Best virtual data rooms for board management

A board does not open a data room to close a transaction. It opens one to circulate confidential papers to directors on a schedule, keep the sensitive items sealed, and leave a record that the right people saw the right documents at the right time. That is a different job from due diligence, and it rewards different software. This page explains what we weight for governance work, sets board portals against secure VDRs, and gives you a way to decide between them.

Board papers are not deal documents

Most VDR rankings optimise for a sell-side auction: bidder analytics, staged access, Q&A throughput. Board work inverts almost all of it. The table below is the quickest way to see why a deal-desk pick can be the wrong tool for a governance calendar.

Three consequences fall out of that:

• Setup becomes a recurring tax. Effort you would tolerate once for a deal repeats every quarter, so a reusable structure matters more than one-off polish.
• Directors are not power users. Many are non-executive, so a login they can open from a tablet the night before a meeting beats any advanced feature.
• The record is permanent. A board minute and the pack behind it are the corporate memory a regulator or a court may later read.

The board pack lifecycle

A governance room is organised around a repeating loop, not a folder tree. The company secretary compiles the pack, distributes it under permissions, directors read and annotate, the meeting produces minutes and resolutions, and the whole thing is archived to the permanent record before the next cycle begins.

A room that forces you to rebuild the pack structure every quarter is fighting the loop. The two capabilities that matter across it are a reusable permission model and an archive that preserves each cycle as a fixed, timestamped record.

Six board rooms, scored on board-specific attributes

The shortlist below is where the ranked roster settles for governance work. It splits into portals that run the meeting and secure rooms that hold the papers, so compare on the attributes a board actually weighs: where the data lives, whether directors get a mobile app, whether the audit log exports, and whether pricing is public or by quote.

Read the shortlist by how your board is shaped, not by feature count:

• Full governance suite. Diligent pairs board management with entity records, a director mobile app, SSO and a full audit trail under SOC 2 and ISO 27001. It is priced by quote and heavier than a pure room, which is the trade for running the whole meeting cycle in one place.
• EU or strict residency rules. Brainloop, now part of Diligent, was built for regulated DACH organisations, with EU data residency, watermarking and two-factor by default, and cloud or on-premise hosting. If where the papers live is a hard constraint, start here.
• Governance as an ongoing programme. Ansarada folds board governance and a data room together with AI readiness scoring, which suits groups that run recurring transactions alongside board work.
• Confidential papers live fast, on clear pricing. Ellty gives the company secretary a modern room they can open within the hour, with per-user permissions, dynamic watermarking, e-signature and a full audit trail on published pricing from $149 a month. It is cloud only with no built-in voting, so pair it with your existing minute-taking if you do not need a portal.
• Regulated enterprise board. Intralinks brings post-download information-rights control and a long compliance track record; iDeals adds SSO and ISO 27001 for boards that also run cross-border diligence.

When two look close, put them side by side. Our Ellty vs iDeals and Intralinks vs Ansarada comparisons, plus the full comparison table, are the fastest way to settle it.

Board portal or secure data room?

This is the fork that decides everything else. A dedicated board portal manages the meeting: agendas, voting, minute-taking, director annotations and entity records. A secure data room manages the documents: it distributes confidential papers under tight controls with a clean audit trail, usually at a lighter price and a faster setup.

The honest read: if your board needs formal in-app voting, entity management and structured minute-taking, a portal earns its keep. If it mainly needs confidential papers circulated to directors under control, with a record you can export, a secure VDR does the job with less overhead and clearer pricing.

Board access changes between meetings, not just at them

Recusal is the control everyone names, but it is not the only board-specific access pattern. Governance access shifts as committees meet, directors rotate and guests attend, and a room that handles only the full-board case will leak in the gaps.

• Committees need their own rooms. Audit, remuneration and nomination committees see papers the full board should not. Model each as a sub-room or access group, not a shared folder, so a remuneration paper never surfaces on the main board index.
• Directors join and leave. Onboarding a new director means granting historical packs so they can catch up; offboarding means revoking access to prior board papers the day they step down, not weeks later. A room that makes both a single permission change keeps the lifecycle clean.
• Auditors and counsel are guests, not directors. External auditors or legal counsel attending one meeting need time-boxed, single-meeting access, not a standing director login. Observer or guest roles with an expiry date cover this without widening the standing circle.
• Resolutions pass between meetings. Boards approve written or circular resolutions without convening; e-signature inside the room lets directors sign where they read, and the signed resolution lands in the permanent record. Ellty and Diligent both offer e-signature, so a room without it pushes signing into email and breaks the audit chain.

Recusal: the board-specific control

Every deal room isolates groups. A board room has to do something narrower and harder: keep a director who is fully trusted with the rest of the pack out of a single conflicted item, and prove the screen held. The conflict is usually one document inside a pack the director otherwise reads in full:

• A property transaction where the director holds an interest.
• A related-party contract with a firm they are connected to.
• An executive compensation paper the affected officer must not see.

That is a permission problem, not a folder problem. The reliable pattern is to place the conflicted item in its own access group, remove the recused director from that group only, and let the audit trail record that they never opened it.

A board minute can say a director recused themselves. A well-configured room proves it: the conflicted paper was never served to them, and the log is the evidence. That is the difference between describing a screen and enforcing one.

For the mechanics of the group model this depends on, our permissions guide and the walkthrough on granting and revoking access go deeper.

