---
title: "Share financials with buyers in 2026: secure file sharing by deal stage"
lang: en
canonical_url: https://www.papermark.com/blog/share-financials-with-potential-buyers
last_updated: 2026-10-15
published: 2026-10-15
category: [mergers-and-acquisitions]
author: "Marc Seitz"
summary: "How to share financials with potential buyers in 2026: an NDA first, 4 disclosure stages, a redaction table, and secure file sharing for business sales."
---

# Share financials with buyers in 2026: secure file sharing by deal stage

To share confidential financials with potential buyers securely, sign an NDA first, release the numbers in stages (ranges in the teaser, summary financials in the CIM, full detail only after a letter of intent), redact what buyers don't need yet, and share through a secure data room such as [Papermark](/data-room.md) with per-buyer access, view-only files, dynamic watermarks and an audit log. Never send financials as email attachments.

## Quick recap

- Financials are the most sensitive part of a sale process because they reveal margins, pricing and customer concentration to people who may be competitors.
- The standard sequence is 4 stages: teaser with revenue and EBITDA ranges, CIM after an NDA, detailed monthly financials at the IOI stage, and tax returns, bank statements and the general ledger only after an LOI.
- An NDA for financial disclosure should cover permitted use, named representatives, no onward disclosure, non-solicit, data security, return or destroy, and a clean-team protocol for competitor buyers.
- Before the LOI, tax returns, bank statements and the general ledger are withheld, and customer names are anonymised (Customer A, Customer B).
- Financial models leak through hidden Excel tabs, comments and metadata, so buyers should get a disclosure copy, never the working file.
- Secure file sharing for business sales means access you can revoke: email verification, per-buyer groups, view-only folders, dynamic watermarks, link expiry and page-level analytics.
- The FTC and NIST frame the same controls as least privilege, multi-factor access, encryption and logging.
- A data room for sharing financials with buyers costs from $99/month with Papermark, while legacy VDRs are usually quote-based per deal.

_No credit card required._

## 1. Secure file sharing for business sales: why financials need their own process

Secure file sharing for business sales is different from everyday document sharing because the recipient is a counterparty, not a colleague. A potential buyer may walk away, may already compete with you, or may be a financial sponsor that owns a competitor in its portfolio. Every number you send survives the deal whether or not it closes.

Financials carry more risk than any other part of the data room. A three-year P&L tells a competitor your gross margin. Revenue by customer tells them who to call. Payroll tells them who to hire away. Once a spreadsheet leaves your inbox as an attachment, you cannot take it back, you cannot see who it was forwarded to, and you cannot prove later what was disclosed and when.

That is why experienced sell-side advisers treat financial disclosure as a staged process rather than a single upload. The buyer earns more detail as their commitment rises: first a signed NDA, then an indication of interest (IOI), then a letter of intent (LOI) with exclusivity. At each step, the seller decides what the buyer now needs to make the next decision, and holds back the rest.

The tooling question follows from the process. If you plan to release financials in four stages to a dozen buyers, you need a way to give each buyer exactly its stage, change that access without resending files, and see what each buyer has opened. That is what a virtual data room does and what email, password-protected PDFs and shared drives don't. The rest of this guide covers the sequence, the redactions and the settings, in that order.

## 2. Before you share anything: NDA and buyer screening

No buyer should see a single real number before two things happen: they have signed a non-disclosure agreement, and you have checked that they are a credible buyer. The teaser is the only exception, because it is anonymised and contains ranges, not figures.

Screening protects your time as much as your data. A buyer who cannot show proof of funds or a financing plan is unlikely to close, and every extra party with your financials is one more potential leak. Your adviser should know within one call whether the buyer is strategic or financial, how the deal would be funded, and whether the buyer or its portfolio competes with you.

