Data Room Checklist
Standard request list for every target before LOI. Seller must provide or justify absence.
1. Corporate
- Certificate of incorporation / Czech trade register excerpt
- Articles of association (current)
- Cap table with UBO disclosure
- All subsidiaries and related entities
- Board resolutions for last 3 years
2. Financial
- Audited financials last 3 years (P&L, balance sheet, cash flow)
- Monthly management accounts last 24 months
- Bank statements last 12 months (all accounts)
- Tax filings last 3 years
- Revenue breakdown by product / geography / payment method
- Subscription metrics: MRR, ARR, churn, ARPU, LTV, CAC
- Cohort retention curves
3. Commercial
- User count: total / active / paying (MAU, DAU, WAU)
- Top 10 affiliate / traffic partners with volume
- Marketing spend by channel last 24 months
- CAC by channel
- SEO: top keywords, organic traffic trend
- Content library size (UGC counts, upload rate)
4. Payment Processing
- Current merchant account(s) and contracts
- Chargeback ratio last 24 months
- Reserves held and release schedule
- History of account terminations / reviews
- Backup processor documentation
5. Legal & Compliance
- GDPR documentation (DPA, DPIAs, breach log)
- DSA compliance evidence (moderator count, transparency report)
- 2257 recordkeeping (if US exposure)
- DMCA designated agent registration
- Content moderation policy + SLA
- CSAM scanning tool contract (PhotoDNA or equivalent)
- Pending litigation (3-year history)
- Law enforcement requests log
6. Technical
- Architecture diagram
- Tech stack inventory
- Hosting contracts (AWS/Hetzner/etc.)
- Security audit reports / pentests
- ISO 27001 / SOC 2 if applicable
- Incident history last 24 months
- Source code escrow arrangements
7. HR
- Headcount and org chart
- Key person list and compensation
- Employment contracts (standard + key people)
- Contractor agreements
- Non-compete / non-solicit in place?
8. IP
- Trademark registrations (domain + brand)
- Domain names with registrar + expiry
- Code ownership (no open-source contamination)
- Third-party licenses