increase, becoming increasingly unreliable in longer contexts.
You already know this intuitively. You do not dump every case you found into a brief. You select the most relevant authorities, organize them strategically (strongest arguments first and last, weaker ones in the middle), and present a curated body of evidence. Brief page limits taught you this discipline. Federal rules did not give you 50 pages because they thought you needed all 50. They gave you a ceiling, and the best brief writers never came close to it.
Apply the same discipline to AI prompts. When analyzing a 50-page agreement, do not paste the whole thing. Paste the specific sections relevant to your question. If you need to analyze the full document, break it into sections and analyze each separately. Put the most critical context first and last. Treat every word in your prompt the way you treat every word in a reply brief: if it does not advance the analysis, cut it.
## Show, Don't Just Tell
Precedent is not just legal authority. It is a communication tool. When you cite a case, you are not merely invoking a rule. You are showing the reader an example of how a court applied that rule to facts, which teaches the reader how to apply the same rule to your facts. The entire common law system is built on learning by example.
In AI prompting, this technique is called "few-shot prompting," and it is one of the most effective approaches available. [Anthropic recommends](https://docs.anthropic.com/en/docs/build-with-claude/prompt-engineering/overview) providing a few diverse, high-quality examples. But [recent research](https://arxiv.org/abs/2509.13196) reveals a nuance that any lawyer would recognize: quality matters more than quantity. Two or three well-chosen examples are highly effective. Beyond that, you hit diminishing returns. And poorly chosen examples actively degrade performance.
This is precedent selection. You cite cases not because they exist but because they are on point. You choose the case from the same jurisdiction, with analogous facts, decided under the same legal standard. A dozen peripheral cases do not help your argument. Two strong, on-point precedents do.
Apply the same instinct to AI. If you want the model to extract provisions in a specific format, show it one good example of the format you want before asking it to do 50 more. If you want risk assessments structured a certain way, provide a sample output from a previous deal. Just like in a brief, a few strong examples beat a dozen weak ones.
The common law trained you to teach by showing. AI learns the same way.
## Never Accept the First Answer
This is the heart of it.
Picture the moment. First semester, Contracts or Torts or Civil Procedure. The professor scans the room. The silence is excruciating. Then: your name.
You give your answer. You think it is pretty good. The professor does not nod. Does not smile. Instead: "But what about...?" "Is that always true?" "What happens when...?"
Your heart rate spikes. You scramble. The professor is not being cruel (probably). The professor is doing something very specific: asking targeted follow-up questions that expose the gaps in your reasoning. Not "try again." Not "be more precise." But: "What about the exception for fraud?" "Does that analysis change if the jurisdiction is Delaware?" "You said the statute requires notice, but notice to whom?"
That visceral, anxiety-producing process is exactly what makes multi-turn AI prompting effective.
A [NeurIPS 2025 study](https://arxiv.org/abs/2509.06770) found that targeted, specific follow-up reliably improves AI output quality. But here is the critical finding: vague feedback ("make it better," "try again," "be more thorough") causes quality to plateau or actually reverse. The AI does not know what "better" means any more than you knew what to do when a professor just stared at you in disappointed silence.
The difference between effective and ineffective iteration is precision. Professors did not say "try again." They said "What about the exception for fraud?" That specificity is what makes the Socratic method work, and it is what makes multi-turn prompting work.
Walk through a three-turn example:
**Turn 1:** "Identify all change-of-control provisions in this customer agreement."
The AI produces a competent but surface-level answer: the agreement contains an anti-assignment clause in Section 9.1 that restricts assignment without consent.
**Turn 2:** "What about the permitted transfer carve-out in Section 3.2(b)? Does that create a gap in the buyer's protection?"
Now the AI engages more deeply. It identifies that Section 3.2(b) allows transfers to affiliates without consent, which could permit a post-closing restructuring that effectively circumvents the anti-assignment protection.
**Turn 3:** "How does that interact with the anti-assignment clause in Section 9.1? Are those provisions consistent, or does the affiliate transfer carve-out create an internal conflict?"
The AI's analysis transforms. It identifies the tension between the two provisions, notes that the definition of "affiliate" in Section 1.1 is broad enough to create a genuine gap, and flags this as a point for negotiation.
The output improved across each turn. Not because you said "be better," but because you asked the precise follow-up question that exposed the gap. Just like the professor did. Just like the professor always did.
Your heart rate might still spike a little when someone says your name in a quiet room. But the skill that caused the spike is the skill that makes you good at this.
## Ask the Specific Question, Not the General One
The real skill gap with AI is not about how you ask. It is about what you ask. This is where legal training creates the widest advantage.
A non-lawyer looking at a stock purchase agreement asks: "Summarize this agreement." A first-year associate asks about the representations and warranties. A senior M&A attorney asks about the change-of-control triggers in the customer agreements, the consent requirements that could delay closing, the anti-assignment provisions that might impair the value of the acquired book of business, the indemnification caps relative to enterprise value, and the survival periods on fundamental reps versus general reps.
The difference is not sophistication of language. It is issue spotting. The senior attorney knows what to look for because they have seen what goes wrong. They know that the most consequential provision in a data room is often the one nobody thought to ask about.
Think back to the exam room. Three hours. A fact pattern dense with issues. Your grade depended not on how well you analyzed the issues you spotted, but on how many issues you spotted in the first place. That timed-exam instinct, the ability to scan a fact pattern and identify what matters, is precisely what AI lacks and what you provide.
AI does not know what questions to ask itself. It will answer whatever you ask, competently, confidently, and sometimes incorrectly. But it will not tell you that you asked the wrong question. That is your job. And it is a job that three years of law school and years of practice have trained you to do better than almost anyone.
## Change One Fact and See What Breaks
Every law professor has a version of this move. You give your answer. It seems solid. Then: "Now assume the buyer is a competitor." "What if the closing condition fails?" "Same facts, but the governing law is California instead of Delaware."
One fact changes. Your entire analysis might collapse. Or it might hold. Either way, you learn something.
This technique, hypo-shifting, is one of the most powerful ways to test whether an AI is actually reasoning about your problem or just pattern-matching against its training data.
Here is how to apply it. Ask the AI to analyze a non-compete provision under Delaware law. Get the analysis. Then change one variable: "Now assume the governing law is California." If the AI's answer does not change meaningfully (California is famously hostile to non-competes), the AI was not analyzing. It was generating plausible-sounding text based on patterns. If the answer does change, and changes in the right ways, you have evidence that the analysis is substantive.
Change one variable at a time. Jurisdiction. Dollar threshold. Time period. Party identity. Each shift should produce a different analysis if the model is actually engaging with the substance. An indemnification cap analysis should change when you shift the deal size from $50 million to $500 million. A non-solicitation analysis should change when you shift the restricted party from employees to customers. A termination analysis should change when you shift from a convenience right to a cause-only right.
If the analysis stays the same when the facts change, you are not getting analysis. You are getting a template. And you know the difference, because your professors spent three years training you to spot it.
## Argue the Other Side
Moot court was exhausting. You prepare your argument. It is airtight. Then they tell you to argue the other side. Suddenly, all the gaps you did not see become obvious.
This adversarial instinct translates directly to AI. After getting an analysis you are satisfied with, try this: "What would opposing counsel say about this analysis?" or "What are the three strongest counterarguments to the conclusion you just reached?"
[Research on self-critique in AI](https://arxiv.org/abs/2305.11738) confirms that this technique produces measurable improvements, but only when the critique is directed against specific criteria. "What is wrong with this?" is too vague. "What would a seller's counsel argue about the enforceability of this non-compete under California law?" gives the model a specific adversarial lens.
In M&A diligence, this is especially powerful for risk assessment. After identifying an issue, prompt the AI to argue why it might not be as significant as it appears. "This customer contract has a termination for convenience clause with 30 days notice. Argue that this is not a material risk to the buyer." The resulting analysis often surfaces mitigating factors (notice period requirements, cure provisions, termination payments) that a single-perspective analysis misses.
You learned in moot court that you do not truly understand your own position until you can argue against it. The same principle applies to AI output. The first answer is your opening brief. The adversarial follow-up is the reply.
## "You Are a Legal Expert" Is Worth Exactly Nothing
Here is the counterintuitive kicker. The single most popular prompting technique on the internet is persona setting. "You are a senior M&A attorney at a top-10 law firm with 20 years of experience." Every prompting guide recommends it. Every AI tutorial starts with it.
It does not work.
[Wharton tested persona prompting rigorously](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5879722) in 2025 across six leading language models. The finding was unambiguous: expert personas produced performance "statistically indistinguishable from the baseline." Telling an AI it is an expert does not make it smarter, more accurate, or more thorough. It is the prompting equivalent of telling a first-year associate to "think like a partner." It sounds motivating. It changes nothing about the quality of their work product.
Why does this matter? Because if the most popular prompting technique does not work, then the techniques that do work become even more important. And those techniques are: specificity. Structure. Strategic context. Targeted follow-up. Adversarial thinking.
Look at that list. Specificity is contracts drafting. Structure is IRAC. Strategic context is brief writing. Targeted follow-up is the Socratic method. Adversarial thinking is moot court.
The research does not just suggest that lawyers can prompt AI effectively. It says that the techniques that actually improve AI output ARE the techniques lawyers already practice, and that the one technique everyone else relies on is the one that does not work.
One caveat: persona setting can affect tone and register. "Respond in a formal legal memorandum style" will change how the output reads. It just will not change whether the analysis is correct. Tone is not substance. You learned that distinction in legal writing, too.
## You Were Trained for This
So there it is. The nine things. Everything you need to know about prompting AI, you learned in law school.
The most effective AI users are not technologists. They are not prompt engineers with computer science degrees. They are rigorous thinkers who know how to specify precisely, structure analytically, curate context, press on weak answers, and argue both sides. They are people trained to never accept the first draft, to always ask "what about the exception," and to treat every word as if it carries legal consequence.
The rest of the world is paying for prompt engineering courses and buying prompting playbooks and attending webinars on "how to talk to AI." You already took that course. It was called law school. It just came with a heavier reading load, worse coffee, and a Socratic method that still makes your heart rate spike when someone says your name in a quiet room.
The syntax is new. The thinking is not.
---
Not in the way most people think. Prompt engineering as a discipline focuses on crafting precise instructions for language models. Lawyers already practice a version of this every day: framing issues precisely, asking structured questions, and pressing for specificity when answers are vague. The skills that make a good M&A attorney, issue spotting, structured analysis, relentless follow-up, are the same skills that produce useful AI output. The syntax is different, but the thinking is identical.
Use the IRAC framework you already know. Start with the Issue (what you need to analyze), provide the Rule (the governing standard or criteria), specify the Application (the documents or facts to analyze against), and define the Conclusion format (how you want the output structured). This gives the AI the same context you would give a junior associate when delegating a research assignment. For complex tasks, break it into sequential prompts rather than one large request.
The Socratic method is iterative questioning that drives toward precision. When an AI gives you a vague or incomplete answer, you do the same thing a law professor does: ask a follow-up that exposes the gap. "What about the exception for fraud?" "Does that analysis change if the jurisdiction is Delaware?" "You said the cap is standard, but standard relative to what?" Research shows that targeted follow-up questions improve AI output by approximately 20%, while vague feedback like "make it better" actually causes quality to decline.
Three reasons. First, lawyers are trained to spot issues that others miss, which means they know what questions to ask. Second, lawyers are trained in precision of language, which means their questions are specific enough for AI to produce useful answers. Third, lawyers are trained to never accept the first answer without scrutiny, which means they naturally iterate in ways that improve AI output. Research has also shown that the most popular prompting shortcut, persona setting ("You are a legal expert"), does not actually improve accuracy. The techniques that do work, specificity, structure, strategic context, and targeted follow-up, are all core legal skills.
Mage is built for the way attorneys already think. Structured analysis, source-cited findings, and workflows designed around how M&A teams actually work.
See How Mage Works
---
## URL: https://magelegal.com/blog/llm-hallucination-in-contract-analysis
### Title: LLM Hallucination in Contract Analysis: Why Source Verification Is Non-Negotiable
### Author: Raffi Isanians
LLM hallucination is the phenomenon where a language model generates text that is fluent and plausible but factually incorrect, fabricating information that does not exist in its source material. In contract analysis, hallucination is not an abstract research concern. It is a professional liability risk that can produce fabricated clause citations, invented provision language, and phantom risks that do not exist in the actual documents.
The challenge is not that LLMs hallucinate obviously. The challenge is that they hallucinate convincingly. A fabricated indemnification provision complete with section numbers, dollar thresholds, and proper legal terminology looks identical to a real one, until you check the source.
- LLM hallucination in legal contexts is not random noise. It tends to produce plausible-sounding provisions that match common legal patterns but do not exist in the actual documents
- The most dangerous hallucinations are not obviously wrong. They are fabricated clauses that look exactly like real provisions, complete with section numbers and legal terminology
- Source verification, where every AI finding links directly to a specific page and clause in the source document, is the only reliable defense against hallucination in legal work
- System architecture matters more than model selection. Constrained extraction with mandatory source citation produces fewer hallucinations than open-ended generation regardless of model quality
## How Hallucination Manifests in Legal Work
Legal hallucination is distinct from general AI hallucination because legal language is highly patterned. LLMs have ingested millions of contracts during training. They know what indemnification clauses look like. They know standard change of control definitions. They know typical non-compete structures.
This pattern knowledge is precisely what makes legal hallucination dangerous. When a model fabricates a provision, it does not generate random text. It generates text that matches the statistical distribution of legal language it was trained on. The output looks like a real clause because it is constructed from real patterns.
Three categories of legal hallucination appear most frequently:
**Fabricated provisions.** The model reports that a contract contains a provision that does not exist. For example, it might state that an employment agreement includes a 24-month non-compete with a 50-mile geographic restriction when the agreement contains no non-compete at all. The fabrication uses standard legal phrasing and specific parameters, making it indistinguishable from a real finding without checking the source.
**Misattributed language.** The model attributes language from one document to another, or from one section to a different section within the same document. In a data room with 300 contracts, the model might describe the indemnification cap from Contract A as belonging to Contract B. Both contracts exist. The provision exists. But the attribution is wrong.
**Invented specifics.** The model correctly identifies that a provision exists but fabricates specific details. A real limitation of liability clause might cap damages at "the fees paid in the preceding 12 months," but the model reports a specific dollar amount of $2 million. The clause is real. The dollar figure is hallucinated.
## Why Legal Hallucination Is Different
In a general knowledge context, hallucination is annoying but manageable. If a chatbot gets a historical date wrong, the stakes are low.
In legal diligence, every finding becomes part of a work product that informs deal decisions. A fabricated change of control provision that does not actually exist in a customer agreement could cause a deal team to negotiate an unnecessary consent. A missed indemnification cap because the model hallucinated one that does not exist could leave a buyer exposed to uncapped liability.
The professional stakes are real. Attorneys signing off on diligence memos are putting their names on the analysis. If an AI-generated finding turns out to be fabricated, the attorney bears the professional responsibility, not the software vendor.
This is why we wrote about [why we do not let users write prompts](/blog/why-we-dont-let-users-write-prompts): open-ended generation interfaces maximize the surface area for hallucination. Every unconstrained query is an opportunity for the model to fabricate a plausible answer.
## The Source Verification Requirement
The only reliable defense against hallucination in legal AI is mandatory source verification: every extracted finding must link directly to the specific page and clause in the source document where that finding originates.
This is not a nice-to-have feature. It is a structural requirement. Without source links, every finding from an AI system requires the attorney to manually locate the relevant provision in the source document, search through pages to find the language, and verify that the AI's characterization is accurate. At that point, the AI has not saved time. It has created additional work.
With mandatory source citation, verification becomes a single click. The attorney reads the AI's finding, clicks the source link, sees the exact language highlighted in the document, and either confirms or corrects. The hallucination is immediately visible because the source text does not match the finding.
This architectural choice changes the trust model entirely. Instead of asking "Is this AI output correct?" the attorney asks "Does this source text support this finding?" The second question is faster, more reliable, and does not require trusting the model.
## Architecture Over Model Selection
A common misconception is that hallucination is primarily a model quality problem, that better models hallucinate less. This is partially true but fundamentally misleading. Even the most capable models hallucinate when given unconstrained generation tasks. The difference between a 5% hallucination rate and a 2% hallucination rate is meaningful in research but irrelevant in practice when you are reviewing 300 contracts and need every finding to be correct.
The more impactful variable is system architecture. Three design choices dramatically reduce hallucination regardless of which model powers the system:
**Constrained extraction over open-ended generation.** Instead of asking "What are the key provisions in this contract?", a constrained system extracts specific provision types from a predefined schema. The model fills defined fields rather than generating free-form analysis. This reduces the degrees of freedom available for hallucination.
**Mandatory source grounding.** Every extracted value must trace to specific text in the source document. The system does not accept findings without source citations. This creates a structural check: if the model cannot point to source text, the finding is not surfaced.
**Type-aware document processing.** Different document types have different provision structures. An employment agreement has different relevant provisions than a credit agreement. Processing documents through type-specific extraction schemas means the model operates within a constrained space that matches the actual document structure.
These architectural choices are how [Mage approaches contract review](/contract-review), and they explain why accuracy rates in constrained extraction systems consistently exceed those of open-ended legal AI chatbots, regardless of which underlying model each uses.
## What This Means for Choosing Legal AI
When evaluating legal AI tools, the question is not "Does this tool use the best model?" The question is "Can I verify every finding this tool produces?"
If the tool generates analysis without source citations, you cannot verify. If the tool answers questions without showing you exactly where in the document the answer comes from, you are trusting the model. And trusting any LLM, regardless of capability, without verification is not a sound basis for legal work product.
The tools that will earn attorney trust are not the ones that hallucinate less. They are the ones that make hallucination immediately visible when it occurs, so that attorneys can correct it before it reaches a deliverable.
---
Hallucination rates vary significantly based on system architecture. Open-ended question-answering over legal documents can produce hallucinations in 5-15% of responses, depending on the model and prompt design. Constrained extraction systems with mandatory source citation reduce this to below 1%. The key variable is not the model itself but the architectural constraints around how the model generates output and whether every finding must link to a verifiable source.
Legal hallucinations are uniquely dangerous because they look correct. A model might cite "Section 7.2(b)" of an agreement and describe a non-compete provision with specific duration and geographic scope, using proper legal terminology and formatting. The provision sounds exactly like something that would exist in the contract. But when you check Section 7.2(b), the language is different or the section does not exist. These plausible fabrications are harder to catch than obvious errors.
No system can guarantee zero hallucination from a language model. However, system architecture can make hallucination functionally irrelevant by requiring every extracted finding to link directly to its source text with page and clause citations. When every finding is verifiable with one click, hallucinations become immediately detectable. The goal is not zero hallucination but zero undetectable hallucination.
Mage uses constrained extraction rather than open-ended generation. Every extracted provision must link to a specific page and clause in the source document. The system extracts from defined provision categories rather than generating free-form analysis, which structurally limits the model's ability to fabricate findings. Attorneys can verify any finding against the source text with a single click, making any hallucination immediately visible.
## Every Finding. Every Source. Every Time.
Mage links every extracted provision directly to the source document. No black boxes. No trusting the model. Verify any finding with a single click.
Request a Demo
---
## URL: https://magelegal.com/blog/signing-to-closing-interim-covenants
### Title: Signing to Closing: Interim Covenants and Compliance Monitoring in M&A
### Author: Mage Team
Signing to closing in M&A is the interim period between executing the purchase agreement and consummating the transaction. It is the most structurally vulnerable phase of any deal: the buyer has committed capital and resources, but does not yet control the target business. Interim operating covenants are the primary mechanism for managing that vulnerability, and monitoring compliance with those covenants is where many deal teams fall short.
- The signing-to-closing period is when deals are most vulnerable: the buyer has committed capital but does not yet control the business, making covenant compliance the primary risk management tool
- Interim operating covenants typically restrict the target from taking material actions outside the ordinary course of business without buyer consent, but poorly drafted covenants create friction that damages the business
- Material adverse change clauses provide a narrow exit right, but recent case law has raised the bar significantly, making covenant compliance monitoring more important than MAC enforcement
- Systematic tracking of covenant obligations, consent requests, and compliance deadlines prevents the small breaches that compound into closing disputes
## Why the Interim Period Matters
Between signing and closing, the target company continues to operate. Employees come and go. Contracts renew or expire. Capital gets spent. Customers make decisions. The business the buyer agreed to acquire on signing day is changing every day until closing.
Interim operating covenants exist to control the rate and nature of that change. They draw a boundary around what the seller can do without asking permission, and they establish a consent mechanism for everything outside that boundary.
The challenge is practical, not conceptual. Most deal attorneys understand what covenants do. The difficulty is tracking compliance across dozens of specific obligations while simultaneously managing regulatory approvals, third-party consents, and closing deliverables.
## Anatomy of Interim Operating Covenants
A well-drafted interim covenant section addresses several categories of seller conduct.
### Ordinary Course of Business
The foundational covenant requires the target to operate in the ordinary course of business consistent with past practice. This standard is intentionally broad, covering everything from vendor payments to hiring decisions to capital expenditures.
The "consistent with past practice" qualifier matters. A target that historically made annual capital expenditures of $5 million cannot suddenly commit to a $20 million equipment purchase and claim it is ordinary course. The standard is calibrated to the target's historical operations, not the industry generally.
### Specific Negative Covenants
Beyond the ordinary course requirement, purchase agreements typically include specific restrictions on material actions:
- **No amendments to organizational documents** without buyer consent
- **No issuance of equity** or changes to capitalization
- **No material contracts** entered into, amended, or terminated outside ordinary course
- **No disposition of material assets** outside normal inventory sales
- **No changes to compensation** above specified thresholds
- **No settlement of litigation** above specified amounts
- **No changes to accounting methods** or tax elections
- **No incurrence of material debt** outside existing credit facilities
Each restriction should include a materiality qualifier or dollar threshold to prevent the covenant from paralyzing normal business operations. A covenant that requires buyer consent for any contract amendment, regardless of value, will generate constant consent requests and slow the business unnecessarily.
### Affirmative Covenants
The purchase agreement also imposes affirmative obligations on the seller:
- **Maintain insurance coverage** at current levels
- **Preserve business relationships** with customers, suppliers, and employees
- **File tax returns** on time and in the ordinary course
- **Provide the buyer with access** to the business, properties, and records
- **Notify the buyer promptly** of any material developments
These affirmative covenants create ongoing monitoring obligations for both parties.
## Material Adverse Change: The Nuclear Option
MAC clauses provide the buyer with a termination right if the target experiences a material adverse change between signing and closing. In theory, this protects the buyer from being forced to close on a fundamentally different business than the one it agreed to acquire.
In practice, MAC clauses are rarely invoked successfully. Delaware courts have set a high bar, requiring the adverse change to be durationally significant and substantial enough to threaten the target's long-term earning power. Standard MAC exceptions for industry-wide conditions, general economic downturns, changes in law, and the effects of the transaction itself further narrow the clause.
The practical lesson is that MAC clauses are a backstop, not a primary risk management tool. Covenant compliance monitoring is far more effective at protecting the buyer during the interim period. A buyer that discovers a covenant breach in real time can address it before it becomes material. A buyer that relies solely on the MAC clause is waiting for damage to accumulate.
## Building a Compliance Monitoring System
Effective compliance monitoring requires structure. The deal team needs a system that tracks every obligation, assigns responsibility, and surfaces issues before they become problems.
### Extract and Catalog Every Obligation
Start by extracting every interim covenant obligation from the purchase agreement. Catalog each obligation with its scope, any materiality thresholds or dollar limits, the party responsible for compliance, and any notice or consent requirements.
This is where [structured extraction tools](/clause-extraction) add significant value. Rather than manually reading through covenant provisions and building a tracking spreadsheet from scratch, deal teams can extract structured obligations directly from the purchase agreement.
### Establish a Consent Request Workflow
The buyer will receive consent requests throughout the interim period. The seller wants to enter a new customer contract. An employee at the VP level is leaving and needs to be replaced. A lease is coming up for renewal. Each request needs a defined workflow:
1. **Receive and log** the consent request with supporting documentation
2. **Route to the responsible deal team member** based on subject matter
3. **Analyze the request** against the covenant terms and deal thesis
4. **Respond within the agreed timeline** to avoid claims of unreasonable withholding
5. **Document the decision** and any conditions attached to the consent
### Monitor Ongoing Compliance
Beyond consent requests, the deal team should establish regular compliance reporting. This typically includes:
- **Weekly or biweekly calls** with the target's management team
- **Monthly financial reporting** compared to historical baselines
- **Prompt notification** of any material developments or potential breaches
- **Ongoing review** of the target's contract activity against the covenant restrictions
### Track Third-Party Consent and Regulatory Milestones
The interim period also requires tracking third-party consents identified during [due diligence](/ma-diligence) and regulatory approval timelines. These items run in parallel with covenant monitoring but have their own deadlines and dependencies.
A centralized tracking system that combines covenant obligations, consent requests, third-party consents, and regulatory milestones gives the deal team a complete picture of interim period risk.
## When Breaches Happen
Despite best efforts, breaches occur. The question is how the deal team responds.
**Immaterial breaches** are common and usually resolved through notice and cure. The seller inadvertently exceeds a spending threshold, corrects the issue, and the parties move on. The purchase agreement should include a cure period for this reason.
**Material breaches** require a different analysis. The buyer must evaluate whether the breach affects the deal thesis, whether it is curable, and whether the appropriate remedy is termination, price adjustment, or enhanced indemnification. The answer depends on the specific facts and the parties' motivation to close.
**Patterns of minor breaches** can be more concerning than a single material event. Repeated small violations may indicate that the seller is not taking the covenants seriously, which raises questions about other compliance obligations and the reliability of the seller's representations.
## From Interim Monitoring to Post-Closing Integration
The compliance monitoring infrastructure built during the interim period has value beyond closing. The obligation tracking system, consent workflows, and reporting cadences translate directly into the [post-closing integration](/blog/post-closing-integration-diligence-handoff) process. Contract provisions identified during diligence, covenant compliance issues flagged during the interim period, and regulatory conditions attached to approvals all become inputs to the integration plan.
Deal teams that treat the interim period as an isolated phase miss this connection. The best practice is to design the monitoring system with integration in mind from the start.
---
Interim operating covenants are contractual obligations in the purchase agreement that govern how the target company operates between signing and closing. They typically require the seller to operate in the ordinary course of business, maintain existing contracts and relationships, preserve the workforce, and refrain from taking material actions without buyer consent. These covenants protect the buyer from receiving a fundamentally different business than the one it agreed to acquire.
A material adverse change (MAC) clause is triggered by events that substantially threaten the long-term earning power of the target company. Delaware courts have interpreted this standard narrowly, requiring deterioration that is durationally significant and measured in years rather than months. Standard MAC exceptions for industry-wide conditions, economic downturns, and changes in law further limit the clause's applicability. As a practical matter, MAC claims are difficult to prove and rarely succeed.
Buyers should establish a systematic compliance tracking process that includes regular reporting from the target, a consent request workflow with defined response timelines, and a centralized log of all material actions taken by the target. Tracking obligations from the purchase agreement alongside ongoing contract provisions identified during diligence ensures nothing falls through the cracks during the interim period.
A seller's breach of an interim covenant gives the buyer several potential remedies depending on the purchase agreement terms. The buyer may have the right to terminate the agreement if the breach is material and uncured. More commonly, the buyer uses the breach as leverage to negotiate a purchase price adjustment, enhanced indemnification, or modified closing conditions. The practical outcome depends on how material the breach is and how motivated both parties are to close.
## Track Every Obligation from Signing to Closing
Mage extracts and structures covenant obligations, consent requirements, and compliance deadlines from your purchase agreement so nothing falls through the cracks during the interim period.
Request a Demo
---
## URL: https://magelegal.com/blog/what-300-ndas-taught-me-about-change-of-control-clauses
### Title: What 300 NDAs Taught Me About Change of Control Clauses
### Author: Raffi Isanians
A change of control clause in a non-disclosure agreement specifies what happens to confidentiality obligations when one party undergoes a change in ownership, such as through an M&A transaction. These provisions determine whether NDAs survive closing, require counterparty consent, or terminate automatically, with direct implications for the buyer's ability to maintain the target's confidentiality protections post-acquisition.
Over the past year, we have analyzed change of control provisions across more than 300 NDAs for mid-market M&A transactions using Mage's [clause-level extraction](/clause-extraction). The patterns that emerge across the full dataset are striking, and they are invisible when you review NDAs one at a time.
- Change of control provisions in NDAs fall into five categories: silent (no COC clause), notice-only, consent-required, automatic termination, and conditional termination. The distribution across 300 NDAs is roughly 35%, 15%, 25%, 10%, and 15% respectively
- The most common mistake in diligence is treating all change of control clauses as equivalent. A consent-required provision with a 30-day cure period is fundamentally different from an automatic termination on closing
- NDAs with automatic termination on change of control can create immediate post-closing confidentiality gaps, particularly problematic when the NDA covers ongoing business relationships or technology access
- Structured extraction across the full NDA set reveals patterns invisible in contract-by-contract review: which counterparties have aggressive COC terms, which relationships are at risk, and where the aggregate exposure concentrates
## The Five Categories
After extracting and categorizing change of control provisions from 300 NDAs, five distinct patterns emerge. Each has different implications for deal execution and post-closing operations.
### Category 1: Silent (35% of NDAs)
The largest category. These NDAs contain no change of control provision at all. The agreement is silent on what happens if either party is acquired.
For deal teams, silent NDAs are generally the lowest risk. In a stock acquisition, the legal entity survives and the NDA continues by its terms. In an asset acquisition, the analysis turns on the NDA's assignment provision, which is a separate question.
The key diligence point for silent NDAs is not the absence of a COC clause but the presence of other provisions (assignment restrictions, termination for convenience) that could interact with a change in control even without an explicit COC trigger.
### Category 2: Notice-Only (15% of NDAs)
These NDAs require the party undergoing a change of control to notify the counterparty, but do not give the counterparty any termination or consent right. The NDA survives the transaction provided notice is given.
Notice-only provisions are relatively low risk, but they create an administrative obligation. For a target with 20 notice-only NDAs, the buyer needs to send 20 notification letters around closing. Missing the notice requirement could technically constitute a breach, though the practical consequences are usually minimal.
The diligence takeaway: flag these for the closing checklist and confirm the notice window (typically 30-60 days) does not create timing problems relative to the expected closing date.
### Category 3: Consent-Required (25% of NDAs)
The second most common category. These NDAs require the counterparty's consent before the NDA can survive or be assigned in connection with a change of control. Without consent, the NDA may terminate or the disclosing party may have a termination right.
Consent-required provisions vary significantly in their mechanics:
- **Affirmative consent:** The NDA explicitly survives only if the counterparty provides written consent. Silence is not consent.
- **Negative consent:** The NDA survives unless the counterparty objects within a specified period (e.g., 30 days after notice). Silence equals consent.
- **Reasonable consent:** The NDA states consent shall not be unreasonably withheld. This provides some protection but introduces ambiguity.
For M&A deal teams, consent-required NDAs are the highest-effort category. Each one requires an outreach to the counterparty, and the buyer must factor potential non-consent into closing risk. If a critical technology partner's NDA requires affirmative consent, the risk that consent is denied or delayed becomes a deal consideration.
### Category 4: Automatic Termination (10% of NDAs)
The most aggressive category. These NDAs state that the agreement automatically terminates upon a change of control, without any notice, consent, or cure period.
Automatic termination NDAs create an immediate confidentiality gap at closing. If the NDA covered a technology partnership, trade secret exchange, or joint development relationship, the confidentiality protections disappear the moment the deal closes. The buyer acquires the business but loses the contractual protection for information the target had been sharing under that NDA.
At 10% of the 300 NDAs reviewed, this represents roughly 30 agreements. In most cases, these cover lower-value relationships where the automatic termination is manageable. But when automatic termination applies to a strategic technology partner or a key customer relationship, the risk is substantial.
### Category 5: Conditional Termination (15% of NDAs)
These NDAs give the counterparty a termination right (not automatic) triggered by a change of control, often with conditions attached: a cure period, a requirement that the termination be exercised within a specified window, or a condition that the termination right only applies if the acquirer is a competitor.
Conditional termination provisions are more nuanced than automatic termination and require closer analysis:
- A 60-day termination window gives the buyer time to negotiate continued coverage
- A competitor-only trigger may not apply depending on the buyer's business
- A cure provision may allow the buyer to address the counterparty's concerns before termination takes effect
These provisions require individual assessment during diligence. The specifics matter, and they vary significantly across agreements.
## What Pattern Analysis Reveals
Reviewing NDAs one at a time produces a list of individual findings. Reviewing all 300 through [structured extraction](/blog/clause-level-segmentation-precision) reveals patterns:
**Counterparty concentration.** When the same counterparty appears across multiple NDAs with aggressive COC terms, the aggregate exposure to that relationship becomes visible. A technology vendor with consent-required provisions across 5 separate NDAs represents a concentrated consent risk.
**Standard form identification.** Many NDAs within a single data room share the same template. Extracting COC provisions across all of them reveals which template was used and whether any agreements deviate from the standard form. The deviations often indicate a negotiated relationship that deserves closer attention.
**Risk distribution by category.** Knowing that 10% of NDAs have automatic termination is useful. Knowing that those 30 NDAs cover 6 technology partnerships and 24 standard vendor relationships tells you where the actual risk concentrates.
**Deal structure implications.** The aggregate COC analysis informs deal structure decisions. If 25% of NDAs require consent, and those NDAs cover relationships representing 40% of the target's technology stack, the consent risk may favor a stock purchase over an asset purchase.
This pattern-level analysis is only possible when every NDA in the data room is reviewed. [Sampling 10-20%](/blog/pe-diligence-coverage-sampling-contracts-risk) of NDAs provides individual findings but cannot reveal the aggregate patterns that inform deal strategy.
## Practical Implications for Deal Teams
For attorneys conducting [M&A diligence](/ma-diligence), the NDA COC analysis feeds directly into several deal deliverables:
**Disclosure schedules.** Contracts with consent-required or termination provisions are disclosed under the standard "contracts requiring third-party consent" representation.
**Closing conditions.** Material consent-required NDAs may become closing conditions or pre-closing covenants, requiring the seller to obtain consent before closing.
**Indemnification provisions.** Risks from automatic termination NDAs that cannot be addressed pre-closing may be allocated through specific indemnification provisions.
**Post-closing integration planning.** The buyer's integration team needs to know which NDA relationships require immediate attention after closing: consent requests to send, notices to deliver, and confidentiality protections to replace.
When the COC extraction is structured from the start, these deliverables populate directly from the analysis. The data flows from extraction to disclosure schedule without a manual transcription step.
---
A change of control clause in an NDA specifies what happens to the confidentiality obligations when one party undergoes a change in ownership or control, such as in an M&A transaction. These clauses range from simple notice requirements to automatic termination upon closing. They matter in M&A because a target company's NDAs often cover sensitive business information, trade secrets, and technology access that the buyer needs to maintain post-closing.
Based on analysis of 300 NDAs across mid-market M&A transactions, approximately 65% contain some form of change of control provision, while 35% are silent on the topic. Among those with COC provisions, the most common type is consent-required (25% of all NDAs), followed by notice-only (15%), conditional termination (15%), and automatic termination (10%). Distribution varies by industry and counterparty sophistication.
The outcome depends on the NDA's change of control provision and the deal structure. In a stock acquisition, the NDA typically survives because the legal entity has not changed. In an asset acquisition, assignment provisions become relevant. NDAs with automatic termination clauses may cease to be effective upon closing, creating confidentiality gaps. NDAs with consent requirements may require counterparty approval before the buyer can access covered information. NDAs that are silent on change of control generally survive both deal structures.
NDAs often fall below the materiality threshold for individual contract review because they do not generate revenue. However, NDAs collectively define the target's confidentiality obligations, technology access rights, and counterparty relationships. An NDA with an automatic termination clause covering a key technology partner could create an immediate post-closing gap in IP protection. Reviewing all NDAs through structured extraction reveals these risks at a cost far below manual review of each agreement individually.
## Extract Every Change of Control Clause. Automatically.
Upload your data room and see COC provisions across every NDA, categorized, flagged, and linked to source. No manual reading required.
Request a Demo
---
## URL: https://magelegal.com/blog/non-compete-clauses-in-manda-enforceability-extraction-deal-impact
### Title: Non-Compete Clauses in M&A: Enforceability, Extraction, and Deal Impact
### Author: Mage Team
A non-compete clause is a contractual restriction that prohibits a party from engaging in competitive activities for a defined period, within a defined geography, and within a defined scope of business. In M&A transactions, non-competes appear in two critical contexts: as provisions in the purchase agreement restricting sellers from competing with the acquired business, and as existing restrictions in the target company's employment and commercial agreements that the acquirer inherits. Both categories require careful diligence, and the enforceability landscape is shifting in ways that directly affect deal structuring.
- Non-compete enforceability varies dramatically by jurisdiction, and the regulatory landscape is shifting toward greater restrictions on employer-imposed non-competes
- In M&A, non-competes serve dual purposes: protecting the acquirer's investment in the target's business and retaining key personnel through the transition period
- Geographic scope, temporal duration, and activity restrictions must each be reasonable under applicable law, and courts frequently narrow or void provisions that overreach
- Systematic extraction of non-compete terms across all employment, consulting, and commercial agreements reveals the true post-acquisition competitive landscape
## The Dual Role of Non-Competes in M&A
Non-compete clauses serve fundamentally different purposes depending on where they appear in a transaction.
**Seller non-competes in the purchase agreement** protect the acquirer's investment. When a buyer pays a premium that includes goodwill, customer relationships, and market position, the non-compete ensures the seller cannot immediately start a competing business and erode the value that was just acquired. Courts recognize this as a legitimate commercial interest and generally apply a more permissive reasonableness standard to seller non-competes than to employment non-competes.
**Existing non-competes in the target's contract portfolio** define the competitive landscape the acquirer inherits. Employment agreements with key personnel, consulting contracts with former executives, distribution agreements with exclusivity provisions, and partnership arrangements with restrictive covenants all contain non-compete or non-competition provisions that shape what the combined entity can and cannot do post-closing.
Understanding both categories, and their interaction, is essential for accurate deal valuation.
## The Evolving Enforceability Landscape
Non-compete enforceability has never been uniform across jurisdictions, and the divergence is accelerating.
**State-level variation is significant.** California has long refused to enforce most non-compete agreements. Several states have followed with partial or complete bans, particularly for employees below certain income thresholds. Others continue to enforce reasonable non-competes under traditional common law frameworks. For a target company with employees in multiple states, the enforceability of its non-compete portfolio is not a single legal question but a jurisdiction-by-jurisdiction analysis.
**Federal regulatory pressure continues.** The FTC's efforts to restrict non-compete agreements, while facing legal challenges, signal a broader policy direction that deal teams must consider. Even where current law permits enforcement, the trajectory suggests that non-competes with aggressive scope may face greater scrutiny in the near term.
**The M&A exception endures.** Critically, the regulatory shift against non-competes has generally preserved the enforceability of restrictions tied to the sale of a business. The rationale is straightforward: a seller who receives millions in consideration for their business is in a fundamentally different bargaining position than an employee who signs a non-compete as a condition of at-will employment. Deal counsel should nonetheless ensure that seller non-competes are carefully drafted to survive evolving legal standards.
## Anatomy of an Enforceable Non-Compete
Whether a non-compete will be upheld depends on the reasonableness of three elements working together.
### Geographic Scope
The geographic restriction must correspond to the area where the restricted party could meaningfully compete with the protected business. A nationwide non-compete for a regional services company is more vulnerable to challenge than one for a company with national operations. During diligence, mapping the target's geographic footprint against the geographic scope of its non-compete portfolio identifies provisions that may be unenforceable because they overreach.
### Temporal Duration
Market standard for seller non-competes in M&A is two to five years, with three years being the most common. Employee non-competes typically run one to two years. Courts evaluate duration against what is reasonably necessary for the protected party to establish independent goodwill or for the competitive advantage to diminish. Provisions at the outer boundary of reasonableness may be enforced, reformed to a shorter period, or voided entirely depending on the jurisdiction.
### Activity Restrictions
The restricted activities must be narrowly defined to protect the legitimate business interest without preventing the restricted party from earning a livelihood (for individuals) or pursuing unrelated business opportunities (for sellers). Broad restrictions like "any business that competes in any way" face more skepticism than specific restrictions like "providing commercial insurance brokerage services to middle-market companies."
## What Deal Teams Should Extract During Diligence
Effective non-compete diligence requires systematic extraction across every agreement category that might contain restrictive covenants.
**Employment agreements.** Identify which employees are subject to non-competes, the terms of each restriction, the governing law, and whether the provision includes a garden leave or compensation requirement. Pay particular attention to key personnel whose retention is material to deal value.
**Consulting and independent contractor agreements.** Former employees who transitioned to consulting roles may have different (and sometimes broader) non-compete obligations. These provisions often have different enforceability standards.
**Commercial agreements.** Non-compete and exclusivity provisions in distribution agreements, partnership arrangements, joint venture agreements, and licensing contracts restrict the combined entity's competitive freedom in ways that may not surface in a standard employment-focused review.
**Previous acquisition agreements.** If the target previously acquired businesses, the seller non-competes from those transactions may still be in effect and may restrict the target's activities in ways relevant to the current deal.
AI-powered [clause extraction](/clause-extraction) is particularly valuable here because non-compete provisions appear across multiple agreement types with different structures and terminology. A systematic extraction that identifies the geographic scope, duration, restricted activities, triggering events, and governing law for every non-compete in the data room gives deal counsel a comprehensive view that manual review across hundreds of agreements often misses.
## Impact on Deal Structuring and Valuation
Non-compete findings during [M&A diligence](/ma-diligence) flow directly into deal structuring decisions.
**Key person retention.** If critical employees have non-competes with the target that would survive an acquisition, the acquirer inherits a retention mechanism. If they do not, the acquirer must negotiate new arrangements, often at a premium, during or after closing.
**Competitive landscape assessment.** The aggregate non-compete portfolio reveals who cannot compete with the target and for how long. When major restrictions expire shortly after closing, the competitive landscape may shift in ways that affect valuation assumptions.
**Seller non-compete negotiation.** Findings from the target's existing non-compete portfolio inform the scope and duration of the seller non-compete in the purchase agreement. If the target's industry norms and governing jurisdictions favor shorter, narrower restrictions, an aggressive seller non-compete may not survive enforcement.
**Indemnification provisions.** Material non-competes that are potentially unenforceable under applicable law represent a risk that should be addressed through representations, warranties, and indemnification in the purchase agreement.
## Building a Non-Compete Risk Matrix
The output of non-compete diligence should be a structured risk matrix that categorizes every identified restriction by enforceability risk, materiality, and expiration timeline. This matrix serves multiple stakeholders: deal counsel uses it to structure the purchase agreement, the integration team uses it to plan workforce decisions, and the client uses it to understand the competitive dynamics of the business they are acquiring.
Building this matrix manually across a large [contract review](/contract-review) portfolio is precisely the kind of high-volume extraction work where AI tools deliver the most value. The legal judgment, whether a specific non-compete is enforceable, how to negotiate around it, what it means for deal value, remains with the attorney. The extraction, categorization, and structured presentation of every non-compete in the data room is where technology eliminates weeks of associate time.
---
Non-compete clauses in M&A transactions are generally more enforceable than those in standard employment agreements because the seller receives substantial consideration (the purchase price) in exchange for the restriction. Courts recognize that protecting the goodwill acquired in a business sale is a legitimate interest. However, even in the M&A context, the clause must be reasonable in geographic scope, temporal duration, and activity restriction under the governing jurisdiction's standards.
Non-compete duration in M&A transactions typically ranges from two to five years post-closing, with three years being the most common market standard. Courts evaluate reasonableness based on the nature of the business, the seller's role, and the time needed for the acquirer to establish independent goodwill. Provisions exceeding five years face increasing judicial skepticism, though some courts will reform rather than void an unreasonably long restriction.
A seller non-compete restricts the target company's owners from competing with the business they sold, and courts apply a more permissive reasonableness standard because sellers received deal consideration. An employee non-compete restricts individual workers from joining competitors, and courts scrutinize these more heavily, especially as regulatory sentiment shifts against broad employee restrictions. During diligence, both types must be identified and assessed separately.
AI-powered contract review tools scan employment agreements, consulting contracts, partnership agreements, and commercial contracts simultaneously to extract non-compete provisions. The extraction identifies geographic scope, temporal duration, restricted activities, triggering events, carve-outs, and governing law for each provision, allowing deal teams to build a comprehensive competitive restriction matrix across the entire target workforce and contract portfolio.
## Map Every Non-Compete Across Your Deal Portfolio
Mage extracts non-compete provisions from employment agreements, commercial contracts, and prior acquisition documents simultaneously, giving your team a complete competitive restriction matrix with enforceability analysis by jurisdiction.
Request a Demo
---
## URL: https://magelegal.com/blog/exclusivity-clauses-in-commercial-contracts
### Title: Exclusivity Clauses in Commercial Contracts: What M&A Deal Teams Need to Know
### Author: Mage Team
An exclusivity clause is a contractual provision that restricts one or both parties from engaging with competitors, alternative providers, or other market participants within a defined scope. In commercial contracts, exclusivity takes many forms: exclusive distribution rights, sole supplier obligations, exclusive licensing grants, and restrictions on serving competing customers. During M&A due diligence, these provisions are strategically significant because the acquirer inherits the target's exclusivity obligations and benefits, and either can fundamentally reshape what the combined entity can do after closing.
- Exclusivity clauses restrict a party's freedom to engage with competitors, and they come in several forms: customer exclusivity, territory exclusivity, product exclusivity, and supplier exclusivity
- In M&A, inherited exclusivity obligations can block the acquirer's growth strategy, prevent cross-selling, or create conflicts with the acquirer's existing business lines
- Exclusivity provisions often appear in distribution, supply, licensing, and partnership agreements where they may not be the primary focus of the counterparty relationship
- Early identification and mapping of exclusivity obligations across the target's contract portfolio is essential for accurate post-acquisition planning
## Why Exclusivity Provisions Matter in Acquisitions
Exclusivity clauses define the boundaries of a company's commercial relationships. When an acquirer purchases a target, it acquires those boundaries. The challenge is that exclusivity provisions can either enhance or constrain the deal thesis depending on the specific terms and the acquirer's strategic intent.
**Favorable exclusivity enhances value.** If the target holds exclusive distribution rights in a desirable market, exclusive licensing rights to valuable intellectual property, or exclusive supply arrangements with favorable pricing, those provisions represent competitive advantages that the acquirer inherits.
**Restrictive exclusivity constrains strategy.** If the target is obligated to source exclusively from a specific supplier, restricted from serving customers in the acquirer's existing markets, or prohibited from offering competing products, those obligations may conflict with the acquirer's integration plans and growth strategy.
The distinction between favorable and restrictive exclusivity depends entirely on the acquirer's perspective, which is why these provisions must be identified and analyzed in the context of the specific transaction.
## Types of Exclusivity Provisions
Exclusivity appears in commercial contracts in four primary forms, each with different strategic implications.