### NDA clauses that matter for financial data

A standard mutual NDA is often too thin for a sale process. These are the clauses that matter most when the information is financial. This is a draft list, not legal advice, so have counsel adapt it to your jurisdiction:

- **Permitted use**: information may be used solely to evaluate the transaction.
- **Named representatives**: only employees, advisers and financing sources who need to know, each bound by the same terms.
- **No onward disclosure**: no sharing with lenders, co-investors or other parties without written consent.
- **Non-solicit**: no approaching your employees or customers for a fixed period, where enforceable.
- **Data security**: an obligation to protect the information with reasonable safeguards and to notify you of a breach.
- **Return or destroy**: on request or when talks end, with a written certificate.
- **Term**: how long confidentiality lasts after talks end, commonly 2 to 3 years.
- **Standstill**: if your company is public or has public securities.
- **Clean-team protocol**: competitively sensitive data goes only to a ring-fenced team when the buyer is a competitor.

In a data room, the NDA can sit in front of the documents. An [NDA gate](/one-click-nda.md) on the link means the buyer accepts or signs before the first file opens, and the acceptance is logged with a timestamp. Our guide to [NDA compliance in a virtual data room](/blog/nda-compliance-virtual-data-room.md) covers the mechanics.

### How to screen buyers before releasing numbers

Screening works best as a short checklist your adviser runs before the NDA is countersigned:

- Proof of funds or a named financing source
- Strategic or financial buyer, and which portfolio companies it owns
- Direct or indirect competitor exposure
- Acquisition history and whether past deals closed
- Who on the buyer side will see the data

When the buyer is a competitor, competition law also limits what you can share before closing. The FTC's guidance on [avoiding antitrust pitfalls during pre-merger negotiations and due diligence](https://www.ftc.gov/enforcement/competition-matters/2018/03/avoiding-antitrust-pitfalls-during-pre-merger-negotiations-due-diligence) warns against exchanging current pricing, customer-specific and cost data between competitors without safeguards such as clean teams and aggregation. Ask counsel where that line sits for your deal.

## 3. What financials to share at each stage

The core rule is that detail follows commitment. At each stage, release the financials a buyer needs to make its next decision and nothing more. The table below is the stage-by-stage disclosure sequence most lower and mid-market sell-side processes follow, with the data room setting that matches each stage.

| Stage | Share | Hold back | Data room setting |
| --- | --- | --- | --- |
| 1. Teaser | Revenue and EBITDA ranges, growth band, industry | Company name, customers, exact figures | Email-verified link, download off |
| 2. CIM after NDA | 3-year summary P&L, adjusted EBITDA and add-backs, KPIs | Customer names, payroll detail, tax returns | NDA gate, per-buyer link, watermark, view only |
| 3. IOI and management meetings | 24 to 36 months of monthly P&L, balance sheet, AR/AP aging, anonymised concentration | Unredacted contracts, bank statements | One group per shortlisted buyer, view only, watermark |
| 4. Confirmatory diligence after LOI | Tax returns, bank statements, general ledger, payroll, QoE support, customer data | Competitor-sensitive data outside the clean team | Buyer group plus counsel group with download, audit log review |

### Stage 1: teaser with anonymised ranges

The teaser is a one or two-page summary that lets a buyer decide whether to sign an NDA. It names the industry, the region, and ranges such as "revenue $12M to $15M, EBITDA margin 18% to 22%". It should not let a reader identify the company. Share it as an email-verified link with download disabled, so you know who opened it.

### Stage 2: the CIM after the NDA

The confidential information memorandum (CIM) carries the first real numbers: a three-year summary P&L, adjusted EBITDA with each add-back explained, and the KPIs that drive value (recurring revenue, retention, gross margin). Send each buyer its own link behind the NDA gate, with a dynamic watermark on every page. Our guide to the [confidential information memorandum](https://www.papermark.com/confidential-information-memorandum) covers what goes inside.

### Stage 3: IOI and management meetings

Buyers who submit an IOI in your range get the monthly detail they need to firm up a valuation: 24 to 36 months of monthly P&L, the balance sheet, receivables and payables aging, and customer concentration with names replaced by letters. Put these in a "Financials, round 2" folder visible only to the shortlisted groups.

