A deal-grade data room audit log records every view, download, permission change, invitation and failed access attempt, each tied to a named user, a timestamp and a document version, and it exports cleanly to CSV and PDF. Counsel relies on that export at signing and closing to show what was disclosed, to whom and when.
We have already covered why audit trails matter in a secure data room. This guide is the practical follow-up: which events and fields make a log defensible, which export formats to ask for, what lawyers and buyers request at each milestone, how the log supports disclosure evidence, and how long to keep it once the deal is done.
Best overall: Read the Papermark review
Papermark is best for deal teams that need audit logs and page-level analytics alongside NDA gating and granular permissions in one secure data room. The Data Rooms plan is $99/month on annual billing with unlimited data rooms and visitors.
What a deal-grade data room audit log records
A basic activity feed shows who logged in and which files were popular. A deal-grade log goes further: it captures every event that could matter if disclosure, confidentiality or the fairness of the process is questioned later.
| Event | What to capture | Why counsel cares |
|---|---|---|
| Document view | User, document, version, time opened, pages viewed where tracked | Shows a party had the document in front of them, not just access to it |
| Download or print | User, document, version, time, format | Identifies copies that left the room |
| Upload, replace or delete | Administrator, document, old and new version, time | Establishes when each version first became available |
| Permission change | Administrator, group or user affected, before and after, time | Proves which parties could see which folders on a given date |
| Invitation and revocation | Who invited whom, to which group, and when access ended | Reconstructs the full population of reviewers |
| NDA acceptance | User, agreement version, time | Ties access to confidentiality terms |
| Failed access | Failed logins, blocked attempts to open restricted files, expired links | Flags credential sharing, probing or misconfigured permissions |
| Q&A activity | Question, answer, who asked, who answered, time | Questions and answers often form part of the disclosure record |
Fields that make a secure audit log defensible
A log is only as useful as the questions it can answer under pressure. Two properties matter more than any dashboard: completeness and integrity. Completeness means every relevant action is captured with enough context to stand on its own. Integrity means entries cannot be edited or deleted, including by room administrators. NIST's guide to log management, SP 800-92, treats protecting logs from tampering as a core requirement, and the same logic applies to a deal record.
Ask the vendor directly whether any user, including your own admins and the vendor's support staff, can alter or remove entries. The right answer is no.
- A unique, named user identity for every event, never a shared login
- Timestamps from synchronized clocks, in UTC or with an explicit time zone
- A stable document identifier, the folder path and the version number
- The actor for every administrative change, not just the affected user
- The permission group the user belonged to at the time of the event
- IP address or device details where the platform captures them
- Append-only storage: entries cannot be edited or deleted by any role
Data room audit log export formats
An audit log that cannot leave the platform is a weak record. You will need to hand it to counsel, attach it to a closing archive and sometimes analyze it in a spreadsheet. Ask which formats are available, whether exports can be filtered by date, user, group and folder, and whether large exports complete without truncation.
| Format | Best for | Watch out for |
|---|---|---|
| CSV or XLSX | Filtering and analysis by counsel, advisors or a forensic reviewer | Time zone handling and row limits on very large rooms |
| PDF report | A human-readable record for the closing set or a board file | Summaries that drop event-level detail |
| API or JSON feed | Feeding a security monitoring tool or a firm's own records system | Often a higher-tier feature; check plan and rate limits |
| Full room archive | A frozen copy of documents and index at a cut-off date | Confirm whether the archive includes the log or only the files |
What counsel and buyers request at signing and closing
Requests cluster around two milestones. Before signing, both sides want to fix what has been disclosed. After closing, both want a permanent record that cannot drift.
Buyers and their counsel often ask for the archive and log as a closing deliverable, because the purchase agreement may refer to documents 'made available in the data room'. Agree the format, the cut-off time and who holds the archive early. Arguing about it the night before signing is avoidable.
- At signing: a data room index frozen at an agreed cut-off date and time
- At signing: the date each document was first made available, taken from upload events
- At signing: confirmation of which buyer users had access to each folder at the cut-off
- At signing: the Q&A log with answers given up to the cut-off
- At closing: an archive of documents as they stood at signing, plus any agreed later uploads
- At closing: a complete audit log export covering the whole process
- At closing: NDA acceptance records for every reviewer
- After closing: confirmation that buyer access has been revoked, with the date
Using the audit log as disclosure-letter evidence
In many share and asset purchase agreements, the seller qualifies its warranties by disclosure. English-law style deals do this in a disclosure letter; US-style deals use disclosure schedules. The parties often negotiate whether the contents of the data room count as disclosed, and to what standard, commonly expressed as 'fairly disclosed' with enough detail to identify the nature and scope of the matter.
