HOLDco

Before you upload a single document to a data room, you need a permission architecture — and this episode walks through exactly how to build one. A practical guide for deal teams on audience mapping, clean-team walls, lender tiers, and audit-ready access logs.

Show Notes

Permission structures in a virtual data room are a strategic decision, not an afterthought — yet most deal teams design them after the room is already live. This episode of HoldCo breaks down the sequencing that separates a clean, defensible diligence process from one that creates trust problems mid-deal and legal exposure long after close.

Here's what the episode covers:

  • Why permissioning goes wrong: Treating data room access like a shared drive — a few broad tiers, set once — fails the moment you're running multiple buyer groups with different NDAs, competitive sensitivities, and process stages simultaneously.
  • Mapping your audience groups before anything is uploaded: The right starting point is a simple working document that lists every party, their role, and their sensitivity exposure — not a platform configuration. Granular permissions are only as good as the thinking that precedes them.
  • A practical clean-team test: The episode offers a document-level question deal teams can apply when deciding what belongs behind a clean-team wall — customer lists, pricing schedules, and go-to-market decks versus leases, audited financials, and IP schedules.
  • Building folder structure around sensitivity, not the other way around: Tagging sensitivity onto an existing folder tree leads to over- or under-restriction. The episode argues for building a sensitivity matrix first, then letting it dictate subfolder design — so that clean-team walls map to discrete folder paths that are easy to verify inside a well-configured virtual data room.
  • Lender permissioning as a distinct tier: Lenders need a curated subset of the room — financial and operational data — not broad access to buyer-side materials like the management presentation or strategic rationale documents. Building a dedicated lender index from the start also simplifies producing the lender package later.
  • The audit trail as a legal document: A well-structured permission architecture from day one makes audit logs legible and defensible. Ad hoc changes, documents moved mid-process, and permission edits without documentation turn that log into noise — precisely the kind of noise that becomes a problem in post-closing disputes.

The episode closes with a concrete deliverable recommendation: a written permission table, signed off by the deal lead and seller's counsel before the room opens, and updated in writing any time a party or tier changes. For further reading on structuring a diligence process from the ground up, the M&A due diligence guide covers the full workflow in depth. If you enjoyed this episode, the conversation on Real Estate Capital Markets Explained: Debt, Equity, Public, and Private is a strong companion listen for anyone working through complex multi-party deal structures.

VDR

What is HOLDco?

An operator-led view of holding company work: acquiring, building and running durable, cash-producing businesses in the real economy. Deal criteria, diligence, integration, capital allocation, and the management questions that arrive the day after a close.

Each episode takes one decision — what to pay, what to fix first, when to keep the seller and when not to, how to fund the next deal — and reasons it through from an operator's chair rather than a spreadsheet. Written for people buying and running businesses, not spectating on them. Five or six minutes an episode.

Topics include deal criteria and screening, diligence that finds the real risk, deal structure and seller financing, integration priorities after close, capital allocation, management transitions, and running several businesses at once.

Produced by HOLD.co, an operator-led holding company. Full details, services and further reading at https://hold.co