### Stage 4: confirmatory diligence after the LOI

After exclusivity, the winning buyer gets everything its accountants need for the quality of earnings review: tax returns, bank statements, the general ledger, payroll and the source data behind each add-back. This is when downloads may open for the buyer's counsel and QoE provider, still watermarked. The [due diligence request list](/blog/due-diligence-request-list.md) shows what the buyer will ask for, and [financial due diligence](/blog/financial-due-diligence.md) explains how they will use it.

## 4. What to redact before buyers see your financials

Redaction is not about hiding problems. Anything material must be disclosed before signing, or it becomes a warranty claim later. It is about timing: some data is only needed once a buyer is exclusive, and some personal data never needs to be shown in identifiable form at all.

Always redact a disclosure copy, never the original. Keep the source file untouched in your own records and upload a separate version to the data room. Check that the redaction is real: a black box drawn over text in a PDF editor can often be copied out underneath, so use a tool that removes the text.

| Document | Before LOI | After LOI |
| --- | --- | --- |
| P&L and balance sheet | Share, summarised | Share in full |
| Tax returns | Withhold | Share with buyer and counsel |
| Bank statements | Withhold | Share, mask account numbers |
| Customer list and revenue by customer | Anonymise (Customer A, B, C) | Reveal, via clean team if competitor |
| Payroll | Aggregate by role | Individual, minus personal identifiers |
| General ledger and invoices | Withhold | Share, strip bank details |
| Forecasts and budget | Share with stated assumptions | Share model, view only unless counsel |

Financial models deserve a separate check. Excel files leak through hidden tabs, hidden rows, cell comments, named ranges pointing to other workbooks, and document properties that show the author and file path. Before upload, unhide everything, delete what the buyer shouldn't see, clear comments, and run the document inspector. If you need to keep formulas private, upload a values-only copy or a PDF export.

## 5. Security settings checklist for financial documents

Security settings for financial documents come down to four questions: who is this person, what can they see, can you trace what they do with it, and is the platform itself sound. The checklist below covers all four and maps them to the principles regulators use.

The FTC's [Start with Security](https://www.ftc.gov/business-guidance/resources/start-security-guide-business) guide and its [Safeguards Rule](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) summary both stress access controls, multi-factor authentication, encryption and monitoring. [NIST SP 800-53](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) names the core one as least privilege (control AC-6): every person gets the minimum access their task needs. Staged disclosure is least privilege applied to a sale.

### Identity: email verification, NDA gate, allow-list

Every link should require email verification, so a buyer proves they control the address they typed with a one-time code. Add the NDA gate on top, and where you know the buyer's domain, an allow-list so only addresses at that firm can get in.

### Access: per-buyer groups, view-only, expiry

Each buyer gets its own group with its own folder permissions. Financial folders stay view-only until the LOI. Every link gets an expiry date tied to your process deadline, such as the IOI or LOI date.

### Traceability: watermarks, analytics, audit log

Dynamic watermarks stamp the viewer's email, IP address and date on every page, so a leaked screenshot names its source. Page-level analytics and an audit log record who opened which file, for how long, and whether they downloaded it.

### Platform: encryption and certifications

The provider should encrypt data at rest and in transit and hold independent certifications. Papermark uses AES-256 encryption at rest and TLS in transit, is SOC 2 Type II and ISO 27001 certified, and offers EU hosting in Frankfurt. Details are on the [security page](/security.md).

| Control | Principle | Setting |
| --- | --- | --- |
| Signed NDA logged before access | Accountability | NDA gate on every buyer link |
| Each buyer in its own group | Least privilege | Group per buyer, folder permissions |
| Financial folders view-only | Least privilege | Download off until LOI |
| Verified identity | Authentication | Email verification, domain allow-list |
| Traceable copies | Monitoring | Dynamic watermark: email, IP, date |
| Time-boxed access | Least privilege | Link expiry at IOI or LOI deadline |
| Activity record | Logging | Audit log reviewed weekly |
| Same-day revocation | Access review | Disable group when a buyer exits |
| Sound platform | Encryption | AES-256 at rest, TLS in transit, SOC 2 Type II, ISO 27001 |

## 6. Sharing an Excel financial model safely

The financial model is the file buyers want most and the one sellers worry about most. It shows how you think about the business, and a working model can be reused by a buyer long after they walk away.