Where data room contents are deemed disclosed, the audit log becomes evidence. The seller wants to show that a document was in the room, in a specific version, before the cut-off. The buyer wants a late upload the night before signing to be visible as exactly that. Upload and version events answer both questions. View events show whether the buyer's team actually opened the document.
Be clear about what the log proves. It shows availability and access: a file was there, and a named person opened it on a date, with page-level detail where the platform tracks it. It does not show that the reader understood it. Whether a matter was fairly disclosed is a legal question, and the log is one input alongside the archive and the disclosure letter itself.
A hypothetical scenario: Calder Tooling closes with a clean audit record
Calder Tooling is a hypothetical, family-owned precision machining business with two plants, being sold to a private equity-backed buyer. The purchase agreement deems documents in the data room disclosed against the warranties, provided they were uploaded before an agreed cut-off at 5pm two days before signing.
Three days before the cut-off, Calder's finance director uploads a revised environmental report for one plant. The buyer's counsel asks for proof of when the new version appeared and whether their environmental consultant opened it. Calder's advisor filters the audit log by document and exports a CSV showing the upload time, the replaced version and two view events from the consultant's named account, with page-level detail.
At the cut-off, the advisor exports the full log and a frozen archive of the room, and counsel on both sides receive a copy. After closing, the advisor revokes all buyer access, exports a final log showing the revocations and stores everything with the closing archive.
Eighteen months later, the buyer raises a warranty question about the same plant. Calder's counsel produces the archive and the log. The dispute quickly narrows to the substance of the report rather than whether it was ever provided, which is the outcome a clean audit record is designed to produce.
Audit log retention after a secure deal closes
The log matters most after the room is closed. Warranty claims, indemnity claims and confidentiality disputes can surface long after completion, and the audit log is often the only contemporaneous record of who saw what. Set the retention period with counsel, covering at least the warranty claim period in the purchase agreement and the relevant limitation period.
Do not rely on the vendor to keep it for you. Subscription terms differ, and closing or deleting a room may delete its activity history. Export the full log and archive before you close a room, store them encrypted with access limited to named people, and record where they live. Because logs contain personal data such as names, emails and IP addresses, document the retention basis and period in line with GDPR or whichever privacy law applies to you.
- Export the full audit log, NDA records and a frozen archive before any room is closed
- Ask the vendor what happens to logs when a room or subscription ends
- Store exports encrypted, with access limited to named people
- Write down the retention period and its basis, agreed with counsel
- Set a review date instead of keeping records indefinitely
Common data room audit log export mistakes
- Assuming an activity dashboard is an audit log, then discovering it cannot export event-level detail.
- Running a shared login for an advisory team, so the log cannot say which individual did what.
- Leaving time zones unclear, which makes a cut-off argument harder than it needs to be.
- Replacing documents without versioning, so the log cannot show which version was available on which date.
- Exporting only at closing and missing the signing cut-off snapshot.
- Letting the subscription lapse before exporting the log and archive.
More on data room security
Part of the What is a secure data room? cluster.
Next steps
What is a secure data room?
The security hub for the controls a secure data room should provide.
Secure data room features checklist
Compare audit logging alongside the rest of the control set.
Why audit trails matter in a secure data room
The case for audit trails, before you get to exporting them.
NDA data room
How NDA acceptance records are captured and retained.
M&A data room checklist
The wider transaction checklist the closing archive belongs to.
FAQ
What does a data room audit log record?
A deal-grade log records views, downloads, uploads and replacements, permission changes, invitations and revocations, NDA acceptances, Q&A activity and failed access attempts. Each event should carry a named user, a timestamp, the document and its version. Entries should be impossible to edit or delete.
Which format should I export a data room audit log in?
Ask for CSV or XLSX for analysis and a PDF report for the archive. Larger organizations may also want an API feed. Whatever the format, check that exports keep event-level detail and state the time zone.
When should I export the audit log in a deal?
At least twice: at the signing cut-off, together with a frozen index or archive, and again at closing after buyer access is revoked. Ad hoc exports during diligence help answer specific questions. Never let a room be deleted without a final export.
Can a data room audit log prove disclosure?
It can prove that a document was available in a specific version before a date, and that named users opened it. Whether that amounts to fair disclosure is a legal question that also depends on the purchase agreement and the disclosure letter. The log is strong supporting evidence, not the whole argument.
How long should I keep a data room audit log after closing?
Keep it at least for the warranty claim period in your purchase agreement and the relevant limitation period, as set by counsel. Store it encrypted with restricted access. Document the retention basis, because the log contains personal data.
Can data room administrators edit the audit log?
In a deal-grade platform they should not be able to. Ask the vendor to confirm in writing that no role, including its own support staff, can alter or delete entries. An editable log has little evidential value.