Data room checklist for selling a business, with a separate records map

Why build a records map alongside the data room

Sell-side preparation is the one moment most owners organize everything: contracts are found, financials are tied out and IT documents its systems. The same effort can answer a second question at almost no extra cost: which operating systems hold years of history that AI labs and data buyers might license?

Keep the two strictly apart. The data room holds documents for prospective acquirers under NDA, released in stages. The records map is a short internal list for the owner and the advisor, holding metadata only: system names, years of history and who can export. No confidential record moves from the data room into a licensing discussion, and the records map never goes into the data room.

The timing suits advisors. McKinsey's great ownership transfer research estimates that about six million US small and medium-size businesses will face ownership transitions by 2035 as baby boomers retire, with more than one million of them viable candidates for sale. Many of those owners will sit down with an M&A advisor for the first time during exit preparation, which is exactly when the records question is easiest to raise.

The data room checklist

Release folders by stage: a summary set for first-round bidders, full detail after letters of intent, and confirmatory items before signing. Index every folder with the same numbering in the data room and the disclosure schedules.

Corporate and governance

• Formation documents, bylaws or operating agreement, and good standing certificates
• Capitalization table, equity grants and shareholder agreements
• Board and shareholder minutes and written consents
• Chart of legal entities and ownership

Financial

• Audited or reviewed financial statements and monthly management accounts
• Quality of earnings report, if one was commissioned
• Revenue by customer, product and channel, plus AR and AP agings
• Budget, forecast and the model behind the CIM

Tax

• Federal, state and local returns for the years counsel specifies
• Sales and use tax filings and any nexus analysis
• Open audits, notices and tax-sharing agreements

Commercial

• Top customer and supplier contracts, with change-of-control and assignment clauses flagged
• Customer concentration, churn and pipeline reports
• Pricing policies and standard terms

Employees

• Anonymized census for early rounds, with full detail later under clean-team rules
• Employment agreements, offer letter templates and restrictive covenants
• Benefit plans, policies and the employee handbook

Intellectual property and technology

• Registered and unregistered IP list, with evidence of ownership
• Employee and contractor IP assignment agreements
• Software inventory, open-source use and key third-party licenses

IT, privacy and security

• System architecture and application list
• Security policies, incident history and recent assessments
• Every version of the privacy policy and terms of service, with effective dates
• Data processing agreements with vendors and customers

Keep the full version history of privacy notices. FTC staff have warned that adopting more permissive data practices, such as using customer data for AI training, through a quiet retroactive change to terms or a privacy policy may be unfair or deceptive. Both an acquirer and any later licensing review will want to see what customers were told, and when.

Property, insurance, litigation and regulatory

• Leases, owned property and environmental reports where relevant
• Insurance policies and claims history
• Pending and threatened litigation, settlements and regulator correspondence
• Operating licenses and permits

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

The records map: what it holds and what it never holds

Build it in one working session with the CFO or controller and the IT lead. Each row is a system; each column is metadata.

A map showing 10-15+ systems and 5-10+ years of history, at a company that had 50+ full-time employees at peak (contractors excluded), is worth a conversation with the owner.

Reading the records map

When to raise a SourceX introduction without disrupting the sale

The safest windows are before a mandate starts and after a deal closes or falls away. A license is typically exclusive for AI training for an agreed term, so during a live process it becomes one more contract the buyer will diligence; the owner and deal counsel decide the sequence. If an owner wants to sell the company but keep or separately license its records, read excluded assets in an asset sale. The trigger-moment map for raising data licensing covers the other moments in an advisory relationship.

The company's own process is short to describe: you introduce it with your referral link or the referral form, SourceX qualifies it, the company completes its own data inventory, and price and terms are agreed before AI labs and data buyers see anything. Nothing is binding until the company signs.

Red flags

• The owner wants to send sample records to test interest; advisors and partners never send records.
• Key systems were cancelled during pre-sale cost-cutting.
• The company's main data belongs to its clients, as at many agencies and outsourcers.
• The data has already been licensed for AI training.
• Records were generated with AI to make them saleable.

How rewards work for sell-side advisors

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Rewards become payable only after the buyer pays and SourceX receives its fee, and no reward is guaranteed; the reward is never deducted from the seller's proceeds. Registered representatives and other licensed advisors should check their firm's and regulator's rules on outside fees before registering. The M&A advisor partner page has more on the program for sell-side firms.

Next step

Add the records map to your sell-side kickoff checklist. If a client meets the who qualifies baseline, register as a partner, then use the introduction email builder or have the owner apply at sourcex.si/apply with your referral link.