### Customer Exclusivity
Customer exclusivity provisions restrict a party from serving specified customers or customer categories. In distribution and reseller agreements, a manufacturer might grant a distributor exclusive rights to serve certain named accounts or customer segments. The acquirer inherits both the benefit (protected customer relationships) and the burden (inability to serve those customers through alternative channels).
### Territory Exclusivity
Territory exclusivity defines geographic boundaries within which a party has exclusive rights or obligations. Exclusive territory arrangements are common in distribution, franchise, and licensing agreements. During diligence, the critical question is whether the target's territory exclusivity overlaps with or complements the acquirer's existing geographic footprint. Overlapping territories can create conflicts with the acquirer's existing distribution arrangements.
### Product Exclusivity
Product exclusivity restricts a party from offering, manufacturing, or distributing competing products. A distribution agreement might require the distributor to carry only the manufacturer's product line within a category. For an acquirer that plans to consolidate product offerings or cross-sell its existing portfolio through the target's channels, product exclusivity provisions can be a significant constraint.
### Supplier Exclusivity
Supplier exclusivity obligates a party to source specific materials, components, or services from a single provider. These provisions lock the target into a supply relationship that the acquirer may want to restructure, renegotiate, or replace. Exclusive supply arrangements can also create concentration risk if the sole supplier faces disruption.
## Where Exclusivity Provisions Hide
One of the challenges with exclusivity diligence is that these provisions are often embedded in agreements where they are not the primary commercial focus.
**Distribution agreements** frequently contain territory and product exclusivity as secondary provisions alongside pricing, volume commitments, and performance benchmarks.
**Licensing agreements** may include exclusive fields of use, exclusive territories, or exclusive sublicensing rights buried within the grant of rights section.
**Joint venture and partnership agreements** often include exclusivity provisions that restrict the partners from competing with the joint venture or pursuing overlapping opportunities independently.
**Supply agreements** may contain both exclusive sourcing obligations and exclusive supply commitments, creating bilateral restrictions that affect procurement flexibility.
Because exclusivity provisions are scattered across multiple agreement types and are often not the headline provision, they require systematic extraction across the entire data room. A review focused only on agreements titled "Exclusive Distribution Agreement" will miss the majority of exclusivity obligations.
## Impact on Post-Acquisition Strategy
The strategic impact of inherited exclusivity depends on alignment between the provisions and the acquirer's plans.
**Cross-selling conflicts.** If the acquirer plans to sell its products through the target's customer relationships, product exclusivity provisions that restrict the target from offering competing products create a direct obstacle.
**Market expansion limitations.** Territory exclusivity that grants a counterparty exclusive rights in markets the acquirer intended to enter post-acquisition limits growth options.
**Supplier consolidation barriers.** Exclusive sourcing obligations prevent the acquirer from consolidating procurement across the combined entity, potentially missing economies of scale.
**Channel conflicts.** Overlapping exclusive distribution arrangements between the acquirer's existing contracts and the target's contracts can create channel conflicts that require resolution before or shortly after closing.
Mapping these conflicts requires visibility into both the target's exclusivity portfolio and the acquirer's existing contractual obligations, making exclusivity one of the diligence areas where cross-referencing between buyer and target contracts is most valuable.
## Termination and Modification Mechanisms
Not all exclusivity obligations are permanent. During diligence, identifying the termination and modification mechanisms within each exclusivity provision reveals the acquirer's options for restructuring post-closing.
**Expiration dates.** Many exclusivity arrangements have defined terms that may expire before or shortly after the expected closing date, resolving the constraint naturally.
**Performance benchmarks.** Some exclusivity provisions are contingent on meeting minimum volume, revenue, or activity thresholds. If the benchmarks are not being met, the exclusivity may already be terminable.
**Change of control provisions.** Exclusivity arrangements that include change of control termination rights give the counterparty, or sometimes the target, the right to terminate the exclusivity upon an acquisition.
**Renegotiation triggers.** Some agreements include renegotiation windows or most favored nation provisions that allow the terms of the exclusivity to be adjusted upon certain events.
AI-powered [contract review](/contract-review) tools can extract these termination mechanisms alongside the exclusivity provisions themselves, giving deal teams a complete picture of which restrictions are fixed and which are modifiable. This extraction enables the post-acquisition strategy discussion to move from "what exclusivity exists" to "what exclusivity can we work with and what can we exit."
## Building an Exclusivity Map for Deal Planning
The deliverable from exclusivity diligence should be a structured map that plots every exclusivity provision against the acquirer's strategic priorities. This map should identify for each provision the type of exclusivity, the counterparty, the scope (geographic, customer, product, or supplier), the duration, the termination mechanisms, and the alignment or conflict with the acquirer's integration plan.
This is precisely the kind of structured [clause extraction](/clause-extraction) and categorization that scales effectively with AI assistance. The legal judgment about whether to renegotiate, terminate, or work within a given exclusivity arrangement remains with deal counsel. The comprehensive identification and structured presentation of every exclusivity provision across hundreds of contracts is where technology prevents material provisions from being overlooked.
---
An exclusivity clause is a contractual provision that restricts one or both parties from engaging with competitors or alternative providers within a defined scope. Common forms include exclusive distribution rights within a territory, exclusive supply arrangements, and exclusive licensing grants. These provisions are standard in commercial agreements and become strategically significant during M&A because the acquirer inherits these restrictions along with the contracts.
Exclusivity clauses affect M&A deal value in both directions. Favorable exclusivity, such as exclusive distribution rights in a high-value territory, can enhance deal value by protecting market position. Restrictive exclusivity, such as obligations that prevent the target from working with competitors of the acquirer's existing partners, can reduce value by limiting post-acquisition strategy. The net impact depends on the specific provisions and the acquirer's integration plans.
Exclusivity clauses generally survive an acquisition unless the contract contains a change of control termination right or the exclusivity provision itself has an expiration date or termination mechanism. Some exclusivity arrangements include performance benchmarks that, if unmet, allow the non-exclusive party to terminate the exclusivity while keeping the broader contract in place. Identifying these termination mechanisms during diligence is critical for post-acquisition planning.
Deal teams should identify four primary types: customer exclusivity (restrictions on serving certain customers), territory exclusivity (geographic limitations on where products or services can be offered), product exclusivity (limitations on offering competing products), and supplier exclusivity (obligations to source from a single provider). Each type carries different implications for post-acquisition strategy and should be mapped against the acquirer's existing business and growth plans.
## Map Every Exclusivity Obligation Before You Close
Mage extracts exclusivity provisions from distribution, licensing, supply, and partnership agreements across your entire data room, mapping restrictions by type, scope, and termination mechanism so your team can plan integration with full visibility.
Request a Demo
---
## URL: https://magelegal.com/blog/anti-assignment-clauses-in-manda-what-every-deal-attorney-should-know
### Title: Anti-Assignment Clauses in M&A: What Every Deal Attorney Should Know
### Author: Mage Team
An anti-assignment clause is a contractual provision that restricts or prohibits a party from transferring its rights or obligations under an agreement to a third party. These provisions are among the most commonly encountered restrictions during M&A due diligence, appearing in everything from customer contracts and vendor agreements to real estate leases and intellectual property licenses. When an acquisition effectively transfers a target company's contractual relationships to a new owner, anti-assignment clauses determine whether those relationships survive the transaction.
- Anti-assignment clauses restrict a party's ability to transfer contractual rights or obligations, and they appear in the majority of commercial agreements reviewed during M&A diligence
- The three main variants, blanket prohibitions, consent-required provisions, and change of control triggers, each carry different risk profiles for deal structuring
- Whether a merger constitutes an "assignment" under a given contract depends on the clause language, governing law, and transaction structure
- Missing a critical anti-assignment clause can result in contract termination, loss of key customer relationships, or renegotiation leverage shifting to counterparties
## Why Anti-Assignment Clauses Matter in M&A
Every acquisition involves, at its core, a transfer of contractual relationships. The target company's agreements with customers, vendors, landlords, licensors, and partners form the commercial foundation that drives deal value. Anti-assignment clauses are the contractual gatekeepers that determine which of those relationships transfer smoothly and which require counterparty consent, renegotiation, or creative deal structuring.
The risk is asymmetric. An acquirer who identifies assignment restrictions early can plan around them through transaction structuring, consent solicitation, or purchase price adjustments. An acquirer who discovers them post-signing faces counterparties with significant leverage, the potential loss of material contracts, and deal economics that no longer work.
## Three Types of Anti-Assignment Provisions
Not all anti-assignment clauses carry the same risk. Understanding the three primary variants is essential for accurate risk assessment.
### Blanket Prohibitions
The most restrictive form flatly prohibits assignment without exception. Language such as "Neither party may assign this Agreement under any circumstances" leaves no room for consent or negotiation. These clauses are relatively uncommon in negotiated commercial agreements but appear frequently in form contracts and adhesion agreements. When they surface in material contracts, they require careful attention to whether the contemplated transaction structure constitutes an "assignment" under applicable law.
### Consent-Required Provisions
The most common variant permits assignment with the other party's prior written consent. The critical sub-question is whether consent may be withheld at the counterparty's sole discretion or only on a "reasonable" basis. A clause requiring consent "not to be unreasonably withheld" gives the assignor significantly more leverage than one granting the counterparty absolute discretion. During diligence, flagging this distinction across hundreds of contracts can materially affect the consent solicitation strategy and timeline.
### Change of Control Triggers
Some anti-assignment clauses explicitly address changes of control, capturing indirect transfers that might otherwise fall outside a traditional "assignment" analysis. Language such as "any change in the controlling ownership of a party shall be deemed an assignment" extends the restriction to stock acquisitions and mergers that do not involve a direct contractual assignment. These provisions are particularly significant in private equity transactions where the operating entity may remain the same but the ultimate ownership changes.
## Does a Merger Constitute an Assignment?
This is one of the most frequently litigated questions at the intersection of contract law and M&A. The answer depends on three factors: the clause language, the governing law, and the transaction structure.
**Clause language matters most.** A provision that restricts "assignment by operation of law" or "any change of control, whether direct or indirect" is far more likely to capture a merger than one that simply prohibits "assignment" without further elaboration.
**Governing law creates divergence.** Many U.S. jurisdictions follow the rule that a merger by operation of law does not constitute an "assignment" unless the contract language specifically says otherwise. Delaware, where many target entities are organized, generally follows this principle. However, the analysis varies by state, and some jurisdictions take a broader view. International contracts add another layer of complexity.
**Transaction structure can be a lever.** A reverse triangular merger, where the target survives as a subsidiary of the acquirer, may avoid triggering assignment clauses that a forward merger or asset purchase would activate. Deal counsel frequently structure transactions specifically to navigate the anti-assignment landscape in the target's contract portfolio.
## Practical Implications for Deal Teams
The operational impact of anti-assignment clauses extends well beyond legal risk. They affect deal timeline, purchase price, and post-closing integration.
**Consent solicitation takes time.** When material contracts require counterparty consent, the consent process can add weeks or months to the deal timeline. Counterparties may use consent requests as leverage to renegotiate pricing, service levels, or other terms. Identifying which contracts require consent, and prioritizing them by materiality, must happen early in diligence.
**Purchase price adjustments.** Contracts that cannot be assigned or that carry significant consent risk may warrant purchase price adjustments. A customer contract worth $5 million annually with a blanket prohibition on assignment represents a different risk profile than one with a consent-required clause and a cooperative counterparty.
**Post-closing risk allocation.** The purchase agreement should address what happens when consent is not obtained before closing. Interim operating arrangements, efforts covenants (reasonable efforts, best efforts, commercially reasonable efforts), and indemnification for lost contracts are all standard mechanisms, but they require accurate identification of the at-risk contracts during diligence.
## Scaling Assignment Clause Review Across a Data Room
A typical mid-market data room contains hundreds of commercial agreements, each with its own assignment provision. Manually reviewing every contract for assignment restrictions, categorizing each clause by type, and building a risk matrix is precisely the kind of high-volume, pattern-recognition work that consumes associate hours without requiring deep legal judgment on each individual contract.
AI-powered [contract review](/contract-review) tools can extract and categorize anti-assignment provisions across an entire data room simultaneously. Instead of reading 300 contracts to find the 15 with problematic assignment language, deal teams can work from a structured extraction that identifies every assignment clause, flags the variant type, notes whether consent can be unreasonably withheld, and highlights change of control triggers. This allows attorneys to spend their time on the contracts that actually require judgment rather than the contracts that simply require reading.
The combination of automated [clause extraction](/clause-extraction) with attorney oversight is particularly effective for assignment clauses because the risk is binary and high-impact. You either identified the restriction before signing or you did not. There is no partial credit.
## Structuring Around Assignment Restrictions
When diligence reveals problematic anti-assignment clauses, deal teams have several structural options.
**Reverse triangular mergers** preserve the target entity as a surviving subsidiary, potentially avoiding "assignment" triggers in contracts that do not have change of control language. This is the most common structural solution.
**Asset purchases with assumption agreements** allow selective assumption of contracts, but they generally constitute an "assignment" under most contract law frameworks, requiring counterparty consent for restricted contracts.
**Novation agreements** replace the original contract with a new agreement between the counterparty and the acquirer. These are most practical for a small number of high-value contracts where the counterparty relationship is strong.
**Pre-closing consent solicitation** addresses the issue directly by obtaining counterparty waivers before the deal closes. The risk is that counterparties may demand concessions, refuse consent, or use the request as an opportunity to terminate.
---
An anti-assignment clause is a contractual provision that restricts or prohibits one or both parties from transferring their rights, obligations, or interests under the agreement to a third party without the other party's consent. These clauses are standard in commercial contracts and become critically important during M&A transactions where the acquiring entity effectively steps into the target's contractual shoes.
Whether a merger triggers an anti-assignment clause depends on the specific language of the provision and the governing law. Many jurisdictions hold that a merger by operation of law is not an "assignment" unless the clause explicitly covers mergers or changes of control. However, some contracts include broad language that captures any transfer, including by operation of law, making careful review of each clause essential during diligence.
AI-powered contract review tools can scan hundreds of agreements simultaneously and extract anti-assignment provisions with their specific trigger conditions, consent requirements, and remedies. This allows deal teams to build a comprehensive risk matrix across the entire contract portfolio in hours rather than weeks, ensuring no critical assignment restriction goes undetected before signing.
Violating an anti-assignment clause can have severe consequences including automatic termination of the contract, the counterparty gaining the right to terminate at will, breach of contract claims, or the assignment being deemed void. In M&A, this can mean losing key customer contracts, vendor relationships, or licensed intellectual property that was material to the deal thesis.
## Stop Missing Assignment Restrictions in Your Data Rooms
Mage extracts and categorizes every anti-assignment clause across your entire contract portfolio, flagging consent requirements, change of control triggers, and blanket prohibitions so your team can build an accurate risk matrix before signing.
Request a Demo
---
## URL: https://magelegal.com/blog/most-favored-nation-clauses-mfn-manda
### Title: Most Favored Nation Clauses in M&A: Pricing, Compliance, and Deal Impact
### Author: Mage Team
A most favored nation (MFN) clause is a contractual provision that guarantees a counterparty the most favorable pricing, terms, or conditions that the company offers to any comparable customer or partner. When triggered, the MFN holder receives an automatic adjustment to match or exceed the best terms available elsewhere in the company's portfolio. In M&A, these provisions create ongoing compliance obligations that the acquirer inherits, and they can fundamentally constrain post-acquisition pricing strategy, customer management, and revenue optimization across the combined entity.
- Most favored nation (MFN) clauses guarantee a counterparty the best pricing, terms, or conditions that the company offers to any comparable customer, creating an ongoing compliance obligation that follows the contract through an acquisition
- MFN clauses can constrain post-acquisition pricing strategy, prevent the acquirer from offering preferential terms to strategic accounts, and create cascading price reductions across the customer base
- The scope of the MFN comparison, whether it covers pricing only, all commercial terms, or specific service levels, determines the actual constraint on the combined entity's commercial flexibility
- Systematic extraction of MFN provisions across a data room reveals the pricing floor for the entire customer portfolio and identifies contracts that will limit post-acquisition commercial strategy
## How MFN Clauses Work
The mechanics of an MFN clause are straightforward in concept but complex in application.
**The guarantee.** The MFN holder is entitled to terms at least as favorable as those offered to any other comparable counterparty. If the company offers Customer B a 15% discount and Customer A has an MFN clause, Customer A is automatically entitled to at least a 15% discount.
**The trigger.** The MFN obligation is triggered whenever the company enters into a new arrangement or modifies an existing arrangement that offers more favorable terms to a comparable counterparty. Some MFN clauses are self-executing (the adjustment happens automatically), while others require the MFN holder to request an audit or comparison.
**The comparison standard.** This is where MFN clauses diverge significantly. A broad MFN that compares against "any customer" creates a much larger constraint than one that compares against "similarly situated customers purchasing comparable volumes." The comparison standard determines the practical scope of the obligation.
**The remedy.** When an MFN is triggered, the typical remedy is an automatic price adjustment or term modification. Some MFN clauses also include audit rights that allow the MFN holder to verify compliance, retroactive adjustments for the period during which more favorable terms were offered elsewhere, and termination rights if the company fails to comply.
## Why MFN Clauses Create Problems in M&A
The challenges that MFN clauses create in acquisitions fall into three categories.
### Pricing Floor Effects
When the acquirer and target have overlapping customer bases with different pricing structures, MFN clauses in either entity's contracts can force pricing adjustments across the combined portfolio. If the target's Customer A has an MFN clause and the acquirer offers lower pricing to its existing Customer B for the same service, the MFN may require extending that lower pricing to Customer A, reducing revenue without gaining any new business.
This cascading effect can be significant. If multiple customers hold MFN rights, a single pricing concession to one customer can trigger adjustments across the portfolio, eroding margins on a portfolio-wide basis.
### Strategic Pricing Constraints
Post-acquisition, companies frequently want to implement strategic pricing to win key accounts, retain at-risk customers, or penetrate new markets. MFN clauses limit this flexibility because any preferential pricing offered to a strategic target becomes the new floor for every MFN-protected customer.
This constraint can prevent the acquirer from executing common commercial strategies: introductory pricing for new market segments, volume discounts for large accounts, or competitive win-back pricing for churning customers.
### Compliance Complexity
MFN compliance requires ongoing monitoring of the company's pricing and terms across its entire customer portfolio. Every new deal, every contract renewal, and every negotiated concession must be evaluated against existing MFN obligations. For a combined entity with hundreds of customer contracts, this compliance burden is substantial and the risk of inadvertent breach is real.
## Identifying MFN Provisions in Due Diligence
MFN clauses are notoriously difficult to find through manual review because they appear under many different names and in unexpected locations within agreements.
**Naming variations.** MFN provisions may be labeled as "most favored nation," "most favored customer," "pricing parity," "best pricing guarantee," "comparable terms," or "price matching" clauses. Some contracts achieve the same economic effect through "benchmarking" or "competitive pricing" provisions without using traditional MFN terminology.
**Location variations.** While some MFN clauses appear as standalone provisions, others are embedded in pricing schedules, service level agreements, side letters, or amendments that may not be included in the primary contract file in the data room.
**Scope variations.** The practical constraint of an MFN clause depends on its scope, which varies significantly across contracts. Some MFN provisions cover only base pricing. Others extend to all commercial terms including service levels, payment terms, warranty coverage, and indemnification.
AI-powered [clause extraction](/clause-extraction) is particularly valuable for MFN identification because the provisions use inconsistent terminology and appear in varied locations. A systematic extraction that searches across all naming conventions, document sections, and agreement types is the most reliable method for building a complete MFN inventory.
## Assessing MFN Impact on Deal Economics
Once identified, MFN provisions must be analyzed for their economic impact on the combined entity.
**Pricing scenario analysis.** For each MFN clause, model the impact of combining the acquirer's and target's pricing structures. Identify which MFN provisions would be triggered by the pricing differential and quantify the revenue impact of the required adjustments.
**Term integration conflicts.** Beyond pricing, evaluate whether differences in service levels, payment terms, or other commercial terms between the two entities' contracts would trigger MFN adjustments.
**Compliance cost.** Estimate the ongoing cost of MFN compliance monitoring for the combined entity. For companies with large contract portfolios, this can require dedicated resources or automated monitoring systems.
**Termination and modification options.** Identify which MFN provisions have expiration dates, can be renegotiated upon renewal, or are tied to performance benchmarks that allow modification. These mechanisms represent opportunities to reduce MFN constraints over time.
## Managing MFN Risk Post-Closing
Acquirers who identify MFN provisions during [M&A diligence](/ma-diligence) can plan proactively rather than discovering pricing constraints reactively.
**Carve-out negotiations.** Before closing, negotiate carve-outs with MFN-protected counterparties that exclude the acquirer's existing pricing from the MFN comparison. This requires counterparty cooperation but can prevent cascading price adjustments.
**Pricing structure harmonization.** Design the post-acquisition pricing structure to account for MFN obligations from the outset, avoiding inadvertent triggers during integration.
**Contract renewal strategy.** Prioritize MFN-protected contracts for early renewal negotiation, using the renewal as an opportunity to narrow or eliminate the MFN provision.
**Segment-based pricing.** Structure pricing by customer segment, geography, or service tier in ways that place MFN-protected customers in their own comparison group, limiting the scope of the comparison standard.
Comprehensive [contract review](/contract-review) that identifies every MFN provision, maps its scope and trigger mechanism, and models its economic impact gives deal teams the information they need to manage this risk effectively from day one.
---
A most favored nation (MFN) clause is a contractual provision that guarantees one party will receive terms at least as favorable as those offered to any other comparable customer, supplier, or partner. If the company offers better pricing, service levels, or commercial terms to another counterparty, the MFN holder is automatically entitled to those improved terms. These clauses create ongoing compliance obligations that can significantly constrain pricing and commercial strategy.
MFN clauses affect M&A transactions by constraining the combined entity's pricing and commercial strategy post-closing. If the acquirer's existing customers have different pricing than the target's MFN-protected customers, the MFN may require the acquirer to extend its best pricing across the combined customer base. This can erode revenue, prevent strategic pricing differentiation, and create cascading adjustments across multiple contracts.
MFN clauses are generally enforceable as standard contractual provisions, though enforcement depends on the clarity of the comparison standard and the scope of the obligation. Broadly worded MFN clauses that compare across all customers without qualification create clearer enforcement rights than narrow provisions that require comparison only among similarly situated customers. Courts typically enforce MFN provisions according to their terms, making the specific language of each clause critically important during diligence.
MFN clauses appear under various names including "most favored nation," "most favored customer," "pricing parity," "best pricing," and "comparable terms" provisions. They may be embedded in pricing schedules, general terms sections, or side letters rather than appearing as standalone clauses. AI-powered contract review tools can identify these provisions across all naming conventions and locations, extracting the comparison scope, trigger mechanism, and remedy for each MFN obligation in the data room.
## Uncover Every MFN Obligation Before It Erodes Your Deal Economics
Mage identifies MFN provisions across all naming conventions and document locations, extracting comparison scopes, trigger mechanisms, and remedies so your deal team can model the true pricing impact of the acquisition.
Request a Demo
---
## URL: https://magelegal.com/blog/loi-to-closing-deal-attorney-diligence-guide
### Title: LOI to Closing: The Deal Attorney's Diligence Timeline
### Author: Mage Team
LOI due diligence is the structured investigation period between signing a letter of intent and closing an M&A transaction. It is where deal attorneys identify the legal, financial, and operational risks that will shape the purchase agreement, determine the closing conditions, and ultimately decide whether the deal proceeds at all. Getting the timeline and sequencing right is the difference between a smooth closing and a deal that stalls.
- The period between LOI and closing typically runs 60 to 90 days, but the critical path is set in the first two weeks by how quickly you scope your diligence workstreams
- Prioritize material contracts and regulatory approvals early because they create the longest tail risks and drive the most purchase agreement negotiations
- Parallel workstreams across legal, financial, tax, and operational diligence prevent sequential bottlenecks that compress the pre-closing period
- AI-assisted document review can compress the initial contract review phase from weeks to days, giving deal teams more time for substantive legal analysis
## Phase 1: The First 48 Hours After LOI Execution
The clock starts the moment the LOI is signed. The first 48 hours set the tempo for everything that follows.
**Issue the document request list immediately.** Most experienced deal teams maintain template request lists organized by document category: corporate records, material contracts, intellectual property, employment, real property, environmental, litigation, tax, and insurance. Tailor the template to the target's industry and the deal structure, then deliver it to seller's counsel before the end of day one.
**Establish the data room.** Coordinate with seller's counsel on the virtual data room platform, folder structure, and access permissions. The faster documents start flowing, the sooner your team can begin substantive review. A well-organized data room with consistent naming conventions saves hours of sorting later. For more on this, see our guide on [data room organization](/blog/data-room-organization-what-partners-want).
**Assign workstreams.** Map each diligence category to a responsible attorney or advisor. Legal diligence typically splits into corporate, contracts, employment, IP, real property, and regulatory. Financial, tax, and operational diligence run in parallel with their respective advisors.
## Phase 2: Weeks 1 Through 3 - The Initial Review Sprint
This is where the bulk of document review happens. Your team is working through hundreds or thousands of documents across every diligence category simultaneously.
### Material Contract Review
Material contracts are the heart of legal diligence. They determine what obligations transfer, what consents are required, and where the risk profile sits. Focus on:
- **Change-of-control provisions** that could trigger termination rights or acceleration clauses
- **Assignment and consent requirements** that need third-party action before closing
- **Non-compete and exclusivity provisions** that could constrain the combined entity
- **Indemnification and limitation of liability terms** that affect risk allocation
- **Renewal and termination mechanics** that impact go-forward value
Reviewing material contracts manually across a large data room can consume weeks of associate time. [AI-powered contract review](/contract-review) tools can extract these provisions across all contracts simultaneously, giving the deal team a structured view of risk within days rather than weeks.
### Regulatory and Compliance Review
Regulatory issues create the longest timelines because they depend on government agencies, not the parties. Identify these early:
- **HSR Act filing requirements** based on transaction size and party revenues
- **Industry-specific approvals** (banking regulators, insurance commissioners, FCC, state attorneys general)
- **Foreign investment reviews** (CFIUS for national security, foreign equivalents for cross-border deals)
- **Environmental permits and compliance** that may require transfer or reissuance
### Corporate and Organizational Review
Confirm the target's corporate structure, capitalization, and authority to consummate the transaction. Review charter documents, board minutes, stockholder agreements, and organizational charts. Identify any structural issues that need to be addressed before closing.
## Phase 3: Weeks 3 Through 5 - Issue Identification and Negotiation
By week three, your team should have a comprehensive picture of the target's legal landscape. The focus shifts from review to analysis and negotiation.
**Build the issues list.** Consolidate findings from all workstreams into a single issues list that categorizes items by severity, assigns responsibility, and tracks resolution status. This becomes the central document driving purchase agreement negotiations.
**Draft the purchase agreement.** The diligence findings directly inform the representations and warranties, indemnification provisions, closing conditions, and disclosure schedules. Issues identified in contract review shape specific indemnity carve-outs. Regulatory findings determine closing conditions and required approvals.
**Negotiate based on substance.** The deal team with the clearest picture of the target's risk profile has the strongest negotiating position. [Structured extraction and analysis](/clause-extraction) gives your team the data to support every negotiating point with specific contract references.
## Phase 4: Weeks 5 Through 8 - Pre-Closing Execution
The final phase is execution. The purchase agreement is in final form, and the focus is on satisfying closing conditions.
**Third-party consents.** Track every required consent, the party responsible for obtaining it, and its status. Material contract consents often require direct outreach to counterparties, and some will require negotiation of consent terms.
**Regulatory approvals.** Monitor the status of all regulatory filings. Respond promptly to any requests for additional information. Coordinate with regulatory counsel on timing and strategy.
**Closing deliverables.** Prepare the closing checklist, organize signature pages, coordinate wire instructions, and confirm that all conditions precedent have been satisfied or waived.
**Disclosure schedules.** Compile the disclosure schedules based on your diligence findings. These are the concrete output of the entire diligence process, translating months of review into the representations that survive closing.
## Common Timeline Killers
Deals stall for predictable reasons. Knowing them helps you prevent them.
**Late discovery of consent requirements.** A change-of-control provision in a material customer contract discovered in week six instead of week one can delay closing by weeks while the parties negotiate with the counterparty. This is the single strongest argument for [comprehensive contract review](/ma-diligence) early in the process.
**Regulatory surprises.** A deal that requires an unanticipated regulatory approval can add months to the timeline. Industry-specific regulatory analysis should happen in the first week, not the third.
**Incomplete data rooms.** Sellers that populate the data room slowly create cascading delays across every workstream. Establish clear expectations for document delivery timing in the LOI itself.
**Scope creep in negotiations.** Diligence findings should narrow the negotiation, not expand it. A well-organized issues list with clear severity ratings helps the deal team focus on what matters.
## Building a Repeatable Process
The best deal teams treat diligence as a process, not an ad hoc exercise. They maintain template request lists, standardized workstream assignments, and consistent reporting formats. They use technology to accelerate the document review phase so attorneys can focus on judgment calls rather than document sorting.
The shift from manual review to [AI-assisted diligence](/ma-diligence) does not replace attorney judgment. It compresses the time between "documents received" and "issues identified," giving deal teams more time for the substantive analysis and negotiation that actually drives deal outcomes.
---
Most M&A transactions close 60 to 90 days after LOI execution, though complex deals with regulatory approvals can extend to 120 days or more. The diligence period itself usually runs 30 to 45 days, with the remaining time allocated to purchase agreement negotiation, third-party consents, and regulatory filings. The key variable is how quickly the initial document review identifies issues that require negotiation.
The first week should focus on three things: issuing a comprehensive document request list, establishing the data room structure with the seller's counsel, and scoping workstream assignments across your diligence team. Early prioritization of material contracts, regulatory filings, and change-of-control provisions prevents bottlenecks later in the process.
The most common delays stem from late discovery of regulatory approval requirements, third-party consent provisions in material contracts, and unresolved title or lien issues. These items share a common trait: they depend on third parties outside the deal team's control. Identifying them in the first two weeks of diligence gives the team maximum time to resolve them before the target closing date.
AI-powered document review tools can classify and extract key provisions from hundreds of contracts in minutes rather than weeks. This compresses the initial review phase and surfaces issues like change-of-control triggers, assignment restrictions, and non-standard indemnification terms early in the process. Deal attorneys then spend their time on substantive analysis and negotiation rather than manual document review.
## Compress Your Diligence Timeline
Upload a data room and get structured extraction across every agreement in minutes. Mage identifies the issues that matter so your deal team can focus on negotiation, not document review.
Request a Demo
---
## URL: https://magelegal.com/blog/financial-services-manda-regulatory-approval
### Title: Financial Services M&A: Regulatory Approvals and Compliance Due Diligence
### Author: Mage Team
Financial services M&A is the acquisition of businesses subject to prudential financial regulation, including banks, broker-dealers, insurance companies, investment advisers, and specialty finance companies. It is unique among M&A practice areas because every material transaction requires affirmative regulatory approval before closing. Unlike most industries where the parties control the closing timeline, financial services deals close when the regulators say they close.
- Financial services M&A is defined by regulatory gatekeeping: no bank, broker-dealer, or insurance company acquisition closes without affirmative approval from one or more regulators, making the regulatory timeline the transaction's critical path
- Bank M&A requires concurrent approvals from federal regulators (FDIC, OCC, Federal Reserve) and state banking departments, with each regulator applying its own substantive standards and processing timelines
- Broker-dealer acquisitions trigger FINRA change-of-ownership approval requirements and a continuing membership application process that can take 90 to 180 days
- Community Reinvestment Act performance, Bank Secrecy Act compliance, and fair lending records are evaluated by regulators during the approval process, and deficiencies can delay or block approval
## Bank Acquisition Regulatory Framework
### Federal Banking Regulators
Bank acquisitions require approval from the target bank's primary federal regulator. The applicable regulator depends on the target's charter type:
- **Office of the Comptroller of the Currency (OCC)**: National banks and federal savings associations
- **Federal Deposit Insurance Corporation (FDIC)**: State-chartered banks that are not members of the Federal Reserve System
- **Federal Reserve Board**: State-chartered member banks, bank holding companies, and savings and loan holding companies
Each regulator evaluates the same core factors but applies different procedural requirements and timelines:
**Competitive effects.** Regulators assess whether the acquisition would substantially lessen competition in relevant banking markets. The Department of Justice also reviews bank mergers under the antitrust laws and can challenge transactions that exceed concentration thresholds.
**Financial and managerial resources.** The acquirer must demonstrate adequate capital, competent management, and sound financial condition. Regulators evaluate pro forma capital ratios, earnings projections, and management team qualifications.
**Community Reinvestment Act performance.** The CRA records of both the acquirer and the target are evaluated. Poor CRA ratings, unresolved CRA protests, or inadequate lending in low-and moderate-income communities can delay or block approval.
**Financial stability.** For larger transactions, regulators assess the acquisition's impact on the stability of the U.S. banking system.
### State Banking Regulators
In addition to federal approval, most bank acquisitions require approval from the state banking department where the target is chartered. State regulators evaluate similar factors but may impose additional conditions specific to state law.
For interstate acquisitions, state age and deposit cap restrictions may apply. Each state has its own requirements governing the acquisition of banks chartered in that state by out-of-state acquirers.
### Application Timeline Management
The regulatory approval process is the longest item on most bank deal timelines. Effective deal teams:
- **File applications promptly after signing** to start the regulatory clock as early as possible
- **Pre-file with regulators** to identify potential issues before formal submission
- **Coordinate federal and state filings** to run concurrently rather than sequentially
- **Monitor public comment periods** and respond proactively to any protests
- **Maintain open communication** with assigned regulatory examiners throughout the review
## Compliance Due Diligence
Financial services compliance diligence goes beyond standard contract review because regulators evaluate the target's compliance posture as part of the approval process. Compliance deficiencies discovered by the regulator can delay or deny approval.
### Bank Secrecy Act and Anti-Money Laundering
BSA/AML compliance is a threshold regulatory concern. Review the target's:
- **BSA/AML compliance program** structure, including designated BSA officer, policies, procedures, and training
- **Suspicious Activity Report (SAR) filing** history and trending
- **Currency Transaction Report (CTR)** filing accuracy and timeliness
- **Customer identification and due diligence** procedures (CIP, CDD, enhanced due diligence)
- **OFAC screening** procedures and any matches or false positive handling
- **Regulatory examination history** for BSA/AML findings, matters requiring attention, or enforcement actions
- **Independent BSA/AML audit** results and management's response to findings
A target with unresolved BSA/AML deficiencies or a consent order related to BSA compliance will face heightened regulatory scrutiny that can delay approval by months.
### Fair Lending
Regulators review fair lending compliance as part of the approval process. Assess the target's:
- **Fair lending compliance program** and designated fair lending officer
- **HMDA data analysis** for disparities in lending patterns
- **Pricing exception tracking** and justification documentation
- **Regulatory examination findings** related to fair lending
- **Complaint history** related to discrimination allegations
### Examination History and Enforcement Actions
Obtain and review the target's recent regulatory examination reports (typically the last two examination cycles):
- **CAMELS ratings** (composite and component ratings for banks)
- **Matters requiring attention (MRAs)** and management's response
- **Consent orders, cease and desist orders, or civil money penalties**
- **Memoranda of understanding (MOUs)** with regulators
- **Status of remediation** for any outstanding issues
Unresolved examination findings and open enforcement actions are the most common source of regulatory delay in bank M&A.
## Broker-Dealer Acquisitions
### FINRA Continuing Membership Application
Any change of ownership or control of a FINRA member broker-dealer requires FINRA approval through the continuing membership application (CMA) process under FINRA Rule 1017.
The CMA requires detailed disclosure of:
- The proposed new owners' backgrounds, including Form U4 history
- The firm's proposed supervisory structure and compliance systems
- Financial projections and net capital adequacy
- Anticipated changes to the firm's business model
- Any disciplinary history of the proposed new ownership
FINRA's review period is 180 days from filing a complete application. The application is reviewed by FINRA's Member Regulation department, and the firm may receive requests for additional information that effectively extend the timeline.
### SEC and State Registration
Depending on the deal structure, the broker-dealer may need to:
- Amend its Form BD with the SEC to reflect the change of ownership
- Update registrations in states where it is registered
- Obtain new state approvals if the change of ownership triggers re-registration requirements
### Customer Account Transfer
Broker-dealer acquisitions often involve the transfer of customer accounts. The ACATS (Automated Customer Account Transfer System) process and FINRA rules governing customer account transfers must be followed. Customer notification and consent requirements apply.
## Insurance Company Acquisitions
Insurance company acquisitions require approval from the state insurance department where the target is domiciled, plus potential approvals from states where the target holds licenses.
### Form A Filing
The standard state insurance regulatory filing is the Form A, which requires disclosure of:
- The acquirer's identity, background, and financial condition
- The source and structure of acquisition financing
- Plans for the target's future operations
- Pro forma financial projections for the target
- Any proposed changes to management, board composition, or reinsurance arrangements
### Holding Company Act Compliance
If the target is part of an insurance holding company system, the state's insurance holding company act may impose additional approval requirements and ongoing reporting obligations.
## Contract Portfolio Analysis
Beyond regulatory compliance, financial services targets have contract portfolios with unique provisions.
### Loan Documentation
For bank acquisitions, review a sample of the loan portfolio for:
- Credit agreement terms, covenants, and default provisions
- Collateral documentation completeness
- Loan modification and workout history
- Participation and syndication arrangements
### Deposit Agreements and Customer Contracts
Review the target's standard form agreements for:
- Assignment and change-of-control provisions
- Rate and fee structures
- Arbitration provisions and class action waivers
- Privacy notices and data sharing terms
### Vendor and Service Provider Agreements
Financial services companies often rely on third-party vendors for core functions. Review vendor agreements for:
- Change-of-control provisions that could allow the vendor to terminate
- Service level agreements and business continuity provisions
- Data security and privacy compliance requirements
- Regulatory compliance obligations passed through to vendors
[AI-powered contract extraction](/clause-extraction) is particularly valuable for financial services diligence because the volume of loan documents, customer agreements, and vendor contracts can be overwhelming. Extracting change-of-control provisions, assignment restrictions, and key commercial terms across the portfolio gives the deal team a structured foundation for regulatory analysis.
## Coordinating Diligence with Regulatory Strategy
The most important lesson in financial services M&A is that diligence and regulatory strategy are inseparable. Every compliance deficiency discovered during diligence has the potential to become a regulatory issue during the approval process. Every regulatory concern identified through pre-filing discussions should drive additional targeted diligence.
Deal teams that treat diligence and regulatory approval as parallel but connected workstreams, rather than sequential steps, execute financial services transactions more efficiently and with fewer surprises.
---
Bank acquisitions require approval from the target's primary federal regulator (OCC for national banks, FDIC for state nonmember banks, Federal Reserve for state member banks and bank holding companies) and the applicable state banking department. If the acquisition involves a bank holding company, Federal Reserve approval under the Bank Holding Company Act is also required. Each regulator evaluates the transaction's competitive effects, financial and managerial resources of the acquirer, CRA performance, and anti-money laundering compliance.
The regulatory approval timeline for bank acquisitions typically ranges from 90 to 180 days from application filing, though complex transactions or applications with issues can take longer. The FDIC and OCC have statutory processing periods of 60 days, but these are frequently extended. Federal Reserve applications under the Bank Holding Company Act have a 91-day statutory period. Public comment periods, CRA protests, and requests for additional information can all extend the timeline significantly.
Regulators can delay or deny financial services acquisitions based on Bank Secrecy Act and anti-money laundering compliance deficiencies, poor Community Reinvestment Act performance ratings, fair lending violations or pattern-and-practice concerns, inadequate capital levels or financial condition of the acquirer, management quality and integrity concerns, and competitive effects that substantially reduce competition in relevant banking markets. Historical enforcement actions against either party are also scrutinized.
FINRA reviews broker-dealer changes of ownership through the continuing membership application (CMA) process under FINRA Rule 1017. The CMA evaluates the proposed new ownership's financial condition, supervisory structure, compliance history, and business plan. FINRA's review period is 180 days from filing a complete application. The process requires detailed disclosure of the proposed owners' backgrounds, the firm's compliance and supervisory systems, and any anticipated changes to the firm's business model.
## Accelerate Contract Diligence for Financial Services Deals
Mage extracts change-of-control provisions, assignment restrictions, and key commercial terms across loan documents, vendor agreements, and customer contracts in minutes. Your team focuses on the regulatory analysis that determines whether the deal closes.
Request a Demo
---
## URL: https://magelegal.com/blog/manufacturing-manda-environmental-supply-chain
### Title: Manufacturing M&A Due Diligence: Environmental Liabilities and Supply Chain Risks
### Author: Mage Team
Manufacturing M&A due diligence is the process of evaluating the environmental, operational, and supply chain risks specific to acquiring a manufacturing business. It requires diligence into areas that rarely arise in other industries: contaminated real property, complex supply chain dependencies, heavy equipment obligations, and labor union relationships. Each of these areas can carry liabilities that significantly exceed what the balance sheet reflects.
- Environmental liabilities are the single largest category of post-closing surprise in manufacturing M&A because contamination can exist for decades before discovery, and CERCLA imposes strict, joint and several liability on current property owners
- Supply chain concentration risk requires analysis beyond the target's direct suppliers: review the full contract portfolio for single-source dependencies, take-or-pay obligations, and change-of-control triggers that could disrupt supply post-closing
- Equipment leases and capital expenditure obligations often represent significant off-balance-sheet commitments that directly affect the target's cash flow projections and purchase price negotiations
- Union collective bargaining agreements create successor obligations that affect labor costs, operational flexibility, and integration timelines, and must be analyzed in the context of the specific deal structure
## Environmental Liability Assessment
Environmental risk dominates manufacturing diligence for a simple reason: CERCLA (the Comprehensive Environmental Response, Compensation, and Liability Act) imposes strict, joint and several liability on current owners and operators of contaminated property, regardless of when the contamination occurred or who caused it. A buyer that acquires a manufacturing facility acquires its environmental history.
### Phase I and Phase II Environmental Site Assessments
**Phase I ESA** is the standard starting point. It involves a review of historical records, site inspection, and interviews to identify recognized environmental conditions (RECs) that indicate potential contamination. A Phase I ESA that meets the ASTM E1527-21 standard provides the "all appropriate inquiries" defense under CERCLA, which can limit the buyer's liability for pre-existing contamination.
**Phase II ESA** follows when the Phase I identifies RECs. It involves physical sampling and analysis of soil, groundwater, and building materials to confirm or rule out contamination and characterize its extent. The cost and timeline for Phase II work varies significantly based on site conditions.
For manufacturing targets with multiple operating facilities, conducting Phase I ESAs on all material properties is standard practice. Phase II work should be prioritized based on the Phase I findings, the facility's operational history, and the likelihood of contamination.
### Regulatory Compliance Review
Beyond contamination risk, review the target's compliance with environmental regulations:
- **Air quality permits** and emission compliance records
- **Water discharge permits** (NPDES and state equivalents) and monitoring data
- **Hazardous waste management** practices, generator status, and disposal records
- **EPCRA reporting** (Toxic Release Inventory, chemical inventory)
- **Storage tank** registrations, inspection records, and leak detection results
- **Asbestos and lead-based paint** surveys for pre-1980 facilities
Non-compliance can create immediate regulatory liability and may require capital expenditures to remediate. Assess whether the target has any consent decrees, administrative orders, or pending enforcement actions.
### Remediation Obligations
Identify any existing or potential remediation obligations:
- Active cleanup sites with cost estimates and timelines
- Superfund site involvement as a potentially responsible party
- State voluntary cleanup program participation
- Environmental insurance policies that may cover remediation costs
- Indemnification agreements from prior property owners or operators
Remediation cost estimates should be evaluated critically. Initial estimates often understate actual costs as the scope of contamination becomes better understood during cleanup.
## Supply Chain Contract Analysis
Manufacturing businesses depend on supply chain relationships in ways that service businesses do not. A disruption in a critical raw material or component can halt production entirely.
### Identifying Concentration Risk
Map the target's supplier relationships to identify concentration:
- **Single-source suppliers** for critical inputs that cannot be quickly replaced
- **Top-10 supplier concentration** as a percentage of total procurement
- **Geographic concentration** that creates vulnerability to regional disruptions
- **Commodity exposure** and hedging practices for raw material price volatility
### Contract Provision Review
[Extract key provisions](/clause-extraction) from supply agreements across the portfolio:
- **Term and renewal mechanics**: Are critical supply relationships on long-term contracts or spot arrangements?
- **Change-of-control provisions**: Can suppliers terminate or renegotiate upon an acquisition?
- **Take-or-pay obligations**: What minimum purchase commitments exist regardless of demand?
- **Pricing mechanisms**: Are prices fixed, indexed to commodities, or subject to annual negotiation?
- **Force majeure provisions**: How is supply disruption risk allocated between the parties?
- **Exclusivity restrictions**: Is the target restricted from sourcing from alternative suppliers?
A target with a single-source supplier for a critical component, a short-term contract, and a change-of-control termination right represents a supply continuity risk that must be addressed before closing.
### Customer Contract Review
Manufacturing targets often have long-term customer contracts that represent the revenue base. Review these for:
- **Volume commitments and minimum purchase obligations** from customers
- **Pricing adjustment mechanisms** and pass-through rights for raw material cost increases
- **Quality specifications and warranty obligations** that affect manufacturing costs
- **Termination rights** including convenience termination provisions
- **Change-of-control provisions** that could allow customers to exit post-closing
## Equipment and Capital Expenditure Analysis
Manufacturing businesses are capital-intensive. The condition and cost structure of the target's equipment directly affects valuation.
### Equipment Assessment
- **Age and condition** of critical production equipment
- **Remaining useful life** estimates from engineering assessments
- **Deferred maintenance** backlog that represents future capital requirements
- **Capacity utilization** rates that indicate whether additional investment is needed for growth
- **Compliance-driven upgrades** required by environmental, safety, or quality regulations
### Lease and Financing Obligations
Equipment leases are common in manufacturing and can represent significant off-balance-sheet commitments:
- **Operating leases** for equipment, vehicles, and machinery
- **Capital leases and equipment financing** obligations
- **Real property leases** for manufacturing facilities, warehouses, and distribution centers
- **Lease assignment and change-of-control provisions** that could require landlord or lessor consent
Catalog all lease obligations with their terms, payment schedules, and assignment provisions. These fixed commitments directly affect the target's free cash flow and should be factored into purchase price analysis.
## Labor and Union Considerations
### Collective Bargaining Agreements
For unionized manufacturing targets, review all CBAs for:
- **Wage scales and escalation provisions** that determine labor cost trajectory
- **Benefits obligations** including pension, health insurance, and retiree benefits
- **Work rules and job classifications** that affect operational flexibility
- **Grievance and arbitration procedures** and any pending grievances
- **Contract expiration dates** and negotiation history
- **Successorship provisions** that may bind the buyer to existing CBA terms
### Pension and Benefit Obligations
Manufacturing targets with defined benefit pension plans or multiemployer pension participation require careful analysis:
- **Defined benefit plan funding status** and PBGC premiums
- **Multiemployer pension plan withdrawal liability** exposure
- **Retiree health benefit obligations** (OPEB)
- **WARN Act compliance** requirements if workforce reductions are contemplated
Multiemployer pension withdrawal liability is particularly consequential. A buyer that triggers a withdrawal from a multiemployer plan can face liability equal to the buyer's allocable share of the plan's unfunded vested benefits, which can amount to tens of millions of dollars.
