The failure this prevents is the demo. A demo shows a product working under conditions the vendor chose. Six weeks into diligence, a bidder's counsel asks whether the assistant could have surfaced the compensation schedule their team was fenced out of, and the answer turns out to be that the filter ran in the prompt. Nobody asked, because the demo was impressive and the question is awkward. The questions below are the awkward ones.
Three rules make the checklist work. Ask in writing. Get the answers that matter into the contract rather than an email from an account executive who may not be there in November. And treat “we can look into that” as a no, because on the day it matters, it will be.
Group one: AI and retrieval
The first question in this group does more work than the other twenty-two combined. If the permission filter runs anywhere other than the retrieval query, the model was handed text the participant should never have seen and was asked not to use it. That is a hope. It is not a control, and it fails in the direction of disclosure.
| Criterion | What a good answer sounds like | Sifrsys |
|---|---|---|
| Where does the AI permission filter run?The single highest-signal question on this page. | Inside the retrieval query, as a clause the database enforces. Anything applied after retrieval means the model already received text the participant should never have seen. | In the query. Retrieval filters on tenant and a per-participant document access check inside the SQL WHERE clause, not after retrieval and not as a prompt instruction. |
| Can the AI answer from a document I cannot open?A yes means your permission model has a second, invisible copy. | No, under every configuration, and they can show you the code path or the test. | No. The retrieval filter requires view permission or higher, so a name-only document is excluded from answers as well as from the viewer. A separate per-document switch can also remove a viewable document from AI scope. |
| Does every answer carry a citation that opens the source?An uncited answer cannot be checked, and an unchecked answer is a rumour. | Yes, to a page or a cell range, and clicking it opens the document at that location. | Yes. Absolute 1-based sheet rows plus column ranges, rendered as Q3_Model.xlsx · Revenue!B14:F34. Tapping a citation opens the workbook at that sheet and washes those cells. |
| Is AI a paid add-on, and on which tier?Price the tier that has the feature, not the tier in the brochure. | A straight answer, with the tier named and its price published. | Included in every paid tier, never an add-on. |
| What happens to my documents and chat history at the model provider?Ask for retention and training terms in the contract, not in an email. | Named subprocessors, named retention terms, and a contractual position you can point a security reviewer at. | Chat is persisted in your room, so plan what goes into it. Our subprocessor list and current AI data-handling position are published in the Trust Center. Get the terms into the contract rather than taking any vendor's page as the commitment. |
Group two: documents, watermarks and capture
Two of these are designed to be uncomfortable. Where the watermark is generated decides whether a leaked page names anybody. Whether the vendor claims to block screenshots decides whether you can trust the rest of their answers, since no browser product can block an operating-system screenshot.
| Criterion | What a good answer sounds like | Sifrsys |
|---|---|---|
| Are watermarks burned into the pixels or drawn in the browser?The second uncomfortable question. Test it yourself with developer tools open. | Burned server-side before encoding, and they will let you try to strip it during the trial. | Burned server-side into the page image before encoding, tiled, carrying name, email, IP and timestamp. Delete every overlay element in DevTools and the identity stays in the pixels. Worst of 64 sampled 25% crops kept 11.7% watermark ink with all four fields legible. Survives JPEG quality 50 and a 50% downscale. Two participants viewing the same page receive different bytes. |
| What happens if the watermark cannot be generated?Failing open here produces an untraceable copy, silently. | The request fails and the page is not served. A degraded mode that serves a clean page is a defect, not a fallback. | Fails closed. The worker raises rather than writing clean pages for a room that requires a mark. |
| Can you block screenshots?This answer tells you whether the vendor is being straight with you. | No, not in a browser. Any other answer means a native application you must install, or a claim that will not survive a test. | No browser product can, and we do not claim to. Every page carries a per-viewer watermark burned in on the server, so a screenshot names the session that took it. |
| What does fence view mean in your product?Establish which control they mean: a striped overlay, or a metadata-only permission level. | A screen share showing the control running, rather than the phrase. | A permission level at which a participant sees a file name and nothing else. The AI excludes the document too, so its content cannot reach an answer. |
| Are view, download and print separate permissions?A control on reading is decoration if the same person can keep the file. | Yes, configurable independently, and inherited predictably from folder to document. | Yes. Five levels resolved most-specific-first, with download and print as separate switches from the view level. |
| Can nothing open until an NDA is accepted, and what is recorded?An NDA papered outside the room proves a signature, not that the signer was the one who got in. | Yes, enforced on the server before any document, search result or AI answer, with the exact text, version, person and time recorded. | Yes, on the Data Rooms plan and up. One person per buyer group accepts, confirming authority for their organisation; colleagues then see who accepted before they enter. The server checks it before any document, folder, AI answer or question, and records name, company, version, SHA-256 of the text, time and IP on the hash-chained audit log. It is click-wrap acceptance, not an e-signature. |
| Will you render my actual files, not your demo set?Every viewer looks perfect on a file the vendor chose. | Yes, during the trial, on your worst workbook. | Yes. Fidelity is measured against LibreOffice ground truth in real Chromium across four producer dialects: display strings, font styles, alignment, merged cells and KSA number formats at 100%, fills at 99.7% on the 4 August 2026 run against a committed 99.3% floor that fails the build on regression. |
Group three: audit and evidence
This group is the one you will care about long after the deal closes, and the one nobody tests during an evaluation because it produces nothing visible on day one. Run it anyway. The properties behind these five questions are covered in more detail in what a defensible audit trail records.
