Wind-down data room: what to give interested buyers and what to hold back

What is the metadata-only first rule?#

The metadata-only first rule means a wind-down data room starts with information about the records, not the records themselves. A buyer can judge fit from system names, record families, date ranges, field lists and a rights summary, and none of that exposes customers, employees or trade secrets.

The rule protects the company when protection matters most. Staff who once policed access may be gone, the estate may owe duties to creditors, and a leaked export cannot be pulled back. Starting with metadata also filters out parties who only want to look around.

What to share at each stage#

Disclosure in a wind-down data room works in stages, each with a gate that must be met before the next opens. The table gives a default sequence that the wind-down officer can tighten but should not loosen.

Data room checklist: folders to set up#

A wind-down data room checklist keeps the room organized around a buyer's questions rather than the company's old file shares. Set up the folders below and leave each one empty until its gate is met.

• 1Company and authority: entity status, wind-down or proceeding documents, the board resolution or other approval, and the authorized signer.
• 2Inventory: systems, record families, years covered and approximate scale, built from the company's data inventory.
• 3Data dictionary: field names, definitions, code lists and how records link to one another.
• 4Rights summary: categories of customer contracts, vendor terms reviewed, employee notices and known restrictions, written by counsel.
• 5Privacy preparation plan: what will be removed or replaced, the tools and human review used, and how results are checked.
• 6Sample terms and samples: the signed terms first, then the sample itself.
• 7Q&A log: every buyer question and the written answer given.
• 8Access log: who opened what and when, exported from the data room platform.

What to hold back, and what to give instead#

Holding back the wrong items is how wind-down disclosures go wrong, so pair each withheld item with a safer substitute. Buyers usually accept a substitute when the reason is stated plainly.

Secret scanning belongs in this step for any code. Open-source tools such as Gitleaks are built to detect passwords, API keys and tokens in git repositories and files, and a scan should run before any code excerpt is placed in the room.

How to share samples without giving the dataset away#

Samples are shared safely when they are small, prepared and bound by terms. A sample should show structure and quality, such as how a request links to a decision and an outcome, without being large enough to be useful on its own.

Automated detection is a first pass, not the last word. The open-source Presidio project, a toolkit for detecting and anonymizing personal data, states in its own documentation that because it uses automated detection there is no guarantee it will find all sensitive information, and that additional protections should be used. Plan a human review of every sample.

• 1Prepare the sample with the same privacy method planned for delivery, then review it by hand.
• 2Bar training, fine-tuning, evaluation beyond the agreed review, re-identification and onward sharing.
• 3Require deletion of the sample and any copies, with written confirmation, if no license is signed.
• 4Limit access to named reviewers and record who received it.
• 5Keep the sample inside the data room with downloads switched off where the platform allows.

Illustrative: a consulting firm runs a staged room#

Illustrative: a fictional operations consulting firm is closing after its partners join other firms. Its records include proposals, staffing plans, project review notes and a library of internal playbooks, held in SharePoint, a professional services automation tool and a CRM.

The wind-down officer opened the room with only the inventory, the data dictionary and a rights summary noting that client deliverables were excluded. One interested party asked for raw proposals on the first call; the officer declined and offered a privacy-prepared sample once the party described its intended use and signed sample terms.

Another party never moved past the metadata stage, which cost the firm nothing. The party that proceeded reviewed a sample of project review notes with client names replaced by industry labels, and the license scope was later drafted around those notes and the playbooks.

Running the room after the staff are gone#

Running a data room after the staff are gone falls to the wind-down officer or a named delegate, with counsel answering rights questions. Keep the process consistent: give each qualified party the same core materials, answer questions in writing and add each answer to the shared Q&A log.

Use the platform's controls. Turn on view-only access or watermarking where available, set access to expire, and export the access log at the end. That log, with the NDAs and sample terms, shows creditors, a court or a successor how disclosure was managed.

How SourceX handles disclosure#

SourceX follows the same order. The initial fit check collects metadata, not files, and nothing is shared during that assessment. Samples move only with the supplier's approval and after privacy preparation, as part of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery.

For packages that proceed, the SourceX Evidence Packet gives a buyer provenance, licensing rights, permitted use, the privacy record and release authorization in one place, which covers much of what a data room would otherwise need to hold.