## Real Property Considerations
Manufacturing facilities have unique real property diligence requirements:
- **Zoning and land use** compliance for current and intended operations
- **Structural condition** of facilities including roofing, foundation, and HVAC systems
- **Utility infrastructure** capacity (power, water, wastewater) for current and planned production levels
- **Access and easement** rights for trucks, rail, and utility connections
- **Property tax** assessments and abatement agreements
## Running Manufacturing Diligence Efficiently
The volume of contracts, permits, environmental records, and regulatory filings in manufacturing diligence is substantial. Deal teams that rely entirely on manual review often run out of time before they run out of documents.
[AI-powered document review](/ma-diligence) can process the contract portfolio quickly, extracting change-of-control provisions, assignment restrictions, pricing terms, and termination rights across hundreds of supply, customer, and lease agreements simultaneously. This gives the deal team a structured view of the commercial relationships and obligations so they can focus on the environmental, labor, and operational analysis that requires specialized judgment.
---
Environmental diligence for manufacturing targets should assess soil and groundwater contamination at current and former operating sites, hazardous waste management practices and disposal history, air and water discharge permits and compliance records, CERCLA and state superfund liability, underground and aboveground storage tank inventory, asbestos and lead-based paint in facilities, and any pending or threatened environmental enforcement actions. Phase I and Phase II environmental site assessments should be conducted for all material operating properties.
Supply chain contracts in manufacturing acquisitions require review for single-source supplier dependencies that create concentration risk, change-of-control provisions that could allow suppliers to terminate or renegotiate post-closing, take-or-pay and minimum purchase obligations that create fixed cost commitments, pricing escalation mechanisms tied to commodity indices, and force majeure provisions that allocate supply disruption risk. A target with concentrated supplier dependencies and unfavorable contract terms may be more vulnerable to disruption than the purchase price reflects.
In a stock acquisition, all collective bargaining agreements (CBAs) transfer automatically because the employing entity does not change. In an asset acquisition, the buyer may become a successor employer under NLRB doctrine if it continues the business operations and hires substantially the same workforce. Successor employers must bargain with the existing union but are generally not bound by the predecessor's CBA terms unless they voluntarily adopt them. However, certain obligations like pension withdrawal liability may apply regardless of deal structure.
Manufacturing diligence should evaluate the condition and remaining useful life of critical equipment, all equipment lease and financing obligations including off-balance-sheet items, deferred maintenance that represents future capital requirements, capital expenditure plans necessary to maintain operations at current levels, compliance-driven capital requirements such as environmental upgrades, and any equipment subject to liens or security interests. These obligations directly affect free cash flow projections and purchase price negotiations.
## Review Manufacturing Contracts at Deal Speed
Mage extracts change-of-control provisions, pricing terms, and assignment restrictions from supply, customer, and lease agreements in minutes. Your team focuses on the environmental and labor analysis that drives deal structure.
Request a Demo
---
## URL: https://magelegal.com/blog/why-we-dont-let-users-write-prompts
### Title: Why We Do Not Let Users Write Prompts
### Author: Raffi Isanians
Prompt injection is a security vulnerability where adversarial content embedded in input data manipulates an AI system's behavior, causing it to ignore instructions, fabricate outputs, or extract data incorrectly. In legal AI, where systems process third-party documents from data rooms, prompt injection is not a theoretical risk. It is a design consideration that shapes how responsible systems are built.
We made a deliberate decision at Mage: no open prompt boxes. Attorneys do not write extraction prompts. They do not craft queries. They select from constrained interfaces that encode M&A domain expertise directly into the extraction pipeline. This decision was driven by three problems that open prompt interfaces create in legal AI.
- Open prompt interfaces in legal AI create three compounding problems: prompt injection security risks, inconsistent output quality across users, and accuracy that depends on the attorney's prompt engineering skill rather than the system's legal knowledge
- Prompt injection allows adversarial content embedded in documents to manipulate AI systems that accept user-written prompts, a real security risk when processing third-party data rooms
- The best M&A attorneys should not need to be the best prompt engineers. Constrained interfaces encode domain expertise into the system so every user gets expert-level extraction
- Constraint is not limitation. It is a design choice that trades flexibility for reliability, which is exactly the right trade-off for legal work product
## The Security Problem
M&A data rooms contain documents from counterparties, targets, and third parties. You do not control what is in those documents. A sophisticated adversary could embed content in a contract PDF that is invisible to the human eye (white text, metadata fields, embedded objects) but visible to an AI system processing the document.
In a system with open prompt interfaces, the AI processes both the user's prompt and the document content through the same pipeline. Adversarial content in a document can interfere with prompt execution: causing the system to skip certain provisions, report findings that do not exist, or alter extraction behavior in ways that benefit the party who prepared the document.
This is not a hypothetical. Prompt injection attacks against LLM-based systems have been demonstrated repeatedly in production environments. The attack surface exists whenever user instructions and untrusted content flow through the same processing path.
Constrained interfaces reduce this attack surface significantly. When the system's extraction behavior is defined by structured configuration rather than user-written prompts, the document content has fewer vectors to influence system behavior. The extraction schema is fixed. The provision types are predefined. The output structure is determined by the system, not by a prompt that can be manipulated.
For [law firms handling sensitive transactions](/for-law-firms), this security architecture is not optional. It is table stakes.
## The Consistency Problem
Open prompt interfaces produce inconsistent output because different users write different prompts. A senior partner who writes "Extract all indemnification provisions including caps, baskets, survival periods, and carve-outs for fundamental representations" gets meaningfully different output than an associate who writes "What are the indemnification terms?"
Both prompts are reasonable. Both users are doing the same work. But the output quality depends on the prompt quality, which depends on the user's experience with both M&A contracts and prompt engineering.
This creates a perverse dynamic: the attorneys who need the most help from AI (junior associates doing their first diligence review) are the least equipped to write effective prompts, while the attorneys who need the least help (senior partners who already know exactly what to look for) write the best prompts.
A constrained interface eliminates this variance entirely. When the system defines what to extract from each document type, every user gets the same comprehensive extraction. A first-year associate uploading a data room gets the same provision coverage as a twenty-year M&A partner. The domain expertise lives in the product, not in the prompt.
## The Accuracy Problem
Prompt-dependent accuracy is the subtlest and most consequential problem. When extraction quality depends on prompt quality, accuracy becomes a function of how well the user can articulate what they need, not how well the system can extract what matters.
An attorney who forgets to ask about assignment provisions will not get assignment provisions in the output. An attorney who asks about "termination rights" but not "termination for convenience" specifically might get an incomplete picture. An attorney who does not know to ask about anti-assignment carve-outs will never see them.
The entire value proposition of AI in legal review is comprehensive coverage: finding the provisions the attorney might not think to look for. Open prompt interfaces undermine this value because coverage is limited to what the user asks about.
Constrained extraction solves this by defining comprehensive coverage as the default. The system extracts every provision type relevant to the document category, whether or not the user specifically asked for it. If a customer agreement contains an unusual audit right buried in Section 12, the system surfaces it because audit rights are part of the extraction schema for customer agreements, not because someone wrote a prompt asking about audit rights.
This is what makes [structured extraction](/clause-extraction) fundamentally different from [RAG-based question answering](/blog/why-rag-fails-for-legal-contract-review). Question answering gives you what you ask for. Structured extraction gives you everything that matters.
## Constraint as a Design Principle
There is a natural intuition that more flexibility is always better. If a tool lets users write any prompt, it can do anything. If a tool constrains users to predefined interfaces, it can only do what the designers anticipated.
In general-purpose AI, this intuition is correct. ChatGPT is useful precisely because you can ask it anything.
In professional tools for high-stakes work, the opposite is true. An operating room does not give surgeons maximum flexibility. It gives them precisely the right instruments, sterilized, organized, and purpose-built for the procedure. The constraint is the value.
Legal AI for [M&A diligence](/ma-diligence) works the same way. The value is not in asking any question. The value is in getting comprehensive, accurate, consistent extraction across every document in a data room, with every finding linked to its source, structured for the attorney's review workflow.
That requires a system that knows what to extract before the user asks. It requires constrained interfaces that encode domain expertise. It requires trading the flexibility of open prompts for the reliability of structured extraction.
We believe that trade-off is correct for legal work. The best M&A diligence tool is not the one that lets attorneys write the best prompts. It is the one that makes prompts unnecessary.
---
Prompt injection is a security vulnerability where adversarial content embedded in processed documents manipulates the AI system's behavior. In legal AI, this means a malicious actor could embed hidden instructions in a contract PDF that cause the AI to ignore certain provisions, fabricate findings, or extract data incorrectly. Systems that accept user-written prompts are more vulnerable because the prompt-processing pipeline has a larger attack surface than constrained extraction interfaces.
Some legal AI tools use prompts as their primary interface because prompts provide maximum flexibility. Users can ask any question about any document. This approach works for general-purpose AI assistants but creates problems in legal contexts: output quality depends on prompt quality, results are inconsistent across users, and the system has no built-in understanding of which provisions matter for specific transaction types. The flexibility comes at the cost of reliability.
Constrained interfaces encode domain expertise into the system's extraction logic rather than relying on users to specify what to extract via prompts. The system knows which provisions matter in an asset purchase agreement, what parameters to extract from an indemnification clause, and how to structure output for diligence deliverables. This means a first-year associate gets the same extraction quality as a senior partner, because the expertise lives in the product, not in the prompt.
Mage uses constrained extraction interfaces rather than open prompt boxes. Attorneys select analysis types, document categories, and provision types from structured menus that encode M&A domain expertise. This design choice means consistent, high-quality extraction regardless of the user's prompt engineering skill, while also reducing the attack surface for prompt injection from adversarial document content.
## No Prompts. No Guessing. Just Results.
Mage encodes M&A expertise directly into the product. Upload a data room and get structured extraction across every agreement. No prompt engineering required.
Request a Demo
---
## URL: https://magelegal.com/blog/how-to-build-due-diligence-checklist-manda
### Title: How to Build a Due Diligence Checklist for M&A
### Author: Mage Team
A due diligence checklist is the structured framework that guides the investigation of a target company during an M&A transaction. It defines what documents to request, what information to verify, and what issues to investigate across every aspect of the target's business, legal, financial, and operational profile. The quality of the checklist directly determines the quality of the diligence, and the quality of the diligence directly determines whether the deal team catches the issues that affect deal value before signing.
- An effective M&A due diligence checklist is tailored to the deal type, target industry, and transaction structure, not copied from a generic template
- The core categories (corporate, financial, contracts, IP, employment, tax, litigation, regulatory, environmental, insurance, real estate) form the foundation, but the specific items within each category should reflect the deal's risk profile
- Buy-side checklists focus on identifying risks and liabilities the acquirer will inherit, while sell-side checklists focus on preparing documentation and addressing issues before they become negotiation points
- The checklist is a living document that should be updated as diligence progresses and new issues surface, not a static list completed at the outset
## Start with the Deal Thesis, Not a Template
Every experienced deal attorney has encountered the downloaded 50-page checklist template that includes items irrelevant to the deal at hand while missing industry-specific risks that matter most. Templates are starting points, not solutions.
The right starting question is: what is the acquirer buying and why? A private equity firm acquiring a SaaS company for its recurring revenue cares about different things than a strategic acquirer buying a manufacturing company for its supply chain capabilities. The deal thesis drives which categories need deep investigation and which can be addressed at a summary level.
**For a technology acquisition,** IP chain of title, open source compliance, employee invention assignments, and customer contract stability are primary categories. Environmental and real estate may be secondary.
**For a healthcare services acquisition,** regulatory compliance, licensure, payor contracts, and HIPAA compliance are primary. IP may be secondary.
**For a manufacturing acquisition,** environmental liabilities, equipment condition, supply chain contracts, and real estate (owned and leased) are primary. Software IP may be secondary.
The checklist should reflect this prioritization from the outset, ensuring that the most critical categories receive the most detailed request items and the earliest attention.
## The Core Categories
While the specific items vary by deal, the category structure is remarkably consistent across M&A transactions.
### Corporate Organization and Governance
Request items cover the target's organizational documents (certificate of incorporation, bylaws, operating agreements), capitalization table, board and shareholder minutes, subsidiary structure, and jurisdictions of qualification. This category establishes the legal identity of what the acquirer is buying and identifies structural issues (minority interests, outstanding options, dormant subsidiaries) that affect deal mechanics.
### Financial
Financial diligence covers audited and unaudited financial statements, tax returns, accounts receivable and payable aging, debt and credit agreements, projections and budgets, and working capital analysis. While financial diligence is typically led by the accounting team, legal counsel should review debt instruments, guarantees, and financial covenants that create legal obligations.
### Material Contracts
This is the category where [contract review](/contract-review) tools deliver the most value. Request all customer agreements, vendor contracts, distribution agreements, partnership arrangements, joint ventures, and any agreement with annual value exceeding a defined threshold. The specific provisions to extract and review are covered in depth in our guides on [clause extraction](/clause-extraction): assignment restrictions, termination provisions, change of control triggers, exclusivity obligations, MFN clauses, and indemnification terms.
### Intellectual Property
Request patent portfolios, trademark registrations, copyright registrations, trade secret inventories, IP licenses (in and out), open source usage, and the full chain of IP assignment documentation (employment agreements, contractor agreements, founder assignments). For technology companies, IP diligence is often the most complex and highest-stakes category.
### Employment and Labor
Cover employee census, employment agreements (particularly for key personnel), compensation and benefits plans, non-compete and non-solicitation agreements, pending or threatened employment claims, WARN Act compliance, independent contractor classifications, and union or collective bargaining agreements.
### Tax
Request federal and state tax returns, pending audits or assessments, tax sharing agreements, transfer pricing documentation, and analysis of any tax positions that carry audit risk. Tax diligence is typically led by tax counsel, but corporate counsel should understand the tax structure's implications for deal mechanics.
### Litigation and Disputes
Request a schedule of all pending, threatened, and recently resolved litigation, arbitration, and regulatory proceedings. Include demand letters, settlement agreements, and consent decrees. Assess the adequacy of litigation reserves and the potential for unasserted claims.
### Regulatory Compliance
Cover industry-specific regulatory requirements, permits and licenses, compliance programs, government contracts, sanctions and export controls, data privacy and security (GDPR, CCPA, HIPAA as applicable), and anti-corruption compliance (FCPA, UK Bribery Act).
### Environmental
Request environmental assessments, permits, remediation obligations, compliance history, and any Phase I or Phase II environmental site assessments. Environmental liabilities can be significant and long-lasting, making this category particularly important for manufacturing, real estate, and energy targets.
### Insurance
Request all insurance policies (general liability, D&O, cyber, E&O, property, workers' compensation), claims history, and coverage analysis. Assess whether the target's coverage is adequate for its risk profile and whether the acquirer needs to obtain tail coverage or new policies post-closing.
### Real Estate
Cover owned properties (deeds, title reports, surveys), leased properties (lease agreements, amendments, subleases), zoning and land use compliance, and any environmental issues associated with real property.
## Buy-Side vs. Sell-Side Checklists
The same categories serve different purposes depending on which side of the transaction you represent.
### Buy-Side Focus
The buy-side checklist is an investigation tool. Its purpose is to uncover risks, liabilities, and issues that the acquirer will inherit. Buy-side request items should be:
- **Probing.** Ask not just for the document but for the context. "Please provide all customer contracts with annual value exceeding $100,000" is better than "Please provide customer contracts."
- **Comprehensive.** Include catch-all items like "any other agreements not otherwise produced that have annual value exceeding $50,000 or that contain unusual terms."
- **Forward-looking.** Request information about pending changes, threatened actions, and anticipated issues, not just the current state.
### Sell-Side Focus
The sell-side checklist is a preparation tool. Its purpose is to organize the target's documentation and identify issues that should be addressed before the buyer's review. Sell-side preparation items should be:
- **Remediation-oriented.** If an employment agreement is missing an IP assignment clause, fix it before the data room opens rather than explaining the gap.
- **Organized for disclosure.** Structure the data room to make material information easy to find. A well-organized data room builds buyer confidence and reduces follow-up requests.
- **Anticipatory.** Address the questions buyers will ask before they ask them. Include summaries, schedules, and explanations alongside the underlying documents.
## Tailoring by Transaction Structure
The transaction structure determines which liabilities transfer and, consequently, which checklist items matter most.
**Asset purchases** require item-by-item identification of assets being acquired and liabilities being assumed. The checklist should map every category to the asset/liability allocation and identify assumed contracts that require consent.
**Stock purchases** transfer the entity with all its assets and liabilities. The checklist should focus on identifying hidden or contingent liabilities that the buyer inherits by operation of law, regardless of what the purchase agreement says.
**Mergers** combine elements of both, with the surviving entity inheriting all assets and liabilities of the merged entity. The checklist should address entity-level issues (corporate approvals, dissenter rights) alongside the standard operational categories.
## Updating the Checklist as Diligence Progresses
The initial checklist is a starting point. As diligence findings emerge, the checklist should evolve.
**New categories surface.** An initial review of customer contracts might reveal that the target has significant government contracts, triggering a new category for government contract compliance that was not in the original checklist.
**Depth adjustments.** If early findings reveal clean results in a category (no pending litigation, for example), resources can be redirected to categories where issues are emerging.
**Follow-up requests.** Every diligence finding that requires additional context generates a follow-up request. Tracking these alongside the original checklist ensures nothing falls through the cracks.
**Red flag escalation.** Issues identified during [M&A diligence](/ma-diligence) that could affect deal structure or valuation should be escalated immediately rather than waiting for the final diligence memo.
The checklist is a framework for thoroughness. The judgment about how to use it, where to go deep, where to go fast, and what to escalate, is what distinguishes excellent diligence from a completed form.
---
An M&A due diligence checklist should cover corporate organization and governance, financial statements and projections, material contracts and commercial agreements, intellectual property, employment and labor matters, tax compliance and exposures, pending and threatened litigation, regulatory compliance, environmental matters, insurance coverage, and real estate. Each category should be customized with specific request items tailored to the target's industry, size, and the transaction structure.
Customize by starting with the deal thesis: what is the acquirer buying and why? Industry-specific risks (healthcare compliance, environmental remediation, IP chain of title for tech) should be elevated to primary categories. Transaction structure (asset purchase vs. stock purchase vs. merger) determines which liabilities transfer and which request items are most critical. The target's size, geographic footprint, and customer concentration further refine which categories require the deepest review.
Buy-side checklists are designed to identify risks, liabilities, and issues that will affect the acquirer post-closing. They emphasize completeness and probing questions. Sell-side checklists are designed to prepare the target's documentation and address potential issues before buyer review. They emphasize organization, disclosure, and proactive remediation. Experienced deal teams use different checklists for each perspective because the objectives are fundamentally different.
A comprehensive M&A due diligence checklist for a middle-market transaction typically contains 150 to 300 specific request items across all categories. The number varies by deal complexity and industry. More important than item count is coverage completeness and relevance: every item should serve a purpose tied to risk identification or deal structuring. Experienced deal teams continuously refine their checklists based on what they have learned from previous transactions.
## Turn Your Diligence Checklist Into Structured Analysis
Mage takes the contracts from your data room and automatically extracts every provision on your checklist, delivering structured findings organized by category so your team can focus on risk assessment rather than document review.
Request a Demo
---
## URL: https://magelegal.com/blog/model-fusion-technology-why-single-model-not-enough
### Title: Model Fusion: Why a Single AI Model Is Not Enough for Legal Document Analysis
### Author: Raffi Isanians
Model fusion in legal AI is the architectural approach of using multiple specialized AI models in combination to analyze legal documents, rather than relying on a single general-purpose model. It is the technical foundation that allows Mage to deliver the extraction precision that M&A attorneys require on live deals. Understanding why this approach works requires understanding why the simpler alternative does not.
- Single-model AI approaches plateau on legal document analysis because legal tasks span fundamentally different cognitive operations: classification, extraction, reasoning, and comparison require different model architectures optimized for different objectives
- Model fusion routes each subtask to the model architecture best suited for it, then combines outputs through a reconciliation layer that detects and resolves disagreements between models
- Ensemble methods reduce the failure modes that single models exhibit: hallucination, missed provisions, and inconsistent interpretation across document types are all reduced when multiple specialized models cross-check each other
- The trade-off is engineering complexity and cost, but for legal work where a missed provision can have material consequences, the accuracy improvement justifies the infrastructure investment
## The Single-Model Ceiling
The default approach to AI document analysis is straightforward: take a large language model, feed it a document, and ask it to do everything. Classify the document. Extract the provisions. Flag the risks. Compare terms across documents. Summarize the findings.
Large language models are remarkably capable at all of these tasks. But "remarkably capable" is not the same as "reliable enough for legal work."
The challenge is that each of these tasks optimizes for a different objective:
**Classification** requires pattern recognition across the entire document: identifying the document type from its structure, language patterns, and content distribution. The model needs to see the forest, not the trees.
**Extraction** requires precise identification and boundary detection within specific sections: finding the exact text of an indemnification cap, including all carve-outs and cross-references. The model needs to see individual trees at the leaf level.
**Reasoning** requires applying legal knowledge to evaluate whether extracted provisions are standard, unusual, or problematic. The model needs domain expertise and the ability to compare against norms.
**Comparison** requires holding multiple documents in context simultaneously and identifying variance. The model needs to work across documents, not within a single one.
A single model trying to optimize for all four objectives simultaneously makes trade-offs. Architectures that excel at document-level classification tend to lose precision at the provision level. Models fine-tuned for extraction accuracy may not have the domain knowledge for risk reasoning. General-purpose models can attempt everything but master nothing with the consistency that legal work demands.
This is the single-model ceiling: a point where adding more training data or compute to a single model produces diminishing accuracy returns because the fundamental architecture is being asked to optimize for competing objectives.
## How Model Fusion Works
Model fusion breaks the analysis pipeline into subtasks and routes each to the model architecture best suited for it.
### The Pipeline
A document entering Mage's analysis pipeline passes through several stages:
**Stage 1: Document Understanding.** Specialized models process the document's structure, handling OCR for scanned documents, identifying sections and subsections, resolving page breaks and formatting artifacts, and building a structural representation of the document. This is a fundamentally different task than language understanding, and it benefits from models specifically trained on document layout.
**Stage 2: Classification.** Document-level classification models identify the document type based on structural and linguistic features. A model trained specifically for classification can leverage the entire document's signals without being distracted by the extraction objective.
**Stage 3: Targeted Extraction.** Based on the document type, extraction models focus on the specific provisions relevant to that document category. An employment agreement triggers extraction of compensation terms, non-compete provisions, and termination mechanics. A [customer agreement](/contract-review) triggers extraction of indemnification, limitation of liability, and change-of-control provisions. Each extraction model is optimized for its specific document type and clause category.
**Stage 4: Reasoning and Risk Assessment.** Reasoning models evaluate the extracted provisions against domain knowledge. Is this indemnification cap standard for this agreement type? Is this non-compete duration enforceable in this jurisdiction? Is this change-of-control provision buyer-friendly or seller-friendly? These judgments require a different kind of model capability than extraction.
**Stage 5: Reconciliation.** A reconciliation layer combines outputs from the preceding stages, detecting inconsistencies, resolving conflicts, and producing a unified analysis with confidence scores for each output.
### Cross-Checking Through Disagreement
The most powerful feature of model fusion is what happens when models disagree.
If the extraction model identifies a provision as an uncapped indemnification and the reasoning model flags it as standard, there is a conflict that merits investigation. If two extraction approaches produce different boundary text for the same provision, the reconciliation layer can compare them and either select the more likely answer or flag the disagreement for human review.
This cross-checking mechanism is impossible in a single-model architecture. A single model produces a single answer with no internal check. Model fusion produces multiple perspectives on the same provision, and the disagreements between perspectives are themselves informative.
## The Accuracy Case
The accuracy improvement from model fusion is not uniform across all tasks. It is most pronounced in three areas:
### Reduced Hallucination
Language models sometimes generate plausible but incorrect text. In legal document analysis, this manifests as provisions being "extracted" that do not actually exist in the document, or extracted text that subtly differs from the source.
Model fusion reduces hallucination because the reconciliation layer can verify extracted text against the source document. If an extraction model produces text that does not match the original document, the verification step catches it. This is a structural advantage over single-model approaches where the same model that generates the extraction would need to verify its own output.
### Improved Extraction Completeness
Single models tend to find the most prominent instance of a provision and miss secondary instances. An indemnification cap in the main agreement might be extracted while a conflicting cap in an amendment is missed.
Model fusion addresses this by running multiple extraction approaches. One model might focus on the primary agreement sections. Another processes [amendment chains](/blog/amendment-chain-resolution-hardest-problem-legal-ai) specifically. The reconciliation layer combines their outputs into a complete picture that accounts for how the original terms have been modified.
### Consistent Performance Across Document Types
Single models exhibit performance variance across document types. A model that excels on well-structured asset purchase agreements might struggle with handwritten lease modifications. Model fusion allows each document type to be processed by models specifically trained for that type's characteristics, producing more consistent accuracy across the full range of documents attorneys encounter.
## The Engineering Trade-Off
Model fusion is harder to build than single-model approaches. The orchestration layer, reconciliation logic, and model management infrastructure all add engineering complexity. Running multiple models increases compute costs relative to running a single model.
For many applications, this trade-off is not worth it. A chatbot that answers general questions does not need multi-model precision. A summarization tool that produces approximate summaries can accept single-model accuracy.
Legal document analysis is different. A missed provision in a material contract can have consequences measured in millions of dollars. An incorrectly extracted indemnification cap can lead to a pricing error in the purchase agreement. A missed change-of-control trigger can result in a post-closing contract termination that destroys deal value.
For [M&A diligence](/ma-diligence), the accuracy improvement from model fusion justifies the engineering investment. The cost of building and maintaining a multi-model system is real. The cost of unreliable extraction on a live deal is higher.
## What This Means for Legal Teams
For the attorneys using Mage, model fusion is invisible. You upload a data room. You receive structured analysis. You review and verify the output.
What you experience is the result: extractions that are more complete, risk flags that are more calibrated, and confidence scores that accurately reflect where human attention is needed. You do not need to understand the architecture to benefit from it.
But understanding the architecture matters when evaluating legal AI tools. When a vendor claims high accuracy from a single general-purpose model, ask what happens on the difficult documents. Ask about [amendment chains](/blog/amendment-chain-resolution-hardest-problem-legal-ai). Ask about scanned documents with OCR artifacts. Ask about provisions that span multiple sections with cross-references.
The architecture determines the ceiling. Model fusion raises it.
---
Model fusion is an architectural approach that uses multiple specialized AI models to process legal documents, with each model handling the subtask it is best suited for. Rather than relying on a single general-purpose model for classification, extraction, and reasoning, model fusion routes each operation to a purpose-built model and then combines their outputs through a reconciliation layer. This approach achieves higher accuracy than any single model because each model is optimized for its specific task.
Legal document analysis requires fundamentally different cognitive operations: classifying a document type is a different task than extracting a specific provision, which is different from reasoning about whether that provision is standard or unusual. A single model optimized for one task makes trade-offs that reduce performance on others. General-purpose language models can attempt all these tasks but excel at none of them with the precision that legal work demands.
Ensemble methods improve accuracy by combining outputs from multiple models, each approaching the same task from a different angle. When models agree, confidence is high. When models disagree, the disagreement signals an ambiguous or unusual provision that merits closer attention. This cross-checking mechanism catches errors that any single model would miss, reducing hallucination rates and improving extraction completeness. The net effect is more reliable output with built-in uncertainty detection.
Model fusion adds engineering complexity but does not necessarily increase latency for the end user. Many subtasks can be parallelized because they operate on different portions of the document or different aspects of the same provision. A well-designed orchestration layer runs models concurrently where possible and sequentially only where one model's output is required as input to another. The result is accuracy improvement without proportional latency increase.
## Experience Multi-Model Precision on Your Documents
Upload your data room and see the difference that purpose-built, multi-model extraction makes on real deal documents. No prompts. No configuration.
Request a Demo
---
## URL: https://magelegal.com/blog/technology-manda-software-license-ip-diligence
### Title: Technology M&A Due Diligence: Software Licenses, IP Chains, and Data Privacy
### Author: Mage Team
Technology M&A due diligence is the process of evaluating the intellectual property, software assets, customer contracts, and regulatory compliance posture of a technology target. It differs fundamentally from traditional corporate diligence because the core asset being acquired is often intangible: software code, patents, customer data, and the contractual relationships that monetize them. Getting the IP and license analysis wrong can mean acquiring a business whose primary assets are encumbered, unprotectable, or worth less than the purchase price assumes.
- In technology acquisitions, the IP is often the primary asset being acquired, making IP assignment chain verification and freedom-to-operate analysis the highest-priority diligence items
- Software license audit exposure can create seven-figure post-closing liabilities when the target has exceeded license counts, used software outside permitted scope, or failed to track open source dependencies
- SaaS customer agreements with favorable termination rights, uncapped liability, or broad data portability obligations directly affect the target's recurring revenue valuation
- Data privacy compliance is no longer a secondary diligence item: GDPR, CCPA, and state privacy laws create obligations that transfer with the business and carry material penalty exposure
## IP Ownership and Assignment Chains
The foundational question in technology diligence is whether the target actually owns what it claims to own. IP assignment chains must trace from initial creation to the target entity with no gaps.
### Employee and Contractor Assignments
Every person who contributed to the target's technology must have executed an IP assignment agreement. This includes:
- **Founders** who may have developed initial technology before the company was formed
- **Employees** who should have invention assignment provisions in their employment agreements
- **Independent contractors** whose work product is not automatically owned by the hiring party under copyright law
- **Consultants and advisors** who may have contributed to product development
Gaps in the assignment chain are common and consequential. A contractor who built a critical module without executing an IP assignment owns the copyright to that code. A founder who developed the initial product before incorporating may retain personal ownership absent a written assignment.
[Structured extraction](/clause-extraction) across the target's employment and contractor agreements can identify which agreements contain IP assignment provisions and which are missing them. The deal team then focuses investigation on the gaps rather than reading every agreement from start to finish.
### Freedom to Operate
Beyond ownership, the buyer needs confidence that the target's products do not infringe third-party IP rights. Freedom-to-operate analysis should cover:
- **Patent landscape review** in the target's technology domain
- **Existing licensing obligations** that constrain how the technology can be used
- **Cease-and-desist history** and any ongoing IP disputes
- **Indemnification obligations** in customer contracts related to IP infringement claims
## Software License Diligence
Technology targets rely on licensed software for operations and embed licensed components in their products. Both categories require careful review.
### Inbound Licenses (Software the Target Uses)
Review all material software licenses for:
- **Change-of-control provisions** that could allow the licensor to terminate or require consent upon a transaction
- **Scope restrictions** that may not cover the combined entity's intended use
- **Audit rights** that expose the target to true-up payments if license counts have been exceeded
- **Transferability and assignment** limitations that could prevent the buyer from continuing to use the software
- **Pricing and renewal terms** that affect the go-forward cost structure
Enterprise software agreements with vendors like Oracle, SAP, Microsoft, and Salesforce frequently contain change-of-control provisions. A target running its business on an enterprise platform that the licensor can terminate or renegotiate upon acquisition represents a material operational risk.
### Outbound Licenses (Software the Target Sells)
For targets that license software to customers, review the customer agreement portfolio for:
- **License grant scope** and any usage restrictions that could create customer disputes
- **Service level commitments** and remedies for breach
- **Indemnification obligations** for IP infringement, data breaches, or service failures
- **Limitation of liability provisions** including any contracts with uncapped or inadequately capped liability
- **Termination and data portability rights** that could allow customers to exit post-closing
- **Revenue recognition implications** of license structure (perpetual vs. subscription, on-premise vs. SaaS)
For SaaS businesses, the customer agreement portfolio is the revenue base. Contracts with favorable customer termination rights, unlimited data portability, or uncapped liability directly affect the target's recurring revenue valuation.
### Open Source Compliance
Open source software is ubiquitous in technology products. The risk is not that the target uses open source. The risk is that it uses open source with obligations it has not identified or complied with.
**Copyleft licenses** (GPL, LGPL, AGPL) require that derivative works be distributed under the same license terms. If the target's proprietary software is considered a derivative work of a GPL-licensed component, the buyer may face an obligation to release proprietary source code under the GPL.
**Permissive licenses** (MIT, Apache, BSD) have fewer restrictions but still require attribution and disclaimer notices.
**Due diligence steps:**
1. Obtain a complete software bill of materials (SBOM) identifying all open source components
2. Run a software composition analysis (SCA) to identify components and their licenses
3. Evaluate whether copyleft-licensed components are isolated from proprietary code
4. Review the target's open source policy and compliance procedures
5. Assess whether any open source license obligations have been breached
## Data Privacy and Security
Data privacy has moved from a secondary diligence item to a primary risk area in technology acquisitions. The regulatory landscape has expanded significantly, and enforcement has become more aggressive.
### Privacy Law Compliance
Assess the target's compliance with applicable privacy laws based on the jurisdictions in which it operates and collects data:
- **GDPR** (if the target processes personal data of EU residents)
- **CCPA/CPRA** (if the target processes personal information of California residents)
- **State privacy laws** (Virginia, Colorado, Connecticut, and an expanding list of states)
- **Sector-specific regulations** (COPPA for children's data, HIPAA for health data, GLBA for financial data)
### Data Inventory and Processing Activities
Understand what data the target collects, how it processes it, and with whom it shares it:
- Categories of personal data collected
- Purposes for processing and legal bases (for GDPR compliance)
- Data sharing with third parties and data processing agreements
- Cross-border data transfer mechanisms (for international operations)
- Data retention policies and practices
- Consent mechanisms and privacy policy commitments to users
### Security Assessment
- Security incident and breach history
- Security certifications (SOC 2, ISO 27001)
- Vulnerability management practices
- Encryption practices for data at rest and in transit
- Access control and authentication mechanisms
### Customer Data Considerations
For SaaS businesses, customer data is held in trust. Review the target's customer agreements for data ownership provisions, data processing obligations, and data return or deletion requirements upon termination. Post-closing, the buyer inherits these obligations and must maintain compliance continuity.
## Structuring Technology Diligence for Efficiency
Technology targets typically generate more documents for diligence than targets in other industries. The combination of customer agreements, vendor licenses, employment and contractor agreements, IP filings, and privacy documentation creates a volume challenge.
The most effective approach is parallel workstreams with technology-assisted document review:
1. **IP workstream**: Assignment chains, patent portfolio, freedom-to-operate
2. **License workstream**: Inbound software licenses, open source compliance, audit exposure
3. **Revenue workstream**: Customer agreement portfolio, SaaS metrics, churn and renewal analysis
4. **Privacy workstream**: Compliance assessment, data inventory, security posture
[AI-powered contract review](/contract-review) accelerates the document-intensive portions of each workstream. Extracting assignment provisions, change-of-control triggers, liability caps, and termination rights across hundreds of agreements simultaneously gives the deal team structured data to analyze rather than raw documents to read.
The judgment calls remain with the attorneys. Whether a particular open source license creates copyleft exposure, whether a customer concentration poses revenue risk, whether a privacy compliance gap is remediable before closing. But those judgment calls are better informed and faster when they start from structured data rather than stacks of unorganized PDFs.
---
Technology IP diligence should cover four areas: ownership verification (confirming clean assignment chains from founders, employees, and contractors), freedom-to-operate analysis (identifying potential infringement claims), IP protection adequacy (patent, trademark, and trade secret programs), and open source compliance (ensuring open source components do not create copyleft obligations that affect proprietary code). Each area can reveal deal-altering risks that affect valuation and deal structure.
Software license agreements create three categories of risk in M&A: the target's inbound licenses (software the target uses to operate its business), the target's outbound licenses (software the target licenses to its customers), and open source licenses embedded in the target's products. Change-of-control provisions in inbound licenses can restrict the buyer's ability to continue using critical software. Audit rights in those same licenses can expose the target to true-up payments or penalties.
Data privacy diligence in technology M&A should assess the target's compliance with applicable privacy laws (GDPR, CCPA, state laws), the scope and sensitivity of personal data collected and processed, data processing agreements with vendors and partners, consent mechanisms and privacy policy commitments, cross-border data transfer mechanisms, and breach history. Post-closing, the buyer inherits these compliance obligations and any liability for prior violations.
Open source compliance matters because certain open source licenses (particularly copyleft licenses like GPL) require that derivative works be distributed under the same license terms. If the target's proprietary software incorporates GPL-licensed components, the buyer may face an obligation to release proprietary source code. A thorough software composition analysis during diligence identifies these dependencies before they become post-closing surprises.
## Extract IP and License Terms Across Your Entire Data Room
Mage identifies assignment provisions, change-of-control triggers, open source obligations, and liability terms across hundreds of technology agreements in minutes. Your team focuses on the analysis that drives deal outcomes.
Request a Demo
---
## URL: https://magelegal.com/blog/governing-law-forum-selection-manda
### Title: Governing Law and Forum Selection Clauses in M&A: Why Jurisdiction Matters
### Author: Mage Team
A governing law clause specifies which jurisdiction's substantive law will be used to interpret and enforce a contract. A forum selection clause specifies where disputes arising under the contract will be litigated or arbitrated. Together, these provisions determine the legal framework and procedural venue for every contractual relationship in a target company's portfolio. In M&A due diligence, the governing law and forum selection of each material contract affect the enforceability of key provisions, the cost and practicality of dispute resolution, and the compliance complexity the acquirer inherits.
- Governing law clauses determine which jurisdiction's substantive law applies to interpret and enforce the contract, while forum selection clauses determine where disputes will be litigated or arbitrated
- In M&A, the governing law of a target's contracts affects the enforceability of key provisions including non-competes, indemnification, limitation of liability, and liquidated damages
- Multi-jurisdiction contract portfolios create compliance complexity when governing law varies across the target's agreements, requiring the acquirer to manage obligations under multiple legal frameworks
- Mapping governing law and forum selection across the entire data room during diligence reveals jurisdictional concentration risk and identifies contracts governed by unfavorable or unfamiliar law
## Why Governing Law Affects Deal Risk
Governing law is not an administrative detail. It is the lens through which every other provision in the contract is evaluated. The same contractual language can produce different legal outcomes depending on the jurisdiction whose law applies.
**Non-compete enforceability.** A non-compete clause governed by Texas law faces a different enforceability standard than one governed by California law (where most non-competes are unenforceable). During diligence, the governing law of each employment agreement and consulting contract determines whether the target's restrictive covenants actually protect the business.
**Indemnification and limitation of liability.** Jurisdictions differ on the enforceability of indemnification caps, consequential damages waivers, and limitation of liability provisions. A clause that is enforceable under Delaware law may face scrutiny under a different state's unconscionability doctrine.
**Liquidated damages.** The test for whether a liquidated damages provision is enforceable (as opposed to being an unenforceable penalty) varies by jurisdiction. Governing law determines whether the target's liquidated damages provisions in customer and vendor contracts will hold up if challenged.
**Implied warranties and mandatory terms.** Some jurisdictions impose implied terms that cannot be disclaimed by contract. Consumer protection statutes, implied warranties of merchantability, and mandatory cooling-off periods vary by governing law and can affect the actual terms of the contractual relationship regardless of what the written contract says.
## Forum Selection: Where Disputes Get Resolved
Forum selection determines the practical mechanics of dispute resolution, including cost, convenience, procedural rules, and jury availability.
### Exclusive vs. Non-Exclusive Forums
An exclusive forum selection clause requires all disputes to be brought in the designated forum, eliminating the counterparty's ability to file suit in a more favorable jurisdiction. A non-exclusive clause identifies a preferred forum but allows either party to bring disputes elsewhere. From the acquirer's perspective, exclusive forum selection in a convenient jurisdiction is preferable because it reduces the risk of defending litigation in unfamiliar or distant courts.
### Arbitration Clauses
Many commercial contracts replace court litigation with mandatory arbitration, specifying the arbitration institution (AAA, JAMS, ICC), the seat of arbitration, the number of arbitrators, and the procedural rules. Arbitration clauses affect the acquirer's dispute resolution options, cost structure, and the availability of discovery and appeals.
During diligence, mapping which contracts require arbitration versus litigation, and under which procedural frameworks, informs the acquirer's assessment of dispute resolution costs and outcomes across the portfolio.
### Practical Considerations
**Cost of distant forums.** If the target's contracts designate forums in jurisdictions far from the acquirer's operations, the cost of litigating disputes increases. A portfolio of contracts with forums spread across multiple states or countries creates logistical complexity for the acquirer's legal department.
**Jury trial waivers.** Some contracts include jury trial waivers alongside their forum selection clauses. Whether these waivers are enforceable depends on the governing law and the forum, adding another variable to the dispute resolution analysis.
**Enforceability of the clause itself.** Forum selection clauses are generally enforceable, but courts occasionally decline to enforce them when the designated forum is seriously inconvenient, when the clause was not freely negotiated, or when enforcement would contravene public policy. The likelihood of a court honoring the forum selection clause varies by jurisdiction.
## Multi-Jurisdiction Complications
A target company with national or international operations will typically have contracts governed by dozens of different jurisdictions. This multi-jurisdiction reality creates several challenges for acquirers.
**Compliance divergence.** The acquirer must ensure compliance with the target's contractual obligations under each governing jurisdiction's legal standards. What constitutes adequate performance, timely notice, or material breach may vary from contract to contract based on governing law.
**Inconsistent enforceability.** The same provision type (non-compete, limitation of liability, indemnification) may be enforceable in some of the target's contracts and unenforceable in others, depending solely on the governing law. A provision-level risk assessment requires mapping each provision against its governing law.
**Integration complexity.** Post-acquisition, standardizing contract terms across the combined entity is complicated when existing contracts are governed by different jurisdictions. Renewal and renegotiation strategies must account for the governing law of each contract.
**International governing law.** Contracts governed by non-U.S. law introduce additional complexity, including foreign mandatory rules, different interpretation principles, and potentially unfamiliar dispute resolution mechanisms. Contracts governed by the law of jurisdictions where the acquirer has no local counsel or legal infrastructure require particular attention.
## What to Extract During Diligence
Systematic extraction of governing law and forum selection provisions across the data room produces a jurisdictional map that serves multiple purposes.
**Governing law distribution.** A summary of how many contracts are governed by each jurisdiction reveals concentration risk and identifies the jurisdictions where the acquirer needs legal expertise for ongoing contract management.
**Forum selection mapping.** A map of designated forums by contract materiality shows the acquirer's litigation exposure geography and identifies contracts with forums in inconvenient or unfavorable jurisdictions.
**Arbitration inventory.** A list of contracts requiring arbitration, with the applicable institution and rules, informs the acquirer's dispute resolution planning and cost budgeting.
**Cross-reference with key provisions.** The most valuable analysis combines governing law extraction with the extraction of other key provisions, such as [clause extraction](/clause-extraction) for non-competes, indemnification, and limitation of liability. This cross-reference reveals which provisions are at risk of unenforceability under their governing law.
AI-powered [contract review](/contract-review) tools can extract governing law and forum selection provisions from every agreement in the data room simultaneously, producing the jurisdictional map that manual review would require weeks to compile. This extraction enables deal teams to identify jurisdictional risk early in the diligence process and allocate specialist legal resources where they are needed most.
## Governing Law in the Purchase Agreement
Diligence findings about the target's governing law landscape also inform the governing law selection for the purchase agreement itself.
**Delaware is the default for good reasons.** Delaware law is the most common choice for M&A purchase agreements because of its well-developed body of corporate and commercial law, its predictable court system (the Court of Chancery), and the extensive case law on acquisition-related disputes.
**Match the complexity to the deal.** For transactions involving targets with primarily in-state operations and contracts, the target's home state law may be appropriate. For complex, multi-state transactions, Delaware's neutral and well-developed framework is often the most practical choice regardless of where the parties are located.
**Arbitration vs. litigation.** Some purchase agreements include mandatory arbitration provisions, particularly in cross-border transactions where the parties want to avoid litigating in each other's home courts. The choice between arbitration and litigation for the purchase agreement itself should be informed by the broader dispute resolution landscape of the target's [M&A diligence](/ma-diligence) portfolio.
---
A governing law clause (also called a choice of law clause) is a contractual provision that specifies which jurisdiction's laws will be used to interpret and enforce the agreement. For example, a contract governed by New York law will be interpreted according to New York statutes and case law, regardless of where the parties are located or where performance occurs. This clause is distinct from the forum selection clause, which determines where disputes will be heard.
A forum selection clause specifies the court, arbitration tribunal, or other body that will have jurisdiction over disputes arising under the contract. Forum selection clauses can be exclusive (requiring all disputes to be brought in the designated forum) or non-exclusive (identifying a preferred forum but allowing disputes to be brought elsewhere). Some contracts specify mandatory arbitration instead of court litigation, adding additional procedural requirements.
Governing law clauses matter in M&A because different jurisdictions treat the same contractual provisions differently. A non-compete enforceable under Texas law may be unenforceable under California law. An indemnification cap valid under Delaware law may face different treatment elsewhere. During diligence, understanding which law governs each material contract is essential for accurately assessing the enforceability of key provisions and the risk profile of the contract portfolio.
Deal teams should extract the governing law and forum selection clause from every material contract and map them against the contract's key provisions. This reveals jurisdictional concentration, identifies contracts governed by unfavorable law, and highlights provisions whose enforceability varies by jurisdiction. The mapping enables targeted analysis where jurisdiction-specific legal advice is needed and informs the governing law selection for the purchase agreement itself.
## Map Your Jurisdictional Exposure Before Closing
Mage extracts governing law and forum selection from every contract in the data room, cross-referencing against key provisions to reveal which non-competes, indemnification caps, and limitation of liability clauses are at risk under their governing jurisdiction.
Request a Demo
---
## URL: https://magelegal.com/blog/real-bottleneck-manda-diligence-workflow
### Title: The Real Bottleneck in M&A Diligence Isn't the Documents. It's the Workflow.
### Author: Raffi Isanians
Most legal teams lose days not because they lack information, but because they lack a system for processing it. Here's how AI-powered document review is changing that.
- The bottleneck in M&A diligence is workflow, not volume. Attorneys lose days to fragmented tools, not difficult legal questions.
- AI that reviews documents without citing sources is a liability. Every finding must trace back to specific contract language.
- The most effective diligence teams treat AI as a first-pass analyst, not a replacement for judgment.
- Structured extraction (tabular views, clause-level analysis) outperforms chat-based Q&A for contract review at scale.
## The 500-Document Problem
A partner sends you a data room link on Monday morning. Inside: 487 contracts. Customer agreements, vendor MSAs, license terms, NDAs, employment agreements, IP assignments, leases. The buyer wants a diligence memo by end of week.