Until the LOI, share the model view-only. Buyers can read the numbers in the browser viewer and ask questions, but they cannot take the workbook into their own systems. If a buyer needs to run scenarios before the LOI, offer a model walkthrough with your adviser instead of the file.

After the LOI, enable download only for the people who genuinely need the live file, usually the buyer's QoE accountants and counsel, and put them in their own group. In Papermark, the dynamic watermark persists in downloaded files, so even a downloaded copy carries the name of the person who took it. Keep a note of which version each group received, so later questions refer to the same numbers.

## 7. Email, Google Drive or a data room?

Email attachments fail every test that matters for financials: you can't revoke them, you can't see who opened them, and every forward creates an untracked copy. Shared drive links are better for internal work but were built for collaboration, not for controlled disclosure to outside parties. A secure data room is built for exactly this job.

| Method | Revoke access | Per-buyer watermark | Page-level tracking | Fit for financials |
| --- | --- | --- | --- | --- |
| Email attachment | x | x | x | No |
| Password-protected PDF | x | Static only | x | Teaser only |
| Google Drive or Dropbox link | Partial | x | Limited | Low-sensitivity only |
| Secure data room (e.g. Papermark) | ✓ | ✓ | ✓ | Yes |

If you are still choosing a provider, our comparison of the [best virtual data rooms](/blog/best-virtual-data-rooms.md) covers pricing models, bidder management and compliance. For the wider shift from files to links, see [how to send confidential documents to a buyer without losing control](/blog/send-confidential-documents-to-buyer.md).

## 8. Worked scenario: a $15M services business shares financials with 12 buyers

This is a hypothetical scenario that shows the process end to end. Northgate Facilities is a founder-owned commercial cleaning and maintenance company with $15M of revenue and $2.4M of adjusted EBITDA. Its adviser runs a sale process with 12 buyers: 7 private equity firms, 3 strategic acquirers and 2 search funds. One strategic acquirer competes directly in two of Northgate's regions.

The teaser goes out as a verified link to all 12. Ten sign the NDA. Each gets its own group in the data room with the CIM and a three-year summary P&L, watermarked and view-only. The competitor's NDA includes a clean-team clause.

The analytics show a clear split within two weeks. Four buyers spend more than 20 minutes on the summary P&L and come back to it at least twice. Three open the CIM once and leave within five minutes. The adviser prioritises calls accordingly, and six IOIs arrive. Four are in range and move to round 2, which opens a "Financials, round 2" folder to those four groups only: 36 months of monthly P&L, the balance sheet, AR aging and customer concentration with names replaced by letters.

The six buyers that didn't advance have their groups disabled the same day, so their links stop working. After the LOI, the winning private equity firm's group gets the remaining 44 files, and a separate counsel and QoE group gets download rights. When the competitor asks to see revenue by named customer before an LOI, the adviser declines and points to the clean-team clause. Northgate's customer list never leaves the room in identifiable form until exclusivity.

## 9. Common mistakes when sharing financials with buyers

The most common mistake is sending the full financial pack to every buyer at the start. It feels efficient and signals openness, but it gives losing bidders, including competitors, your complete numbers for nothing in return. Staging costs a few extra days of setup and protects you for years.

The second is emailing "just the P&L" to one buyer who asks nicely. The attachment is now outside your control, and if that buyer forwards it to a lender or co-investor, you will never know. Every exception should go through the same room as everyone else.

The third is uploading working files. Hidden Excel tabs, tracked changes in Word and PDF metadata have exposed more confidential data in deals than any hack. Build disclosure copies and inspect them.

The fourth is forgetting to revoke. Buyers who drop out at the IOI stage still have live links unless someone switches them off. Name one person on the deal team who owns revocation, and do it the day a buyer exits.

The fifth is ignoring what the activity data tells you. A buyer who asks for a call but has never opened the monthly P&L is not ready for a management meeting. The [buyer engagement tracking guide](/blog/track-buyer-engagement-deal-documents.md) shows how to read those signals.