| Criterion | What a good answer sounds like | Sifrsys |
|---|---|---|
| Are viewed and downloaded distinct events?A view ends when you revoke access. A download does not. | Yes, as separate event types, visible in the interface without a support request. | Yes, plus print and metadata access as their own events. |
| What is logged when the browser cannot render a file and the original is handed over?Every product has this path. It is the one least likely to be logged correctly. | Its own event, distinct from a view, recording the link and how long it stays live. | Its own event, recording the expiry window of the signed link and whether a watermark was required. A handover is never recorded as a view, so it cannot look like someone glancing at page one. |
| Can an administrator delete or edit a log entry?If yes, the log is a report, not evidence. | No, and they will let you try during the trial. | No. A trigger on update or delete raises an exception, so no application path edits a row in place. |
| Is the log tamper-evident, and is that evidence independent of you?Prevention is a policy. Detection is a property. Independence is a third thing again. | Hash-chained at minimum. Anchored outside the vendor's own infrastructure if your dispute needs evidence independent of them. | Hash-chained with SHA-256 per organisation, so removing a row stops every later hash reconciling, and a verification function recomputes the chain on a schedule. |
| Can I export the trail, with hashes, during the trial?A log you cannot export is a log you lose when the subscription ends. | Yes, as CSV or JSON, without a support ticket. | Yes, as CSV or JSON, capped at 10,000 rows per export and limited to an owner or admin. Test it on the trial rather than taking this row on trust, here or anywhere else. |
Group four: the company behind the product
Product questions are answerable in a trial. These are not, and they are the ones that decide whether a security reviewer signs off.
| Criterion | What a good answer sounds like | Sifrsys |
|---|---|---|
| What security documentation can you share for a vendor review?Ask for documents, not adjectives. | Named documents you can request today, under NDA where appropriate. | A security whitepaper, the sub-processor list, a Data Processing Agreement with SCCs, and a completed security questionnaire (CAIQ / SIG). SOC 2 Type II readiness: controls built and mapped. |
| Do you publish your security controls and sub-processors?A public page is easier to verify than a slide in a sales deck. | A public page listing the controls in place and every sub-processor. | Yes, in the Trust Center: encryption, the hash-chained audit log, AI data handling, and each sub-processor with its purpose. |
| Who owns you?Ownership decides whose infrastructure your documents sit on, and who your vendor competes with. | A straight answer including parent companies and investors with control. | Independent. Not a subsidiary of Datasite, unlike Firmex and Ansarada, based on publicly available information. |
| Can I see your pricing without a call?Unpublished pricing is not automatically worse. It is automatically slower. | A published number for the plan you would buy, and a named billable unit for anything metered. | Yes. Free, Pro at $29, Business at $79, Data Rooms at $149 with unlimited rooms, Plus at $349, Premium at $699, Unlimited at $1,499 a month, and Enterprise on a contract are published, with no per-page fee and no charge per extra seat, though each plan includes a set number of seats. Enterprise is a custom quote. |
| What happens to my documents when I delete a room?Ask before signature. Nobody negotiates this well in week six. | A written retention period and a permanent erasure after it. | A deleted room leaves for everyone at once. After 30 days its documents, participants, invitations, Q&A and AI conversations are permanently erased, as the privacy policy sets out. Export the audit trail first. |
| Can I test the product on my own documents before paying?A trial on your own files tells you more than any brochure. | Yes, on the full product, without a sales call. | Yes. Fourteen days, no credit card, on your own documents, with every row of this checklist testable. |
How to weight the answers
Not all twenty-three carry the same load. Two of them are close to dispositive, because both have a right answer that costs real engineering and a wrong answer that is invisible in a demo: where the AI filter runs, and where the watermark is generated. A vendor who gets both right has built for the failure case. A vendor who gets either wrong has built for the demo, and the rest of their answers should be read in that light.
Weight a precise answer above a confident one. A vendor who explains what a browser can and cannot do about screenshots is telling you something true about a hard problem, and that is good evidence of how they will behave in an incident. On the specific controls above, the reasoning behind how fence view works is worth reading before you score group two, and how metered pricing behaves in diligence matters before you score group four. Our plans, the price-lock terms and the trial are on the pricing page.