You know the drill. Open each document. Skim for the provisions that matter: change-of-control clauses, assignment restrictions, liability caps, indemnification carve-outs, termination for convenience. Flag anything unusual. Synthesize it all into a memo, a set of disclosure schedules, and a closing checklist.
The legal analysis itself is rarely the hard part. Most experienced M&A attorneys can assess a change-of-control provision in seconds once they find it. The hard part is finding it, across hundreds of documents, while tracking which contracts you have reviewed and which you have not, and doing it accurately enough that nothing slips through.
This is the real bottleneck in M&A diligence: not the thinking, but the workflow around the thinking.
## Why Chat-Based AI Falls Short
When attorneys hear "AI for document review," many picture a chatbot. Upload a contract, ask a question, get an answer. And for a single contract, that can work.
But M&A diligence is not a single-document problem. It is a portfolio problem. You need to review hundreds of contracts, extract the same provisions from each, compare them against a standard form, identify variances, and produce structured outputs: matrices, schedules, memos. You need to do this consistently, with citations, under time pressure.
Chat-based AI tools struggle here for three reasons:
**They are reactive, not systematic.** You have to know what to ask, document by document. That means you are still doing the mental work of tracking what has been reviewed and what has not.
**They lack structured output.** A chatbot gives you prose. M&A diligence requires tabular data: which contracts contain assignment restrictions, what the liability caps are across the portfolio, where the consent requirements live. Prose does not scale.
**They obscure provenance.** When a chatbot summarizes a contract, you often cannot trace the answer back to specific language. In a transaction where accuracy is everything and the buyer's counsel will scrutinize your disclosure schedules, that is not acceptable.
## A Different Approach: Structured Extraction at Scale
The teams we work with at Mage have moved to a fundamentally different model. Instead of asking AI questions about individual documents, they treat diligence as a structured extraction problem.
Here is what that workflow looks like.
### Step 1: Upload the data room and let AI classify
The first step is simple: upload all documents at once. AI classifies each document by type (customer agreement, vendor contract, NDA, employment agreement, IP assignment, lease) and organizes them into logical groups.
This alone saves hours. In a traditional workflow, a first-year associate or paralegal would manually sort and label documents before anyone starts reviewing. Here, classification happens in minutes and the attorney can correct any misclassifications with a single click.
### Step 2: Extract provisions across the entire portfolio
Instead of reading each contract end to end, AI extracts the specific provisions that matter for M&A diligence: change-of-control, assignment and anti-assignment, liability caps, indemnification terms, termination rights, consent requirements, exclusivity, non-competes, and more.
The output is not a paragraph of prose. It is a structured matrix: documents as rows, clause types as columns. Each cell contains the extracted provision with a direct link to the source language in the original document.
This is the critical difference. An attorney reviewing 487 contracts can now scan a single view and immediately see: 312 contracts contain no change-of-control provision. 94 require consent. 81 allow termination on change of control. Instead of hunting through documents one by one, the attorney is reviewing findings and exercising judgment.
### Step 3: Detect variances from the standard form
In most portfolios, the majority of contracts follow a standard form with minor variations. The contracts that matter for diligence are the ones that deviate.
AI identifies the baseline form automatically when three or more similar documents exist, then flags every substantive variance. Not formatting changes or minor wording differences, but material deviations: a liability cap that is uncapped when the standard is $1M, an assignment clause that requires board approval instead of simple notice, an indemnification provision that carves out gross negligence.
Each variance is categorized by severity and linked to the specific language in both the form and the deviating contract. Attorneys focus their time on the contracts that actually need attention.
### Step 4: Generate disclosure schedules with triggers
For buy-side attorneys, one of the most tedious outputs is the disclosure schedule: the list of contracts that must be disclosed under each section of the merger agreement. "All contracts with change-of-control provisions." "All contracts with consent requirements upon assignment." "All contracts with liability caps exceeding $500,000."
Instead of manually building these lists, AI generates disclosure schedules by matching each contract against the disclosure criteria. For every contract that appears on a schedule, the system surfaces the specific provision, the "trigger," that caused inclusion.
This is where the workflow pays for itself. When an attorney reviews a disclosure schedule, they do not just see a list of contract names. They see the exact language that triggered each disclosure, with a direct link to the source. They can confirm, reject, or add notes in seconds. The final schedule is backed by citations, not memory.
### Step 5: Produce the memo
With all findings extracted, variances flagged, and disclosure schedules built, generating the diligence memo becomes assembly, not authorship. AI drafts a structured memo organized by diligence category, with findings ranked by risk level and every conclusion citing the underlying contract language.
The attorney's job shifts from "write the memo from scratch" to "review, refine, and add judgment." Which findings warrant a call with the buyer? Which variances should be flagged as closing conditions? Which contracts need amendments? These are the questions attorneys should spend their time on.
## What Changes When You Work This Way
### Time compression without shortcuts
Teams using this workflow consistently report compressing the first-pass review from days to hours. Not because AI replaces attorney judgment, but because it eliminates the mechanical work that consumes most of the timeline: opening documents, finding provisions, tracking what has been reviewed, and manually building schedules.
The attorney still reviews every finding. But reviewing a finding takes seconds. Hunting for a finding takes minutes. Across 487 contracts, that difference adds up to days.
### Accuracy through structure, not heroics
Traditional diligence relies on thoroughness through effort: reading every page of every document and hoping nothing is missed. That model breaks down at scale. Fatigue sets in. Contracts get skimmed instead of read. Provisions are overlooked.
Structured extraction inverts this. AI reviews every document with the same attention to every clause. Attorneys then validate findings against the source, catching errors through verification rather than hoping to avoid them through endurance.
The result is more consistent and more defensible. Every item on a disclosure schedule can be traced to a specific provision in a specific document. If a buyer's counsel challenges a finding, there is a clear audit trail.
### Attorneys doing attorney work
This is the shift that matters most. M&A attorneys did not go to law school to open PDFs and search for "change of control" across 500 documents. They went to understand deal structures, assess risk, negotiate terms, and protect their clients.
When the mechanical work is handled, attorneys spend their time on the questions that require legal judgment: Is this liability cap market? Should we negotiate a broader indemnification carve-out? Does this change-of-control provision create a material adverse effect risk? These are the conversations that add value, and the conversations that too often get compressed into the last 48 hours of a deal because the first pass took too long.
## The Pattern Worth Adopting
Whether or not you use Mage, the underlying principle is worth internalizing:
**Treat diligence as a structured data problem, not a reading problem.** The goal is not to read every contract. The goal is to extract every relevant provision, identify every material variance, and produce every required output, with citations, under deadline.
**Require provenance for every finding.** Any AI system that gives you answers without showing you the source language is creating risk, not reducing it. In M&A, an unsourced finding is worse than no finding at all.
**Design for the portfolio, not the document.** Tools that work well for reviewing a single contract often break down at deal scale. The right workflow handles hundreds of documents as a single structured dataset, not as individual files to process one at a time.
**Let attorneys do attorney work.** The most expensive resource on any deal team is the experienced attorney's judgment. Every hour spent on mechanical extraction is an hour not spent on risk assessment, negotiation strategy, and client counseling. Build workflows that protect that time.
M&A deals are not getting simpler. Data rooms are not getting smaller. Timelines are not getting longer. The teams that build systematic, AI-powered diligence workflows now will have a structural advantage on every deal that follows.
That advantage compounds.
---
## URL: https://magelegal.com/blog/termination-for-convenience-vs-cause
### Title: Termination for Convenience vs. Cause: What M&A Attorneys Must Know
### Author: Mage Team
Termination for convenience is a contractual right that allows a party to exit an agreement without demonstrating breach, fault, or any other justification, typically with advance notice. Termination for cause, by contrast, requires a material breach or specified triggering event and usually includes a cure period that allows the breaching party to remedy the issue before termination takes effect. In M&A due diligence, the distinction between these two termination mechanisms determines the stability of every contract in the target's portfolio, and the difference between a contract that survives an acquisition and one that disappears.
- Termination for convenience allows a party to exit a contract without cause, typically with a notice period, while termination for cause requires a material breach or specified triggering event
- In M&A diligence, convenience termination rights held by counterparties represent the highest contract instability risk because they can be exercised without any breach by the target
- Notice periods and cure rights create time buffers that materially affect whether the acquirer can preserve at-risk contracts, and they vary significantly across a typical data room
- The combination of change of control triggers and convenience termination rights gives counterparties maximum leverage during and after an acquisition
## Termination for Convenience: The Freedom to Walk Away
Termination for convenience gives one or both parties the right to end the contractual relationship for any reason or no reason at all. The provision typically includes a notice period, and it may include wind-down obligations, transition assistance requirements, and termination fees.
**Where it appears most frequently.** Convenience termination rights are standard in services agreements (both as client and provider), government contracts, master service agreements, and certain subscription-based commercial relationships. They are less common in agreements with significant upfront investment or long-term exclusivity, where the parties need contractual stability to justify the commitment.
**Why it matters in M&A.** When a counterparty holds a convenience termination right, the contract is only as stable as the counterparty's willingness to continue the relationship. An acquisition often triggers counterparty concerns about service continuity, relationship changes, or competitive dynamics. Even without a formal change of control trigger, a counterparty who is unhappy about an acquisition can exercise a convenience termination right and walk away.
**The notice period is the acquirer's window.** The length of the notice period for convenience termination determines how much time the acquirer has to engage the counterparty, demonstrate continuity, and preserve the relationship. A 90-day notice period provides meaningful time to act. A 30-day period provides very little.
## Termination for Cause: The Guardrails
Termination for cause restricts the right to terminate to specified triggering events, most commonly material breach of the agreement. This mechanism provides significantly more contract stability because the target (and subsequently the acquirer) can prevent termination by performing its obligations.
### Common Cause Triggers
**Material breach** is the universal cause trigger. What constitutes "material" depends on the contract language and applicable law. Some agreements define material breach with specificity (failure to meet service levels, failure to make timely payments). Others leave the determination to the general legal standard of materiality.
**Insolvency and bankruptcy.** Most commercial contracts include bankruptcy, insolvency, or cessation of business as termination triggers. These provisions are important in distressed M&A transactions where the target's financial condition may implicate ipso facto clause restrictions under the Bankruptcy Code.
**Change of control.** Some contracts treat a change of control as a cause-level termination event, giving the counterparty the right to terminate upon an acquisition. Unlike convenience termination, these provisions are specifically targeted at ownership changes and represent a distinct risk category during diligence.
**Failure to meet performance benchmarks.** Particularly in services and supply agreements, failure to maintain specified performance levels (uptime, delivery schedules, quality standards) can constitute cause for termination after a cure period.
### Cure Rights: The Safety Valve
The cure period is what distinguishes cause termination from an immediate exit right. When a breach occurs, the non-breaching party must provide written notice specifying the breach and allow the breaching party a defined period to remedy the issue before termination takes effect.
Cure periods typically range from 15 to 60 days, with 30 days being the market standard. Some agreements provide different cure periods for different breach types: shorter periods for payment defaults (often 10 to 15 days) and longer periods for performance issues that require operational changes (30 to 60 days).
For deal teams, the cure period represents the acquirer's opportunity to address inherited issues before losing a contract. A contract terminable for cause with a 30-day cure period gives the acquirer at least 30 days to resolve any performance issues before the counterparty can terminate.
## Risk Assessment During Diligence
Systematic extraction of termination provisions across a data room produces a contract stability matrix that informs multiple aspects of the transaction.
### Mapping Counterparty Rights
The first step is identifying which party holds which termination rights in every material contract. The highest risk contracts are those where the counterparty holds both a convenience termination right and a change of control trigger. The lowest risk contracts are those terminable only for cause with meaningful cure periods.
### Evaluating Notice Periods
Notice periods across a data room vary from as short as 15 days to as long as 12 months. Building a matrix of notice periods by contract materiality reveals the acquirer's exposure timeline: how quickly could the most valuable contracts be terminated if counterparties exercise their rights?
### Identifying Termination Fees and Wind-Down Provisions
Some contracts include termination fees that make exercise of the termination right economically unattractive. Others include transition assistance obligations that ensure the acquiring entity has time to find alternative arrangements. These provisions mitigate termination risk even when the right itself exists.
### Change of Control Interaction
When a contract contains both a change of control trigger and termination provisions, the interaction between them determines the counterparty's leverage. A change of control provision that requires consent (but does not itself trigger termination) is less risky than one that gives the counterparty an affirmative termination right upon change of control.
## Implications for Deal Structuring
Termination risk findings directly influence transaction structuring and purchase agreement negotiations.
**Consent solicitation priority.** Contracts where counterparties hold convenience termination rights or change of control termination triggers should be prioritized for pre-closing consent solicitation. The purchase agreement should include covenants regarding the seller's efforts to obtain these consents.
**Pre-closing covenants.** The purchase agreement should restrict the target from exercising its own termination rights or taking actions that could trigger counterparty termination rights during the period between signing and closing.
**Risk allocation.** Contracts with high termination risk that cannot be mitigated through consent or structuring should be addressed through purchase price adjustments, escrow holdbacks, or specific indemnification provisions.
**Integration planning.** The post-closing integration plan should include immediate counterparty engagement for contracts with short convenience termination notice periods. Waiting to engage counterparties until integration planning is underway may mean losing contracts within the notice window.
AI-powered [clause extraction](/clause-extraction) across the full [contract review](/contract-review) portfolio enables deal teams to build these termination risk matrices efficiently. When a data room contains hundreds of agreements, the ability to extract every termination provision, categorize it by type, identify the notice period and cure rights, and flag change of control interactions gives attorneys the complete picture they need to advise on deal structure and risk allocation.
---
Termination for convenience is a contractual right that allows a party to end the agreement without needing to demonstrate cause, breach, or any other justification. The terminating party typically must provide advance written notice (commonly 30 to 90 days) and may be required to pay a termination fee or fulfill wind-down obligations. This provision is common in services agreements, government contracts, and commercial relationships where one party needs flexibility to exit.
Termination for cause requires a triggering event, typically a material breach of the agreement, bankruptcy, or insolvency, and usually includes a cure period allowing the breaching party to remedy the issue before termination takes effect. Termination for convenience requires no justification and can be exercised at any time within the contract's notice requirements. From a diligence perspective, convenience rights are riskier because they cannot be prevented through performance.
Termination clauses directly affect the stability assessment of every contract in the target's portfolio. Contracts where the counterparty holds convenience termination rights are inherently less stable than those terminable only for cause. When termination rights are combined with change of control triggers, counterparties gain the ability to exit relationships specifically because of the acquisition. Deal teams must map these provisions to assess contract survival probability post-closing.
Cure periods in termination for cause clauses typically range from 15 to 60 days, with 30 days being the most common standard. The cure period gives the breaching party an opportunity to remedy the breach after receiving written notice before the non-breaching party can terminate. Some agreements provide different cure periods for different types of breaches, with shorter periods for payment defaults and longer periods for performance issues that require operational changes.
## Assess Contract Stability Across Your Entire Data Room
Mage extracts every termination provision, maps convenience vs. cause rights by counterparty, identifies notice periods and cure rights, and flags change of control interactions so your deal team can build an accurate contract stability matrix.
Request a Demo
---
## URL: https://magelegal.com/blog/what-is-a-virtual-data-room
### Title: What Is a Virtual Data Room? The 2026 Guide for Deal Teams
### Author: Mage Team
A virtual data room is a permissioned online repository where a company shares confidential documents with a defined set of outside parties during a transaction. Every viewer is invited by name, every document opens under rules the seller sets, and every page view is recorded. In M&A and fundraising, the room is where diligence physically happens.
The definition is short because the product is simple. The job it performs across an eight to sixteen week deal cycle is not, and that is the part vendor definitions skip. This guide covers the job.
## What does VDR mean, and is a deal room something different?
VDR is the abbreviation for virtual data room. Deal room, diligence room, and data site name the same artifact, and vendors alternate between them for positioning rather than meaning. If someone sends you an access link and calls it any of the four, expect the same thing: a gated document set, a permission model, and an activity log.
The distinction worth preserving is between the room and the work. The room is the repository and the access record. Diligence is the review performed against what sits inside it: reading the contracts, resolving the amendments, producing the issues list, the schedules, and the closing deliverables. Confusing the two is how sellers buy storage and expect analysis.
The physical ancestor explains the design. A data room used to be a locked conference room with numbered binders, a sign-in sheet, and a paralegal watching the door. The numbered index, the confidentiality legend, and the visitor log all survive from it.
## How is a data room different from Google Drive or Dropbox?
Ask this as a risk question, not a feature question. Cloud storage is not insecure, and pretending otherwise is a sales tactic. The gap is evidentiary and administrative.
There are four questions a shared folder struggles to answer.
| Question | Shared cloud folder | Virtual data room |
| --- | --- | --- |
| Who read which document, and how much of it? | File-level opens at best, often only inside your domain | Per-person, per-document, usually per-page |
| Can you cut off one recipient instantly? | Find and edit every share on every file | Revoke that recipient; every other invitation is unaffected |
| If a page is forwarded, whose copy is it? | No identifying mark | Each page carries the viewer's identity, the date, and a confidentiality legend |
| Can you show, two years later, what was made available and when? | Partial logs and memory | A durable access record, produced by normal use |
Sellers underestimate the third and fourth rows until they matter. The industry's answer to the third is dynamic watermarking, which stamps the viewer's name and email onto each page as it renders, and several vendors headline it alongside a family of post-download controls. Be clear-eyed about what all of that is: a deterrent that makes a leaked page traceable to a person. It does not stop anyone photographing a screen, and a vendor calling it leak prevention is overselling it.
The fourth row is the real separation, and it is why counsel cares. We compared the shortcut in detail in [using Google Drive or Dropbox as a data room](/blog/google-drive-dropbox-as-data-room), including where the shortcut is defensible.
## What actually happens inside a room over a deal cycle?
The room has four phases, and most teams only plan for the first.
**Build, two to six weeks.** Sell-side counsel and the company assemble the document set against a request list. A room that opens materially incomplete generates a follow-up request list, and that round trip is where weeks go.
**Open, week one of buyer access.** Buy-side teams arrive: corporate counsel, specialist counsel for employment, IP, tax, and regulatory, plus accountants, brokers, and sometimes lenders. On a mid-market deal that is fifteen to forty named individuals across four or five firms, none of whom work for you.
**Question period, four to ten weeks.** The phase that defines the room. Buyer-side reviewers post questions, seller-side counsel routes each one, and answers go back in writing. Vendors sell this as a workflow feature; Ansarada lists streamlined Q&A among its headline capabilities (Ansarada pricing page, accessed August 1, 2026).
Bankers care about that log more than they care about storage, and not because it is a convenient inbox. The log is a disclosure record. What the seller writes there becomes part of the information the buyer received, and whether it operates as disclosure against a representation depends on how the purchase agreement's disclosure and anti-sandbagging provisions are drafted. Answer casually and you may have amended your reps. Route answers through counsel and the log becomes a defensive asset. It is also why bidders are walled off from each other's questions: the log controls information symmetry across a competitive process.
**Confirmatory and closing.** Access narrows, the document set is frozen, and the room becomes the evidentiary snapshot of what the buyer was given. For the mechanics of running the room day to day, see our [virtual data room management workflow](/blog/workflow-virtual-data-room-management).
## What does the audit trail actually prove?
Three things, in descending order of how often they matter.
First, it proves availability. When a buyer asserts post-closing that a contract with a change-of-control provision was never produced, the access record shows the document was in the room from a given date and, often, that a named reviewer opened it. That does not resolve the claim by itself, but it moves the argument from memory to evidence.
Second, it reads intent during the live process. Which bidder's tax counsel spent forty minutes in the state filings tells the banker something no status call will. Third, it disciplines your own side: a room where every download is attributable changes how a seller's team treats the document set.
One caution: an audit trail records access, not comprehension. It is evidence that something was made available, never proof that it was read or understood.
## Who needs a virtual data room, and who does not need one yet?
Most content on this question says everyone, because everyone writing it sells rooms. That is not true. You probably do not need one yet if you are raising a pre-seed or seed round with a dozen documents and a handful of investors, if you are doing a small asset purchase with one cooperative counterparty, or if everything you are sharing is already public.
You need one once any of these is true:
- More than one counterparty is looking, and they should not see each other's activity or questions.
- The buy-side team includes outside professionals you did not hire and cannot control.
- You are sharing documents you would not want forwarded: customer contracts, employee data, cap table detail, unsigned drafts.
- The transaction produces representations you will have to defend, which makes the disclosure record part of the deal itself.
- Your document set will exceed roughly a hundred files, at which point folder discipline and an index stop being optional.
Deal size alone is a poor threshold. A $4M acquihire with three bidders needs a room more than a $40M single-buyer asset deal does.
## What does a virtual data room cost, and why is the price never on the site?
Because the price depends on how much you upload and how long the deal runs, and the vendor would rather learn both before quoting.
The historical version of this problem was per-page pricing, and the best account of it comes from a vendor. Firmex published an attorney's story of paying roughly $25,000 for a data room on a $20M deal at $1 per page, with the bill tripling as documents were added through diligence. Firmex called the model a printer's paradigm rather than a software paradigm, noting that the hosting cost of a page is a fraction of a cent per month while the model forces a seller to count pages before it can even get a quote (Firmex blog, accessed August 1, 2026). Read that with its date in view: the post is from 2011, so it is evidence that per-page billing produced overruns, not evidence of any 2026 price.
Per-page billing has largely given way to volume-based billing, which relocates the same risk. Here is what six providers state on their own pages, read August 1, 2026.
| Provider | Pricing basis as stated | The detail that moves the bill |
| --- | --- | --- |
| SecureDocs | Flat monthly fee, published | Tiers at $250 and $400 per month, self-serve, setup stated at ten minutes with no sales call |
| Datasite | Quote only | No price anywhere on the site; the diligence product routes to a quote, with a trial up to 90 days |
| Firmex | Quote only | Its page states data requirements and project length set the price; the subscription plan is priced on annual data volume |
| Ideals | Quote only | Three plans, each with a "Get price" button; the entry plan caps at 0.5 to 2 GB, where overage exposure begins |
| Ansarada | Data plan | Its pricing FAQ states that exceeding the plan raises fees for the rest of the term, that overage is measured at peak usage, and that deleting data does not lower it |
| DealRoom | Quote only, annual commitment | Charges neither per page nor per seat, prices on deal volume, publishes no dollar figure |
SecureDocs is the only one publishing an actual number. Ansarada also defers payment until the room goes live or 90 days after creation, whichever comes first.
Competitors characterize the model too. Ideals states that per-page vendors bill on cumulative uploads rather than stored volume, so re-uploading an edited document is billed again, and that they charge penalty rather than prorated rates past term (Ideals pricing page, accessed August 1, 2026). That is a competitor describing unnamed legacy vendors, not an independently verified fact.
The takeaway is a procurement one. Before signing, get three things in writing: the overage rate, how volume is measured and when, and what happens if the deal runs sixty days past term. Our [virtual data room pricing breakdown](/blog/virtual-data-room-pricing) works through the quote process.
## How many companies are you actually choosing between?
Fewer than the comparison sites suggest, and it is the most useful thing to know before a bake-off. Every acquisition below was read on the acquirer's own announcement or a regulator's register, accessed August 1, 2026.
Datasite acquired Firmex, announced July 26, 2021. Datasite then agreed to acquire ASX-listed Ansarada by scheme of arrangement, the deed announced February 13, 2024, and the Australian competition regulator confirmed on July 24, 2024 that it would not oppose the deal (ACCC informal merger review register). Datasite's own leadership page names five acquisitions. Datasite, Firmex, and Ansarada are one company, and a comparison table listing them as three independent alternatives describes a market that no longer exists.
The pattern holds. SS&C Technologies completed its acquisition of Intralinks on November 16, 2018, a date routinely misreported as 2020. Onit acquired SecureDocs on January 11, 2022. Dropbox announced its acquisition of DocSend for $165 million on March 9, 2021.
None of that makes these products worse. It does mean a shortlist of six names may be a shortlist of three companies, and your bargaining power is smaller than your spreadsheet implies.
## What separates one room from another?
Once you accept that every provider stores files competently, three things are left to test. Vendor statements below were read on the vendors' own pages, accessed August 1, 2026.
**Permission granularity.** Ideals headlines eight discrete permission levels, which is the most granular staging any vendor here advertises. What you want to test is not the count but revocation: how fast one recipient loses access without disturbing the other twelve.
**What the room does with the documents.** Where the category is moving. Datasite headlines semantic search, in-room AI with citations, and redaction at scale including text inside images. Ansarada headlines AI redaction at volume plus a data gauge for billing visibility, and a billing-visibility feature is an admission that surprise invoices are a known problem here.
**Claims, read skeptically.** The certification and adoption figures the enterprise vendors publish are vendor-reported, and we set out Datasite's in our [provider roundup](/blog/best-virtual-data-room-providers). So are the star ratings you will see, because the numbers reach you through vendor pages: the G2 testimonials Datasite embeds on its diligence page are labelled by Datasite itself as incentivized. Ask for the current SOC 2 Type II report rather than a badge.
## Which of these parts does Mage build?
Mage Data Room is a secure data room for fundraising and M&A, free for a limited time. It is self-serve: you create the room yourself, with no lead form and no sales call. Mapped against the definition this guide opened with:
- **Getting documents in.** Drag in files and folders, drop a data room ZIP export, or connect Google Drive, OneDrive, Dropbox, or Box and pick a folder. Common Paper imports executed agreements; SharePoint and Bookface are coming soon. A command-line client lets a terminal or an AI agent push documents in.
- **Organization.** One pass organizes the room and places every document. Each folder and filed document gets a stable dotted index number, the classic VDR index, exportable to XLSX. Unsorted documents stay unnumbered until they are filed.
- **Knowing what is missing.** Every room carries a readiness checklist of the documents an investor or acquirer expects to find, marked present, partial, or missing, and your own curation survives every recompute.
- **Sharing.** Invitations mint one personalized link per recipient, scoped to the room, a folder, or one document, view-only by default, with printing gated separately from download. Links carry optional expiry and instant revocation. The NDA gate is on by default and can produce a countersigned PDF in the audit trail.
- **Watermarking.** On by default: each page carries the viewer's identity, the date, and CONFIDENTIAL. A deterrent that makes a page traceable, not an access control.
- **Who read what.** Unique viewers, total views, and average completion, drilling into named viewers and their per-document engagement. Your own team's views are excluded, so internal activity never inflates the signal.
Mage is SOC 2 Type II certified. Review work is the separate diligence platform, which runs transactional diligence from data room to closing.
## Where to go next
Standing a room up this week? Start with [how to set up a data room](/blog/how-to-set-up-a-data-room), then work from the [investor data room checklist](/blog/investor-data-room-checklist) for a financing or the [due diligence data room checklist](/blog/due-diligence-data-room-checklist) for a sale. The rest of the cluster sits on our [data rooms topic hub](/blog/topics/data-rooms). To create one now, the [Mage Data Room](/dataroom) is self-serve and free for a limited time.
## URL: https://magelegal.com/blog/how-to-set-up-a-data-room
### Title: How to Set Up a Data Room: Step-by-Step (Web and CLI)
### Author: Mage Team
How do you set up a data room? Create the room, get every document into it, let it organize and index itself, then invite viewers one at a time with the permissions each one needs. The software half of that takes an afternoon. Collecting the documents takes one to three weeks, and that is the half that decides whether the room is any good.
Most guides to this question describe only the second half: define your purpose, build folders, configure settings, bulk upload, set permissions, invite users, turn on tracking. That sequence is accurate. It is also not where the time goes. This guide runs the whole path in order, browser first, then the command line for teams whose documents already sit in a structured folder tree on disk. If you are still deciding whether you need a dedicated room at all, start with [what a virtual data room is](/blog/what-is-a-virtual-data-room) and come back.
## How long does setting up a data room actually take?
Three phases, and only one of them is software.
**Collection: one to three weeks.** The documents are not in one place. The cap table lives with finance, the offer letters with HR, the customer agreements in a CRM and in three inboxes, the lease with whoever signed it. Every one of those handoffs is a person who has a day job. This is the phase every setup guide skips and every deal team underestimates.
**Population and structure: an afternoon.** Uploading, classifying, organizing, and indexing is the fastest part of the process now, whether you drag files into a browser or push a directory from a terminal.
**Review and first invite: half a day.** Reading what landed, deciding what is genuinely missing, and issuing the first scoped links.
The failure mode is running these in sequence. Start collection the day you decide to run a process, and create the room the same day, so documents can land as they arrive instead of piling up in a shared drive waiting for a big-bang upload.
## What do you do before you upload anything?
Three decisions, all of them made away from the software.
**Start from the request list, not from a folder template.** The list is the thing you will be graded against, so it should drive collection. A financing and a sale ask for different things: an investor's counsel wants the corporate stack, the cap table, and the commercial agreements that support the story; an acquirer's counsel wants everything the investor wants plus the liabilities. A Mage data room carries a readiness checklist keyed to the room's transaction type, so a fundraising room grades itself against what a venture investor's counsel requests and a sale room against what an acquirer's counsel requests. If you are raising, our [investor data room checklist](/blog/investor-data-room-checklist) is the list to work from.
**Assign an owner to every workstream.** Corporate and cap table, commercial contracts, people and benefits, IP, tax, financing, real estate, litigation. Write a name next to each one, not a department. The single most common reason a room sits at eighty percent for two weeks is that nobody actually asked the person who has the files.
**Decide your disclosure tiers now.** Most sale processes run at least two. Stage one is what a bidder sees before a shortlist: financials, corporate structure, redacted or summary-level commercial terms. Stage two opens after you have narrowed the field: full customer agreements, employee-level compensation, IP assignments, litigation files. Deciding the split before you populate is easy. Deciding it after you have already sent links is not.
## How do you decide folder structure before you have the documents?
You do not, and you should stop trying. Hand-building an empty folder tree in a browser is guesswork about documents you have not seen, and it is the reason so many rooms end up with a half-empty "Other" folder and three places a stock purchase agreement could reasonably live.
Two approaches actually work.
**Mirror a structure that already exists.** If your files sit in an organized directory on a machine or a shared drive, that tree is a real structure that survived contact with the documents. Push it up as it stands and adjust afterward.
**Upload everything, then let the room structure itself.** Mage organizes a room in one pass: a single agent chooses the folder structure and places every document, which is what keeps folder naming consistent across the whole room instead of drifting as documents trickle in. Every folder and every filed document then gets a stable dotted index number (1, 1.2, 1.2.3) in the Index column, and the index exports to XLSX for the deal file. One limit worth knowing before you send anything: a document sitting outside any folder is deliberately left unnumbered until it is filed, so an unsorted pile is visibly unsorted rather than quietly numbered into the index.
For naming conventions, tier design, and what a reviewing partner is actually looking for when they open the tree, see [how to organize a data room](/blog/data-room-organization-what-partners-want). This guide stays on setup mechanics.
## Setting up the room in a browser, step by step
**1. Create the room.** Mage Data Room is self-serve from the [data room product page](/dataroom) with no lead form, and it is free for a limited time. Set the transaction type when you create the room, since that selects which readiness checklist the room grades itself against.
**2. Get the documents in.** Four paths, and you can mix them:
- Drag in loose files or whole folders. Folder structure comes with them.
- Drop a ZIP archive, including a ZIP export from another data room.
- Connect Google Drive, OneDrive, Dropbox, or Box and choose a folder. Imports from SharePoint and Bookface are coming soon.
- Connect Common Paper to bring in executed agreements as PDFs.
Do not clean up the files first. Getting everything in and sorting afterward is faster than sorting before, and a document you cannot see is a document nobody can gap-check.
**3. Let the room classify and organize.** Each upload is classified by document type and summarized in a sentence or two. The organizing pass then places everything. Amendments, exhibits, and side letters get linked to the agreement they belong to, which is the relationship a reviewer would otherwise reconstruct by hand.
**4. Read the readiness checklist.** The room grades itself item by item: present, partial, missing, or not applicable. Partial usually means a multi-document item where something is attached but the set does not look complete, which is exactly the category worth a human minute.
**5. Fill the gaps.** For anything still outstanding, send a document request to the teammate who owns it. Requests here are internal, aimed at your own team. There is no counterparty portal and no client login, deliberately.
**6. Invite the first viewers.** Covered next, because it deserves its own section.
## How do you permission bidders, advisors, and auditors differently?
By issuing a different link to each of them. Mage mints one personalized link per recipient rather than one shared link everyone passes around, and each link carries the recipient's identity, an optional audience label (investor, third party, advisor, or custom), and its own settings.
The settings that matter for a real process:
- **Scope.** A link points at the whole room, one folder and everything nested beneath it, or exactly one document. Folder links are bound to a stable folder id rather than a path, so renaming or moving the folder does not break the link, and a folder that no longer resolves yields nothing rather than falling back to something broader.
- **View or download.** Download is off by default. Printing is gated independently, also off by default, because print to PDF is a download wearing a hat.
- **Expiry and revocation.** Set an expiry timestamp on the link, and revoke instantly when a bidder drops out. Revocation is read fresh on every request.
That model is what makes staged disclosure practical. Stage one is folder-scoped links to the early bidder set. Stage two is a room-scoped link issued to the shortlist. Because links are per recipient, opening tier two means issuing new links to a subset, not re-permissioning a link that half the market already holds.
Every page a guest views carries a dynamic watermark with their identity, the date, and CONFIDENTIAL. Be clear with yourself about what that does: it is a deterrent and an attribution tool, not an access control. It does not stop anyone from photographing a screen. What it does is guarantee that any page that leaves already carries the name of the person it was served to.
You also get the other side of that: which invitees opened the room, which documents they read, and how far through each one they got, with your own team's page views excluded so internal activity never inflates the signal. Analytics are owner and admin only.
## Should NDA gating happen inside the room or before it?
Both, and they answer different questions.
The negotiated NDA governs the relationship and is signed before the process starts. The in-room gate governs the individual open: the specific human who clicked through, on the specific date, before reaching the documents. In Mage the gate is on by default on every link. You can supply your own NDA text, upload an NDA PDF to display at the gate, or use the default template, and you can require a countersigned PDF that captures the accepted terms, the signer, and the audit metadata as a stored record both sides can see.
The distinction to hold onto: a click-through gate is an identification and acknowledgment mechanism. It is not a substitute for counsel negotiating an NDA, and nobody should treat it as one.
## What do you do about documents you cannot find?
Flag the gap. Always.
The instinct is to leave the hole quiet and hope the section reads as complete. It does not. Diligence counsel works from a request list, notices that item 4.3 has no response, and now has two questions instead of one: where is the document, and what else is missing that they have not spotted yet.
A labeled gap costs you one line. Mark the item missing with an owner and a date, or mark it not applicable when it genuinely does not apply, which removes it from the readiness score rather than leaving it as a permanent red mark. A room that says "we do not have signed copies of four 2019 offer letters, HR is reconstructing them, expected Friday" reads as a team in control of its own file. A room with four silent blanks reads as something else.
## The CLI path: when the files are already organized on disk
If your diligence documents already sit in a structured directory, the browser is the slow option. At 5,000 files across nested folders, drag and drop is a bad interface and everyone using it knows it.
Mage publishes a command line client for the data room. From zero it is two commands:
```bash
npx @magelegal/cli login
npx @magelegal/cli upload ./diligence
```
`login` opens a browser, you confirm a short code, and the CLI mints its own room-scoped API key that shows up in the room's API key settings. It requires Node.js 20 or newer, and credentials are stored locally at `~/.config/mage/config.json` with permissions readable only by you.
`upload` mirrors the local structure into the room. A directory reproduces its contents beneath it, transfers run in parallel, dotfiles like `.DS_Store` are skipped, and each document begins processing the moment it arrives rather than after the batch finishes. Push a file into a named folder with `--to "Corporate"`, and the folder is created if it does not exist.
The rest of the surface is what you would expect from a file client: `mage ls` to list documents by folder, `mage mkdir` to create a folder, `mage readiness` to print what is present, partial, and missing, `mage download` to pull the room or a folder back down with the structure intact, and `mage rm` to delete, where deleting a folder moves its documents to Unsorted rather than destroying them.
Two things worth stating plainly. The CLI covers the data room only; Mage's diligence platform has no command line surface. And every command accepts `--json`, which is what makes the same path usable by an AI agent rather than a person. The full command reference lives in our [data room CLI guide](/blog/data-room-cli).
## What to check before the first link goes out
Five minutes, in this order:
1. **Nothing stranded.** Anything sitting outside a folder is unnumbered and effectively invisible in the index. File it or delete it.
2. **The checklist has been read by a human.** Present, partial, missing, not applicable. Partial items are where the surprises live.
3. **Scope, on your own invite.** Open the link you are about to send and confirm it shows exactly what you intended and nothing adjacent.
4. **Download and print, deliberately set.** Both off unless you have a reason, and the reason should be a named person, not a habit.
5. **Expiry set on anything time-boxed.** A link to an auditor for a two-week review should not still be live in March.
Then send. Setup is not a one-time event; a live process adds documents every week, and the point of getting the structure and permissioning right up front is that additions land into a shape that already works.
More on running the room once it is populated, and on the rest of the deal preparation stack, in our [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/best-virtual-data-room-providers
### Title: The 10 Best Virtual Data Room Providers in 2026 (Honest Rankings from a Deal Lawyer)
### Author: Raffi Isanians
There is no single best virtual data room, and any list that names one is usually selling placement. The market splits into four segments, and your deal profile picks the segment: Datasite, Intralinks, and Ansarada for large-cap M&A; Firmex, Ideals, DealRoom, and SecureDocs for mid-market deals; DocSend, Digify, Papermark, and Mage for fundraising and small rooms; Box, Papermark, and Mage for teams that want a machine to drive the room.
That is the ranking. Here is the claim this article has to earn: almost every "best virtual data room providers" page on the first page of Google is an advertisement wearing a lab coat. The fastest way to check one is to look for Firmex and Ansarada presented as independent alternatives to Datasite. Datasite owns both.
## How this ranking was built, and what we sell
We make a data room. [Mage Data Room](/dataroom) is our product, it appears below, and we did not put it first.
Every competitor fact here was read on the vendor's own page or on a primary source such as a regulator's merger register or a press release, on August 1, 2026, and is attributed inline. We run no affiliate links, and no vendor paid for a position or reviewed a draft. There is no composite score either, because a composite score with unpublished inputs is a number picked to produce a ranking rather than measured to describe one.
One limit worth stating. We read no independent review score at its source, because G2, Capterra, TrustRadius, and Software Advice all refused automated access, so every star rating quoted in this category is a vendor's restatement. Relevant: the G2 testimonials Datasite embeds on its own diligence page are labelled by Datasite as incentivized, dated 9/25/25 and 10/3/25 (Datasite Diligence page, accessed August 1, 2026).
## Who actually owns whom in 2026?
| Brand | Parent | Milestone and date |
| --- | --- | --- |
| Datasite | CapVest Partners | Acquisition announced October 19, 2020 |
| Datasite | Formerly Merrill Corporation | Rebrand announced March 24, 2020 |
| Firmex | Datasite | Acquisition announced July 26, 2021 |
| Ansarada | Datasite | Scheme deed signed February 13, 2024; ACCC did not oppose July 24, 2024 |
| Intralinks | SS&C Technologies | Acquisition completed November 16, 2018 |
| SecureDocs | Onit | Acquisition announced January 11, 2022 |
| DocSend | Dropbox | Acquisition announced March 9, 2021, for $165 million |
Sources, all accessed August 1, 2026: CapVest's announcement; Datasite's leadership page, which carries the Merrill history and an acquisition list naming Firmex, MergerLinks, Sherpany, Sealk, and Ansarada, plus data provider Grata in 2025; Firmex's newsroom, which records the sale by Vertu Capital and BDC Growth Equity Partners Fund I on undisclosed terms; the ACCC public merger register; the SS&C press release; Onit's newsroom; and TechCrunch. Note the Intralinks date, routinely misdated to 2020 in search results and AI summaries. SS&C completed it in 2018.
The practical consequence: if your process runs Datasite against Firmex against Ansarada, you are negotiating with one seller across three quotes. Price each against a genuinely independent option, and read our [Datasite alternatives](/blog/best-datasite-alternatives) and [Intralinks alternatives](/blog/best-intralinks-alternatives) breakdowns for the vendor-specific versions of this argument.
## Which data room fits which deal?
| Deal profile | Segment | Where to start |
| --- | --- | --- |
| Large-cap M&A, competitive auction, many bidders | Enterprise M&A | Datasite, Intralinks, Ansarada |
| Mid-market M&A, few bidders, a named banker | Mid-market | Firmex, Ideals, DealRoom, SecureDocs |
| Seed to Series B raise, one document set, dozens of investors | Fundraising | DocSend, Digify, Papermark, Mage |
| Engineering-led team, agent or script driven | Developer and agent-driven | Box, Papermark, Mage |
## The enterprise M&A tier
### 1. Datasite
Datasite's stated positioning is that it is "the world's most trusted data room" and "the first with multi-LLM access" (Datasite Diligence page, accessed August 1, 2026). Its three headline diligence features as it states them: semantic search, in-room AI powered by Blueflame AI that draws only on project content and returns citations, and redaction at scale including text inside images. An MCP connector lets Claude, ChatGPT, or Microsoft Copilot operate against the room.
Datasite states it is the first data room provider certified to ISO/IEC 42001, handles 16,000 or more new transactions annually, and is used by 10 of the top 10 financial advisors. All vendor-reported; we could not verify the ISO 42001 claim.
Where it wins: the largest, most contested processes, where the buy side expects a room it already knows. Where it costs you: Datasite publishes no price anywhere. The diligence page routes to "request a quote," with a trial of up to 90 days.
### 2. Intralinks
Intralinks, now an SS&C company, markets VDRPro as "the fastest, smartest VDR anywhere" and claims to be the first VDR to earn ISO 27701 certification (Intralinks VDRPro page, accessed August 1, 2026; that page blocks automated retrieval, so treat the wording as approximate and confirm it yourself).
Where it wins: cross-border processes and financial-sponsor workflows where SS&C's broader stack is already in the building. Where it costs you: same opacity as Datasite, with no published price.
### 3. Ansarada
Ansarada markets predictable pricing with no hidden fees and defers payment until the room goes live or 90 days after creation, whichever comes first. Its stated headline features: AI redaction described as over 500 documents in minutes, a "data gauge" to eliminate bill shock, and streamlined Q&A (Ansarada pricing page, accessed August 1, 2026). It states a user base of 948,028 or more dealmakers, vendor-reported.
Now read the same page's FAQ, which contains the most useful sentence in the category. Ansarada states that exceeding your data plan means being charged for additional data for the remainder of your contracted term, that fees increase automatically from the next billing period, that overage is captured at peak usage, and that reducing the data in the room will not reduce the cost of the overage.
That is not a criticism. Ansarada is the only vendor here describing its own overage mechanic in plain English rather than attacking a rival's. It is also the clause you negotiate: ask for prorated overage and a peak-usage carve-out, with any vendor. Ownership overlap applies, since Ansarada is a Datasite company as of 2024.
## The mid-market tier
### 4. Firmex
Firmex positions as a purpose-built VDR operating since 2006 and sells subscription as the way to avoid project overtime charges, with the line "always-on, unlimited access means no project can ever go into overtime" (Firmex pricing page, accessed August 1, 2026). Its pricing headline is "no compromises, no surprises," though the page routes every plan to a quote: single-project pricing set by data requirements and project length, subscription priced on annual data volume rather than pages or seats. Firmex states 223,000 or more companies, 1.4 million or more users, and 189,000 completed projects. Vendor-reported.
Firmex also published the best argument against per-page pricing: a 2011 post quoting an attorney who paid roughly $25,000 for a room on a $20 million deal at $1 a page, the bill tripling as documents were added. That post is fifteen years old, so read it as evidence the model existed and produced overruns, never as a 2026 price.
Where it wins: recurring mid-market deal flow, where an annual subscription beats per-deal pricing. Where it costs you: it is a Datasite company, so it is not the independent counterweight a bake-off needs.
### 5. Ideals
Ideals prices on stored data volume rather than page count and markets that as the anti-hidden-fee position, with the line "pay for data used, not page counts." Its stated headline features: eight permission levels with in-depth data governance, an award-winning setup flow, and reporting built for oversight (Ideals homepage, accessed August 1, 2026). It promotes an MCP connector in its top banner.
Two things to read carefully on the pricing page. There is no published price; Core, Premier, and Enterprise each carry a "Get price" call to action. And the entry Core plan is capped at 0.5 to 2 GB of storage, the cap that creates overage exposure on a document-heavy room. The MCP connector and the API integration add-on are both gated to Enterprise. Ideals displays a G2 rating of 4.7 from 800 or more reviews and a Capterra rating of 4.8 from 300 or more reviews on its own site; we confirmed neither at the review site.
Where it wins: mid-market deals needing fine-grained permissioning without enterprise pricing. Our [Mage and Ideals comparison](/blog/mage-vs-ideals-data-room) goes deeper on the permission model.
### 6. DealRoom
DealRoom positions as an AI-powered operating system for buyer-led M&A, spanning pipeline management, due diligence, the data room, and post-merger integration, with DealRoom AI for Diligence sold as a paid add-on (DealRoom pricing page, accessed August 1, 2026). It states it does not charge per page or per seat, prices by the number of deals you actually do, includes unlimited users and data storage, requires an annual commitment, and publishes no dollar figure. It also ships an MCP integration connecting DealRoom data to Claude, ChatGPT, and Copilot.
One caution. DealRoom publishes three outcome statistics on that page, covering hours saved, closure speed, and team efficiency, with no stated methodology, sample, or period. Do not carry those into a committee memo.
Where it wins: a corporate development team running a repeatable acquisition program that wants pipeline and integration in the same tool as the room.
### 7. SecureDocs
SecureDocs is the only vendor here that publishes an actual price. Flat fee starting at $250 a month, including unlimited users, unlimited documents, and 24/7 support, with a second tier at $400 a month, and self-setup in ten minutes with no sales call required (SecureDocs product page on onit.com, accessed August 1, 2026). Publishing a number removes the two-week procurement dance from a deal that needs to start Monday, and the category gives that too little credit.
Where it wins: a mid-market seller who needs a room open today at a knowable cost. Where it costs you: a simpler product than the enterprise three, now sitting inside Onit's contract lifecycle portfolio.
## The fundraising and small-room tier
### 8. DocSend
DocSend is a Dropbox product. Dropbox announced the acquisition on March 9, 2021, for $165 million, and TechCrunch's report of that day describes the product as helping customers share and track documents by sending a secure link instead of an attachment (TechCrunch, accessed August 1, 2026). In our experience it is where founders start, and it reads closer to document analytics than to a deal room. We publish no DocSend price because every reachable figure came from a competitor's content marketing rather than the source. See our [Mage and DocSend comparison](/blog/mage-vs-docsend-data-room) for the functional differences.
### 9. Digify
Digify positions as secure document sharing plus virtual data rooms, with digital rights management, persistent protection after download, screenshot protection, dynamic watermarking, and one-click NDA as its stated headline features (Digify homepage, accessed August 1, 2026). Its pricing page renders entirely in JavaScript and returned nothing readable, so we record no Digify price.