## 10. Data room for sharing financials with buyers

A data room for sharing financials with buyers does three jobs at once: it gives each buyer exactly its stage of disclosure, it makes every copy traceable, and it records who saw what. [Papermark](/data-room.md) is a secure, fully customizable, and developer-friendly data room for modern dealmakers, with page-by-page analytics, dynamic watermarking, unlimited data room visitors and transparent pricing.

![Papermark data room for sharing financials with potential buyers, organised by disclosure stage](https://img.papermarkassets.com/upload/file_35DtVER7SdS1G6unRE8unv-papermark-data-room.png)

_One data room holds every stage of financial disclosure, with access scoped per buyer._

### Why you need a data room for sharing financials

A sale process puts your most sensitive numbers in front of several counterparties at once, and at least some of them won't buy. You need to give each buyer a different slice of the same document set, change that slice as the process moves, and prove afterwards what each one saw. Email and shared drives can do none of these reliably.

The data room also protects your negotiating position. When a buyer raises a point in week six, the audit log shows whether they opened the relevant schedule in week one. When a buyer goes quiet, the analytics show whether they stopped reading or are simply slow to reply.

### Step 1: create one room with folders by disclosure stage

Create a single data room for the transaction and build folders that mirror your stages: "1. Teaser and CIM", "2. Financials, round 2", "3. Confirmatory diligence". Upload disclosure copies, never working files. Unlimited documents and storage mean you never trim the confirmatory set to fit a plan.

### Step 2: add one group per buyer with granular permissions

Create a group for each buyer and set [granular permissions](https://www.papermark.com/granular-permissions) at folder and file level. Round 1 groups see only the first folder. When a buyer advances, you open the next folder to that group, without sending a new file.

![Granular folder permissions per buyer group in a Papermark data room for financials](https://assets.papermark.io/upload/file_LkU4BNY6MKUKMgDucSzzFg-papermark-granular-permissions.png)

_Folder permissions per buyer group keep round 2 financials hidden from round 1 buyers._

### Step 3: put the NDA and email verification on every link

Turn on **email verification** so every viewer proves their identity with a one-time code, add a domain allow-list where you know the buyer's firm, and attach your NDA. The **NDA agreement** is signed or accepted before the first page loads, and signing is powered by Documento.

### Step 4: lock financial folders with watermarks and view-only access

Switch financial folders to view-only and turn on [dynamic watermarking](/dynamic-watermarking.md), which overlays the viewer's email, IP address and date and time on every page. Add [screenshot protection](/screenshot-protection.md) on the most sensitive schedules. Set a link expiry that matches your IOI or LOI deadline.

![Watermarked financial document with viewer email and timestamp in Papermark](https://assets.papermark.io/upload/file_Ks2dtpU7UXaoreiAAtXr54-watermarked-document.png)

_Every page carries the viewer's identity, so a leaked screenshot points back to its source._

### Step 5: read the analytics and revoke when buyers exit

[Page-by-page analytics](/document-analytics.md) show which buyer opened which financial file, for how long, and how often they returned. Use it before every call. When a buyer drops out, disable its group and the links stop working immediately. At close, Data Rooms Plus and above can freeze the room into a tamper-evident archive.

![Per-buyer page-level analytics on financial documents in a Papermark data room](https://assets.papermark.io/upload/file_YVZLbYwELYa8SxfjBg3mGe-virtual-data-room-analytics-.png)

_Per-buyer analytics show who is actually working through the monthly P&L._

### What it costs

The [Data Rooms plan](https://www.papermark.com/pricing.md?view=datarooms) is **$99/month** with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms and documents, a custom domain, dynamic watermarking, NDA agreements and granular file-level permissions. The Q&A module and data room freeze are on Data Rooms Plus and above, and AI redaction is on Premium and above. Teams that want to automate rooms can use the public [API, CLI and MCP server](https://www.papermark.com/agents.md). Papermark is also open source, with self-hosting available. Legacy VDRs such as Intralinks and Datasite usually quote per deal.