Security and residency for board papers

Board papers are among the most sensitive documents a company holds: strategy, unpublished results, executive pay, litigation exposure. The security floor is the same one we hold every provider to, with three governance-specific emphases.

• Certified, not self-declared. Look for SOC 2 and ISO 27001 as a floor, so the platform is independently audited. Our explainer on VDR certifications breaks down what each covers.
• Residency can be a hard rule. Where directors or the entity sit under EU or other data-protection regimes, hosting location and on-premise options matter. Brainloop and Drooms offer EU hosting; our guide on data residency in virtual data rooms explains when it becomes a requirement rather than a preference.
• The minute book is a statutory record. A board is obliged to keep minutes and resolutions as the permanent corporate record, so the room that holds them should export both documents and the activity log in a portable format, letting the record survive a change of provider.
• Controls that travel. Dynamic watermarking, view-only rendering and two-factor stop a forwarded pack from leaking cleanly. The security features checklist covers the controls to insist on before a single director is invited.

Which way should your board go?

The portal-versus-VDR choice is easier to make against your own board’s needs than against a feature list. This short quiz weighs residency, meeting formality and pricing to point you at the right shape.

Running a board cycle in a room

The setup that pays off is the one you build once and reuse every cycle. These steps take a single board meeting from raw papers to a distributed, recusal-safe pack, in the order that never exposes a conflicted item.

How to run a board meeting cycle in a data room

A reusable structure a company secretary can stand up once and repeat every board cycle.

Estimated time: 90min

1. 1

   Build a reusable pack structure

   Create a folder tree that mirrors your standing agenda: minutes, finance, strategy, committee reports, and a separate folder for any conflicted or related-party item. Give each committee its own sub-room so its papers stay off the main board index. Number it so the same shape carries from one cycle to the next.

2. 2

   Set up the director group and any recusal groups

   Create one group for the full board, then a separate access group for each conflicted item. Grant folder rights to the group, so recusing a director is one change, not a rebuild.

3. 3

   Load the pack and turn on controls

   Upload the papers, then enable dynamic watermarking, view-only rendering and two-factor before any invitation is possible, so a forwarded pack cannot travel cleanly.

4. 4

   Distribute, add guests and confirm recusal

   Invite directors to the board group, give any auditor or external counsel a time-boxed guest role that expires after the meeting, remove any conflicted director from the relevant recusal group, and confirm the room never serves them that item.

5. 5

   Archive the cycle as a fixed record

   After the meeting, lock a timestamped snapshot of the pack, capture any signed circular resolutions, and export the audit trail, so each cycle becomes a permanent, defensible part of the corporate record.

Two steps carry the risk. The recusal groups in step two are where a rushed board leaks a conflicted paper, and the archive in step five is what a regulator or a successor secretary will later rely on. Reading the permissions guide before the first cycle repays the time.

What board software costs, honestly

Governance pricing is bimodal. Dedicated board portals such as Diligent and Brainloop are priced by quote, set per engagement and typically at the higher end because they bundle meeting management and entity records. Secure data rooms that hold board papers span a wider range, and a few, including Ellty at published pricing from $149 a month, let you budget without a sales call.

The practical question is whether you are paying for a full board portal or for a secure room to distribute papers. If your governance process already handles voting and minutes, a VDR is usually the leaner spend. Our pricing overview collects indicative rates in one place, and the guide to per-page versus flat-rate pricing explains the billing model to favour for recurring, document-light board packs.

Frequently asked questions

Do we need a dedicated board portal, or will a secure data room do?

It depends on how formal your meeting process is. A dedicated board portal earns its keep when you want in-app voting, structured minute-taking and entity records in one place, and you accept quote-based pricing for it. A secure data room is the leaner choice when your governance process already handles voting and minutes and you mainly need confidential papers distributed to directors under control, with an exportable audit trail. Many boards find a well-configured VDR covers the document side at lower cost and faster setup.

How do we keep a conflicted director out of one agenda item?

Treat recusal as a permission, not a folder. Place the conflicted item in its own access group, add every director except the recused one, and grant folder rights to the group rather than to individuals. The room then never serves that paper to the conflicted director, and the audit trail records that they never opened it, which is the evidence behind the minute noting the recusal. Test it before the meeting by logging in as the recused user and confirming the item is invisible.

How should committees and their papers be handled?

Audit, remuneration and nomination committees see material the full board should not, so model each committee as its own sub-room or access group rather than a folder inside the shared board space. Grant committee papers to the committee group only, keep them off the main board index, and give the company secretary a view across all of them. The same pattern that enforces recusal enforces committee segmentation: rights flow to a group, and membership decides who sees what.

What happens to a director's access when they join or leave?

Onboarding a new director usually means granting access to recent historical packs so they can catch up, which a group-based room does in one change. Offboarding is the higher-risk half: a departing director's access to prior board papers should be revoked the day they step down, not left standing for weeks. Confirm the room lets you revoke group membership instantly and shows, in the audit trail, exactly when access ended.

How long should board packs be kept in the room?

Longer than a deal room, because a board minute and the pack behind it are part of the permanent corporate record a regulator, auditor or court may later read, and company law obliges the board to keep that minute book. The practical pattern is to archive each cycle as a fixed, timestamped snapshot and export the audit trail, so the record survives even if you later change providers. Confirm the room lets you export both the documents and the activity log in a portable format.

The through-line across every board shape is the same. For governance work the best room is the one that turns a director’s duty of confidentiality into settings the software enforces every cycle, then hands you the record to prove it held.