Where it wins: sensitive document distribution outside a deal, where per-document controls matter more than a deal index.
### 10. Papermark
Papermark is the entrant most likely to be missing from an affiliate list. It publishes @papermark/mcp-server on npm from a vendor-owned scope and repository, maintained by the founder's account, with 13 versions and a last publish on July 27, 2026 (npm registry, accessed August 1, 2026). A separate papermark-cli package exists on npm but is published by an individual from a personal repository, so do not treat it as vendor tooling.
Where it wins: technical founders who want a room they can script against.
### Mage Data Room (our product, deliberately unnumbered)
Ten providers are ranked above. This one is ours, so it sits outside the count and inside the segments where it belongs.
Documents arrive by drag and drop, by zip, by cloud connector for Google Drive, OneDrive, Dropbox, Box, and Common Paper, or by command line. Every document that lands is classified and summarized. One agent organizes the whole room in a single pass and assigns the classic dotted index number to every filed document, which exports to XLSX. A readiness checklist names what an investor's or an acquirer's counsel will ask for and is still missing. Sharing is invite-first: one personalized link per recipient, view or download, printing gated separately and off by default, optional expiry, instant revocation, an NDA gate that can produce a countersigned PDF into the audit trail, and per-viewer watermarking as a deterrent. Analytics show which named viewers opened what and how far through each one they got. SOC 2 Type II certified, and free for a limited time.
Where it wins: small and mid-market rooms, fundraising, and technical or agent-driven teams. The command line client installs with `npx @magelegal/cli`, every command accepts `--json`, and `mage readiness --json` returns the missing-item list with stable item ids, so an agent can upload against the right item.
Where it does not win: a hundred-bidder carve-out auction. Mage Data Room has no counterparty Q&A workflow, no redaction, and no bidder-segregation history a sell-side banker recognizes on sight. If your process needs those, buy one of the enterprise three. Our [Mage and Datasite comparison](/blog/mage-vs-datasite) sets out that boundary.
## Who publishes a price, and who makes you call sales?
| Provider | Published price? | Pricing basis as stated |
| --- | --- | --- |
| SecureDocs | Yes | Flat fee, $250 and $400 a month |
| Firmex | No | Data volume plus project length; subscription on annual volume |
| Ideals | No | Stored data volume; entry plan capped at 0.5 to 2 GB |
| Ansarada | No | Data plan with peak-usage overage for the rest of the term |
| DealRoom | No | Deal volume, unlimited users, annual commitment |
| Datasite | No | Quote only; trial of up to 90 days |
| Intralinks | No | Quote only |
| Digify | Not readable | Pricing page returned nothing readable |
| DocSend | Not verified | Not readable at the source |
One vendor out of nine publishes a number. That is why the negotiating lever in this category is the overage clause, not the headline rate. Our [virtual data room pricing breakdown](/blog/virtual-data-room-pricing) works through the models one at a time.
## Which AI features are shipped, and which are marketing?
Shipped and verifiable on the vendor's own surface, all accessed August 1, 2026: Datasite's in-room AI with citations, at-scale redaction, and MCP connector, plus its public repository of eight agent skills for sell-side deal teams covering VDR index setup, gap analysis, information-request-list tracking, and bulk Q&A drafting, with Claude Code named as a supported host; Ideals' MCP connector, gated to Enterprise; DealRoom's MCP integration; Ansarada's volume redaction.
Stop repeating the claim that only one vendor is agent-reachable. What holds, checked on August 1, 2026, is narrower: no established deal VDR publishes a command-line client on npm. Box does publish an official npm command line client and does market a virtual data room, and Papermark publishes a vendor-owned npm executable, so the unqualified version is false. The vendor-by-vendor check and both counterexamples sit in our piece on [the data room command line client](/blog/data-room-cli).
## How to read any ranking, including this one
Four questions. Who paid for the order? What was accessed, and when? Are any of these brands the same company? Does the author sell one of the products, which we do?
If a page cannot answer those, it is not research. Start from your deal profile, price the ownership map honestly, negotiate the overage clause rather than the sticker, and read more in our [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/best-datasite-alternatives
### Title: 8 Best Datasite Alternatives in 2026 (and Which Ones Datasite Now Owns)
### Author: Raffi Isanians
The Datasite alternatives most buying guides recommend are Intralinks, Ideals, Firmex, Ansarada, DealRoom, SecureDocs, Digify, and a newer class of self-serve rooms. Two of those are Datasite. Datasite announced its acquisition of Firmex on July 26, 2021, and Ansarada announced a signed scheme implementation deed with Datasite on February 13, 2024, so a shortlist offering Firmex or Ansarada as an escape from Datasite is recommending the same parent company twice.
That is not automatically the wrong answer. Firmex prices on data volume rather than pages, and the pricing model is usually the real reason people leave. But a bake-off in which two of your three quotes come from one seller is not a bake-off, and the first thing that happens when you try to play those quotes against each other is nothing.
## How did the data room market get here?
Dates below are from the primary announcements, accessed August 1, 2026.
- **November 16, 2018.** SS&C Technologies completed its acquisition of Intralinks Holdings, per SS&C's own release. This one is routinely misdated to 2020 in search results and AI summaries. The close is 2018.
- **March 24, 2020.** Merrill Corporation became Datasite. Datasite's about page still describes the company as "still known as Merrill Corporation" in 2014, before its transformation from financial communications and print into M&A software.
- **October 19, 2020.** CapVest Partners LLP announced an agreement to acquire Datasite Global Corporation, closing expected in Q4 2020. Datasite has been CapVest-owned since. It was not Carlyle, whatever the summaries say.
- **July 26, 2021.** Datasite announced the acquisition of Firmex from majority owners Vertu Capital and BDC Growth Equity Partners Fund I. Terms were not disclosed, and Firmex was to operate as a standalone strategic business unit with its management in place.
- **January 11, 2022.** Onit acquired SecureDocs, per Onit's own announcement.
- **February 13, 2024.** Ansarada announced a signed scheme implementation deed with Datasite covering 100% of its fully diluted share capital, per the ACCC's public merger register.
- **July 24, 2024.** The ACCC recorded the transaction as not opposed, after a review that commenced March 27, 2024 and ran 38 days.
- **2025.** Datasite acquired private-market data provider Grata, per Datasite's own leadership bios.
Datasite's about page lists five acquisitions in one sentence: Firmex, MergerLinks, Sherpany, Sealk, and Ansarada. Two of those are vendors comparison articles routinely present as Datasite's rivals.
## Which Datasite alternatives does Datasite own?
Two of the eight below. Here is the field on one screen, each pricing model stated the way the vendor states it.
| Provider | Parent | Pricing model as stated by the vendor | Dollar figure published? |
| --- | --- | --- | --- |
| Datasite | CapVest since 2020 | Quote only; free trial up to 90 days on a new project | No |
| Firmex | **Datasite** | Per project by data volume and project length, or subscription by annual data volume | No |
| Ansarada | **Datasite** | Tailored quote; payment deferred until the room goes live or 90 days after creation | No |
| Intralinks | SS&C since 2018 | Not published | No |
| Ideals | None recorded | Priced on stored data volume; three plans, entry tier capped at 0.5 to 2 GB | No |
| DealRoom | None recorded | Priced by deal volume, unlimited users, annual commitment | No |
| SecureDocs | Onit since 2022 | Flat fee, unlimited users and documents | **Yes, from $250/month** |
| Digify | None recorded | Not readable at source | No |
Read "none recorded" literally. It means we found no acquisition on a primary announcement or a regulator's register, not that we confirmed the company is independent. Given how much of this article is about ownership that comparison lists get wrong, we are not going to assert the negative.
One vendor of the eight publishes a number. That single fact explains most of the frustration behind the query that brought you here, and it is why we wrote a separate piece on [how virtual data room pricing models actually work](/blog/virtual-data-room-pricing).
## The six alternatives with no Datasite tie
Each entry below answers one question only: what does switching here get a Datasite customer, and what does it cost you. The full capability write-ups live in our [roundup of virtual data room providers](/blog/best-virtual-data-room-providers), and we have deliberately not repeated them.
### 1. Intralinks (SS&C)
The other incumbent, and the only swap on this list that a large-cap bidder universe will recognize on sight. Its VDRPro page claims a first-VDR ISO 27701 certification, but that page blocks automated retrieval, so treat the wording as approximate and confirm it yourself before you put it in a procurement pack. The trade runs both ways, which is the subject of our guide to [Intralinks alternatives](/blog/best-intralinks-alternatives).
### 2. Ideals
The switch that changes the meter rather than the vendor tier: Ideals sizes the bill to stored data volume instead of uploads, which is usually the objection that started your search. Check the entry plan's 0.5 to 2 GB cap against your scanned exhibits before you treat that as a saving, and check which tier your integrations sit in.
### 3. DealRoom
Not really a Datasite substitute. It is a buy-side program tool with a room attached, so it fits a corporate development team that keeps acquiring and does not fit a one-off sale. It also publishes outcome statistics with no stated methodology, sample, or period, which do not belong in a committee memo.
### 4. SecureDocs (Onit)
The shortest path from "we cannot get a number" to a number: flat-fee pricing published from $250 per month, with a second tier at $400, and self-setup stated at ten minutes with no sales call. Put that published figure next to your Datasite quote and make the rep explain the difference, which is a useful conversation whichever room you end up in.
### 5. Digify
A document-security product rather than a deal-process one. Right for a bilateral disclosure or a pre-marketing phase, wrong the moment a request list arrives and someone needs an index to cite.
### 6. Mage Data Room
Disclosure: this is ours, so read it as an argument rather than a verdict. [Mage Data Room](/dataroom) is free for a limited time. That is the only price claim we make, and we have kept it out of the table above on purpose.
The mechanic that matters to somebody leaving an incumbent room is the migration itself. A Datasite ZIP export goes into the same drop zone that takes loose files and folders, so there is nothing to configure and no connector to buy; the documents arrive tagged with where they came from. An organizing pass then rebuilds the folder tree and assigns the classic dotted index number to every filed document, exportable to XLSX, which is the artifact your request list has to be reconciled against on the day you cut over. Sharing is rebuilt per recipient rather than per group, so Stage 1 and Stage 2 become two scopes on one room. Mage is SOC 2 Type II certified.
Two honest gaps against Datasite and Ansarada. There is no redaction feature, and no counterparty Q&A module. The room's assistant is members-only and grounded in the room's own documents, which makes it the wrong shape for a bidder-facing question log. If a bank-run Q&A log is a hard requirement, this is not your room yet. The boundary is drawn in full in our read of [what a Datasite quote actually buys](/blog/mage-vs-datasite).
## The two alternatives with Datasite as the parent
### 7. Firmex
Worth shortlisting for one reason: it meters on data volume and project length rather than on uploads, and it sells an always-on subscription aimed squarely at teams tired of project overtime charges. Every plan still routes to a quote, and it is a Datasite business unit, so walk into that negotiation knowing whose margin you are arguing about.
### 8. Ansarada
The relevant fact for a switcher is not its feature list, it is its candour about billing. Ansarada's own pricing FAQ concedes that overage rides the rest of the contracted term, that it is captured at peak usage, and that deleting the data afterwards does not reduce the invoice. Ask every metered vendor on your list the same three questions, and see our [pricing guide](/blog/virtual-data-room-pricing) for the rest of the mechanic. Payment is deferred until the room goes live or 90 days after creation, whichever comes first, which is genuinely useful when your timeline is uncertain. Ownership applies here too.
## What does Datasite actually cost?
Nobody outside a Datasite quote knows: the company publishes no price anywhere on its site, routes the diligence product to a quote request, and offers a new project a trial of up to 90 days. That makes every cost conversation a negotiation under asymmetric information, and the seven definitions you have to pin down before a quote means anything are set out in our [breakdown of Datasite pricing](/blog/mage-vs-datasite).
## Can you trust the review scores in this category?
Less than you would like, and it matters because most competing listicles are built on scraped G2 numbers. Datasite embeds G2 testimonials on its own diligence page and labels them incentivized, dated 9/25/25 and 10/3/25. That does not make a review false, but the sample is not organic. Ideals displays a 4.7 out of 5 from 800+ G2 reviews and 4.8 out of 5 from 300+ Capterra reviews on its own site. Ansarada displays G2 Grid Leader badges. Every one of those numbers is a vendor restating a score about itself.
Use review sites to generate questions, not to rank vendors. The signal you want is three references from firms doing your deal size in your sector, and one should be a deal that went badly.
## When is switching away from Datasite a mistake?
When the buyer universe expects it.
Datasite publishes certification and adoption figures to support that claim, all vendor-reported and unaudited, and we set them out in our [provider roundup](/blog/best-virtual-data-room-providers). The familiarity argument underneath them is the real one, and it is the strongest thing Datasite has. In a broad auction, every diligence team on the other side has used the interface before, and their questions land on your banker instead of your associate. Two capabilities are built for exactly that process and have no equivalent in a lean room: redaction that runs at volume, and a Q&A workflow a bank can administer.
So the recommendation splits by process. Any article giving you one answer is not paying attention:
- **Broad large-cap auction, banker-run, dozens of bidders.** Stay. Negotiate the pricing model, not the vendor.
- **Mid-market sale, bilateral or small club.** Switch freely. Bidder familiarity is worth little when the bidder list fits on one line.
- **Fundraising, a carve-out data room, or a diligence prep room before the bank is hired.** You are paying deal-process pricing for what is, at that stage, an organized folder tree with an audit trail.
Three honest costs of leaving. Your banker's preference becomes your friction, and they will mention it to your client. The rebuild is real: index numbering changes, permission groups get reconstructed, live links get reissued, so move between phases and never inside a bid window. And redaction at volume plus a formal Q&A module are present in the incumbent rooms and absent from lighter ones, so confirm your deal does not need them before calling the price gap free money.
## How to run the shortlist
Pick two rooms that price on different models, not two rooms with different logos. Send both the same three pricing questions and require written answers. Then run your own document-collection phase through the finalist before the room goes live to a counterparty.
For the wider field rather than the Datasite-specific view, start with our [virtual data room provider roundup](/blog/best-virtual-data-room-providers). The rest of our writing on rooms sits in the [data rooms resource hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/best-intralinks-alternatives
### Title: 7 Best Intralinks Alternatives for 2026
### Author: Raffi Isanians
The best Intralinks alternatives in 2026 are Datasite, Ideals, Ansarada, Firmex, DealRoom, SecureDocs and Digify. Which one fits depends entirely on why you are on Intralinks in the first place. If a banker or a lender picked the room and you are running a mid-market deal, most of this list does the same job with less friction. If you are there for syndicated loan administration or a cross-border information rights model your counsel already wrote into protocol, a straight swap may not exist at any price.
This article is written for the second reader. Intralinks sits under banks, lenders, insurers and capital markets teams, and the failure mode for those buyers is not overpaying. It is signing a room that cannot satisfy an information rights protocol, or that cannot attribute a page view to one participant in a syndicate, and discovering it in the week the facility is being amended.
Two facts to get straight before anything else, because most pages on this query have them wrong. SS&C Technologies completed its acquisition of Intralinks on November 16, 2018, per SS&C's own announcement, accessed 2026-08-01; search results and AI summaries routinely place it in 2020. And three names that standard roundups offer as separate alternatives now share one parent, which our [provider roundup](/blog/best-virtual-data-room-providers) maps in full. Neither fact changes what a room does. Both change who you are actually negotiating against.
One product claim you will meet immediately. Intralinks positions VDRPro on speed and AI and states that it is the first VDR to earn ISO 27701 certification (Intralinks VDRPro page, accessed 2026-08-01; that page blocks automated retrieval, so treat the wording as approximate and confirm it yourself). Whichever room you end up in, ask for the certificate and its scope of systems rather than the sentence on the page.
## What does an information rights model demand from the room?
Before residency, before price, before anyone demos anything, write down what your counsel has already promised somebody about who can see what.
In a bilateral corporate sale that document does not exist and the question is trivial. In a syndicated facility, an underwriting panel, or a cross-border carve-out with a works council involved, it exists, it was negotiated, and the room has to implement it rather than approximate it. Three requirements fall out of it and they are the ones cheap rooms fail:
- **Attribution per human, not per organization.** A lender group is dozens of readers your borrower never invited and cannot vet. If access is one link circulated inside an institution, you cannot answer the only question that will ever be asked about it.
- **Scope that survives reorganization.** Rights are written against categories of information, and folder trees get rebuilt mid-facility. A permission bound to a folder path breaks silently when someone renames the folder; a permission bound to a stable folder id does not.
- **An audit trail you can hand over.** Not a screen inside the vendor's product, which you lose when the account closes, but an export in a format your record retention policy already accepts.
Write those three down before anything else. They decide whether you are shopping at all.
## When does Intralinks have no real substitute?
Ask a blunt question before you shortlist anything: what would break if the room disappeared tomorrow? If the answer is "our documents would need somewhere else to live", you have a storage problem and this list solves it. If the answer names a workflow that runs continuously and outside any single deal, you have something else. Three cases come up repeatedly:
- **Syndicated loan administration.** The room is not hosting a deal, it is servicing a facility across a lender group, with an amendment cadence that never ends. Moving that is a workflow migration with a legal review attached, not a vendor swap.
- **Cross-border information rights.** When counsel has already written a rights model into a protocol that regulators or a works council signed off on, the model is the constraint, not the software. Re-papering it costs more than the licence.
- **Regulated capital markets and insurance M&A.** Underwriting panels and syndicate readers mean dozens of external people who are not your client, on documents your client cannot reissue. Attribution per reader is the requirement, and it is the one most cheaply built alternatives fail.
If none of those apply, and for most Intralinks rooms none of them do, the rest of this list is live.
## What will a bank's own risk review refuse to pass?
Run this before any demo. It is faster than a feature matrix, and it is what that review will run anyway once you have already fallen in love with something.
| Requirement | Why it matters at a bank, lender or insurer | What to ask for, in writing |
| --- | --- | --- |
| Certification evidence | A badge on a marketing page is not a report | The current report under NDA, with audit period and scope of systems covered |
| Data residency | Cross-border deals impose constraints the vendor cannot waive | The named regions where live documents and backups sit |
| Attribution per reader | A syndicate or underwriting panel is dozens of readers you never invited | Whether every link binds to one named recipient, or one link circulates |
| Print gated separately from download | Print to PDF is a download in disguise | Whether print is its own permission, not folded into download |
| Revocation behaviour | Access must end the moment a party drops out | Whether revocation is checked on every request or cached until a session expires |
| Exportable audit trail | Six months later the record is the deliverable, not the room | The export format, and which roles can pull it |
| Exit path | Every room is temporary | Whether a full export reproduces the folder tree and the index numbering |
Anything that cannot answer residency and attribution in writing is off the list. That usually cuts a nine-name shortlist to four before a single call, and only then does price become a real question.
## What does a quote look like when the room is bank-mandated?
Almost nobody in this category publishes a number, and the few who do sell a different shape of product.
| Vendor | Owner, where recorded | Price published on its own page? | How it is priced, as the vendor states it |
| --- | --- | --- | --- |
| Intralinks | SS&C Technologies since 2018 | None found at source | Not verified |
| Datasite | CapVest Partners since 2020 | No | Request a quote; free trial up to 90 days on a new project |
| Ansarada | Datasite | No | Tailored quote; payment deferred until the room goes live or 90 days after creation |
| Firmex | Datasite | No | Quote set by data volume and project length; subscription priced on annual data volume |
| Ideals | None recorded | No | Three plans, each with a "Get price" call to action; entry plan capped at 0.5 to 2 GB |
| DealRoom | None recorded | No | Priced by deal volume, annual commitment |
| SecureDocs | Onit since 2022 | Yes | Flat fee from $250 per month, self serve |
| Digify | None recorded | Not recorded | Pricing page returned no readable content when checked |
Every entry above was read from the vendor's own page on 2026-08-01, except the Intralinks row, where no primary published price was found. Treat any specific Intralinks figure in a listicle as unsourced until someone shows you the quote.
The structural consequence matters more than the missing numbers. When price is set in a quote, it is set by what the vendor thinks you can pay, and a bank-mandated room on a mid-market deal is the easiest quote in the category to inflate. We cover the underlying models in our breakdown of [how virtual data rooms price](/blog/virtual-data-room-pricing).
## The 7 best Intralinks alternatives for 2026
Each entry states only what it means for a regulated, lender-side or syndicate buyer. Full capability write-ups on all seven live in our [roundup of virtual data room providers](/blog/best-virtual-data-room-providers), and we have deliberately not repeated them here.
### 1. Datasite, the like for like enterprise swap
For a bank-mandated room this is the same buying experience with a different logo: no published price, a quote, an enterprise cycle, and a genuine peer on scale that the teams across the table already recognize. What you do not gain is negotiating room unless you are willing to walk, and two of the names you would price it against are its own business units, which our guide to [Datasite alternatives](/blog/best-datasite-alternatives) works through.
### 2. Ansarada, strong sell-side discipline, now inside Datasite
The relevant fact for a lender-side buyer is not the feature list, it is the billing mechanic: Ansarada's own pricing FAQ concedes that going over a data plan lifts the fee for the balance of the contracted term, which you want to have read before anyone loads a full facility history into a room. Put it on a shortlist knowing it is not independent competitive tension against Datasite.
### 3. Firmex, for teams that run rooms continuously
It answers a specific banking pattern, the team that opens rooms constantly and is billed for each one, by selling an always-on subscription priced on annual data volume instead of per project. If your objection to Intralinks is bill volatility across many small rooms rather than the room itself, that is the shape of answer to look for, whoever sells it to you.
### 4. Ideals, permission granularity for regulated counterparties
Eight discrete permission levels is the detail that matters when you are distributing to a lender group or an underwriting panel, because the gap between what the lead sees and what a participant sees is a legal distinction rather than a preference. Check which tier your integrations sit in and where the entry plan's storage cap lands against a facility's document history, because both are quote conversations you would rather have before signature.
### 5. DealRoom, built for the buy side rather than the seller
Right shape for an acquisitive lender or a corporate development team running a repeatable program, wrong shape for a single facility or a one-off sale. It publishes no dollar figure and requires an annual commitment, which makes it a program decision rather than a deal decision.
### 6. SecureDocs, the only published price
The only vendor in this set that publishes an actual number: flat fee from $250 per month, self setup stated at ten minutes, no sales call. For a mid-market deal that landed on an enterprise room because a banker had a login, putting that published figure next to your quote and asking what the difference buys is the most useful hour in the process.
### 7. Digify, for lighter regulated exposure
Right size for a bilateral disclosure, a small portfolio sale, or the pre-marketing phase before a real room opens. Wrong size for a syndicated process with dozens of separately attributed readers, which is the requirement this article opened with.
## What does a lean room give a syndicate buyer, and what does it not?
[Mage Data Room](/dataroom) is our own product, so read this section as the interested party writing it, and read the limits first.
There is no counterparty Q&A module and no redaction feature, and Mage claims SOC 2 Type II and no other certification. A risk review asking about anything beyond that gets no answer from us, and a lender-side process that needs a formal question log administered by an agent bank is not a process we would take from an incumbent.
What is relevant to the three requirements at the top of this page is narrower, and it is the sharing model. Inviting someone mints one link bound to that person's email address, so every view is attributable to a human even before an NDA is signed, which is the requirement most cheaply built rooms fail. Links carry view or download permission with print gated independently of download, and both expiry and instant revocation are read fresh on every guest request rather than cached to a session. Folder-scoped links point at a stable folder id rather than a path, so rebuilding the tree mid-facility does not silently break somebody's rights, and a scope that no longer resolves yields nothing rather than defaulting open. An Intralinks ZIP export goes in through the same drop zone that takes loose folders, and the documents arrive tagged with where they came from; that is ingestion rather than an integration, and there is no Intralinks connector. Per-viewer watermarking is on by default and is a deterrent rather than an access control: bytes leaving the server already carry the reader's name. Mage is free for a limited time.
One narrow fact relevant to automated workflows: no established deal VDR publishes a command-line client on npm, checked 2026-08-01, while Mage publishes `@magelegal/cli`. The vendor-by-vendor check and the two counterexamples are in our piece on [the data room command line client](/blog/data-room-cli). That is not a claim to be uniquely reachable by software. Datasite ships an MCP connector for Claude, ChatGPT or Microsoft Copilot, Ideals promotes an MCP connector on its homepage, and DealRoom ships an MCP integration for its deal data. Agent access is becoming table stakes, not a differentiator.
## How do you cut a room over inside a live facility?
Mechanically, easier than people expect. Procedurally, harder. The export usually works. What does not travel is everything hanging off the old room: the index numbers your amendment request cites, live participant sessions you have to reissue and re-paper against the same information rights, and an audit trail that now sits in two systems and has to read as one continuous record six months later.
Three rules. Move between amendment cycles or diligence phases, never during a bid deadline or a consent window. Freeze the request list the day you cut over and reconcile it against the new index before you reopen access. Export the old room's activity log to a file you control on the day you close the account, because a terminated account is not a place to keep evidence.
Still building the shortlist? Start from the information rights model at the top of this page rather than from a feature matrix, and the rest of our [data room coverage](/blog/topics/data-rooms) goes deeper on room structure, pricing and the handoff into diligence.
## URL: https://magelegal.com/blog/mage-vs-datasite
### Title: Datasite Pricing Explained (2026): Why There Is No Published Number, and What to Pin Down in the Quote
### Author: Raffi Isanians
Datasite does not publish a price. Its diligence product page routes every buyer to a quote and offers a new project a free trial of up to 90 days, per Datasite's own product page accessed August 1, 2026. That makes the arithmetic your job, so start there.
Settle one thing before any of it, because most pages answering this query get it wrong by implication. Datasite states no billing unit publicly either. Nobody outside the sales conversation can tell you whether your room will be quoted on pages, on gigabytes, on named seats, or as a flat fee for the term. Metered billing is a documented practice across the virtual data room category, not a verified fact about this vendor, so everything below is written as what to do if your quote comes back on a given basis, never as a description of what Datasite charges.
That distinction matters more than it sounds, because the unit decides the bill far more than the rate does. A metered bill scales with the room: every document the buyer asks for adds to it, and the seller's incentive quietly inverts. A flat fee does not. The single best-documented account of what happens on the wrong side of that curve is a Firmex post from 2011, in which an attorney's data room bill tripled as documents kept arriving through diligence on a $20M deal, and we work through it in our [guide to virtual data room pricing](/blog/virtual-data-room-pricing).
Everything below is about which side of the curve your deal sits on, and about the seven things that have to be in the quote before you can tell.
## What does Datasite cost for a mid-market deal?
There is no honest public answer, and any article that hands you one is reconstructing it. The verifiable facts are narrow: Datasite states no price on its site, routes the diligence product to a quote, and offers up to 90 days free on a new project.
So treat the quote as a document to negotiate, not a number to accept. Ask the rep to put all of the following in writing before you compare anything:
- The billing unit. Pages, gigabytes, users, deals, or a flat term fee.
- The definition of that unit. How a spreadsheet, an email archive, and a scanned exhibit set are counted.
- The included allowance and the overage rate, stated separately.
- Whether overage is measured at peak usage or at end of term.
- The term, the extension rate, and whether extensions prorate.
- File type surcharges, user seat charges, training charges, and support tiers.
- The exit: export format, cost, and how long you have to take it.
A quote that answers all seven is one you can compare against another vendor. A quote that answers three is a number with no units.
## What counts as a page?
If a quote comes back metered on pages, this is the definition to chase. A page is a rendered output, not a sheet of paper, and that distinction is the whole game.
Take your own operating model. As a file, it is one item in your room. As a rendered artifact it is whatever the vendor's conversion pipeline produces from a wide multi tab workbook, and if the conversion breaks wide tabs across sheets it is more again. One file, an unknown number of billable units. A scanned minute book gives the opposite result, page for page and unavoidable. Nobody can hand you that ratio in an article, because it is a property of your files run through their converter. What you can do is ask them to run it and put the number in the quote before you sign, which takes them an hour and takes you a phone call.
Two mechanics widen the gap, and both are documented by vendors selling against the model rather than by the vendors using it. Ideals argues that legacy metered vendors count every upload rather than what ends up stored, so ten revisions of one file can mean paying for it ten times, and that the same vendors add surcharges on non-PDF conversions and reprice rather than prorate an extension. That is a competitor's characterization of unnamed vendors and not an audited finding, and our [pricing guide](/blog/virtual-data-room-pricing) sets out what Ideals actually published. They are still the right questions to put to any rep.
The structural complaint is older than the current vendors. Firmex called per page billing a printer's paradigm rather than a software paradigm, noted that the hosting and bandwidth cost of a page is fractions of a cent per month, and pointed out the practical absurdity: the seller has to count its own pages before it can even get a quote. That was 2011. The model outlived the argument.
## Which fees are not in the quote?
The overage clause is where a quote and an invoice usually part company, and one vendor sets out the mechanic in plain English on its own page: Ansarada's pricing FAQ concedes that overage rides the rest of the contracted term. Our [pricing guide](/blog/virtual-data-room-pricing) takes that clause apart in full. Read it before you sign anything sized to a plan, because the practical consequence is that one heavy week of diligence uploads can set the rate for the remaining five months, whether or not the documents are still there.
The category knows this is a real problem, which is why Ansarada also markets a data gauge whose stated purpose is to remove guesswork and eliminate bill shock. A vendor shipping a dashboard against its own invoice is a concession worth reading.
Here is how the models on offer compare on the one thing that matters, which is what happens to the bill when the room grows.
| Pricing model | Stated by | What it does to your bill |
| --- | --- | --- |
| Metered on uploads | The model the rest of the category publishes arguments against | Scales directly with what you load, and again with re-uploads if the vendor meters cumulative uploads |
| Data volume | Ideals prices on stored data volume rather than page count and markets it as the anti hidden fee position | Scales with gigabytes; the entry Core plan is capped at 0.5 to 2 GB, which is where overage exposure starts |
| Data plan with overage | Ansarada's own pricing FAQ | Overage rides the remainder of the term |
| Deal volume, flat | DealRoom states it does not charge per page or per seat, prices on deal volume with unlimited users, and requires an annual commitment | Fixed per deal, but no dollar figure is published and the commitment is annual |
| Published flat fee | SecureDocs publishes flat fee pricing from $250 per month with unlimited users and unlimited documents | Fixed regardless of room size, and the only actual published price among the vendors reviewed here |
| Quote only | Datasite publishes no price and routes to a quote, with up to 90 days free on a new project | Unknown until quoted, which is why the seven definitions above matter |
All entries read on each vendor's own site, accessed August 1, 2026.
## At what deal size does a metered room stop making sense?
You can find the crossover for your own deal with one division, and you should do it before the call rather than during it.
Take the published flat figure for the term you actually need. SecureDocs posts $250 per month, so six months is $1,500. Divide that by the number of pages, or gigabytes, or seats your room will realistically hold, and you have the metered rate at which the two contracts tie. Any quoted rate above that line makes the metered room the more expensive one; any rate below it makes the flat room the more expensive one. On a fifteen hundred page room the tie is a dollar a unit. On a forty thousand page room it is under four cents.
That is why the crossover almost always lands in the same place. Flat pricing wins on any room large enough to need a data room in the first place, and metered pricing only competes on a room small enough that a shared folder would also have done the job.
The workflow consequence is the one people underrate. Sellers billed by the upload start rationing uploads, and a rationed room reads as an evasive room to the buyer on the other side. That is a negotiating cost, not a line item, and it does not appear anywhere in the quote.
## Who owns the alternatives on your shortlist?
This is the part most comparison pages get wrong, and it changes how you run the bake off.
Datasite announced its acquisition of Firmex on July 26, 2021. It signed a scheme implementation deed to acquire ASX listed Ansarada on February 13, 2024, and the Australian competition regulator did not oppose the transaction on July 24, 2024 after a 38 day review. Datasite's own leadership page lists Firmex, MergerLinks, Sherpany, Sealk, and Ansarada among the acquisitions it made, and adds private market data provider Grata in 2025. Datasite itself is the former Merrill Corporation, rebranded in 2020, and has been owned by CapVest Partners since a deal announced October 19, 2020.
So a shortlist of Datasite, Firmex, and Ansarada is one company quoted three ways. That is not disqualifying, and business units do still compete internally on price. But you should know it before you play one quote against another. Ownership across the category is mapped in our roundup of the [best virtual data room providers](/blog/best-virtual-data-room-providers), and the vendor specific view is in [best Datasite alternatives](/blog/best-datasite-alternatives).
## Does the AI change the diligence work, or just the search box?
Datasite positions its diligence product as the world's most trusted data room and the first with multi LLM access. Its three stated headline features are semantic search that tracks meanings rather than keywords, an in room AI powered by Blueflame AI that draws only on the project's content, respects user permissions, and returns cited answers, and at scale redaction that can target words inside images. Datasite also states an MCP connector and a published set of agent skills aimed at sell-side deal teams, which the [provider roundup](/blog/best-virtual-data-room-providers) enumerates.
Those are real capabilities, and the redaction one has no equivalent in a lean room. If your deal carries a redaction burden measured in hundreds of documents, that feature alone can justify the enterprise quote. The certification and adoption figures Datasite publishes are vendor reported and enumerated in the roundup linked above; the practical point for a buyer is narrower, which is that a procurement team will treat a certification line as a real answer and most rooms have no answer to give.
The honest read on both sides of this comparison is narrower than the marketing on either. An in room assistant answers questions about the documents in the room. It does not produce the diligence work product, and neither vendor claims a substitute for the review itself. When you evaluate AI in a data room, the useful question is not whether it answers questions. It is whether anything happens to a document at the moment it lands, before anyone thinks to ask.
One note on evidence. The G2 testimonials Datasite embeds on its own diligence page are labelled by Datasite as incentivized reviews. That disclosure is unremarkable and to their credit, but it is a reason not to treat aggregate review scores in this category as independent signal.
## What a quote does not buy either way
Disclosure: we build a data room, so this section is where our interest sits. Gaps first, because they are the part of a quote comparison that actually decides it.
Three things the enterprise room has and ours does not. There is no redaction feature in [Mage Data Room](/dataroom), so anything requiring it is handled before upload. There is no counterparty Q&A module, the buyer-and-seller question workflow that bankers administer a sell-side process on; Ask Mage answers from the room's documents for members only and guests never see it. And Mage claims SOC 2 Type II and no other certification, so a procurement questionnaire asking about anything beyond that gets a blank. On a large banked auction, the incumbent wins those three lines outright, and that is not a deal we would take from them.
What is worth saying against a no-price quote is that the procurement cycle is itself a cost. Mage Data Room is free for a limited time and self-serve, with no lead form, no sales call, and no negotiation over the seven definitions above, because there is nothing metered to define. That is the trade being offered: capability you may not need, against a room you can open this afternoon.
One narrow point on agent access, because it is where comparison pages overreach in our favour. As of August 1, 2026, no established deal VDR publishes a command line client on npm, and the vendor-by-vendor check sits in our piece on [the data room command line client](/blog/data-room-cli). But Datasite, Ideals, and DealRoom all ship MCP connectors, so nobody should tell you Mage is the only room a machine can drive. The difference is the shape of the interface, not the existence of one.
## The short version
If your deal is large, banked, and carries a redaction burden, the enterprise room earns its quote, and your energy belongs in the definitions inside it rather than the rate. If your deal is a financing or a mid-market sale, the pricing model matters more than the feature list, because it decides whether your team uploads freely or rations. Get the billing unit, the counting rule, the overage mechanic, and the exit path in writing. Those four are the deal. The rest of our work on rooms is collected in the [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/mage-vs-ideals-data-room
### Title: Ideals Data Room Review: Pricing, Fit, and Mid-Market Deals
### Author: Raffi Isanians
A sell-side team on a $40 million carve-out picked its data room in an afternoon and had documents loading by dinner. Six weeks later the room was still doing its job, and the deal was still slipping, because the buyer's counsel had asked for a list of every contract carrying a change of control consent and nobody on the seller's side could produce one without opening three hundred agreements by hand.
Ideals is a virtual data room for confidential dealmaking that prices on stored data volume rather than page count, publishes no dollar figure, and routes all three of its plans to a quote. On the criteria most mid-market sellers actually use when they buy a room, setup speed, permissioning, and reporting, it is a strong product and its reviews reflect that. On the cost that decides whether a mid-market deal closes on time, the sheer volume of reading the room creates for both sides, a data room is not the thing being evaluated. This review takes both questions seriously.
## What is Ideals, and who is it built for?
Ideals positions itself on precision and security for confidential dealmaking. Its stated headline capabilities are eight permission levels with detailed data governance, a setup flow it describes as award winning, and reporting features for oversight of the room, all per the Ideals homepage accessed 2026-08-01.
That feature set describes an administrator's product. Eight permission levels matter when you are staging a room for three bidders at different stages of access. Reporting matters when the banker wants to know who is actually reading. Both are real problems, and Ideals solves them for a team that is running the process itself rather than handing it to a bank.
Ideals also promotes an MCP connector in the top banner of its homepage, letting Claude, Copilot, and ChatGPT connect to the room. Its pricing page gates that connector, along with API integration, to the Enterprise tier (both accessed 2026-08-01). If agent access is part of why you are buying, that gating is worth pricing before you commit to a plan.
## Where does an Ideals plan actually bite?
Ideals does not publish a price. The pricing page shows three plans, Core, Premier, and Enterprise, each with a Get price button, and the entry Core plan is capped at 0.5 to 2 GB of storage (accessed 2026-08-01). On its homepage, Ideals frames the model as paying for data used rather than page counts, and calls that transparent, predictable pricing with no hidden fees.
Give them credit where it is due. Among the incumbent models, sizing the bill to stored volume is the most defensible, because it tracks something the vendor actually spends money on. The exposure sits in the cap. A 2 GB plan is a small room by M&A standards, and the moment a data set of scanned leases or a plan document library lands, you are in a conversation about the next tier.
Two more things belong in this section, because they are what the SERP does not tell you.
First, Ideals is the loudest critic of per page billing, and it is arguing its own book. Its comparison table asserts that the per page model carries hidden fees, extra charges for non PDF file types, upload charges, and contract extensions billed at two to three times the rate, against its own prorated extensions (Ideals blog, accessed 2026-08-01). No vendor is named and no invoice evidence is supplied. Read it as positioning, not as a finding.
Second, ask about the overage mechanic in writing before you sign anything sized to a plan, Ideals included. Ansarada is unusually direct about the mechanic on its own pricing page, and our [guide to virtual data room pricing](/blog/virtual-data-room-pricing) takes that clause apart alongside the rest of the models and the one published price in the category. There is no reason to reproduce that comparison here.
## What do the review scores actually prove?
Ideals displays a G2 rating of 4.7 out of 5 from more than 800 reviews and a Capterra rating of 4.8 out of 5 from more than 300 reviews on its homepage, badged for 2026 (accessed 2026-08-01).
Now the part most reviews of Ideals will not tell you. Those numbers were read on Ideals' own site, not on G2 or Capterra. Every attempt to retrieve the G2 product page, the G2 category page, Capterra, TrustRadius, and Software Advice on 2026-08-01 returned an HTTP 403, so neither the score nor the review count was confirmed at source, and neither carries an as of date. Directory pages that quote those figures are, as far as we can tell, quoting the vendor too.
Take that as a caution about method rather than about Ideals. The scores are plausible and consistent with what practitioners say: Ideals is easy to run and needs little training. But a rating of the administrator's experience is not a rating of the deal's experience. The person filling in a G2 review is usually the person who set up the room, not the associate who spent the weekend reading what was in it.
## Ideals or Datasite for a $20 million to $100 million deal?
Datasite is the room mid-market sellers get compared against, so the comparison is worth doing precisely.
Datasite's capability set is broader at the top end. Everything it publishes about certification and adoption is vendor reported, and we lay those figures out in the [provider roundup](/blog/best-virtual-data-room-providers) rather than restating them here. Two of those capabilities are the ones a mid-market seller might actually miss: redaction at scale that reaches words inside images, and an in room AI that returns cited answers from the project's content. Datasite publishes no price and offers a trial of up to 90 days (Datasite diligence page, accessed 2026-08-01).
One structural fact reframes most comparison articles in this category: Datasite acquired Firmex, announced 26 July 2021, and signed a scheme implementation deed to acquire ASX listed Ansarada, announced 13 February 2024 per the Australian competition regulator's public merger register. Datasite's own about page names Firmex, MergerLinks, Sherpany, Sealk, and Ansarada as acquisitions, and it acquired the private markets data provider Grata in 2025. If a listicle offers you Datasite, Firmex, and Ansarada as three independent alternatives, it is offering you one company three times.
So the honest read for a $20 million to $100 million deal is this. Ideals is easier to administer and the plan structure is friendlier to a seller who is watching the budget. Datasite carries the expectations of the institutional buy side, and if the buyer's counsel already lives in it, the friction you save by choosing it is worth more than the line item you save by not. Neither answer is a feature comparison. It is a question about who is on the other side of the table. If you are working the incumbent end of the market, our [Intralinks alternatives guide](/blog/best-intralinks-alternatives) covers that tier, and the full field is in our [roundup of virtual data room providers](/blog/best-virtual-data-room-providers).
## What does the room leave on your desk?
Every product above is measured on how well it stores, permissions, and serves documents. That is the category definition, and all of them are good at it now. The work that actually consumes a mid-market deal budget is downstream. Here is the split, on the carve-out this article opened with.
| The work | Who does it in a conventional room | What it costs when nobody does it early |
| --- | --- | --- |
| Filing and permissioning three hundred agreements | The room, well | Nothing. This is the solved part |
| Deciding what each of three hundred documents actually is | An associate, by opening each one | The first week of the review, repeated by the buy side |
| Tying an amendment to the agreement it modifies | An associate, by memory and search | A chain read wrong, which is a diligence finding rather than an admin error |
| Answering "which contracts carry a change of control consent" | Nobody, until somebody asks | The six weeks in the story at the top of this page |
| Knowing what the room is still missing | A spreadsheet somebody stops updating | A gap the buyer finds in week ten instead of week one |
This is where we built Mage differently, and it is the only claim in this article I would make on our own behalf.
In Mage Data Room the ingest is where that work happens. Arrival triggers one cheap classification pass per document, which sets its type and writes two or three factual sentences describing what it is, and the label space that pass draws from is the readiness checklist's own sections, so the Type column and the checklist agree instead of drifting apart over sixteen weeks. Amendments, exhibits, and side letters are linked to the agreement they belong to. The checklist itself reports present, partial, and missing item by item against what an acquirer's or an investor's counsel would ask for. None of that reads the contracts for you, and we are not going to claim it does. It removes the first pass, which is the pass nobody bills for and everybody does.
The workflow difference is the terminal. The Mage CLI installs with `npx @magelegal/cli` and needs two commands to go from nothing to a loaded room: `login`, which opens a browser for your approval and mints its own room scoped key, and `upload`, which mirrors a local folder into the room. Every command takes `--json`. An AI agent holding a room scoped API key can skip login entirely, read `mage readiness --json` to see what is missing, go find those documents wherever they live, and upload each one attached to its checklist item. Two limits belong here rather than in a footnote: the CLI covers the data room only and does not drive Mage's diligence platform, and a document sitting in Unsorted is deliberately left un-numbered until it is organized into a folder.
Google Drive, OneDrive, Dropbox, Box, and Common Paper connect directly; SharePoint and Bookface are coming soon. Mage is SOC 2 Type II certified. The [Mage Data Room](/dataroom) is self-serve with no lead form, and it is free for a limited time.
## When Ideals is the better buy
Name the cases where we are not the answer, because a comparison that never does is an advertisement.
- **The buyer's counsel has standardized on Ideals.** Forcing a counterparty into an unfamiliar room to save a line item is a bad trade on a live deal.
- **You need at scale redaction.** Mage has no redaction feature. Datasite states redaction that reaches text inside images, and Ansarada markets AI redaction across 500 documents in minutes (both accessed 2026-08-01).
- **You need a counterparty Q&A module.** The buyer submits questions, the seller routes them to experts, answers publish back to the room. Ansarada markets that workflow explicitly. Mage's Ask Mage assistant answers from the documents in the room for members only; it is not a counterparty Q&A workflow and guests cannot use it.
- **You need enterprise SSO and API integration in one tier.** Ideals gates single sign on, its MCP connector, and its API integration add on to the Enterprise plan (accessed 2026-08-01).
- **Eight discrete permission levels are a hard requirement.** That is Ideals' stated model, and it is more granular staging than most mid-market processes need, until the one time it is not.
## Three questions, in this order
Order matters here, because answering the third one first is how sellers buy the wrong room.
1. **Who is reading, and where do they already work?** If the buy side is institutional and already standardized, that answer usually decides it.
2. **What is my real exposure, storage or reading?** Storage is a line item on a quote. Reading three hundred agreements is billed hours at your own rates, so multiply them out yourself, and notice that it is the number the SERP never prices.
3. **Can anything other than a person put documents in and take findings out?** An API, a CLI, or an agent connector is the difference between a room your team feeds by hand and one your tooling can drive.
Ideals answers the first question well for mid-market sellers and the third one at its top tier. It is a good product and the reviews are earned. Just do not buy a room expecting it to solve the reading, and do not let the ease of setting one up convince you the expensive part of the deal is handled. More of our work on this is collected in the [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/mage-vs-docsend-data-room
### Title: DocSend for Fundraising: When a Tracked Link Beats a Data Room (and When It Stops)
### Author: Raffi Isanians
A hardware startup raised its seed round on a single tracked link: a nineteen slide deck, forty investors, one URL. Four months later its Series A lead sent a diligence request list, and within two weeks three different firms were reading the cap table, the customer agreements, and the IP assignments at the same time. Nothing about the tool had changed. The job had.
A tracked link does one job very well. It puts a document in front of a named person without an email attachment. A data room does a different job: it holds hundreds of documents behind per recipient permissions, gives every document a number both sides can cite, and lets you cut off one viewer without disturbing anyone else. For most pre-seed and seed founders, the tracked link is the correct answer and a dedicated room is money spent early. The question is not which product is better. It is which job you are doing this month.
## What is a tracked link actually built to do?
DocSend is the name most founders reach for, and it is a Dropbox product. Dropbox announced its acquisition for $165 million on March 9, 2021, and TechCrunch, accessed August 1, 2026, described the company as helping "customers share and track documents by sending a secure link instead of an attachment." That sentence is the whole category in one line, and it is a genuinely good line of business. Sending a link instead of a 14 MB attachment means the file never leaves your control, the version everyone sees is the current one, and every open is attributable to a person rather than to a forwarded mailbox.
For a fundraise, that shape of product yields something a data room is not designed to yield: attention data on one document sent to many readers, rather than access data on many documents sent to a few. It is the artifact founders actually use to decide who to call back, and founders who move everything into a room and stop watching deck engagement lose something real.
One honest caveat about this comparison, and it is a real limit rather than a formality. We could not retrieve DocSend's own pages at source when this article was researched on August 1, 2026, so this article makes no claim about what that product reports, what its tiers include, or what it costs. Every capability sentence here describes the category, not a vendor. Read your own vendor's documentation before you buy anything, in either direction.
## When is buying a data room the wrong move?
Most of the time, at the stage where founders first search for one.