## FAQ

### When should I send financials to a potential buyer?

Release them in 4 stages: revenue and EBITDA ranges in the teaser, a 3-year summary P&L in the CIM after the NDA, 24 to 36 months of monthly detail after an IOI, and tax returns and bank statements only after an LOI. In a Papermark data room, each stage is a folder you open to a buyer's group when they advance.

### Is it safe to email financial statements to a buyer?

No. Once attached, a file can't be revoked, watermarked per buyer or tracked, and every forward creates an untracked copy. Share a link instead: Papermark links require email verification and can be disabled in 1 click, which ends access immediately.

### What financial documents do buyers ask for?

Typically 3 years of P&L and balance sheets, monthly financials for the last 24 to 36 months, an adjusted EBITDA bridge, AR and AP aging, tax returns, bank statements, payroll and the general ledger. The last 4 normally come only after an LOI. Papermark's unlimited documents and storage mean the full confirmatory set fits in one room.

### Should buyers be able to download my financial model?

Not before the LOI. Share it view-only, and after the LOI allow download only for the buyer's counsel and QoE team in a separate group. Papermark's dynamic watermark, showing email, IP and date, persists in downloaded files.

### What if the buyer is a competitor?

Hold back customer names, pricing and margin detail, or route them through a clean team of 2 to 3 people who are not involved in commercial decisions, and ask counsel about antitrust limits on pre-closing information exchange. In Papermark, the clean team gets its own group with its own folder permissions.

### What should an NDA for sharing financials include?

At minimum: permitted use, named representatives, no onward disclosure, non-solicit, data security, return or destroy, a term of usually 2 to 3 years, and a clean-team clause for competitors. Papermark can require the NDA on the link, so it is signed or accepted before the first file opens and logged with a timestamp.

### What should I redact before sharing financials?

Before the LOI, anonymise customer names, aggregate payroll by role and withhold bank statements, tax returns and the general ledger. After the LOI, still mask account numbers and personal identifiers. Papermark offers AI redaction, and you should always keep the unredacted original outside the room.

### Can I see which buyers have opened my financials?

Yes, if you share through a data room with page-level analytics. Papermark shows each verified viewer, time per page and return visits, and pauses time tracking after about 5 minutes of inactivity so the numbers stay honest.

### What security certifications should a data room for financials have?

Look for SOC 2 Type II and ISO 27001 at minimum, plus encryption at rest and in transit. Papermark holds both certifications and uses AES-256 at rest with TLS in transit, with EU hosting in Frankfurt available.

### How do I revoke a buyer's access to my financials?

Disable the buyer's link or group, and access stops immediately. You can't undo what was already viewed, which is why staging and watermarks matter. In Papermark, revocation takes 1 click and the audit log keeps the record of what was opened.

### How much does a data room for sharing financials cost?

Papermark's Data Rooms plan is $99/month with a 7-day free trial and unlimited data room visitors, so 12 buyers cost the same as 2. Legacy VDRs are usually quote-based per deal.

### Can I share financials with buyers on Google Drive?

Only for low-sensitivity files. Drive links can be shared on, have no per-viewer watermark, and give limited insight into who read which page. For a process with more than 2 or 3 buyers, a data room with per-buyer groups is the safer setup.

## Related resources

- [Papermark data room](/data-room.md)
- [Best virtual data rooms](/blog/best-virtual-data-rooms.md)
- [How to send confidential documents to a buyer without losing control](/blog/send-confidential-documents-to-buyer.md)
- [How to track which buyers are reading your deal documents](/blog/track-buyer-engagement-deal-documents.md)
- [Due diligence request list](/blog/due-diligence-request-list.md)
- [Sell-side due diligence](/blog/sell-side-due-diligence.md)
- [Data room permission matrix](/blog/data-room-permission-matrix.md)
- [Watermark documents for acquirers](/blog/watermark-documents-for-acquirers.md)

---

_Markdown version of [this article](https://www.papermark.com/blog/share-financials-with-potential-buyers) for AI agents and LLMs._
_More Papermark content: [llms.txt](https://www.papermark.com/llms.txt) · [full index](https://www.papermark.com/llms-full.txt)._