A pre-seed or seed process is a deck of roughly twelve to twenty slides, a metrics appendix, and a small set of corporate documents. As a rule of thumb, a seed round rarely runs past forty or fifty documents in total, and a large share of those never get opened. Nothing in that pile needs a numbered index, a readiness checklist, or an acceptance gate. It needs to reach investors quickly and tell you who read it.
Buying a room at that stage costs you three ways. There is the price. There is the setup time, which comes out of the same week you are supposed to be running a process. And there is the friction you push onto a busy investor, who now has to accept terms and wait for an invite in order to read a deck that could have been one click. At seed, that friction is not caution. It is a tax on your own funnel.
So here is the advice that gets ignored. If you are pre-seed, keep the tracked link, spend the money on something else, and come back to this page when the request list shows up.
## Where exactly is the line?
The transition is not a stage label. It is a set of events, and each one is observable on a specific day.
| The moment | What it demands | The tool shape that serves it |
| --- | --- | --- |
| A diligence request list arrives | Sixty or seventy documents mapped to named items, with the gaps visible before counsel finds them | A room with a checklist and an index |
| More than one party is reading at once | Separate permissions and a separate audit trail per firm | One personalized link per recipient, not one shared link |
| A party drops out or goes quiet | Cutting off that viewer alone, immediately | Per link revocation that takes effect on the next request |
| Counsel starts citing documents | A stable number per document that both sides use in email | A numbered index that exports to a spreadsheet |
| Financials and customer contracts move | Acceptance recorded against the human who opened the file | An NDA gate on the link, plus a per viewer watermark as a deterrent |
| Something has to be taken back | Scope, expiry, and revocation as three separate dials | Link level controls, not a password everyone already shared |
Two of those rows deserve emphasis because they are where link sharing genuinely breaks rather than merely gets awkward.
The first is concurrency. One shared link with a password becomes one identity as soon as the password is forwarded inside a firm, which is what always happens. You lose the ability to say who read the customer concentration schedule, and you lose it exactly when that question starts to matter.
The second is selective revocation. When one of three interested parties goes quiet, you want their access gone and everyone else's untouched. If your only lever is deleting the link, you have just interrupted the two firms still working.
The document count is the measurable version of this. Roughly forty to fifty documents at seed is a folder. Roughly sixty to seventy with a request list attached is a process, and a process needs an index. For what lands on that list, our [investor data room checklist](/blog/investor-data-room-checklist) is the fundraising version rather than the M&A one.
## What do these rooms actually cost?
Price posture is the most underrated part of this decision, because for most vendors the price is not the first obstacle. Getting a number at all is.
| Vendor | Publishes a price? | What the vendor's own page says |
| --- | --- | --- |
| SecureDocs | Yes | Flat fee from $250 per month including "unlimited users, unlimited documents, and 24/7 support," self setup in ten minutes with no sales call, and two tiers shown on the same page at $400 and $250 per month |
| Datasite | No | "Request a quote," with a free trial of up to 90 days |
| Ideals | No | Three plans, each with a "Get price" call to action, and an entry Core plan capped at 0.5 to 2 GB of storage |
| DealRoom | No | Four stated pricing principles and an annual commitment, with no dollar figure published |
Every row above was read on that vendor's own product or pricing page, accessed August 1, 2026. The wider field, including the vendors whose pricing pages return nothing readable at all, is in our [roundup of virtual data room providers](/blog/best-virtual-data-room-providers).
The useful read is not the ranking. It is that one vendor of the four will tell you the price today and the rest attach a sales conversation to the question. If you are three days from sending documents, that timing matters more than the number. Storage caps deserve a second look too: a plan sized in gigabytes turns a folder of scanned executed agreements into an overage conversation, and scans are exactly what a diligence request list produces. The free option most founders try first is covered in [using Google Drive or Dropbox as a data room](/blog/google-drive-dropbox-as-data-room).
## What does the crossover actually cost you?
We build one of these rooms, so read this section as an interested party. You create a [Mage Data Room](/dataroom) yourself, with nobody to talk to first, and it is free for a limited time.
The reason to raise price at all here is that the crossover is where founders stall. A request list arrives on a Tuesday, the room takes a week of setup and a procurement conversation, and the answer to the lead's first question is three weeks late. Everything in the setup is the cost: naming folders, deciding what each investor sees, producing an index the other side can cite. A self serve room removes the sales cycle from that week, which is the only part of the cost we can honestly claim to have removed. It does not remove the judgment about what belongs in the room, and our [investor data room checklist](/blog/investor-data-room-checklist) is where that judgment lives.
The one mechanic worth naming for a fundraise specifically is per recipient sharing. Inviting someone mints their own link rather than adding them to a shared one, so a party that goes quiet can be revoked without touching the two firms still working, and a page that turns up somewhere it should not carries the reader's name as a deterrent rather than as a control. That is the capability a tracked link does not have and the reason the crossover exists at all. Mage is SOC 2 Type II certified.
Here is what Mage is not. It is not a deck analytics product, and it is not trying to be. If your only artifact this quarter is a deck and a metrics appendix, a tracked link is still the better tool and you should keep using it. Mage also does not replace your cloud drive: it connects to Drive, Dropbox, Box, and OneDrive rather than asking you to move off them.
## What should you act on once people are in the room?
Two signals are worth interrupting your day for. A first open means the person is in the documents right now, which is the best moment a follow up will ever get. Sustained depth across several documents by several people at one firm means diligence has actually started, which is when you should be lining up references and getting counsel ready.
Everything else is atmosphere. Completion percentage counts distinct pages seen against total reachable pages, so a viewer who skipped the appendix of a ten page document still shows an incomplete read. That is a fact about pages, not about conviction. No engagement chart has ever produced a term sheet on its own, and reading one as though it might is how founders talk themselves into waiting instead of asking.
## So which one?
If you are raising on a deck, keep the link. If a request list is in your inbox, more than one party is reading, or you need to remove one viewer without touching the round, you have crossed the line and a room is now the cheaper option, measured in the hours you would otherwise spend reconstructing who saw what.
The decision is stage shaped, not brand shaped, and it is fine for the answer to change twice in one year. More on structuring what goes inside the room is collected in our [data room guides](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/virtual-data-room-pricing
### Title: Virtual Data Room Pricing in 2026: Per-Page Fees, Flat Rates, and What Deals Actually Cost
### Author: Raffi Isanians
On a $20 million deal, an attorney paid roughly $25,000 to host the data room at $1 per page, and the bill tripled as documents kept arriving through diligence. Firmex published that account on its own blog, dated March 4, 2011, so read it as evidence of what per-page billing does to a budget rather than as a current rate. The 2026 answer to what a data room costs is that almost nobody publishes one: vendors bill per page, per gigabyte, per user, or per deal, and the unit they choose matters more than the rate they quote.
Of nine widely used providers checked on August 1, 2026, exactly one publishes a real number. SecureDocs lists flat-fee plans starting at $250 per month, with what it describes as unlimited users and unlimited documents, self-serve and with no sales call required, on its own product page. Everything below is built so you can take whatever number a vendor gives you and convert it into the only figure that matters: cost per deal.
## Why does almost nobody publish a data room price?
Opacity is the category norm. The evidence, read directly from each vendor's own pages on August 1, 2026:
- **Datasite** publishes no price anywhere on its site. Its diligence product page routes to a quote and offers a trial of up to 90 days.
- **Firmex** routes every plan to a quote and states that price is set by data volume and project length. Its pricing page headline sells predictability rather than a number, and its subscription plan is priced on annual data volume rather than pages or seats.
- **Ideals** shows three plans, Core, Premier and Enterprise, each with a get-price call to action.
- **DealRoom** publishes four pricing principles and requires an annual commitment, with no dollar figure on the page.
- **SecureDocs** is the exception, publishing two flat tiers, $400 per month and $250 per month, and stating that a room can be set up in ten minutes without contacting sales.
Two things follow. First, you cannot comparison shop from published rates, so you have to normalize the quotes yourself. Second, a price that is never published has no public anchor, which means the first number you hear is an opening position rather than a rate card. Buyers who ask for a quote against the term they actually need, rather than the term the vendor offers by default, tend to hear a different number.
## What are the four pricing models, and who wins under each?
| Model | What you are billed for | What makes the bill grow | Best fit | On the record |
| --- | --- | --- | --- | --- |
| Per page | Pages uploaded, counted as converted output | More documents, re-uploads, file types that convert badly | Small, short, static document sets | The model the rest of the category publishes arguments against |
| Per gigabyte or data plan | Contracted or stored volume | Scans, media, models, peak spikes | Text-heavy rooms with predictable volume | Firmex prices its subscription on annual data volume; Ideals prices on stored data volume; Ansarada bills against a data plan with overage |
| Per user | Named seats | Bidders, advisers, and their teams | Bilateral deals with a short invite list | DealRoom states it charges neither per page nor per seat, and prices on deal volume with unlimited users |
| Flat fee per room | The room, per month or per deal | Nothing until you extend or change plan | Long deals, large rooms, auctions | SecureDocs publishes $250 and $400 per month |
The per-user row deserves a warning. In an auction, seat count is not a variable you control. Eight bidders at five people each is 40 seats before you count your own advisers, and the buy side decides how many people it puts on the deal.
## What is a billable page, and why do spreadsheets blow up the count?
A page in a per-page contract is a unit of converted output, not a sheet of paper, so the count comes out of the vendor's conversion pipeline rather than from anything visible in your file system. Firmex made the practical consequence explicit in that 2011 post: per-page pricing forces a seller to count its pages before it can even get a quote, while the hosting cost of a page, Firmex argued, is a fraction of a cent per month. Firmex called the model a printer's paradigm rather than a software one.
Three exposures are worth writing into the contract before signature.
**Spreadsheets and drawings.** A financial model with forty columns has no page count until something renders it, and a set of site plans can render at a page per sheet. Ask in writing how a spreadsheet is counted.
**Re-uploads.** Ideals states that per-page vendors bill on cumulative uploads rather than stored volume, so re-uploading an edited document is billed a second time (Ideals blog, accessed August 1, 2026). That is a competitor's characterization of unnamed vendors rather than an audited fact, and it is exactly the question to put to the vendor quoting you.
**File types.** Ideals also publishes a comparison table asserting that the per-page model carries hidden fees, upload charges, extension charges of two to three times, and extra charges for non-PDF file types (accessed August 1, 2026). Again, no vendor is named and no evidence is supplied. Ask anyway, because the answer is cheap to get before you sign and expensive to discover afterwards.
## What do three deal sizes actually cost?
Only one per-page rate in this article is anchored to a source, and it is fifteen years old: the $1 per page in the Firmex account from 2011. We publish no other per-page number, because no vendor in these sources publishes one and a range picked off a competitor's blog is not evidence. So the table below has one sourced column, one blank column for the rate your own vendor quotes you, and one column built on the only price published today.
| Scenario | Pages | Months live | Per page at your quoted rate | Per page at $1.00 (the rate in the 2011 account) | Flat at $250 per month (SecureDocs published) |
| --- | --- | --- | --- | --- | --- |
| $15M asset sale | 4,000 | 2 | 4,000 × your rate | $4,000 | $500 |
| $75M mid-market sale | 40,000 | 3 | 40,000 × your rate | $40,000 | $750 |
| $500M carve-out | 250,000 | 5 | 250,000 × your rate | $250,000 | $1,250 |
The crossover is the point of the table, and you can find yours with one division. Take the flat figure for your expected term, $500 on a two-month asset sale against the published $250 monthly tier, and divide it by your page count. That is the per-page rate at which the two models tie: on the asset sale, 12.5 cents. Any quoted rate above it makes the metered room the more expensive one, and the single rate on the record in this article is eight times higher than that. Per-page billing does not scale with the value the room delivers. It scales with how complete your diligence file is, which is the opposite of the incentive a seller wants on a deal where completeness is the product.
For a gigabyte quote, run the arithmetic against peak stored volume rather than average, for reasons the next section makes concrete. For a seat quote, multiply by the seats the buy side will demand, not the seats you plan to invite.
## What happens to the bill when the deal slips two months?
Timeline slip is the largest uncosted variable in a data room contract, and every model absorbs it differently.
**Flat fee.** Two extra months at a published $250 per month is $500. That is the entire exposure.
**Per page.** An extension costs nothing by itself. It costs a great deal in practice, because a longer deal means more requests and more documents. That is exactly what the Firmex account describes: the original estimate tripled because documents kept being added through the diligence period.
**Data plan.** Ansarada's own pricing FAQ states that exceeding the data plan raises fees for the remainder of the contracted term, that overage is measured at peak usage for the billing period, and that deleting data does not reduce the overage invoice (accessed August 1, 2026). This is the most useful billing disclosure in the category, because it is a vendor describing its own mechanics rather than attacking a rival. Read it as the shape of data-plan billing generally, then put the same three questions to every data-plan vendor you talk to.
**Extensions generally.** Ideals states that per-page vendors charge penalty rates rather than prorated rates when a deal runs past the contracted term (accessed August 1, 2026), which is again a competitor's characterization. Firmex, for its part, sells subscription as the way to avoid project overtime charges and positions itself as a purpose-built data room operating since 2006 (accessed August 1, 2026). Both statements are marketing. Both point at the same clause you should read before signing.
## Which fees appear after the quote?
Put these in the quote document, not in the call.
1. **Extension rate**, and whether it is prorated or penalized.
2. **Overage measurement.** Peak or average? Does deleting data reduce it? Ansarada answers both on its pricing page. Most vendors do not answer either until asked.
3. **Storage caps.** Ideals' entry Core plan is capped at 0.5 to 2 GB (accessed August 1, 2026). The cap, not the plan price, is what creates the exposure.
4. **Feature gating.** Ideals gates its MCP connector and API integration to the Enterprise tier (accessed August 1, 2026). DealRoom sells AI for diligence as a paid add-on and positions itself as an operating system for buyer-led M&A spanning pipeline, diligence, data room and post-merger integration (accessed August 1, 2026). If the capability you are buying the product for sits above your tier, the tier price is not your price.
5. **When the meter starts.** Ansarada defers payment until the room goes live or 90 days after creation, whichever comes first, and markets predictable pricing with no hidden fees (accessed August 1, 2026). Datasite offers a trial of up to 90 days (accessed August 1, 2026). Both are useful when your timeline is uncertain. Both have an end date.
6. **Administrators, support and training.** Ask whether they are billed separately, and whether support hours cover your closing time zone.
One more signal worth reading. Ansarada's headline features include a data gauge for billing visibility (accessed August 1, 2026). A vendor shipping a dashboard whose job is to keep customers from being surprised by their own invoice is a fair summary of this category's history with billing.
## How do you compare two quotes built on different units?
Five steps, in order.
1. **Convert to cost per deal.** One number each, at your realistic page count, storage volume, seat count and month count.
2. **Rerun at 1.5 times the timeline.** Deals slip. A quote that only holds on schedule is not a quote.
3. **Rerun at peak volume, not average.** If the vendor measures at peak, so should you.
4. **Ask who owns the counter.** If the vendor's system produces the billable count, ask for the count in writing before signature and a statement every month after.
5. **Check whether the two vendors are one company.** Datasite announced its acquisition of Firmex on July 26, 2021, with Firmex continuing as a standalone business unit. Datasite signed a scheme implementation deed to acquire ASX-listed Ansarada, announced February 13, 2024, and the ACCC announced on July 24, 2024 that it would not oppose the deal. SecureDocs has been an Onit product since January 11, 2022. Playing two quotes against each other works less well when the same parent prices both.
That last point is the one buyers miss most often. If you are running a formal comparison, our [overview of data room providers](/blog/best-virtual-data-room-providers) covers the field, and the [Datasite alternatives](/blog/best-datasite-alternatives) and [Intralinks alternatives](/blog/best-intralinks-alternatives) rundowns go deeper on capability than a cost guide should.
## What is fair for a $25M deal versus a $500M deal?
There is no published market survey here we would stand behind, so treat what follows as judgment rather than benchmark.
Price the room against the two variables you control: months live and pages loaded. Then compare against the one published reference point among the nine providers we checked on August 1, 2026, the $250 per month SecureDocs posts. On a $25 million sale running four months, a room at anything close to that reference is a rounding error against legal fees, and a five-figure quote should come with a clear statement of what the extra buys. Redaction at volume, a managed counterparty question workflow, a named project manager, and support across three time zones are real services that some deals genuinely need. They should be priced as services, and named.
On a $500 million carve-out with 250,000 pages, several bidders and a twenty-week timeline, the calculus inverts. Per-page billing is the wrong shape at any rate, seat billing is unpredictable because the buy side sets the seat count, and the room is operationally complex enough that a project manager earns their fee. That is where a negotiated flat fee for the deal is worth paying for, and where a vendor's willingness to quote one tells you something about how they expect the engagement to go.
The size-independent test: if a vendor cannot tell you what the bill will be at 1.5 times your expected timeline and twice your expected volume, you do not have a price. You have an opening position.
## Our disclosure, since this is our page
We build a room, so read the last two paragraphs knowing that. [Mage Data Room](/dataroom) is free for a limited time. That is the whole of our price claim, and we are deliberately not putting it in any table above, because a free product cannot be compared like for like against a quoted one and pretending otherwise would be the same trick this article spends 2,000 words warning you about.
What is worth saying in a cost guide is where the money in a data room engagement actually goes, which is almost never the licence. It is the weeks between deciding to sell and being able to open the room, and the hours counsel spends reading what is inside it. Mage is SOC 2 Type II certified and self-serve, with no lead form and no sales call, so the procurement cycle is not one of the costs. For the capability comparison rather than the cost one, read our [analysis of what Datasite's quote actually buys](/blog/mage-vs-datasite), and the rest of the category writing sits in our [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/data-room-cli
### Title: The Data Room CLI: A Live, Permissioned Data Room from Your Terminal
### Author: Mage Team
Two commands take a local folder tree to a live, permissioned data room:
```bash
npx @magelegal/cli login
npx @magelegal/cli upload ./diligence
```
The first opens a browser, asks you to confirm a short code, and binds this machine to a room. The second mirrors the folder into the room, in parallel, with processing starting as each document arrives. Node.js 20 or newer is the only prerequisite, and `npx` means nothing gets installed.
That is the whole pitch. The rest of this page is the reference: what each command does, how the credential works, what breaks, and what the tool deliberately will not do.
## Why run a data room from a terminal at all?
Because the documents are already in a folder tree, and the browser is the worst possible way to move 4,000 of them.
Three situations make this concrete. A founder assembling a fundraising room has everything in one directory that mirrors how the company actually files things. An associate prepping a sell-side room has an export from the client's file server. A platform team wants the room populated by the same CI job that assembles the closing binder, with no human in the loop.
All three want the same thing: local structure in, room structure out, no drag-and-drop marathon, and no shared login pasted into a Slack thread.
## Install and first run
```bash
node --version # must be 20 or newer
npx @magelegal/cli login
```
Or install it once and drop the `npx`:
```bash
npm install -g @magelegal/cli
mage --help
```
The package is `@magelegal/cli`, the executable is `mage`, it is MIT licensed, and the source is public at github.com/magelegal/mage-dataroom-cli. Runtime dependencies are two small libraries. Cite the install command rather than a version number; the published version moves.
`login` does four things: opens a browser page for your approval, resolves which room this machine should bind to (asking if your organization has several, and offering to create one if the account is brand new), mints a room-scoped API key labelled with this machine's hostname, and stores it locally. On a machine with no browser, or over SSH, pass `--no-browser` and it prints the approval URL instead.
Two constraints before you try. Minting a key requires owner or admin rights on the room. And the login does not expire: it works until the key is revoked.
## How does the credential actually work?
Security is the first objection anyone sensible raises about a CLI that touches deal documents, so here is the model in full.
The key the CLI mints for itself is **room-scoped**. It acts in exactly one room and carries the permission set chosen at mint time, visible under Settings and API keys alongside who minted it and when. A login-minted key can read the room's document list, upload, manage folders, delete documents, download document files, and read and fill the readiness checklist.
What it cannot do is the more useful half:
- It cannot reach another room.
- It cannot delete the room itself.
- It cannot change room settings, people, or sharing. That needs the Manage room permission, which is not granted by default.
- It cannot fetch document contents without the Download permission. Reading the document list and reading the bytes are separate grants.
Permissions are immutable after mint. Widening a key means minting a new one, which is the right trade: a key's authority never quietly grows.
Revoking a key under Settings and API keys kills it everywhere, instantly. The secret itself is returned exactly once, at creation, and is never recoverable afterward; the room's settings list shows only the room binding, who minted it, its permission set, and its audit trail. Locally, credentials live in `~/.config/mage/config.json` at mode 0600, readable only by you.
Only two commands act as *you* rather than as the key: `mage rooms` and `mage use`. Everything else runs with the key's authority, which is why a stolen laptop is a revocation problem rather than an account problem.
## The command reference
| Command | What it does |
| --- | --- |
| `mage login [key] [--room ] [--with-key] [--no-browser]` | Sign in via browser, or store an API key, and bind this machine to a room |
| `mage logout` | Revoke the CLI's key where possible and clear this machine |
| `mage rooms` | List your organization's data rooms (browser login only) |
| `mage use ` | Switch which room this machine is bound to (browser login only) |
| `mage upload [--to ] [--for-item ]` | Upload files or whole folders, mirroring their structure |
| `mage readiness` | Show the room's readiness checklist: present, partial, and missing |
| `mage readiness attach ` | Attach already-uploaded documents to a checklist item |
| `mage ls [folder]` | List the room's documents, grouped by folder |
| `mage download [target] [dest]` | Download the room, a folder, or one document, mirroring structure |
| `mage mkdir ` | Create an empty folder, for example `01-Corporate/Charters` |
| `mage rm [-r\|--folder] [-y\|--yes]` | Delete a document, or a folder with `--folder` |
| `mage version` | Print the CLI version |
| `mage help [command]` | Display help for a command |
Global flags: `--json` for machine-readable output on stdout, `--api-url ` to point at a different API base, and `-v, --version`.
Environment variables: `MAGE_API_KEY` (a room-scoped key that overrides any stored login), `MAGE_API_URL` (override the API base), `MAGE_ROOM_ID` (pin the room id rather than resolving it from the key), and `MAGE_OAUTH_CLIENT_ID` (rarely needed; normally discovered from the API).
## How folder structure survives the trip
Point the CLI at a directory and the directory mirrors its contents beneath itself. Point it at a file and the file lands in the folder named by `--to`, which is created if it does not exist. Dotfiles like `.DS_Store` and `.git` are skipped. Uploads run in parallel.
```bash
mage upload ./diligence
mage upload ./charter.pdf --to "01-Corporate"
mage mkdir "01-Corporate/Charters"
```
Structure matters more here than in ordinary file storage, because the tree becomes the index. Every folder and filed document receives a stable dotted hierarchical number, the classic VDR convention: 1, 1.2, 1.2.3. Within a level, folders and documents share one number sequence, ordered case-insensitively by display name. Numbers are stored rather than recomputed on every read, so a citation to 4.2.1 stays valid until the room is deliberately re-indexed.
One deliberate exception: a document with no folder path sits in Unsorted and is left un-numbered until it is organized into a folder. That is by design, not a gap, and it is the reason to get the tree right before you push.
While the files land, the room does its own work. The server classifies each arrival by type, summarizes it, organizes the room in a single pass that chooses the folder structure, and links amendments, exhibits, and side letters to the agreement they belong to. The [full walkthrough of a first room setup](/blog/how-to-set-up-a-data-room) covers that side.
## Reading the checklist and filling it
The room carries a readiness checklist: the documents an investor's counsel or an acquirer's counsel expects to find, scored per item as present, partial, or missing, with items the user has marked not applicable excluded from the score entirely.
```bash
mage readiness
mage readiness --json
mage upload ./tax/2025-return.pdf --for-item
mage readiness attach "Corporate/Bylaws.pdf"
```
`--json` returns each item with a stable `itemId`, a label, and a hint describing what the item should contain. `--for-item` uploads the files and attaches every one that landed to that item, in one step. `readiness attach` accepts a document id, a name, or `folder/name`, and is additive: documents already attached stay attached. Per-item curation lives on its own and survives every recompute, so marking something not applicable is not undone by the next pass.
That loop is what makes this scriptable. Read what is missing, produce it, attach it, re-read. Handing the same loop to an AI agent is a natural extension, which we cover separately in [data rooms in the agentic era](/blog/data-rooms-for-ai-agents).
## Machine-readable output and headless runs
Every command accepts `--json` and emits machine-readable output on stdout. Combined with a key in the environment, that is the whole headless story:
```bash
export MAGE_API_KEY="..."
mage readiness --json
mage upload ./collected --for-item cap-table
```
Setting `MAGE_API_KEY` skips `login` entirely. The CLI discovers which room the key belongs to on first use, so the key is all a CI job or an agent needs. On the readiness API specifically, reads and per-item curation accept a room-scoped key, while notify and recompute stay human-gated behind a session. That split is deliberate: a script can fill the room, but it cannot email your investors.
## Which providers expose a terminal client or an API?
Precision matters here, because the marketing in this category is loose.
| Access path | Where it stands as of August 1, 2026 |
| --- | --- |
| Command-line client on npm | None of Datasite, Intralinks, Ideals, Firmex, Ansarada, DealRoom, SecureDocs, Digify, or DocSend publishes one |
| MCP connectors | Datasite states an MCP connector for Claude, ChatGPT, or Microsoft Copilot; Ideals promotes an MCP connector on its homepage; DealRoom ships an MCP integration |
| Vendor-published npm executable | Papermark publishes `@papermark/mcp-server` on npm from its own scope and repo |
| API tier gating | Ideals gates its MCP connector and API integration to the Enterprise plan |
Two honest qualifications. Box publishes an official command-line client for the Box API on npm and also sells a virtual data room, so "no data room vendor ships a CLI" is only true of the deal-VDR incumbents, not of the category read broadly. And Mage is not uniquely agent-reachable: Datasite ships an MCP server plus published agent skills targeting sell-side workflows including VDR index setup and information-request-list tracking, and names Claude Code as a supported host. This space is moving fast, and three of those MCP products shipped within the last four months.
What remains distinctive is the shape rather than the existence of access. An MCP connector or an enterprise REST integration is something an IT team wires up. A published npm executable is something a founder or an associate runs in ninety seconds, with a credential they can revoke themselves from a settings page.
## What this CLI will not do
Four limits, stated plainly, because a reference that only lists capabilities is a brochure.
**It drives the data room, and nothing else.** `mage --help` groups every current command under "Data room". Mage's diligence platform has no command-line surface. If you are looking to script disclosure schedules or memos, that is not this tool.
**There is no unauthenticated path.** The shortest honest flow from zero is two commands, not one. Anything shorter is a tutorial for a different product.
**Deletes are gentler than they look, which cuts both ways.** `rm --folder` moves that folder's documents to Unsorted rather than deleting them, so a scripted cleanup can leave you with a pile of un-numbered documents instead of the clean room you expected. Run `ls` after.
**The room has no redaction and no counterparty Q&A module.** Ask Mage answers questions from the room's documents for members, and guests do not get it. Neither of those is a CLI limitation; they are product limitations that the CLI cannot route around.
For continuous sync from a shared drive, the connector path is the documented one: connect Google Drive, OneDrive, Dropbox, or Box, choose a folder, and Mage keeps the room in sync as new files land. The CLI is for pushes you control, not a background sync daemon.
## The web path, for everyone else
Most of the people you work with will never open a terminal, and they should not have to. Everything above has a browser equivalent: drag in files and folders, drop a ZIP, or connect a cloud drive from the source picker. The room organizes itself the same way, numbers the same way, and shares the same way, through per-recipient invite links carrying view or download permission, an optional expiry, instant revocation, and an NDA gate that is on by default.
Pick the interface that matches the person. The terminal for the founder with a folder tree and the platform team with a pipeline; the browser for the deal team. Start either one at [Mage Data Room](/dataroom), which is free for a limited time, or read the rest of our writing on rooms in the [data rooms resource hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/data-rooms-for-ai-agents
### Title: Data Rooms for AI Agents: What to Let an Agent Do, and What Never to Let It Do
### Author: Raffi Isanians
An AI agent data room is a data room an agent can drive with a key and a command instead of a browser: it reads which documents are still missing, finds them, uploads each one against the item it satisfies, and re-reads the list to confirm the gap closed. That access exists today at several vendors, so the interesting question is no longer whether an agent can operate a room. It is which actions an agent should be permitted to take at all, and how the credential is scoped so it cannot take the others.
Start with that split, because it is the entire design.
| Action in a live deal room | Give it to an agent? | Why |
| --- | --- | --- |
| Read the document list and folder tree | Yes | Read-only and verifiable |
| Read the readiness checklist and its gaps | Yes | The gap list is the agent's work order |
| Upload a document | Yes | Additive; a wrong file is visible and removable |
| Attach a document to a checklist item | Yes | Makes the agent's work checkable item by item |
| Create and name folders | Yes | Reversible in seconds |
| Download document contents | Only with a key minted for it | Bytes leaving the room is a separate decision |
| Delete a document or folder | Only with a human confirming | Destructive, and failure is silent |
| Grant or revoke a person's access | Never | Confidentiality boundary |
| Send an invitation or change a link's terms | Never | Discloses documents to a human being |
| Mark a diligence item complete or not applicable | Never | A judgment a counterparty relies on |
The line has nothing to do with how capable the model is. It tracks which actions are additive and reversible, which are destructive, and which disclose confidential material or put a decision on the record. An agent that files a document in the wrong folder costs someone two minutes. An agent that emails a share link to the wrong address ends a deal.
## Why the permission line falls where it does
Three categories, and they behave differently under failure.
**Additive and reversible.** Uploading, creating folders, attaching a document to a checklist item, reading an inventory. When the agent is wrong, the room holds an extra file in the wrong place. A human sees it, moves it, and nothing left the building. This is where an agent earns its keep, and it is the most tedious part of standing up a room.
**Destructive.** Deleting a document or a folder. The failure mode is silent, and recovery depends entirely on what the product does with a deletion. Ask every vendor the same question: when a folder is deleted, what happens to the documents inside it? In our data room, deleting a folder moves its documents to Unsorted and never deletes them, and the client asks for confirmation unless you pass a flag saying you know what you are doing. That design predates agents, but it is the reason an agent can hold a delete permission without it being reckless.
**Disclosive or on the record.** Granting access, sending an invitation, changing what a share link permits, or marking a diligence item complete. Each one either puts confidential documents in front of a human being or records a judgment the other side will rely on. These are not agent actions at any capability level, and the last section explains why that is structural rather than a limitation waiting to be lifted.
## Which data rooms can an agent actually reach today?
More than the "nobody has built this" framing suggests. Everything below was read on August 1, 2026.
Datasite states on its diligence product page that you can connect Claude, ChatGPT, or Microsoft Copilot through MCP, with data staying inside Diligence. Its public AI organization also publishes an agent skills repository describing eight coordinated skills for sell-side deal teams, including index setup and matching an information request list against room content, and its stated requirements name Claude Code as a supported host.
Ideals promotes an MCP connector in the top banner of its homepage, connecting Claude, Copilot, and ChatGPT to the data room. On its pricing page, that connector and an API integration add-on sit under the Enterprise tier, which is worth noting: at some vendors, agent reach is a pricing decision rather than a product one.
DealRoom advertises an MCP integration on its pricing page for connecting deal data to any MCP-compatible AI.
Papermark, a data room vendor, publishes an MCP server on npm from its own scope and its own repository, declaring a runnable executable, last published on July 27, 2026.
Two observations about the shape of that race.
First, MCP and a command line client are different access surfaces, and no established deal VDR publishes a command line client on npm, checked August 1, 2026; the vendor-by-vendor check is in our piece on [the data room command line client](/blog/data-room-cli). Do not read that as a moat. Box publishes an official command line interface for the Box API on npm under its own maintainer accounts, last published June 1, 2026, and Box sells a virtual data room for managing mergers on its own site. Read "data room vendor" at its plain meaning and the gap closes.
Second, look at who published the package. A CLI named papermark-cli exists on npm and describes itself as an agent-first CLI for data room workflows, but an individual publishes it from a personal repository, not the vendor. That distinction matters more for an agent than for a person: a community wrapper holds your credential, tracks the vendor's API on its own schedule, and answers to nobody when it breaks mid-process.
## How do you scope a credential so an agent cannot touch the wrong room?
This is where a design either exists or does not, and it is the question I would put first in any vendor call.
In our data room, an agent needs one environment variable and nothing else. Set `MAGE_API_KEY` and skip the login step entirely; the client discovers which room the key belongs to on first use. That is the documented path for agents and for continuous integration, and the reason it matters is negative rather than positive: the agent never holds a browser session, never drives a UI, and never runs as you.
What a room-scoped key can and cannot do:
- It acts in its own room only. It cannot reach another room in your organization.
- It carries the permission set chosen when it was minted, and those permissions are immutable. Widening a key means minting a new one, which is a deliberate human act with its own record.
- It cannot delete the room.
- It cannot change room settings, people, or sharing without a Manage room permission that is not granted by default.
- It cannot fetch document contents without a Download permission. Reading the document list and reading the bytes are two different grants.
- Revoking it under Settings, API keys kills it everywhere instantly.
The secret itself is returned exactly once, at creation. What the room records is: the room binding, who minted it, a snapshot of its permissions, and the audit trail. On a developer's machine, the client keeps its credential in a config file readable only by that user.
The practical version is short. Mint the narrowest key the task needs, hand it to the agent, revoke it when the task is done. A browser login cannot offer that, because it carries every permission you hold in every room you can see, for as long as the session lives.
## Does agent access break the audit trail, or improve it?
It improves it, and this is the claim I expect to argue about.
Consider the honest baseline in a live process. An associate is signed into an account several people know the password to. A session is open on a laptop in a conference room. Views and downloads land on the room's log attributed to whoever's session it was, which is frequently not the person who did the work. Nobody calls that an audit failure because it is what everyone has always done.
A scoped key inverts it. The credential is minted for one purpose, named for the machine it lives on, listed in the room's settings with its permission set and the person who created it, and revocable in one click. Every file it downloads lands on the room's access audit trail like any other. When something goes wrong, three questions have answers a shared login cannot produce: what was this credential allowed to do, what did it actually do, and who authorized it.
The serious objection is not that agents are unaccountable. It is that they act quickly and at volume, so a mistake propagates before anyone notices. That is real, and its answer is the same mechanism: narrow the permission set, keep revocation one click away. Both are properties of the credential, not of the model.
## What the loop actually looks like
Four steps, and the third is the only one that is not obvious.
1. `mage readiness --json` returns the room's checklist as machine-readable items. Each carries an id, a label, a status of missing, partial, or present, and a hint describing what the item should contain.
2. The agent finds those documents with its own tools, wherever they live.
3. `mage upload --for-item ` uploads the file and attaches it to that checklist item in one call.
4. `mage readiness --json` again, to confirm the item closed. Repeat until nothing required is missing.
Every command accepts `--json` and emits machine-readable output on stdout. That is the boring detail the whole loop rests on. A tool an agent has to screen-scrape is a tool an agent cannot verify, and an agent that cannot verify its own work is just a faster way to produce a mess.
Step three changes the character of the work. Uploading a file is a blind action; uploading it against the item it satisfies is a claim that can be checked. When the agent finishes, the room's own checklist is the report card, in the same view a human would have read anyway.
The product ships the prompt, so nobody has to write one. The key-based version reads:
> Fill my Mage data room. With `MAGE_API_KEY=""`, run `npx @magelegal/cli readiness --json` to see which checklist items are missing, find those documents in my files or other services, and upload each one with `npx @magelegal/cli upload --for-item ` until nothing required is missing.
A realistic task on top of that: pull last year's tax return from our accounting system and satisfy the missing tax items in the readiness checklist.
The client is `@magelegal/cli`, MIT licensed, public source, Node.js 20 or newer, and runnable with `npx` without installing anything. The command reference, flags, and the human-at-a-terminal walkthrough live in [the Mage data room CLI](/blog/data-room-cli). One boundary worth stating plainly: this client drives the data room only. Mage's diligence platform has no command line surface, and I would rather say that here than have you discover it after a purchase.
## Why does a browser-only room become the bottleneck?
Because everything on either side of it is already scriptable.
The documents originate in systems with APIs. Cap tables, financial statements, payroll exports, signed agreements, board consents: they live in software an agent can already reach. Downstream, review is software too. What the room does to a document once it lands, meaning typing, filing, numbering, and gap-checking, is covered in [AI data rooms](/blog/ai-data-room), and the handoff from a full room into diligence is covered in [from data room to diligence workflow](/blog/data-room-to-diligence-workflow). The room in the middle is the only step that has traditionally required a person, a mouse, and an afternoon. When the two steps around it are automated, the manual one stops being a step and starts being a queue.
There is a worse version of solving this, which is pointing a browser-driving agent at the room's UI. It works in a demo. It is brittle against any interface change, it is slow, and above all it runs inside a human's full session, which puts you back at every permission that person holds in every room. UI automation is not agent access. It is a person's credential with a robot's hands.
## What must a human still sign off on, and why is that permanent?
Because models produce confident wrong answers, and in diligence a confident wrong answer is worse than no answer. A tool that says nothing is missing, and is wrong, does not merely fail to help. It removes the item from the reviewer's attention. That asymmetry does not go away with a better model, so the design has to absorb it.
Three things stay human in our room by construction rather than by policy.
**Who gets access.** Invitations mint one personalized link per recipient and email it to them, and every view on that link is attributable to the person it was issued to. That is a decision about who sees confidential material, which means it belongs to a person who can be asked why.
**What a link permits.** Whether it requires an NDA, whether it carries a watermark, whether it allows download, whether printing is allowed separately from download, and when it expires. These are per-link settings a human chooses. On the watermark specifically: per-viewer stamping puts the viewer's identity and the date on every page, and it is a deterrent, not an access control. Anyone selling watermarking as leak prevention is selling you something.
**Telling other people the room changed.** Reading the readiness checklist and curating individual items accept a room-scoped key, which is what lets an agent attach what it uploads. Triggering a recompute and notifying people are gated to a signed-in human. The split is deliberate: an agent may do the work, and a person decides when the work is announced. The same reasoning is why the table at the top says an agent should attach documents to an item but should not be the one declaring the item done, even where the credential would permit it.
That is not a temporary boundary awaiting a smarter model. It is the same boundary that governs a first-year associate, drawn in software instead of in a supervision policy.
## Where to start
Run the loop against a real room and see whether it holds up. Our data room is free for a limited time and self-serve, so you can hand a key to your own agent this afternoon without talking to anybody: it is at the [Mage Data Room page](/dataroom). Mage is SOC 2 Type II certified, which covers the security controls and says nothing about whether your agent filed a document correctly, which is exactly the point of keeping the checklist as the report card.
The rest of our writing on how these rooms should work sits in the [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/ai-data-room
### Title: AI Data Rooms in 2026: What Auto-Structuring at Ingest Actually Does (and What Is Marketing)
### Author: Raffi Isanians
Every data room vendor sells AI now. The word covers at least four different products, and the gap between them is the difference between a room that files itself and a room that generates a paragraph about documents you already read.
An AI data room is a virtual data room that structures documents at the moment they arrive: classifying each one by type, placing it in a folder, numbering it, linking amendments to the agreements they modify, and reporting which expected documents are still missing. That is ingest-time AI, and it removes work. The other kind arrives after the filing is done, in the form of dashboards and narrative summaries, and it mostly relabels work you have already finished.
This piece separates the two, grades each advertised capability by what it actually replaces, and proposes one standard the whole category should be held to.
## The two places AI can sit in a data room
**At ingest.** A document arrives and something immediately decides what it is, where it goes, what number it carries, what it belongs to, and whether it closes a gap in the expected set. The output is a structured corpus. The reader who benefits is the next person to open the room, which in a sale process is opposing counsel.
**After the fact.** A person or a rules engine has already filed everything, and the AI reads the result to produce search, summaries, engagement analytics, and insight panels. The output is commentary on a corpus. The reader who benefits is the seller, watching their own room.
Both can be useful. Only one changes the shape of the work. If a vendor's AI section is entirely dashboards and summaries, the room is not doing anything to the documents; it is doing something to the report about the documents.
## What does "AI-powered" actually mean on a feature page?
Grade each capability by what it replaces. That single question sorts a feature list faster than any comparison chart.
**OCR and full-text search: replaces nothing.** These make a room usable. A scanned PDF that cannot be searched is a liability, and every serious provider handles this. It is baseline infrastructure that predates the current wave by a decade, and it should not carry an AI badge.
**Semantic search: replaces keyword guessing.** Real, modest, and pleasant. Datasite markets exactly this on its diligence product page, framing it as tracking down meanings rather than keywords, accessed August 1, 2026. It saves you from running six searches because you did not guess the drafter's vocabulary. It does not restructure anything.
**Auto-classification and auto-indexing: replaces a paralegal's first pass.** This is the capability that earns the category its name. It is also the one that fails predictably, which I get to below.
**Family detection: replaces manual chain reconstruction.** Resolving an amendment or an exhibit to the agreement it modifies is tedious, error-prone by hand, and genuinely automatable at the document-relationship level.
**Coverage or gap analysis: replaces the checklist tick-through.** Comparing the room's inventory against the list of documents a counterparty expects is mechanical work that humans do badly at 400 documents.
**Clause extraction: replaces an associate's clause pull.** Real work, and checkable, because every extracted value points at a passage you can open. This is diligence software territory more than data room territory.
**Redaction at volume: replaces manual masking.** A legitimate feature category. Ansarada advertises AI-based redaction across hundreds of documents on its pricing page, accessed August 1, 2026. Worth knowing where you stand: Mage's data room has no redaction feature, so if bulk redaction is your requirement, that is a real reason to look elsewhere.
**Narrative AI insights: replaces judgment, and should not.** A paragraph telling you the target has "moderate contractual risk" is not a diligence artifact. It cannot be verified, cannot be cited in a memo, and cannot be defended to a client. It is the capability most likely to be demoed and least likely to be used twice.
## The one standard the category should be held to
Does the output cite a source you can open, and can you tell when it is wrong?
That is it. Both halves matter. A citation you cannot click is a footnote. An answer you cannot falsify is an opinion. An AI feature that satisfies both is a tool an attorney can put weight on; one that satisfies neither is a demo.
Applied honestly, the standard cuts across vendors rather than for one of them. Datasite's own description of its in-room AI is a good example of the right shape of claim: it states the assistant draws only on the project's content, respects user permissions, and returns citations, per its diligence product page accessed August 1, 2026. Note the vendor's own word is "hallucination-resistant" rather than hallucination-free. That is the correct word, and it also tells you where the buyer's obligation starts. Resistant is a design posture, not a guarantee, and the only way to know how resistant is to test it against documents where you already know the answer.
## What auto-structuring at ingest actually does
Here is what the mechanic looks like in our own data room, described concretely enough that you can check the same things in anyone else's.
**Typing and a factual summary.** Every document that lands gets a type and a short factual description of what it is. Not analysis, not an executive summary. Two or three sentences saying what the document is, which is what makes a search result legible in a list.
**One organizing pass.** A single agent chooses the folder structure for the room and places every document, rather than each document being filed independently as it arrives. That matters for a reason that sounds cosmetic and is not: folder naming stays consistent across the whole room, instead of drifting as the corpus grows.
**A stable index.** Every folder and every filed document gets a dotted hierarchical number (1, 1.2, 1.2.3), the classic VDR index, exportable to XLSX. The numbers are stored rather than recomputed on every read, so a reference you send to counsel on Tuesday still points at the same document on Friday.
**Family edges.** Amendments, exhibits, and side letters get linked to the agreement they belong to. I will not claim this is exhaustive on a messy corpus, because no honest vendor can.
**A readiness verdict per item.** The room grades itself against the document set a counterparty is expected to ask for, and marks each item present, partial, missing, or not applicable. Partial is the interesting status: attached documents that do not look like full coverage. That is where a human minute pays for itself.
Two limits, stated because they are the kind of thing a feature page omits. A document sitting outside any folder is deliberately left unnumbered until it is filed, so "every document gets an index number" is not true and should not be claimed. And the room's assistant answers from the documents in the room for members of the room; it is not a counterparty question-and-answer workflow, which is a different product that VDR buyers often assume is the same thing.
If you want the structural principles rather than the software, [how to organize a data room](/blog/data-room-organization-what-partners-want) covers the folder taxonomy and naming conventions that a reviewing partner expects to find.
## What happens when auto-classification is wrong, and who notices?
Usually nobody. That is the real problem, and it is a design problem rather than a model problem.
Classification is reliable when the document announces itself and unreliable when it does not. A signed stock purchase agreement is easy. An untitled two-page amendment, a scanned side letter with a handwritten date, a spreadsheet that is half a cap table and half a forecast: those are the documents that get a plausible wrong label. And a plausible wrong label is worse than an obvious one, because it survives review.
Three design choices decide whether the failure is visible:
**Constrain the label space to the checklist.** If the classifier's available labels are the same sections the room is graded against, then a wrong label surfaces as a wrong readiness verdict, which a human reads and questions. If the labels are a free-form taxonomy, a misfile is silent.
**Validate the contract, not the content.** A guardrail should check that the model returned one of the labels it was given, and coerce anything else to a catch-all. It should not attempt to re-derive the right answer from the document, because a second heuristic quietly overruling the first is how you get confident wrong answers instead of visible ones.
**Make human corrections stick.** If a person re-files a document or marks an item not applicable, that judgment has to survive the next recompute. A system that silently reverts a partner's correction teaches everyone to stop correcting it.
Ask a vendor which of these three they do. The answers are specific and hard to fake.
## Can AI in a data room hallucinate, and what does it cost?
Yes, and the cost is asymmetric.
In most software, a wrong answer is an inconvenience. In diligence, a wrong answer that reads confidently is the mechanism by which something does not get reviewed. An assistant that says a document set contains no change of control restrictions, and is wrong, does not merely fail to help. It actively removes the item from the reviewer's attention. That is why the citation standard is not a nice-to-have: an uncited answer cannot be checked, and an answer that cannot be checked cannot be relied on, which means the reviewer has to do the work anyway and the feature saved nothing.
The same logic governs vendor accuracy numbers. Kira advertises 90% accuracy from a hybrid of generative and proprietary models trained on 45,000 lawyer hours, according to Litera's Kira product page accessed August 1, 2026. No task definition, corpus, or scoring rubric accompanies it. A number you cannot reproduce is a marketing asset rather than a measurement, and comparing your own number against it would be comparing two things nobody measured the same way.
## What does ISO/IEC 42001 certification actually certify?
Datasite states it is the first data room provider certified to ISO/IEC 42001, on its diligence product page accessed August 1, 2026. That is a real and non-trivial thing to have done, and it is worth understanding precisely.
ISO/IEC 42001 is a management system standard. It certifies that an organization runs a documented system for governing AI: defined roles, risk assessment, controls, monitoring, and review. It does not certify that any model is accurate, that any output is complete, or that any summary is free of hallucination. A certified provider and an uncertified provider can ship the same model with the same error rate.
This is the confusion a governance badge invites, and it is the same confusion that surrounds SOC 2, which is the only certification claim we make for Mage. SOC 2 Type II is an audit of security controls over a period of time. Neither standard says anything about whether a document was classified correctly.
The useful buyer question is not "are you certified" but "what does your certification certify, and what would you show me to demonstrate accuracy". The first question has a badge for an answer. The second one does not.
## Agent access is now table stakes, and that is good
The most consequential recent change in this category is not a summarization feature. It is that data rooms became reachable by software.
Datasite ships an MCP connector so Claude, ChatGPT, or Microsoft Copilot can operate against the room, per its diligence product page accessed August 1, 2026, and publishes an agent skills repository whose requirements name Claude Code as a supported host, per that repository accessed August 1, 2026. Ideals promotes an MCP connector in the top banner of its homepage, accessed August 1, 2026. DealRoom advertises an MCP integration for its deal data on its pricing page, accessed August 1, 2026.
Nobody should claim uniqueness here, including us. What is worth arguing about is the shape of the access. Our data room is driven by a room-scoped API key plus a command line client where every command emits machine-readable output, so an agent can read what is missing, fetch the documents, upload each one against the checklist item it satisfies, and re-read the list to confirm. That loop is the useful unit, not the connector. The argument for it is in [data rooms for AI agents](/blog/data-rooms-for-ai-agents).
## Where does the AI stop and attorney review start?
At the boundary between the corpus and its contents.
The room can tell you what is here, where it belongs, what it relates to, and what is missing. Those are facts about the document set, checkable in seconds by a person looking at the room. It cannot tell you whether the assignment clause in the largest customer agreement blocks the deal, whether the indemnity cap is off-market, or what belongs on a disclosure schedule. Those are legal judgments made against a document, a deal structure, and a client's risk tolerance.
The honest positioning for ingest-time AI is that it deletes the sorting problem so the judgment work can start on day one instead of day nine. What that handoff looks like in practice is covered in [from data room to diligence workflow](/blog/data-room-to-diligence-workflow).
## How to test an AI data room in twenty minutes
Do this before any purchase, on every vendor, with the same folder:
1. Upload a deliberately messy set: a scanned document, an amendment whose parent is not named in the filename, a near-duplicate, and a file whose name contradicts its contents.
2. Look at the type assigned to each ambiguous one. Correct answers on the easy documents prove nothing.
3. Ask a question whose answer sits in exactly one document, and check whether the answer carries a source you can open.
4. Ask a question the room cannot answer, and see whether it says so or invents something.
5. Check what happens to documents that were never filed into a folder. Do they appear in the index as if they were organized?
6. Re-file one document by hand, trigger whatever recompute the product offers, and confirm your correction survived.
7. Ask what the vendor's certifications certify.
Twenty minutes of that tells you more than any feature comparison, because it tests the two things that matter: whether the output is verifiable, and whether the failures are visible.
Our own data room is free for a limited time and self-serve, so you can run that test on it without talking to anyone. It is at the [Mage Data Room page](/dataroom), and the rest of our writing on how these rooms should work sits in the [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/investor-data-room-checklist
### Title: Investor Data Room Checklist: Exactly What to Include for Seed Through Series B
### Author: Mage Team
An investor data room holds the documents a venture investor's counsel will ask for once the partner meeting goes well: the corporate record, the cap table and everything that authorizes it, IP assignments, key contracts, financials, and the prior round's executed paper. Plan for roughly 40 documents at seed, 65 at Series A and 90 at Series B. Those counts are our own rule of thumb from the rooms we have seen rather than a survey of anything, and every document count in this article should be read that way. The difference between stages is mostly financial history and commercial contracts, because the corporate set is the same set at every stage. It is simply supposed to be complete and signed.
That last clause is where rounds actually stall, and it is why this article is organized the way it is. A round does not die because a checklist item was missing. It dies because an associate found an option grant approved by email in week four, and the fix needed a board to sign something, and the term sheet had an expiry on it. So the list below is followed by the failure modes: which items break, how a diligence lawyer finds the break, and what the break costs you in calendar time.
## The list by stage
| Category | Seed | Series A adds | Series B adds | Hold until asked |
| --- | --- | --- | --- | --- |
| Corporate | Charter and amendments, bylaws, signed consents, good standing | Every consent since the seed closing, foreign qualifications | Subsidiary and international entity documents | Internal strategy memos |
| Cap table and equity | Cap table, founder purchase and vesting agreements, 83(b) elections, plan and grant ledger, SAFEs and notes | Prior-round paper, current 409A, ledger reconciled to reserve | Secondary transactions, repurchases, warrant agreements | Individual holder correspondence |
| IP | Assignment agreements for every contributor, filings, domains | Open source inventory, license schedule | Freedom to operate analysis if one exists | Source code |
| Commercial | Template agreement, top contracts | Concentration, cohort retention, assignment and change of control flags | Pipeline definitions, churn, net revenue retention | Full contract set at seed |
| Financial | Monthly P&L, balance sheet, model, cash summary | Revenue recognition policy, budget versus actual | Reviewed or audited financials, tax filings | Personal tax returns, ever |
| Team | Org chart, executive agreements, contractor list | Comp band census, option ledger by employee | Sales comp plans, handbook, classification analysis | Individual offer letters and salaries |
| Legal | Insurance, litigation, privacy policy and terms | Security questionnaire answers, data processing terms | D&O schedule, material vendor contracts | Anything under privilege you have not cleared |
### Seed, roughly 40 documents
1. **Corporate**
- Certificate of incorporation and every amendment
- Bylaws
- Board consents and minutes since formation, signed
- Stockholder consents where the charter or statute required one
- EIN letter and a current certificate of good standing
- Foreign qualification in every state where you have employees
2. **Cap table and equity**
- Cap table as a spreadsheet, tied line by line to the stock ledger
- Founder stock purchase agreements
- Founder vesting agreements, including any acceleration terms
- 83(b) elections with proof of timely filing
- Equity incentive plan, with the board and stockholder approvals that adopted it
- Option grant ledger with grant dates, exercise prices and the approval for each
- Every SAFE and convertible note, with every side letter
3. **Intellectual property**
- Confidential information and invention assignment agreements for every founder, employee and contractor
- Trademark and patent filings, with status
- Domain list and any material inbound licenses
- Open source policy if you ship software
4. **Commercial**
- Template customer agreement
- Signed contracts for your largest customers
- A note flagging any exclusivity, most favored nation or change of control term
5. **Financial**
- Monthly profit and loss since inception, plus a current balance sheet
- Cash position and burn summary
- Financial model with the assumptions visible
- Use of funds from any prior round
6. **Team**
- Org chart with roles and start dates
- Offer letter template and executive employment agreements
- Contractor list with signed agreements
7. **Legal and compliance**
- Insurance certificates
- Any litigation, threatened or pending
- Privacy policy, terms of service, and a note on what personal data you hold
### Series A adds, roughly 65 total
- The seed round's executed paper: stock purchase agreement, investors' rights agreement, voting agreement, right of first refusal and co-sale agreement, and the amended and restated charter
- Board minutes and consents for every meeting since that closing, signed
- A current 409A valuation report
- Option ledger reconciled to the plan reserve, showing what is granted, exercised, outstanding and available
- Customer concentration and cohort retention
- Key contracts marked for assignment and change of control terms
- Security questionnaire answers and a subprocessor list
- Data processing terms if you handle personal data
- Employee census with compensation bands rather than individual salaries
### Series B adds, roughly 90 total
- Reviewed or audited financials, with your revenue recognition policy
- Monthly cohort data, churn and net revenue retention with the definitions you use
- Sales compensation plans and quota attainment
- Pipeline by stage, with each stage defined
- Subsidiary formation documents and intercompany agreements
- International entities, payroll arrangements and contractor classification analysis
- Tax filings and any state nexus analysis
- Insurance schedule including directors and officers coverage
- Material vendor contracts and an open source inventory
## What actually breaks, and what it costs you
These are the findings that turn a two-week confirmatory diligence into a six-week one. Each is cheap to fix in advance and expensive to fix under a signed term sheet.
**Board consents that were approved but never signed.** Every option grant, every stock issuance, every charter amendment needs an authorizing consent with signatures on it. Approval in a meeting somebody remembers is not the record. The fix is a ratifying consent, which is straightforward, but counsel has to identify every gap first and your board has to sign, and that takes calendar time you will not have in week five.
**A cap table that does not tie to the stock ledger.** The spreadsheet and the underlying issuance documents have to agree on share counts, dates, prices and holder names. They usually diverge at the seams: a repurchase nobody recorded, a transfer to a trust, an exercise that was paid but never issued. Investors' counsel reconciles the two, and a difference of a hundred shares becomes a question about your record keeping generally.
**Missing 83(b) elections.** A founder who did not file within 30 days of purchase carries a tax problem that no amount of paperwork now solves. You cannot fix it in diligence. You can disclose it accurately, and you should, because the discovered version is worse than the disclosed one.
**IP assignments that were never executed.** The gap is almost always an early contractor, a friend who built the first prototype, or a founder who left. If the assignment was never signed, the company may not own the code or the mark. Chase these down the week you start building the room, because the counterparty is a person whose response time you do not control.
**Option grants approved by email.** A grant needs a board approval, an exercise price supported by a current valuation, and a signed award agreement delivered to the employee. Grants that live only in a spreadsheet, or that were priced off a stale 409A, get repriced or re-approved, and repricing is a conversation with your employees at exactly the wrong moment.
**Founder vesting with acceleration nobody modeled.** Single-trigger acceleration and unusual vesting schedules are fine as long as they are documented and everyone knows they exist. What is not fine is an investor's counsel finding acceleration in week four that changes the post-money cap table.
**SAFEs and notes with terms nobody has stacked.** Pro rata side letters, most favored nation clauses and inconsistent caps across a dozen instruments compound into a conversion nobody has modeled. Build the conversion model before the room opens, and put it in the room. The investor is going to build it anyway.
**Advisor and consultant equity with no assignment language.** Advisors who received equity but signed nothing assigning their work product are the same problem as the missing contractor assignment, with the added complication that they are usually still in your network.
## What should you deliberately leave out?
For a fundraise the short answer is: founders' personal tax returns at any stage, individual offer letters and salary detail, source code, internal strategy memos, and board decks carrying projections you no longer believe. The full exclusion discipline, including privilege, competitively sensitive customer economics and unredacted personnel data, belongs to the sale-process version of this problem and is set out in our [due diligence data room checklist](/blog/due-diligence-data-room-checklist).
The founder-specific reason to hold things back is worth one line of its own. Every document in the room is a document an investor's counsel can ask about, and the question arrives on their schedule rather than yours.
## When do you open the room?
Not with the first email. The deck earns the meeting, and the room answers the questions the meeting produced.
**Before the raise:** build the room and share it with nobody. This is when you find the unsigned consent and the missing election, and this is when fixing them costs two weeks instead of the timetable.
**After the first partner meeting, or when an investor asks:** share a scoped view covering corporate, cap table, financials and the metrics you already presented.
**After a term sheet:** open the full set for confirmatory diligence.
Two tiers, one room. Send each investor their own link scoped to what they should see, rather than one link that circulates. Per-recipient links are also how you find out later who actually read what, which matters more than founders expect. If you are still deciding what to run the room on, [what a virtual data room actually is](/blog/what-is-a-virtual-data-room) covers the category, and [when a shared drive is and is not enough](/blog/google-drive-dropbox-as-data-room) covers the option most seed founders start with.
## How do you keep the room current across a three-month raise?
A room built once and never touched goes stale in about three weeks, usually at the financials.
**One owner, one weekly pass.** Financials refresh monthly, the cap table refreshes on every issuance, and the metrics refresh whenever you send an update.
**Replace, do not append.** A folder holding model v3, model v3 final and model v3 final revised is a question you will get asked. Replace the file and let the index carry one current version.
**Name what does not exist.** If an investor asks for something you do not have, add a line to the index naming the document, saying plainly that it does not exist yet, and giving the date it will. An acknowledged gap reads as a project plan. A silent gap discovered in week six reads as a reason to ask what else is missing.
**Watch engagement and act on it.** If a partner opened the model twice and never opened the customer contracts, your follow-up email writes itself.
**Close the room when the round closes.** Revoke the links. A room left open after a closing is a document set circulating without a reason.
## How Mage handles the readiness list
[Mage Data Room](/dataroom) ships a fundraising readiness checklist: the documents a venture investor's counsel requests in a financing, scored per item as present, partial, missing or not applicable. The verdict is computed against your room's actual inventory rather than against a static template, and any curation you do by hand, marking an item complete or not applicable, survives every recompute.
Two details make that list usable rather than decorative. Amendments, exhibits and side letters are linked to the agreement they belong to, so a SAFE side letter stops living three folders away from the SAFE and stops reading as a missing item when it is really a filed one. And an item you mark not applicable, because you have no subsidiaries or no option plan yet, stays not applicable through every recompute rather than reappearing as a gap the next time something uploads.
If you work with an AI agent, hand it the list rather than the folder. `npx @magelegal/cli readiness --json` returns every checklist item with its status and an id, and `npx @magelegal/cli upload --for-item ` files a document against the item it satisfies, so the agent can work the missing list until nothing required is left. That loop is the whole reason the checklist is a data structure rather than a page. Mage is SOC 2 Type II certified, and the data room is free for a limited time and self-serve, with no lead form.
For the mechanics of building the room itself, see our [step-by-step setup guide](/blog/how-to-set-up-a-data-room). If you are weighing tools for a raise specifically, we wrote up [Mage and DocSend side by side](/blog/mage-vs-docsend-data-room). Everything else we have published on rooms sits in the [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/due-diligence-data-room-checklist
### Title: Due Diligence Data Room Checklist for M&A Sellers (2026)
### Author: Mage Team
A due diligence data room checklist is a buyer's request list turned into a filing plan. The request list is the easy half: ten categories, essentially the same on every mid-market deal. The hard half, and the reason deals stall in week ten, is the seller's answer to each line, because a real company never has every item sitting in a folder.
Every number in this article is our own rule of thumb from processes we have run rather than a published survey, and the ranges are wide on purpose. On our count a full request list runs past 170 line items, and a mid-market room ends up holding somewhere between five thousand and fifty thousand pages against them.
Two buy-side checklists on this site already list what a buyer asks for: [the complete M&A due diligence checklist](/blog/the-complete-manda-due-diligence-checklist-for-2026) and its [companion request list](/blog/checklist-manda-due-diligence-checklist). This article does not duplicate them. It is the seller's side of the same document: how to organize the room around that list, how to run the gap register while you do it, what gets staged to which bidder, and what never goes in the room at all.
## What will the buyer actually request?
Ten categories cover the request lists you will see. A fourteen category variant circulates, but it splits the same material rather than adding new material. Here is the map, with the line that stalls most often in each category.
| Category | Core requests | Where sellers stall |
| --- | --- | --- |
| Corporate and governance | Charter, bylaws, minute books, stock ledger, board and stockholder consents, subsidiary records | Consents for past equity issuances that were never papered |
| Financial | Audited and management financials, monthly reporting pack, budget, working capital detail, debt schedule | Reconciling management numbers to the audited set |
| Tax | Federal, state, and local returns, nexus analysis, sales tax filings, audit correspondence | State nexus in jurisdictions nobody registered in |
| Legal and contracts | Material agreements, leases, licenses, litigation, settlements, insurance | Amendments and side letters filed apart from the base agreement |
| Customers and revenue | Top customer contracts, cohort and churn data, pipeline, backlog | Change of control and assignment consent provisions |
| HR and benefits | Census, offer letters, equity grants, benefit plans, contractor agreements, handbooks | Contractor classification and unpapered contractor IP |
| IP and technology | Registrations, assignments, open source inventory, escrow, architecture | Missing invention assignments from founders and early hires |
| Security and privacy | Policies, audit reports, breach history, DPAs, subprocessor list | Privacy commitments made in sales cycles and never tracked |
| Operations and real estate | Leases, key vendors, supply agreements, capex | Auto-renewing vendor contracts nobody has read since signing |
| Regulatory | Licenses, permits, compliance filings, correspondence | Permits held in a subsidiary name after a reorganization |
The page count is not a quality signal, and this is the one place we would argue with a buyer. A small room with a clean index does more for the associate on the other side than a large one without, because the associate's job is to find what they were sent to find and a dump makes that harder rather than easier.
## How long does preparation take, and what does it consist of?
On our own experience, budget four to six weeks before the room opens, then eight to sixteen weeks of live diligence on a mid-market process. The preparation weeks are not upload weeks. They are:
1. **Pull the request list first.** Start from the buyer's standard list, not from your own file structure. If you do not have one yet, our guide to [building a due diligence checklist](/blog/how-to-build-due-diligence-checklist-manda) covers how to construct one from scratch, and [the complete M&A due diligence checklist](/blog/the-complete-manda-due-diligence-checklist-for-2026) is the buy-side view of the same document.
2. **Assign an owner per category.** Finance owns financial and tax, the general counsel or outside counsel owns legal and corporate, the head of people owns HR, engineering owns IP and technology. One name per category, not a committee.
3. **Run the inventory before the cleanup.** Locate what exists before deciding what to fix. Sellers routinely spend a week fixing a problem that a signed original in someone's email would have closed in an hour.
4. **Clear the disclosure questions early.** Privilege, personal data, and competitively sensitive customer economics all need a decision before anything goes in a folder, not after.
5. **Build the index.** Every folder and document gets a stable number, and the numbering becomes the shared vocabulary for the rest of the deal. [How to organize a data room](/blog/data-room-organization-what-partners-want) covers structure and naming; [how to set up a data room](/blog/how-to-set-up-a-data-room) covers the mechanics of getting live.
The teams that skip preparation do not save the work. They move it to week ten, under a signed letter of intent, with a buyer watching every day of slip.
## How do you run the gap register?
This is the part almost nobody writes about, and it is the difference between a room that closes and a room that grinds.
Give every request-list line an owner, a due date, and exactly one of four statuses:
- **Have it.** The document exists, it is signed, and it is filed against the right line item.
- **Have a version.** An unsigned draft, an unexecuted amendment, or a document you believe is superseded. It goes in the room with a note saying which it is.
- **Cannot locate.** It existed. Nobody can find it. Someone owns the search, and the search has a deadline.
- **Does not exist.** It was never created. This is an answer, not a failure.
The rule that matters: a stated absence with a reason is a diligence answer, and silence on the same line is a red flag. Buyers find every gap. The only variable is whether they find it in week one, when it is a data point, or in week ten, when it is a price adjustment, an indemnity, or a closing condition.
So treat the gap register as a deliverable your own team reads weekly. Sort it by whether closing the gap requires a third party to act. A missing invention assignment needs a former employee to sign. A change of control consent needs a customer's legal team to respond. Those two lines set your critical path, and they are the reason a deal signs in March and closes in June.
## How do you map the room to the buyer's request list?
Buyers do not read your folder structure. They read their own list and check items off. The seller's job is to make that check trivial.
- **Number everything.** Every folder and document carries a stable index number, and your responses cite the number rather than a filename. A filename changes; an index number should not.
- **Answer at the line item, not the folder.** When the buyer asks for line 4.12, the response names documents 4.12.1 through 4.12.4, not the folder they live in.
- **Keep the response log in one place.** Every request list has a response column. Buyers reconcile against it, and a stale column costs you a call.
- **File amendments with their parents.** An amendment that sits three folders from the agreement it modifies produces a question, then a follow-up, then a suspicion that the chain is incomplete.
- **Answer the questions you know are coming.** If the top ten customer agreements have a consent provision, put that fact in the response rather than waiting for the buyer's associate to find it in six of them and ask about the other four.
Most virtual data rooms run a formal Q&A module for this exchange, where buyer questions are routed to the right seller-side expert, answered, and logged with a timestamp. If your process is running through a banker, that module is how the whole conversation gets tracked, and it is worth confirming who on your side has the authority to release an answer before the first question lands.
## What is Stage 1 versus Stage 2 disclosure?
Staged disclosure is standard on any process with more than one bidder, and it is the single most common gap in checklist articles.
**Stage 1** opens to every party that signs an NDA. It carries the confidential information memorandum, financial highlights, top-level corporate structure, an anonymized customer picture (contract values without customer names), and a product overview. Enough to price an indication of interest, not enough to reconstruct your business.
**Stage 2** opens to the shortlist after indications of interest arrive. It carries detailed financials, named customer contracts with their economics, IP assignments and registrations, the employee census with compensation, security audit reports, and litigation detail.
The split protects competitively sensitive material from bidders who will never sign, and some of those bidders are competitors doing a fully legitimate look. Enforce it with scoped access rather than by keeping Stage 2 documents out of the room. Prepare everything, then open folders as the process advances. A folder you have to build under time pressure in week nine is a folder with errors in it.
One practical note: exclusivity changes the calculus. Customer-level pricing that stays closed to five bidders can open to one signed exclusive buyer, and that trade is usually worth making, because the alternative is a diligence condition that follows you to closing.
## What should never go in the room at all?
Three categories, and the discipline here is absolute because there is no undo. Revoking a link stops future access. It does not retrieve the page a guest already read.
**Privileged material.** Counsel memoranda analyzing the exact risks the buyer is diligencing are the most tempting and most dangerous documents in the building. Disclosure to a third party can waive privilege over the subject matter. Litigation assessments, internal investigations, and tax opinions go through counsel before anyone considers uploading them.
**Competitively sensitive customer economics before exclusivity.** Customer-level pricing, discount schedules, and churn by named account handed to a bidder who is also a competitor is an antitrust and commercial risk regardless of the NDA. Aggregate it in Stage 1, name names in Stage 2, and take advice on the clean team arrangement if a direct competitor is bidding.
**Unredacted personnel files.** Performance reviews, medical and leave records, immigration files, and disciplinary history. Employee data carries privacy obligations that the sale process does not suspend. Buyers get a census with the fields they need, not the file.
Two more that belong on the same list: anything under a third-party confidentiality obligation that prohibits disclosure in a sale process, and any document you cannot authenticate. An unsigned agreement presented as executed is worse than an acknowledged gap.
## The checklist, condensed
Print this one. It is the sell-side sequence, not the buyer's list.
1. Obtain the buyer's request list, or a standard one, before you touch a folder.
2. Assign one owner per category, with a name and a date.
3. Inventory what exists before fixing anything.
4. Mark every line: have it, have a version, cannot locate, does not exist.
5. Sort the gaps by whether a third party must act. Start those first.
6. Clear privilege, privacy, and competitive sensitivity questions before uploading.
7. Split Stage 1 from Stage 2 and scope access by folder rather than by omission.
8. Number every folder and document, and cite numbers in every response.
9. File amendments, exhibits, and side letters with the agreement they modify.
10. Publish the gap register internally and review it weekly against the critical path.
11. Track who opened what, and follow up on the bidder who never opened anything.
12. Keep an export of the full room and its index for the closing binder.
## Which parts of this can the room do for you?
Disclosure: we build a data room, and the sequence above is the workflow it was built around. Two steps in that sequence are the ones a room can genuinely take off your desk, and the rest is judgment that stays with counsel.
The gap register is the first. Each Mage room carries a readiness checklist of what an acquirer's counsel expects to find, each item marked present, partial, missing, or not applicable, scored against the room's actual inventory rather than a static template. Curation you do by hand survives every recompute, which is the property that decides whether a register stays trustworthy for sixteen weeks or gets abandoned in week three. Amendments, exhibits, and side letters are linked to the agreement they modify, so an amendment filed three folders away stops reading as a missing item when it is really a misfiled one.
Staged disclosure is the second. Sharing is per recipient, so Stage 1 and Stage 2 are two scopes on one room rather than two rooms: each invite carries its own scope, view only by default, printing gated separately from download, an NDA gate on by default that can produce a countersigned PDF, plus expiry and instant revocation. That is the mechanic the staging section above asks for, and it is the reason you can prepare everything up front and still open folders as the process advances. Every folder and filed document also takes a stable dotted index number exportable to XLSX, which is the numbering your responses are supposed to cite.
Two things the room does not do. There is no redaction, so anything requiring redaction gets handled before upload. And Ask Mage, the room's assistant, answers from the room's documents for members only, which means it is not the buyer-facing Q&A module described above; guests never see it.
The Mage Data Room is free for a limited time. The product page is [Mage Data Room](/dataroom), the rest of our writing on rooms sits in the [data rooms topic hub](/blog/topics/data-rooms), and the two posts that pick up where this one ends are [how to identify material contracts in a data room](/blog/how-to-identify-material-contracts-data-room) and [the data room to diligence workflow](/blog/data-room-to-diligence-workflow). The checklist produces the room. The room still has to produce findings.
## URL: https://magelegal.com/blog/data-room-organization-what-partners-want
### Title: How to Organize a Data Room: The Folder Structure, Naming, and Index Buyers Expect
### Author: Mage Team
A data room is organized well when a reviewer who has never seen your company can find the third amendment to your largest customer agreement in under a minute, without asking. That is the entire test, and it has three parts: a numbered folder tree that mirrors the diligence request list, a filename pattern that carries party, instrument, and date, and an index that gives every document a number both sides cite in email.
The structural consensus across data room guidance is broadly correct, so this article agrees with it quickly and then spends its length on the three problems the ranking pages skip: naming as a daily discipline rather than a convention, amendments and restatements, and how to restructure a room that is already live without breaking anyone's access.
If you are earlier than this and still populating the room, start with [how to set up a data room](/blog/how-to-set-up-a-data-room). If your problem is deciding which agreements have to surface at all before you can file them, work from [how to identify material contracts in a data room](/blog/how-to-identify-material-contracts-data-room).
## What folder structure do buyers expect?
Numbered top level folders, four core categories expanding to about ten for a full M&A room, mirroring the categories in the request list you were sent. Here is the reference tree. Copy it, delete what does not apply to you, and renumber.
```
01-Corporate/
01.1-Formation-and-Charter/
01.2-Bylaws-and-Governance/
01.3-Board-and-Stockholder-Consents/
01.4-Subsidiaries-and-Foreign-Qualifications/
02-Capitalization/
02.1-Cap-Table/
02.2-Equity-Issuances/
02.3-Option-Plan-and-Grants/
02.4-Convertible-Instruments/
02.5-Warrants/
03-Financial/
03.1-Financial-Statements/
03.2-Management-Accounts/
03.3-Budgets-and-Projections/
03.4-Debt-and-Credit-Facilities/
04-Material-Contracts/
04.1-Customer-Agreements/
04.2-Supplier-and-Vendor-Agreements/
04.3-Partnership-and-Reseller/
04.4-Terms-and-Policies/
05-People-and-Benefits/
05.1-Employment-Agreements/
05.2-Offer-Letters-and-Confidentiality/
05.3-Contractors/
05.4-Benefit-Plans/
06-Intellectual-Property/
06.1-Registrations/
06.2-Assignments/
06.3-Licenses-In/
06.4-Licenses-Out/
06.5-Open-Source/
07-Tax/
08-Real-Estate/
09-Litigation-and-Regulatory/
10-Insurance/
```
Three points about this tree that matter more than its exact contents.
The numbers are load bearing. Without them, alphabetical sorting puts Capitalization ahead of Corporate, Financial ahead of Intellectual Property, and your carefully ordered workstreams into an order nobody chose. Different platforms, browsers, and ZIP exports also sort differently, so an unnumbered tree quite literally looks different to different reviewers. Numbering makes the room look the same everywhere, and it lets a request for item 4.2 land on a folder instead of on a search box.
The categories should come from their document, not yours. If counsel sent a request list organized around eight workstreams, use those eight. The room exists to be read by the people who wrote that list, and a room whose sections match the request they sent is a room where nobody has to translate.
Every folder should be able to justify itself. If a folder holds nothing, delete it or say why it is empty. An empty folder named Environmental Permits reads as a document somebody removed.
## How deep should the hierarchy go?
Two levels for most rooms, three at the ceiling, and never a fourth.
The reason is behavioral. Reviewers scan far more than they search, especially in the first pass when they are building a mental map of the company. A document at level four is found only by someone who already knows it is there, which means it is found only by you. Depth does not organize a room. It hides it.
Two sizing rules keep the tree honest. If a subfolder holds fewer than about five documents, promote its contents one level up and delete the folder. If a subfolder holds more than about forty, split it along a dimension a reviewer would actually use, which is usually counterparty or year, and never one you invented for internal filing.
The flat alternative deserves a mention because it is increasingly viable. A room where every document is typed, summarized, and searchable does not depend on the tree for retrieval the way a 2015 room did. The tree still matters, but it is now navigation rather than infrastructure. That shift is the subject of [what an AI data room changes](/blog/ai-data-room).
## How do you name a document so nobody has to open it?
This is where real rooms are won and lost, and it is the part every template skips. At eighty documents a bad name costs a few seconds. At eight thousand it is the whole cost of the room.
The pattern: `Party_Instrument_YYYY-MM-DD.pdf`
Three rules make it work.
Spell out the instrument. The document is an Amended and Restated Certificate of Incorporation, not an AR Charter. Full instrument titles are what counsel writes in a closing checklist, what a schedule cross references, and what a reviewer searches for. Acronyms are the single most cited complaint about seller built rooms, because an acronym that is obvious inside your company is a lookup task for everyone else.
Use ISO dates. 2026-03-14 sorts chronologically in every system on earth. 3/14/26 sorts nowhere and means two different dates depending on which side of the Atlantic your reviewer sits on.
Delete version words. The room holds the operative document. Superseded copies are labeled superseded and filed beneath it. A filename containing final, v3, or REAL tells a reviewer that somewhere in your organization there is another copy and nobody is sure which one governs.
| What arrives from the business | What belongs in the room |
| --- | --- |
| `Agreement final v3 REAL.pdf` | `ExampleCo_Master Services Agreement_2024-06-30.pdf` |
| `AR Charter.pdf` | `Sub-1_Amended and Restated Certificate of Incorporation_2026-03-14.pdf` |
| `Scan_20240612_0003.pdf` | `HolderA_Common Stock Purchase Agreement_2024-06-12.pdf` |
| `NDA signed.pdf` | `VendorB_Mutual Nondisclosure Agreement_2023-11-02.pdf` |
| `option grant jane.pdf` | `EmployeeA_Stock Option Grant Notice_2025-01-15.pdf` |
Consistency beats elegance. One imperfect pattern applied to every document in the room is worth more than three excellent patterns each applied to a third of it, because inconsistency is what forces a reviewer to open files to find out what they are.
## What is the data room index, and how is it different from the tree?
The folder tree is how people navigate. The index is how people cite.
An index is a numbered inventory of every document in the room. Each row carries a stable number, the document title, its date, its parties, and its folder. It is the artifact counsel refers to in email, the artifact a closing checklist ties back to, and the artifact that makes "the third amendment" into "item 4.1.7" so that two firms are provably discussing the same page.
| Index | Document | Date | Parties | Folder |
| --- | --- | --- | --- | --- |
| 4.1.5 | Master Services Agreement | 2024-06-30 | ExampleCo, VendorB | 04.1 Customer Agreements |
| 4.1.6 | Amendment No. 1 to Master Services Agreement | 2025-02-11 | ExampleCo, VendorB | 04.1 Customer Agreements |
| 4.1.7 | Amendment No. 2 to Master Services Agreement | 2025-09-04 | ExampleCo, VendorB | 04.1 Customer Agreements |
Two properties separate a working index from a spreadsheet somebody made once. Numbers must be stable, because a citation that changes silently is worse than no citation. And the index must be exportable, because the people who need it most are working in email and in a closing checklist, not inside your room.
In [Mage Data Room](/dataroom), every folder and every filed document receives a dotted hierarchical number automatically, shown in an Index column and exported to XLSX for any room member. The numbers are stored rather than recomputed on each read, so a citation only changes when the room is deliberately re-indexed. One deliberate limit is worth knowing: documents that are not filed in any folder are left un-numbered until they are organized, which is intentional. An unfiled document has no place in the tree, so giving it a number would create a citation with nowhere to point.
## How do you handle amendments, restatements, and versions?
Amendments are the most common structural failure in real data rooms, and the failure is always the same shape: an Amendments folder.
It looks tidy. It guarantees that someone reads an original agreement without its amendment, forms a view about a term that no longer exists, and prices it. By the time that surfaces it costs a call, a memo, and credibility.
The rule is that an amendment lives with its parent. Same folder, named so it sorts immediately beneath the agreement it modifies, with the amendment number in the name. Three related cases:
**Amendments.** File beneath the parent. `ExampleCo_Master Services Agreement_2024-06-30.pdf` then `ExampleCo_Amendment No. 1 to Master Services Agreement_2025-02-11.pdf`. The index rows sit adjacent, so a reviewer reading one sees the others.
**Amended and restated agreements.** The restatement is the operative document and takes the primary position. The superseded originals stay in the room, filed beneath it and labeled superseded in the filename. Removing them looks like tidying and reads like deletion.
**Exhibits, schedules, and side letters.** These belong with the agreement they attach to, not in a separate exhibits folder. A side letter that modifies one investor's rights is part of that investor's agreement family, and a reviewer who finds the agreement but not the side letter has read half the deal.
Mage's data room runs a detection pass over the room's inventory and links amendments, exhibits, and side letters to the agreement they belong to, so the relationship is recorded even when a filename does not make it obvious. Treat that as a safety net under your naming discipline rather than a replacement for it. If a document's own name says what it modifies, the relationship survives every export, every downstream system, and every reviewer working from a printout.
## What structural mistakes make buyers assume you are hiding something?
Buyers read structure as a signal about management long before they read the documents. These are the tells, in rough order of how much damage they do:
- **A Miscellaneous folder.** It says either that nobody made a decision, or that something is in there deliberately. Both invite a question.
- **Empty folders.** A named folder with nothing inside it reads as a removal. If a category genuinely does not apply, say so in the index rather than leaving a hollow shell.
- **The same agreement in two places.** Now a reviewer has to work out whether the copies are identical, and they will assume they are not.
- **Unexplained acronyms.** Internal shorthand in filenames signals a room built for internal convenience rather than for review.
- **Documents stranded outside any folder.** Unfiled documents fall out of the index, out of the tree, and out of any structured export. They are invisible in exactly the way that looks intentional.
- **Inconsistent structure between sections.** Corporate organized by year, Contracts by counterparty, People by document type. Every switch costs a reviewer a fresh mental model.
- **A silent gap.** A section that is complete except for one obviously missing item. Say a document is missing, name who owns it, and give a date. A labeled gap reads as control of the process. A quiet hole reads as concealment, and diligence counsel finds it either way.
For which documents genuinely have to be there before any of this matters, work from the [due diligence data room checklist](/blog/due-diligence-data-room-checklist).
## How do you restructure a live room without breaking access?
Every real deal reorganizes mid flight. A new workstream opens, a buyer asks for contracts split by counterparty, or the first structure turns out to have been built around the seller's org chart. No page one search result explains how to do it without collateral damage, so here is the procedure.
**Batch the moves into one window.** Continuous reorganization while parties are reading is the worst option: numbers shift under people, and nobody trusts a citation. Do it in one session, ideally at a natural break.
**Keep folder identities stable.** Move documents between existing folders rather than deleting a folder and building a replacement. In Mage, folder scoped share links point at a stable folder id rather than a path, so renaming or moving a folder does not break anyone's link, and a link whose folder no longer resolves fails closed and shows nothing rather than showing the wrong thing. If your platform resolves access by path, treat every folder rename as an access change and re-verify each affected link.
**Make deletion non destructive.** In Mage, deleting a folder moves its documents to Unsorted rather than deleting them, which is the behavior you want when someone reorganizes fast at 11pm. The tradeoff is that unsorted documents leave the index until they are refiled, so a restructure is not finished until nothing is sitting outside a folder.
**Re-index once, at the end.** Not during. Then tell the parties who are reading that the index has been regenerated and the old numbers are retired. A one line note costs nothing and prevents the worst version of this, which is two people citing the same number and meaning different documents.
**Re-run the empty folder sweep.** Reorganizations create hollow folders. Delete them before anyone else sees them.
## The fastest way to build the tree
Two approaches beat hand building folders in a browser.
If your documents already sit in an organized folder tree on disk, push the tree up rather than recreating it. Mage's command line client mirrors a local directory structure into the room in one command, `npx @magelegal/cli upload ./diligence`, running the transfers in parallel. A tree mirrored from disk is more consistent than one assembled by hand in a browser at midnight, because the local tree is the one you have been maintaining all along.
If your documents are scattered across drives and inboxes, do the opposite: get everything in first without cleaning up, then let the room organize itself. Mage types and summarizes every document that lands, then runs a single organizing pass that chooses the folder structure and places every document, which keeps folder naming consistent across the whole room in a way that incremental hand filing never does. Adjust the two or three folders you disagree with afterwards. That is a much shorter list than the one you would build from an empty tree.
Either way, the discipline in this article still applies. The tree is the easy part. The naming, the amendment families, and the index are what a reviewer actually experiences, and they are what separate a room that gets read from a room that gets questioned. More on the whole category is collected in our [data room guides](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/google-drive-dropbox-as-data-room
### Title: Can You Use Google Drive or Dropbox as a Data Room? An Honest Answer
### Author: Mage Team
Yes, sometimes. If you are raising an angel round and sending the same folder to eight investors who already know you, a Google Drive or Dropbox folder is proportionate and paying for a virtual data room instead is theatre. Most articles answering this question are published by companies that sell data rooms, which is why they all answer no.
We also sell one, so treat this as a disclosed opinion rather than neutral advice. Our answer is still yes for the small case. What follows is the line, drawn precisely enough that you can apply it in about a minute.
## When is a shared drive actually good enough?
Four questions. Answer them honestly and the decision makes itself.
**How many counterparties?** Under about ten, all known to you, a drive is manageable. Past that, access administration becomes a job, and jobs done manually get done wrong.
**Is any counterparty a competitor?** In a fundraise, an investor with a portfolio company in your space is a competitor by proxy. In a sale process, a strategic bidder is a competitor by definition. The moment one of them is, you need per-recipient control and a per-page reminder of who is looking at the document.
**Will anyone inspect the process itself?** A regulator, an acquirer's counsel, or a litigation adversary does not just want the documents. They want to know how disclosure was controlled. A drive gives you no story to tell there.
**Might you need to reconstruct access after the fact?** This is the one that decides most cases, and almost nobody asks it up front. Keep reading.
If all four answers are comfortable, use the drive, harden it as described below, and spend the money elsewhere.
## What exactly is missing?
Set encryption aside. It is not where these deals go wrong, and leading with it is a sales tactic. The gaps are procedural, and every one of them is something you can settle in your own admin console this afternoon rather than take on our word. Admin capabilities differ by plan and change without notice, so the left column below is written as what to go and verify, not as a claim about what your account does today.
| Capability | What to verify in your own workspace settings | What a deal-grade data room does by default |
| --- | --- | --- |
| Access unit | Whether a share binds to a named account or to a link anyone holding it can use | One personalized link per named recipient |
| Confidentiality terms | Whether anything records acceptance of terms before the documents open | A gate in front of the documents, with acceptance recorded |
| Watermarking | Whether any per-viewer stamp is applied to pages as they render | Every page stamped with the viewer's identity and date |
| Download control | Whether download, print, and copy are three settings or one | View or download, with printing gated independently |
| Withdrawal of access | Whether a share can expire on a date, or only be removed by hand | Timed expiry plus instant revocation on every link |
| Visibility | How much of a read the activity log records: that a file opened, or how far through it someone got | Which named viewer read which document, and how far through |
| Structure | Whether anything assigns a stable number both sides can cite in an email | A numbered index everyone can cite by number |
| Counterparty questions | Where questions arrive, and who is on the thread | A structured question workflow, in the enterprise tools |
That last row is real. Ansarada, for example, lists streamlined Q&A among its headline features on its own pricing page (accessed August 1, 2026). Email threads are the drive equivalent, and on a deal with real question volume they become the thing that fails.
## Is a drive activity log an audit trail?
No, and this is the argument nobody makes properly.
A drive's activity log is an administrative convenience. It tells the account owner what happened inside the account: this person opened this file, this file was moved, this share was created. It is retrospective telemetry for the person who already controls the environment.
A data room audit trail is built to be produced to somebody else. The record is not "a file was opened." It is: this named recipient was sent this link, on this date, scoped to this folder; they accepted these confidentiality terms before entry, producing a signed PDF held in the record; they first opened it at this moment; they viewed these documents and reached this page of each.
The difference is invisible for months and then decisive in an afternoon. A buyer alleges a disclosure was never made available. A co-investor claims they never saw the side letter. A regulator asks how a competitor obtained a document. In each case the question is not "did you have the file." It is "can you show what was made available to whom, and on what terms, at the time." A drive activity log answers the first question. It is not built to answer the second.
If your deal has any chance of ending in that conversation, the shared drive is the wrong tool and the cost of a real room is not the expensive part of the transaction.
## What goes wrong in practice
Three failures account for most of the damage, and none is exotic.
**Link forwarding.** A link that works for anyone with it works for anyone who receives it. An investor forwards it to an analyst, who forwards it to an operating partner, who is on the board of a competitor. Nobody acted in bad faith and your document is somewhere you cannot name.
**Orphaned access.** A party drops out in week three. Nobody removes them, because removing people is a task without a trigger. Six months later they still have live access to a folder that now contains the executed documents.
**Inherited permissions.** You share a subfolder, then later move a sensitive document into it, or share a parent to save time. Folder sharing in general-purpose drives is designed to flow downward, so a file that moves into a shared folder takes on the folder's audience rather than an audience you picked for it. Confirm the exact inheritance rules for your own plan rather than relying on a mental model of them, because this is the failure people discover last and regret most.
## If you are using a drive anyway, harden it
This is the part vendor content leaves out because it does not sell anything. Do all of it.
1. Share to named accounts only. Turn off "anyone with the link" for the entire tree, and make that the default in your workspace settings if you can.
2. Set viewers to view only, and disable download, print, and copy on every share.
3. Put an expiry date on every share. Deals end; access should end with them.
4. Never share a parent folder. Build one folder per counterparty and place copies inside it, so nothing inherits an audience you did not pick.
5. Get the NDA signed before you share, out of band, and keep the executed copy with a note of exactly which folder version it covered.
6. Number your folders and files so everyone can cite the same reference. Our guidance on what belongs in each numbered section is in the [investor data room checklist](/blog/investor-data-room-checklist).
7. Run an access review every quarter, and immediately after any party drops out. Export the sharing report, read every name, and remove everyone who no longer needs to be there.
8. Assume anything downloaded is permanently gone. Decide what you share on that basis, not on the basis of a setting.
That configuration is genuinely defensible for a small raise. It is not defensible for a competitive sale process, and no amount of settings work will make it so.
## Do the overlay products close the gap?
Partly. They close one gap cleanly and leave three untouched.
Products that layer document tracking on top of Drive add analytics: view counts, time on page, and per-recipient links pointing at content that still lives in your drive. That is a real improvement over no visibility at all, and for a fundraise the analytics are the feature founders actually want.
What they do not add is permissioning, gating, or workflow. The underlying permission model is still Drive's, so inheritance still behaves the way Drive behaves. There is no confidentiality gate producing a record of accepted terms. There is no structured counterparty question process. Buy the overlay for the analytics. Do not buy it believing you have bought control.
Dropbox's own answer to this question was to buy DocSend, announced in March 2021 for $165 million (TechCrunch, accessed August 1, 2026). Dropbox itself concluded that file sync and deal-grade document sharing are different products. We take that category apart in our piece on [when a tracked link beats a data room](/blog/mage-vs-docsend-data-room).
## When to move, and what to move to
Move when any of the four questions turns. More than a handful of counterparties, one of them competitive, an inspectable process, or a real chance you will need to reconstruct the record. In practice that is most Series A rounds and every sale process.
Our disclosure, once: we build [Mage Data Room](/dataroom). It connects to Google Drive, OneDrive, Dropbox, and Box rather than asking you to abandon them, so the documents you already keep in a drive become the room. It mints one personalized link per recipient, defaults to view only with printing gated separately, supports expiry and instant revocation, puts a confidentiality gate in front of the documents that can produce a countersigned PDF into the record, and stamps every page with the viewer's identity as a deterrent, not as an access control. It shows which named viewer read which document and how far through. It numbers the index automatically and exports it. It is SOC 2 Type II certified and free for a limited time.
The honest summary: a shared drive is a filing system that can be shared. A data room is a disclosure record that happens to hold files. For a friendly angel round the first is enough. For anything a lawyer will later ask questions about, you want the second, and if you are still deciding what a data room even is, start with [what a virtual data room actually does](/blog/what-is-a-virtual-data-room) and the rest of our [data rooms topic hub](/blog/topics/data-rooms).
## URL: https://magelegal.com/blog/manda-transaction-management-software
### Title: M&A Transaction Management Software: What It Covers and When a Deal Team Needs It
### Author: Raffi Isanians
M&A transaction management software is the system that runs a deal's execution: the closing checklist, the conditions precedent, who owes which deliverable, the signature pages, and the closing set. It is not a virtual data room, which stores and serves documents, and it is not a diligence tool, which reads them. All three now market themselves as end to end deal platforms, which is why buyers arrive at this category confused.
The useful question is not what the category is called. It is how many systems one deal actually needs, and every page ranking for this term ducks that question because each vendor owns one slice of the lifecycle and describes the rest as an integration. Here is the whole lifecycle, who owns each part of it, and where the handoffs leak.
## What does transaction management software actually do?
Strip the marketing away and the category converges on five functions.
**List based deliverable tracking.** Every item the deal owes someone, with an owner, a status, and a due date. This is the closing checklist, and it is the spine of the product.
**Conditions precedent management.** The subset of items that gate closing. CPs need evidence attached, not just a checkbox, because the question at closing is whether a condition was satisfied and who says so.
**Multi party signing workflows.** Collecting executed signature pages from parties who are in different time zones, on different documents, with different authority.
**Closing binder generation.** Assembling the final set: every executed document, every schedule, every certificate, in an order someone can navigate two years later when a dispute starts.
**Real time visibility.** Letting the client, the other side, and the rest of the deal team see status without a status email.
A tool that does those five things well is a genuinely useful purchase. What it does not do is read anything. It tracks that the customer agreement was delivered. It has no view on the change of control clause inside it.
## Map the deal, then map the systems
Here is the lifecycle end to end, with the category that owns each stage and the handoff that breaks.
| Deal stage | What it produces | Which category owns it | Where the handoff leaks |
| --- | --- | --- | --- |
| Request list | The documents the buy side wants | Diligence tooling, often a spreadsheet | Items are written in the buyer's language and filed under the seller's folder names |
| Data room | Organized, permissioned documents | Virtual data room | The room's index numbers rarely survive into anything downstream |
| Diligence review | Findings, flags, open items | Diligence platform or human review | Findings live in a memo and lose their link back to the source document |
| Disclosure schedules | Schedules that tie to the agreement | Diligence platform, or Word and a paralegal | Schedules get rebuilt by hand from the same documents the room already holds |
| Closing checklist and CPs | Deliverable status, satisfied conditions | Transaction management | Checklist item names do not match either the room's names or the schedules' |
| Signature pages | Executed pages, correctly matched | Signing and closing tools | Pages arrive detached from the version they belong to |
| Closing set | The final binder | Signing and closing tools | Assembled from whatever is newest in someone's email |
Read the right hand column top to bottom. Not one of those failures is a missing feature. Every one of them is a document losing its identity as it crosses a system boundary. That is the actual product problem in this category, and it is why teams that own four best in class tools still close deals with a person reconciling names in a spreadsheet at 2am.
## When does a deal team need it?
A spreadsheet and a shared folder work for longer than vendors like to admit. Three triggers change that.
1. **A signing to closing gap.** The moment conditions have to be tracked over weeks rather than confirmed in a morning, a static list stops reflecting reality. Interim covenant compliance has the same shape, which we cover in [signing to closing interim covenants](/blog/signing-to-closing-interim-covenants).
2. **Counterparties who need partial visibility.** The other side needs to see status on their items without seeing yours. A spreadsheet has one permission level: sent.
3. **More than roughly thirty deliverables or more than three signing parties.** Below that, coordination costs less than a subscription. Above it, the reconciliation work compounds.
Notice that none of those triggers is deal size in dollars. A $30 million deal with a carve out, three sellers, and a regulatory condition needs more machinery than a $300 million all cash acquisition of a single entity.
## Who are the real players, and why does the shortlist keep shrinking?
Three groups sell into this problem, and the market is consolidating hard.
**Data room vendors moving up the stack.** Datasite positions its diligence product on trust plus multi-LLM access and states semantic search, an in room AI powered by Blueflame AI that draws only on the project's content and returns citations, and redaction at scale (Datasite diligence page, accessed 2026-08-01). It is also the consolidator: it acquired Firmex, announced 26 July 2021, signed a scheme implementation deed to acquire ASX listed Ansarada announced 13 February 2024, and its own about page names Firmex, MergerLinks, Sherpany, Sealk, and Ansarada among its acquisitions, plus the private markets data provider Grata in 2025. SS&C Technologies completed its acquisition of Intralinks on 16 November 2018, a date routinely reported wrong as 2020. Litera agreed to acquire Kira Systems, announced 10 August 2021.
**Deal lifecycle platforms.** DealRoom positions as an AI powered operating system for Buyer-Led M&A spanning pipeline management, due diligence, data room, and post merger integration, with its diligence AI sold as a paid add on (DealRoom pricing page, accessed 2026-08-01). That is the broadest single claim in the category, and the add on line is the tell: the lifecycle is the product, the reading is extra.
**Legal AI platforms coming from the document side.** Harvey positions on agents that execute legal work end to end, with Vault for bulk document analysis and a transactional surface aimed at due diligence and contract review (Harvey's site, accessed 2026-08-01).
A fourth group sells signing and closing execution specifically: signature page assembly, execution tracking, and closing binder production. Those are real products and they are good at that job. Mage does not compete there, and any platform that tells you it has absorbed that slice is worth testing on a live signing before you believe it.
The practical consequence of the consolidation is procurement hygiene. If your shortlist has three names and two of them are owned by the third, you are not running a competitive process. Check ownership before you check features.
## Why does nobody publish pricing?
Because the bill is a function of variables the vendor cannot see until the sales call: how many deals, how much data, how long the term. As of 2026-08-01, Ideals shows three plans behind a Get price button, Datasite publishes no price anywhere on its site and offers a trial of up to 90 days, Firmex states that data requirements and project length determine the price, and DealRoom lists four pricing principles and an annual commitment with no dollar figure. SecureDocs is the exception, publishing flat fee pricing from $250 per month, with a $400 per month tier, unlimited users and documents, and self setup in ten minutes without a sales call.
The number that actually decides your spend is not the headline anyway. It is the overage term. Ansarada's own pricing FAQ states that exceeding your data plan raises fees for the remainder of the contracted term, that overage is captured at peak usage for the billing period, and that deleting data does not reduce the overage invoice (accessed 2026-08-01). Ask every vendor that question in writing. The [full pricing breakdown](/blog/virtual-data-room-pricing) is in a separate piece.
## What breaks when the checklist, the room, and the signature pages are three systems
Take one agreement through a real deal. It arrives in the room as `Amend_3_FINAL_v2.pdf`. In the diligence memo it is cited as the third amendment to the master services agreement. On the closing checklist it appears as a consent line item under the counterparty's name. In the signature packet it is a loose page with a company name and a blank date.
Four names, one document, four systems, and no shared identifier. Everything downstream inherits that break:
- **You cannot prove coverage.** Asking whether every material contract has been reviewed requires the room's inventory and the review's output to agree on what a document is.
- **Amendments detach from their agreements.** The amendment chain is the single highest value structure in diligence, and it is the first thing lost when documents are renamed on the way between systems.
- **Schedules get rebuilt rather than generated.** A disclosure schedule is a restatement of facts already sitting in the room. When the systems do not share identity, someone retypes them.
- **The checklist lies.** An item marked delivered points at a file nobody can now find in the room.
The fix is not more integrations. It is one system of record for what a document is, from the moment it lands to the moment it appears in the closing set. That principle is the whole argument for running the room and the review together, which we walk through in [taking a data room through to diligence](/blog/data-room-to-diligence-workflow).
## What Mage covers, and what it does not
Mage runs transactional diligence, from the data room to closing. Concretely, the platform connects the data room, surfaces flags, and produces the deliverables the deal needs: memos, schedules, and closing deliverables.
What that covers today:
- **Company overview**, the target summarized up front.
- **Amendment and document linking**, with every amendment, exhibit, and side letter resolved to its family.
- **Cap table tieout**, with every issuance tied to its authorization.
- **Variance detection**, comparing form agreements across the set.
- **Questionnaires and request lists**, generated for the deal and tracked through to answers.
- **Closing checklists**, with deliverables tracked to signature.
- **Disclosure schedules**, generated from the documents, and counterparty markups reviewed with a recommendation for your side.
- **Memos**, whether counsel, committee, or underwriting, drafted from the findings.
What it does not cover, said plainly, because a platform that overclaims into a category it does not serve dies on contact with anyone who has used the real thing:
- **Signature execution.** Mage does not run e-signature, assemble signature packets, or produce the executed closing binder.
- **Pipeline and origination.** Sourcing, target lists, and post merger integration are somebody else's product.
- **A programmatic interface for the diligence platform.** Mage's command line client covers the data room only; the diligence platform has no CLI or API surface.
- **A counterparty portal.** There are no client logins. Client facing confirmations happen the way they already happen, and the answer gets recorded in the system.
The through line is that findings, schedules, and the closing checklist are all derived from the same reviewed set of documents rather than retyped between three tools. For how the review layer itself is evaluated, see our piece on [AI due diligence software for law firms](/blog/legal-ai-tools-for-manda-evaluation-framework), and for the deliverable this all builds toward, the [M&A closing checklist](/blog/manda-closing-checklist).
## How to buy
Run the evaluation in this order and it stays short.
1. **Draw your own lifecycle first.** Write the eight stages above on one page and mark which system owns each one today. Most teams discover they already own four products covering six stages, with two stages owned by a person.
2. **Test the handoff, not the feature.** Every vendor demos its own stage beautifully. Ask to see a document arrive from the previous stage and leave to the next one, with its identity intact.
3. **Check ownership before features.** Consolidation means your three way bake off may be one company.
4. **Get the overage term in writing.** It will move your bill more than the plan you pick.
5. **Separate storing, reading, and tracking.** Buy the best available answer to each, and refuse to pay for a thin version of one bundled into another.
If the stage you are trying to fix is the review layer, and you want to see request lists, disclosure schedules, and a closing checklist derived from the same reviewed document set, [request a walkthrough](https://magelegal.com/?demo=1). More of our work on that side of the deal sits in the [due diligence topic hub](/blog/topics/due-diligence).
## URL: https://magelegal.com/blog/legal-ai-tools-for-manda-evaluation-framework
### Title: AI Due Diligence Software for Law Firms: Five Axes and a Bake-Off You Can Run Yourself
### Author: Raffi Isanians
AI due diligence software reviews the documents in a transaction and produces structured findings that trace back to a passage in a source document: extracted provisions, issue lists, disclosure schedules, and memos. It is a different product from a general legal AI assistant, which answers questions one at a time. That distinction decides most of the purchase, and it is the thing most buyer's guides in this category blur.
Disclosure first: I run Mage, which sells diligence software. Every ranking of this category is written by somebody with a product in it, including this one. The only defense is a method you can run without trusting the author, so most of what follows is a test protocol rather than a leaderboard. If you read nothing else, read the bake-off section and go run it.
## What separates diligence software from a legal AI assistant?
The category splits on one question: does the tool make a claim about the whole document set, or only answer the question you happened to ask?
An assistant is question-shaped. You ask about a provision, it answers, and the session is only as good as your questions. Nothing in it tells you what you did not think to ask. Diligence software is corpus-shaped. It asserts that it looked at every agreement in scope, found every instance of the provision types you specified, and can show you where each came from. The second claim is harder to make and far easier to falsify, which is the point.
Here is how the significant products position themselves, in their own words, read on August 1, 2026.
| Product | How the vendor positions it | What that implies for a diligence buy |
| --- | --- | --- |
| Harvey | AI software for legal and professional services, led by agents that execute legal work end to end, with Vault for bulk document analysis and a transactional workflow for due diligence and contract review | A firm-wide platform with a diligence surface. Compelling if the purchase is one system for the whole firm |
| Kira (Litera) | The number one contract intelligence solution for law firms, built on multi-layered AI combining generative and proprietary models | Structured extraction across large contract portfolios. Litera agreed to acquire Kira in an announcement dated August 10, 2021, so roadmap questions belong to Litera |
| Luminance | Legal-Grade AI and the legal brain of your organization, on a multi-model architecture spanning draft, negotiate, analyze, comply, and investigate | Its stated center of gravity is contract activity across a business rather than deal diligence. Ask specifically about the deal workflow |
| Datasite | The most trusted data room, first with multi-LLM access, offering semantic search, in-room AI with citations, and redaction at scale | Lives where the documents already sit. Scope is the room, an advantage for search and a constraint for deliverables |
| Mage | Transactional diligence covered end to end, from data room to closing, producing disclosure schedules, tabular review, and drafted memos | Ours. Judge it with the protocol below, and note the diligence platform has no command line or API surface |
Two framing points matter more than the table. Funding is not capability: Harvey announced a $200 million round at an $11 billion valuation co-led by GIC and Sequoia, which CNBC dates to March 25, 2026, and Luminance announced a $75 million Series C led by Point72 Private Investments on February 18, 2025, taking its trailing twelve month total above $115 million. Those numbers speak to durability and roadmap velocity, not to recall on your documents.
Neither does adoption. Kira states adoption among 70 percent of the top 50 global law firms, four of the five UK Magic Circle firms, and three of the Big Four accounting firms. Vendor-reported, undated, unaudited, and even at face value a statement about procurement rather than output. For the deeper comparison of the assistant, extraction, and infrastructure paradigms, see [Harvey vs. Kira vs. infrastructure](/blog/harvey-vs-kira-vs-infrastructure-legal-ai).
## The five axes that decide the purchase
Every serious evaluation collapses to five questions. The rest of this guide is how to answer them with evidence instead of impressions.
**Axis 1: accuracy you can check.** Not the accuracy you are told. The only accuracy number worth anything is the one you measured on your own documents, and the only way to measure it is against a set of findings you already trust.
**Axis 2: time to value.** Processing speed rarely differentiates these tools; all of them beat manual review by an order of magnitude. What differs is how long before an associate produces usable output without a support call. A tool that runs in ten minutes and takes three weeks to configure is slower than one that runs in an hour and works on day one.
**Axis 3: security and confidentiality.** Baseline: SOC 2 Type II rather than Type I, encryption in transit and at rest, client data isolation, no training on your documents, and a deletion commitment you can point to in the contract. For sensitive matters, add data residency and audit logging of every access. Ask the training question in writing and accept only an unambiguous answer. More on what to demand is in [SOC 2 and legal AI](/blog/soc2-and-legal-ai-what-ma-lawyers-should-demand).
**Axis 4: setup cost.** Does the tool understand purchase agreements, employment agreements, IP assignments, leases, and credit facilities without you building templates? Who maintains those templates when they exist? A tool requiring a dedicated internal champion carries a headcount cost nobody puts in the business case.
**Axis 5: output quality.** A deliverable or a paragraph? Structured findings feed a schedule, an issue list, or a memo. Narrative summaries get re-read and re-extracted by an associate, which is where tools give back the time they saved. On the tracking side of that question, [M&A transaction management software](/blog/manda-transaction-management-software) covers what belongs in the management layer rather than the review layer.
Four of the five are cheap to test. Security is a document review; setup cost, time to value, and output quality reveal themselves in an afternoon. Accuracy is the expensive one, and it is the one every vendor asks you to take on faith.
## How do you run a bake-off on a deal you already closed?
The trick is to stop evaluating on new work and start evaluating on finished work, because finished work comes with an answer key.
1. **Pick a closed matter with a final work product.** Ideal shape: a completed M&A deal, 100 to 400 documents, where your team produced an issue list or a set of disclosure schedules that a partner signed. Confidentiality first: confirm you can process those documents under your engagement terms and the vendor's data processing agreement, and use a matter where that is clean rather than arguing about a hard one.
2. **Freeze the answer key before you run anything.** Write down the finding set your team actually produced: every change of control provision, every assignment restriction, every exclusivity, every indemnity cap, with the document and section for each. This list is the ground truth, and it must exist on paper before any tool sees the corpus. Freezing it afterward is how evaluations get corrupted.
3. **Load the identical corpus into each tool,** with the same scope and the same provision list. If one tool gets a cleaner set because someone tidied it midway, the comparison is dead. Resist the urge to prompt your favorite well.
4. **Score blind.** Strip the tool names from the outputs before anyone grades them. The person who championed a product will grade it generously without meaning to, and defeating exactly that bias is the point of the exercise.
5. **Time the verification separately from the run.** Stopwatch on how long an associate takes to confirm 20 findings. This is the number that decides whether the tool is worth anything, and it is the one nobody measures.
6. **Have a second associate use each tool cold.** Not the evaluator. Time from login to first useful output is your real onboarding cost.
Budget two to three hours per tool. That is less than a single vendor demo cycle and produces evidence instead of impressions.
## What do you score, and what does failure look like?
| Criterion | How to measure it | What failure looks like |
| --- | --- | --- |
| Recall against the answer key | Frozen findings the tool surfaced, divided by the total | Misses cluster in scans, amendments, and odd drafting. One missed change of control provision is a failing grade, not a rounding error |
| Precision on details | For each hit, check cap, basket, survival, carve-outs | Provision found, numbers wrong, associate re-reads every one anyway |
| Citation verifiability | Click 20 findings at random and time each click-through | The link opens a document rather than a passage, or opens nothing |
| Cost of checking | Stopwatch on verifying those 20 findings | Verification takes as long as the original review. Disqualifying |
| Behavior outside the trained set | Feed it an unusual agreement type deliberately | Confident output on a document type it does not handle, with no signal it is guessing |
| Deliverable readiness | Populate your standard schedule template from the output | Hours of reformatting, which is where the saved time goes back |
The fifth row is the one most evaluations skip. Extraction systems built on trained provision sets behave predictably inside that set and unpredictably outside it. Ask directly whether the system flags a document type as out of scope or answers anyway. A tool that fails loudly is safer than a tool that fails smoothly.
## What does a citation-backed finding actually mean?
It means the software points at the document, the page, and the passage its claim came from, and clicking through lands you on that language.
Anything short of that is not a citation. A document-level reference tells you which of 300 files to read, which is where you started. The standard is functional: can an attorney confirm or reject the finding in seconds without leaving the tool?
This is why an uncited summary is unusable in diligence regardless of how good it is. Not because it is wrong, but because you cannot tell. An unverifiable finding has to be confirmed independently, which means the software produced a to-do list.
Vendor accuracy numbers deserve the same scrutiny. Kira advertises 90 percent accuracy from a hybrid of generative and proprietary models trained on 45,000 lawyer hours, on Litera's Kira product page accessed August 1, 2026. No task definition, corpus description, or scoring rubric accompanies it. That is not a criticism of Kira specifically, because nobody in this category publishes a methodology. It is a reason not to compare any two vendor percentages, and not to let a vendor compare its number against your measured one. The only reproducible number is yours.
Treat review-site scores with the same care. Datasite labels the G2 testimonials embedded on its own diligence page as incentivized, dated September and October 2025. Some of the review volume here is paid for, and a score restated on a vendor's page is not the artifact you think it is.
## Who is responsible when the software misses a change of control provision?
The firm is, and no vendor page will tell you that.
Your obligations run to the client. The vendor's obligations run to you, in a contract that will cap liability at something like the fees you paid, exclude consequential damages, and disclaim any warranty that the output is complete. Read the limitation of liability clause before the feature list. It is the most informative page in the agreement.
That asymmetry is why verifiability is a professional question rather than a preference. You cannot supervise output you cannot check. If a finding cannot be traced to a passage in seconds, the only way to supervise it is to redo the work, and the tool has produced a suggestion rather than a work product. The signature on the memo is yours either way.
One practical consequence: write into your protocol which categories of finding require human confirmation before they reach a client deliverable, and keep the record of that confirmation. The question "how did you satisfy yourself" arrives after the deal, not during it.
## What can you learn about price before you talk to sales?
Very little, which is itself information.
Datasite publishes no price on its diligence product page and routes to a quote request, with a trial offer of up to 90 days, accessed August 1, 2026. Ideals places its MCP connector and API integration add-on under the Enterprise tier of its pricing page with no figure attached, accessed August 1, 2026. That is the shape of the category: a quote gated behind a sales conversation, with feature access tiered.
So use the call for what it is good for. Three questions that produce usable answers:
- What changes when our deal count doubles? Per-matter and per-seat models diverge sharply at volume, and you want to know which cliff you are walking toward.
- What is included versus an add-on? Agent access, API access, and advanced analytics are commonly tiered rather than standard.
- What can we bill through to the client? Whether the cost lands on the firm's P&L or a disbursement line changes the internal politics of the purchase more than the number does.
How to model the return rather than negotiate the price is covered in [the ROI of legal AI for M&A](/blog/roi-of-legal-ai-for-ma).
## What should you pilot first?
Pick the narrowest workflow with the clearest answer key. For most M&A groups that is provision extraction across one deal's material agreements.
Do not pilot an open-ended assistant on a live matter. There is nothing to score it against, so the result is a collection of anecdotes and the loudest one wins. Do not pilot on a deal that is on fire either, because everyone will grade the tool on whether the week went well.
Start upstream of review if you can. Getting the documents into one place, typed, organized, indexed, and gap-checked is a mechanical problem with visible right answers, and it determines whether review starts on day one or day nine. Our data room is a separate product from our diligence platform: it is self-serve and free for a limited time, so that half can be tested without procurement. The diligence platform is a conversation, like everyone else's here. What the handoff into review looks like is in [from data room to diligence workflow](/blog/data-room-to-diligence-workflow).
When you are ready to test the review layer, the protocol above is the whole ask: one closed deal, one frozen answer key, blind scoring, and a stopwatch on verification. We are happy to be measured that way and will run it on your documents, which you can start from [a conversation with us](/?demo=1). More of our writing on evaluating these tools, including [how attorneys should evaluate LLM-powered tools](/blog/how-attorneys-should-evaluate-llm-powered-tools), sits in the [due diligence topic hub](/blog/topics/due-diligence).
## URL: https://magelegal.com/blog/data-room-to-diligence-workflow
### Title: From Data Room to Diligence Memo: Closing the Gap Between Storage and Analysis
### Author: Raffi Isanians
Every deal has two workflows that people talk about as if they were one. The first is storage: documents arrive, get filed, get indexed, get shared with the other side. The second is analysis: those documents get read, terms get pulled out, issues get assembled, and a memo gets drafted that a partner will put a name on. Data room software is built for the first workflow. Almost nothing is built for the second, and nothing at all is built for the seam between them.
That seam is where findings die. Not in the room, which usually has the documents, and not in the memo, which usually reads well. In the translation layer between them, which on most deals is a spreadsheet, a shared inbox and three associates who each hold a piece of the picture.
Here is a precise account of what that layer does, why it fails, and what has to be true before you can call the output defensible.
## Why the room and the deal disagree about structure
A data room is organized by document type. Corporate, commercial, employment, IP, real estate, litigation. That structure is correct for the seller, correct for the index, and correct for controlling access, because permissions are naturally scoped to folders.
A deal is decided by issue. Whether the buyer inherits the customer base. Whether the option pool clears. Whether one counterparty can walk on a change of control. Whether the environmental exposure is capped.
Those two structures do not map onto each other. A single change of control provision in one customer agreement touches the commercial workstream, the corporate workstream, the financing condition and the disclosure schedule. It lives in exactly one folder, and it will be read by exactly one person, whose job that week is to summarize commercial contracts.
Every deal pays for the translation between those structures. The only question is whether you pay for it deliberately, with a process, or accidentally, in review hours and missed items. Our [step-by-step guide to virtual data room management](/blog/workflow-virtual-data-room-management) covers the storage half properly. This piece is about the other side of the wall.
## What actually happens between upload and memo
Written out, the handoff has six stages, and only the first is a software product.
| Stage | The question it answers | What done looks like | Where it breaks |
| --- | --- | --- | --- |
| Inventory | What is in the room? | Every document typed, numbered and located | Documents keep arriving after the count is taken |
| Reconciliation | What did we ask for that is not here? | Every request list line mapped to documents or marked open | The list is reconciled once, at the end |
| Extraction | What does each document actually say? | The deal-relevant terms pulled per document, with citations | Under resourced and pushed to the most junior reviewer |
| Coverage | Who reviewed what, and when? | A per document record of reviewer, date, conclusion | Kept in a spreadsheet keyed to numbers that drift |
| Assembly | Which facts combine into an issue? | Findings grouped by issue, not by folder | Nobody owns cross-workstream assembly |
| Deliverable | What do we tell the client? | Memo, schedules, escalations, all traceable to source | Prose gets polished, provenance gets dropped |
Notice that the failure column has almost nothing to do with document storage. Every one of those breaks happens after the room has done its job perfectly.
## Why findings get missed when every document was in the room
Three mechanisms account for most of it, and none is exotic.
**Siloed workstreams.** Review is divided by subject matter because that is how expertise is organized. Cross-functional risk is therefore assembled by nobody, because assembly is nobody's assigned lane. The facts are all in the file. The conclusion is not in anyone's head.
**Extraction is under resourced relative to analysis.** Reading four hundred contracts is expensive and unglamorous, so it goes to the most junior person available, often one who has never seen this deal type. Analysis then gets done by a senior lawyer working from that person's summary, which means the senior judgment is applied to a filtered view of the record. Bad extraction is invisible downstream. It does not look like an error, it looks like a shorter list.
**Traceability, not omission.** The common failure is not a missing paragraph. It is that six weeks later nobody can say which version of the document was reviewed, by whom, or whether the reviewer saw the amendment that landed on a Friday. Gaps cluster in predictable places: change of control, pending litigation, environmental liability. Those are exactly the issues where the answer depends on assembling several documents, and where an amendment quietly reverses the answer.
## What is a diligence gap analysis, and who produces it?
A gap analysis is the reconciliation between the request list and the room, item by item, with a status per item and a named next action. It is the only artifact in the process that describes what you do not have, which makes it the one the client needs most and the one that gets updated least.
It has three honest statuses, not two:
- **Present.** Delivered and identified. Nothing further needed.
- **Partial.** Something arrived against the item, but the item is not covered. This is the status that gets rounded up to present under deadline pressure, and it is where the real risk sits.
- **Missing.** Nothing arrived. The value here is not the fact of absence, it is the escalation it triggers.
Anyone can produce the first pass. What makes it a control rather than a status report is the reconciliation cadence. If you generate it at kickoff and again the week before signing, you have a document. If it is regenerated every time the room changes, you have a control. Our [due diligence data room checklist](/blog/due-diligence-data-room-checklist) covers the item level in detail.
## Why the request list stops matching the room within two weeks
Because the two artifacts have different owners and different clocks.
The request list is a negotiated document. It gets numbered, sent, discussed on calls, amended by email, and split into supplemental rounds. The room is an operational system that changes every time somebody uploads a folder. Within a fortnight, the room has documents that answer requests nobody has closed out, requests that were superseded on a call and never struck, and documents filed under a heading that matches no request at all.
The manual fix is a weekly reconciliation meeting, which works and costs an hour of four people's time every week. The structural fix is to key the reconciliation to something stable. Not a folder name, which gets renamed. Not a file name, which gets versioned. A durable identifier that survives reorganization, so that when a document moves, its link to the request line moves with it.
The same problem applies to Q&A threads, and it is worse there because the answers carry legal weight. An answer given in a Q&A module is a statement by the seller about the business, and it will be read later as part of the disclosure record whether or not anyone planned for that. Treat every substantive answer as a document: attach it to the request line it answers and to the finding it changes, on the day it arrives. A Q&A thread that lives only inside the room's messaging tab is evidence nobody exported.
This is the same discipline that [M&A transaction management software](/blog/manda-transaction-management-software) tries to impose across the whole deal calendar, applied to the artifacts that govern whether diligence is finished.
## How do you track coverage, and what counts as covered?
Coverage is the metric this whole process should be judged on, and most teams cannot report it.
Coverage means being able to answer four questions for every document in the room: was it reviewed, by whom, when, and what was concluded. Not "did the team review the customer contracts folder". Per document, or it is an estimate dressed up as a fact.
Two failure patterns are near universal. The first is coverage kept in a spreadsheet keyed to index numbers, which works until the room is re-indexed and every key silently points somewhere new. The second is documents added mid review that never enter the coverage denominator, so the tracker reads one hundred percent against a set that stopped being the room three weeks ago.
The test is simple. Ask for a list of every document in the room that no named reviewer has ever opened. If that list cannot be produced in a few minutes, coverage is not being tracked, it is being assumed.
## What makes a finding defensible six months later?
When a deal goes wrong, nobody reads the memo prose. They read the record behind it. A finding survives that reading when it carries four things:
1. **A citation you can open.** Not a document name, not a folder reference. A pointer to the passage, resolvable to the exact source a reader can put on screen.
2. **A named reviewer.** Someone made the judgment. Anonymous findings cannot be tested and cannot be defended.
3. **A date.** Findings are made against a state of knowledge. Without a timestamp there is no way to distinguish what was knowable from what was known.
4. **A status.** Open, resolved, escalated or accepted, and if accepted, by whom. An issue nobody closed is different from an issue the client chose to live with, and only the record can tell them apart.
Write those four requirements down and most diligence processes fail on two of them. That is not a tooling problem in the first instance. It is a process that never decided the record was a deliverable.
## Where the room can carry part of the load
Some of this genuinely belongs to software, and the storage layer has been moving into the analysis layer for the last two years. Datasite's diligence page, accessed 2026-08-01, describes semantic search and in-room AI with citations powered by Blueflame, and states that Claude, ChatGPT or Microsoft Copilot can connect through MCP. Datasite also publishes an agent skills repository whose stated skills include VDR index setup, gap analysis and information request list tracking, with Claude Code named as a supported host. DealRoom positions itself as an operating system for buyer-led M&A spanning pipeline, diligence, data room and integration, with AI for diligence sold as a paid add-on. Ansarada describes its Q&A capability as a painstaking process now made easy, accessed 2026-08-01, which is a fair description of the problem even in a vendor's own words.
[Mage Data Room](/dataroom) sits on the same side of the wall, and here is exactly what it does at the seam. Every document that lands is typed automatically and given a short factual summary, and the classifier's label space is the coverage checklist itself, so the Type column and the checklist agree rather than drifting. Every filed document takes a stable dotted index number stored on the document rather than recomputed on read, which is precisely the property a coverage tracker needs. A detection pass links amendments, exhibits and side letters to the agreement they belong to. Every room carries a readiness checklist that reports present, partial, missing or not applicable per item against the room's actual inventory, and that checklist is readable and writable by an API key, so an agent can read what is missing and attach what it uploads. Document requests let you ask a teammate for what is missing. The room is free for a limited time, and Mage is SOC 2 Type II certified.
What it does not do is diligence. There is no button that turns a room into a diligence workspace, and treating the checklist as a substitute for legal review would be a category error. The separate diligence platform is where Mage claims the analysis half, publicly describing amendment and document linking across families, cap table tie out, variance detection across form agreements, request lists tracked to answers, and closing checklists tracked to signature. Choosing between tools at that layer is its own exercise, and we set out the criteria in our guide to [AI due diligence software for law firms](/blog/legal-ai-tools-for-manda-evaluation-framework).
## What still needs a human
Two things, and they are the two that matter.
**Materiality.** A machine can tell you that a contract contains a change of control provision requiring consent. Whether that provision is material to this buyer, at this price, with this financing structure, is a judgment about the deal and not about the document. Nothing in the record answers it.
**Escalation.** Deciding that a finding must reach the client today, rather than appearing in Thursday's memo, is a professional judgment with consequences. It depends on knowing what the client is exposed to and what they have already accepted.
Everything upstream of those two, inventory, typing, linking, gap detection, coverage bookkeeping, is clerical work that consumes the majority of the hours and produces none of the judgment. That is the honest case for automating the seam: not that software gets better at law, but that the attorney's attention stops being spent on bookkeeping.
The compounding effect is why this cluster matters. A room that already knows what it contains, what is missing and what links to what hands the analysis layer a clean starting position instead of forty thousand undifferentiated pages. For more on the storage side, see our [data room coverage](/blog/topics/data-rooms), and for the analysis side, our [due diligence coverage](/blog/topics/due-diligence).
## URL: https://magelegal.com/blog/manda-closing-checklist
### Title: The M&A Closing Checklist: From Signing to Close Without Dropped Signature Pages
### Author: Mage Team
Closings rarely fail on the merits. They slip because a signature page was executed against a draft that changed the next morning, because an ancillary agreement had no owner, or because a condition precedent everyone believed was satisfied cannot be evidenced by anyone. The M&A closing checklist is the control for all three: one list of every deliverable and action required to close, each with a named owner, a status, the condition it satisfies, and the location of the executed original.
Most published checklists are adequate as lists. What they omit is the operational reality that makes the list hard to run: it is a shared artifact across four firms with no shared source of truth, and every failure below is a version-control failure wearing a different hat.
## What actually goes on the checklist
A working checklist has more columns than a template checklist. The standard set is an item number, the document or action, the responsible party, draft or final status, and comments. That set is where most drift starts, because "responsible party" is usually filled in with a firm name.
| Column | What it holds | The failure it prevents |
| --- | --- | --- |
| Item number | Stable identifier, referenced on the closing call | Two people editing rows that no longer align |
| Document or action | Deliverable, or an action such as a wire or a filing | Actions falling off a document-only list |
| Owner | One named person with an email address | Firm-level assignment that four people each assume someone else picked up |
| Signatories | Every entity and individual signing that instrument | A subsidiary officer discovered on the closing call |
| Execution version | Version id of the frozen copy pages were generated from | Pages signed against a superseded draft |
| Status | Draft, final, circulated, executed, held in escrow, released | "Signed" meaning three different things |
| Condition satisfied | The agreement section this item discharges | Items with no source and conditions with no item |
| Evidence location | Where the executed original and any proof is filed | A CP marked satisfied that nobody can document |
Two structural rules matter more than the column list. First, split the list into pre-closing deliverables, deliverables at closing, and post-closing obligations, and hand the third to whoever owns integration rather than letting it decay at the bottom of the closing list. Second, every row must trace to a section of the agreement or to a diligence finding. A row that traces to nothing is a template artifact and should be deleted, because unexplained rows are what make a checklist stop being read.
## Signing and closing are two events, and the gap is where the work lives
Signing is execution of the purchase agreement. Closing is the transfer and the payment. In a simple deal they happen the same afternoon. In any deal with regulatory clearance, third-party consents, or financing, weeks or months separate them.
That gap is governed by the interim covenants and the closing conditions, and it has its own discipline that this article deliberately does not restate. Our piece on [interim covenants and compliance monitoring between signing and closing](/blog/signing-to-closing-interim-covenants) covers conduct-of-business restrictions, consent thresholds, and monitoring. The closing checklist is a different artifact: it is the deliverables list, and its job is to make sure that when the conditions are met, the paper is ready the same day.
The gap does add rows of its own. A deal that signs and closes apart typically requires a bring-down certificate confirming the representations remain true at closing, updated disclosure schedules if the agreement permits or requires them, an officer's certificate on covenant compliance, and evidence for each consent or approval obtained during the interim period. Put those rows on the checklist at signing rather than at closing. They are the rows most likely to be drafted twice, once from the template and once from the agreement, and reconciling two versions of a bring-down at 9pm on the closing eve is avoidable work.
## The three failures worth designing against
**A page executed against a version that changed.** Ancillaries get executed in advance. A schedule is revised, an exhibit is swapped, a defined term moves, and the pages already in escrow now attach to a document that no longer exists in that form. This is the defect most often discovered weeks later during closing set assembly, when someone tries to match a signature page to a final document and cannot.
The control is a version id. Freeze the execution copy, record its id in the checklist row, and generate pages only from that version. If the document changes after circulation, the version increments and every outstanding page for it is void. This is a two-word column that eliminates an entire category of defect.
**An ancillary with no owner.** Assignment agreements, IP assignments, employment and non-compete agreements, officer and secretary certificates, resignations, payoff letters, lien releases, escrow agreements, transition services agreements. On a mid-market deal that is thirty to eighty documents, and the ones assigned to a firm rather than a person are the ones that arrive at 11pm the night before.
The control is the owner column, populated with a human. When a firm is responsible, name the associate. Nobody has ever failed to notice their own name on a list.
**A condition precedent satisfied by assertion.** Someone confirms on the call that the landlord consent came through. Nobody files it. Six months later, a post-closing dispute or an audit asks for the consent and it is in a thread nobody can find.
The control is the evidence rule: a CP is satisfied when a document exists and is filed at a recorded location, not when a person says it is. Consents, payoff letters, lien releases, regulatory approvals, and officer certificates are all documents. Run the evidence column with the same rigor as the status column and the closing set assembles itself.
| Failure | Control | Where it lives |
| --- | --- | --- |
| Page signed against a stale draft | Frozen execution version with a version id | Checklist column, enforced at circulation |
| Ancillary nobody prepared | One named human owner per row | Checklist column, enforced at kickoff |
| CP satisfied by assertion | Evidence document plus filed location | Checklist column, enforced on the closing call |
## The signature page escrow and release protocol
Practitioners search for this procedure and free templates omit it. Written as steps:
1. **Freeze the execution version.** Circulate the final document with a version id. Record that id on the checklist row.
2. **Generate pages from that version only.** Signature pages carry the document name and the version they belong to.
3. **Package by signatory.** Each signer receives one bundle covering every instrument they execute, rather than a separate email per document. Track receipt per signatory per document.
4. **Deliver into escrow with a written instruction.** Executed pages go to one named holder, typically one side's counsel, under an instruction that they are held in escrow, undated, and not to be released until the holder receives release authorization from each party. The instruction should be in the transmittal email, not assumed.
5. **Confirm every condition on the closing call.** Walk the checklist. Each CP is either evidenced or waived in writing. A waiver decided verbally gets papered before release.
6. **Take release authorization from each party, then paper it.** The call is where authorization is given; the confirming email is where it exists afterward. Send it the same hour, naming the documents released and the effective date.
7. **Date and assemble.** Pages are dated per the release, attached to their frozen versions, and the executed originals are filed to the location recorded in the checklist.
Step 6 is the one teams skip. A closing call generates no record of itself. If the only evidence that release was authorized is four lawyers' recollection, you have re-created the CP problem at the last step.
## Who owns the checklist across four firms?
One firm, usually buyer's counsel, and one associate at that firm. Shared editing across firms produces divergent copies within a week; the alternative that actually works is a single owner who publishes a versioned copy on a fixed cadence, daily in the last week, with a version stamp and a changed-rows summary at the top.
The cadence matters as much as the ownership. A checklist circulated only when someone asks for it is a checklist people stop reading, and the moment two firms are working from different copies, the item numbers stop referring to the same rows and the closing call becomes a reconciliation exercise. Publish on a schedule everyone knows, keep the item numbers stable even when rows are added, and put new and changed rows at the top of the email rather than expecting anyone to diff a spreadsheet.
The reason this is hard is structural. The checklist is the one artifact every firm needs and no firm's system holds. Deal documents live in the data room, correspondence lives in email, and the checklist lives in a spreadsheet that is emailed. Every mismatch between those three is a place where drift enters. The broader tooling question is covered in our review of [M&A transaction management software](/blog/manda-transaction-management-software), and the upstream half of the problem, moving from a document set to a reviewed record, is covered in the [data room to diligence workflow](/blog/data-room-to-diligence-workflow).
## What goes in the closing set, and when is it due?
The closing set, or closing binder, is the assembled record of the transaction. It contains the executed purchase agreement with its exhibits and disclosure schedules as executed, every ancillary agreement, officer and secretary certificates with the charter documents and resolutions they certify, good standing certificates, third-party consents, payoff letters and lien releases, regulatory approvals and filings, escrow and paying agent documents, wire confirmations, resignations, and the closing checklist itself, which serves as the table of contents.
Target 30 to 60 days after closing. The argument for the short end is memory rather than diligence: assembling a set six months later means reconstructing which of four near-identical PDFs is the executed version, and that is the exact work the checklist existed to prevent.
## Which tools help, and which do not
Be honest about this, because the category is narrow and well served.
Dedicated closing management software solves two specific problems well: identifying and assembling signature pages across a large document set, and compiling the closing binder with a linked index. If your deals routinely run past forty signature pages, that software pays for itself, and it is the right purchase for that job.
Mage does not do that. It does not assemble signature pages and it does not compile binders, and any article that told you otherwise would be selling you something.
Mage's contribution is upstream, where the checklist comes from. A closing checklist built from a template inherits someone else's deal. A closing checklist built from the reviewed diligence record inherits yours: the change-of-control provision found in a customer contract becomes a consent row, the lien found in a UCC search becomes a release row, the option grant that failed to tie to its authorization becomes a corrective consent row. Each item traces back to the document that created it.
That is the work Mage's diligence platform does. It runs transactional diligence from data room to closing, generating request lists and questionnaires for the deal and tracking them to answers, producing disclosure schedules from the documents, resolving every amendment, exhibit, and side letter to the agreement it belongs to, and carrying closing checklists whose deliverables are tracked to signature. The output is a checklist where every row has a source, which is the only version of the list that stays trusted through week six.
If that is the half of the problem you have, [request a walkthrough](https://magelegal.com/?demo=1). If you want the surrounding material first, the [due diligence topic hub](/blog/topics/due-diligence) indexes the rest of the deal-process cluster.
## URL: https://magelegal.com/docs/cli
### Title: Mage Data Room CLI Documentation
### Author: Mage Team
# Mage CLI
Upload and organize a [Mage](https://magelegal.com) data room from your terminal, or from an AI agent.
Built for founders running diligence who want to populate a data room fast, and for the agents they hand the job to. Point it at a folder; it mirrors the structure into your room.
```bash
npx @magelegal/cli upload ./diligence --to "Corporate"
```
## Install
Run it on demand with `npx` (no install):
```bash
npx @magelegal/cli
```
Or install the `mage` binary globally:
```bash
npm install -g @magelegal/cli
mage --help
```
Requires Node.js 20 or newer.
## Authentication
Sign in with your Mage account — no key to copy:
```bash
mage login
```
Your browser opens, you confirm a short code, and you're in. The CLI then picks a room (or asks, if your organization has several — brand-new account? it offers to create your first room right there) and **mints its own room-scoped API key** — named `CLI — `, visible under **Settings → API keys** like any other key. That key is what every command runs on from then on, so the login **never expires**; it works until you revoke it (`mage logout`, or delete it in Settings → API keys).
Over SSH (or with `--no-browser`) the CLI prints the approval URL instead of opening a browser — visit it from any device, your phone included.
Everything is stored at `~/.config/mage/config.json`, readable only by you (`0600`).
Browser login needs an **owner or admin** of the room (it mints a key). A room member can use a key an admin minted for them, below.
### Using an existing key
Have a key from **Settings → API keys**? Store it directly:
```bash
mage login sk_… # or: mage login --with-key (hidden prompt, stays out of shell history)
```
### Headless / agent use
Set `MAGE_API_KEY` and skip `login` entirely. This is the path for AI agents and CI:
```bash
export MAGE_API_KEY="sk_…"
mage upload ./data-room
```
The CLI discovers which room the key belongs to on first use, so the key is all an agent needs.
| Variable | Purpose |
| --- | --- |
| `MAGE_API_KEY` | Room-scoped API key (overrides any stored login) |
| `MAGE_API_URL` | Override the API base URL (default `https://api-dataroom.magelegal.com`) |
| `MAGE_ROOM_ID` | Pin the room id (otherwise resolved from the key) |
| `MAGE_OAUTH_CLIENT_ID` | Override the OAuth client id (rare — it is discovered from the API) |
## Commands
| Command | Description |
| --- | --- |
| `mage login [key] [--room ] [--no-browser]` | Sign in via your browser (or store an API key) and bind this machine to a room |
| `mage logout` | Sign out: revoke the CLI's key where possible and clear this machine |
| `mage rooms` | List your organization's data rooms (browser login) |
| `mage use ` | Switch which room this machine is bound to (browser login) |
| `mage upload [--to ] [--for-item ]` | Upload files or whole folders, mirroring their structure |
| `mage readiness` | Show the room's readiness checklist: what's present, partial, and missing |
| `mage readiness attach ` | Attach already-uploaded documents to a checklist item |
| `mage ls [folder]` | List the room's documents, grouped by folder |
| `mage download [target] [dest]` | Download the room, a folder, or one document, mirroring the folder structure |
| `mage mkdir ` | Create an empty folder |
| `mage rm [--folder] [--yes]` | Delete a document, or a folder with `--folder` |
| `mage version` | Print the CLI version |
Global flags: `--json` (machine-readable output on stdout) and `--api-url `.
Every command above belongs to the **data room** product (`mage --help` groups them under "Data room"). Mage's diligence platform has no CLI surface yet; when it does, its commands will arrive as their own group rather than mixing in.
### Upload
A file lands in the folder you choose with `--to`; a directory mirrors its contents beneath it.
```bash
# One file into a folder (the folder is created if needed)
mage upload term-sheet.pdf --to "Financing"
# A whole tree: ./diligence/Corporate/charter.pdf → Corporate/charter.pdf
mage upload ./diligence
# The same tree, nested under a top-level folder
mage upload ./diligence --to "01-Diligence"
```
Uploads run in parallel. Dotfiles (`.DS_Store`, `.git`, …) are skipped. Files begin processing on arrival; `mage ls` shows their status.
### Readiness
Every room carries a readiness checklist — the documents investors expect to find, each `present`, `partial`, or `missing`. The CLI reads and fills it:
```bash
mage readiness # the checklist, with what's still missing
mage readiness --json # the same, structured for an agent
# Upload and satisfy a checklist item in one step
mage upload 2025-tax-return.pdf --for-item tax-returns
# Or link documents that are already in the room
mage readiness attach fin-statements q1.pdf q2.pdf
```
`--for-item` uploads the files, then attaches every one that landed to the item. `attach` accepts a document id, a name, or `folder/name`, and is additive — documents already attached to the item stay attached.
### List
```bash
mage ls # the whole room, grouped by folder
mage ls "Corporate" # one folder and its subfolders
mage ls --json # raw document array for scripting
```
### Download
```bash
mage download # the whole room → .//
mage download . ./backup # the whole room → ./backup/
mage download "Corporate" ./corp # one folder (recursive) → ./corp/
mage download "Corporate/charter.pdf" # a single document, by folder/name (or by id)
mage download --json # machine-readable results for scripting
```
Folder structure is mirrored locally, files download five at a time, and every
file lands on the room's access-audit trail. Downloading requires a key minted
with the **Download** permission — keys minted by `mage login` include it.
Keys created before permissions existed are upload/organize-only: re-mint the
key (or run `mage login` again) to download.
### Delete
```bash
mage rm "Corporate/charter.pdf" # a document, by folder/name (or by id)
mage rm "Drafts" --folder # a folder (its documents move to Unsorted, never deleted)
mage rm "old.pdf" --yes # skip the confirmation prompt
```
`rm` asks for confirmation interactively. In a non-interactive shell (an agent or CI), pass `--yes` to proceed.
## Using it with an AI agent
This is what the CLI is really for. Getting every document into a data room is the slowest part of running diligence — hand your agent a key and it does the gathering for you: it reads what the room still needs, pulls the documents from wherever they live (your accounting system, your drive, your inbox), and uploads each one against the right checklist item.
```bash
export MAGE_API_KEY="sk_…" # the key is all an agent needs — it discovers its room
```
The loop:
```bash
# 1. Read what's missing.
mage readiness --json
# → items with status "missing", each with an itemId, a label,
# and a founderHint describing what the item should contain
# 2. Gather the documents from wherever they live (the agent's own tools).
# 3. Upload each against its item — one step, upload + attach.
mage upload ./downloads/2025-tax-return.pdf --for-item tax-returns
# 4. Re-read to confirm, and repeat until nothing required is missing.
mage readiness --json
```
An example task to give an agent: *"Pull last year's tax return from our accounting system and satisfy the missing tax items in my Mage data room readiness checklist."*
Beyond readiness, the same key drives the whole room: `mage ls --json` to read the current state, `mage mkdir` to lay out structure, `mage upload ./exports --to "Corporate"` to mirror local files in. Every command speaks `--json`, so an agent can read structured results and decide what to do next.
### As an MCP server
`mage mcp` runs the same surface as a [Model Context Protocol](https://modelcontextprotocol.io) server over stdio, so MCP clients (Claude, Cursor, agent frameworks) can operate the room natively instead of shelling out:
```json
{
"mcpServers": {
"mage-dataroom": {
"command": "npx",
"args": ["-y", "@magelegal/cli", "mcp"],
"env": { "MAGE_API_KEY": "sk_…" }
}
}
}
```
Tools: `list_documents`, `upload_documents` (files or whole directories, optionally attached to a checklist item), `get_readiness`, `attach_to_checklist_item`, `create_folder`, and `download_document` (needs the Download permission). Deletion is deliberately not exposed — an agent fills, organizes, and reads a room; removing deal documents stays a human decision.
## What a key can and cannot do
A room-scoped key acts in **its own room only** and carries the permission set chosen when it was minted — visible under **Settings → API keys**. Keys minted by `mage login` can read the room's document list, upload, manage folders, delete documents, download document files, and read and fill the readiness checklist. A key minted without the **Download** permission cannot fetch document contents; one minted without **Manage room** (the default) cannot change room settings, people, or sharing. No key can reach another room or delete the room itself. Permissions are fixed at mint — re-mint to change them — and revoking a key under **Settings → API keys** kills it everywhere instantly. Keys created before permissions existed act as upload/organize-only.
Only `mage rooms` and `mage use` act as *you* rather than as the key (they list your org's rooms and mint the key for a newly chosen room); they reuse your browser sign-in and re-ask for approval when it has lapsed.
## Development
```bash
bun install
bun test # unit tests
bun run typecheck
bun run build # bundles to dist/index.js
```
The CLI is a thin client over the Mage lite data-room API; all document processing happens server-side.
## License
MIT