Best Virtual Data Rooms in the UK 2026

Papermark is a document sharing and virtual data room platform founded in 2023 and headquartered in Munich, used by more than 60,000 companies with customers worldwide. It is built around EU hosting and a full compliance stack: SOC 2 Type II and ISO/IEC 27001 certification, AES-256 encryption, GDPR compliance with a signable DPA, and data rooms hosted in Frankfurt by default.

The product covers what a transaction actually needs. Folder and file level permissions, dynamic watermarking, NDA acceptance before access, page-by-page viewer analytics, custom domains and white-label branding, and an AI document chat. The codebase is also public, so the access control model can be inspected directly rather than accepted on the strength of a certification badge, and self-hosting is available as a deployment option.

On data residency it is the most flexible option on this table, though not the most straightforward. Hosting is in Europe by default, in Frankfurt, with a US region available and Enterprise plans able to select from more than 38 global locations, which is a wider choice than anyone else here offers. Beyond the managed options, the codebase is open source and can be self-hosted on the customer's own infrastructure, so residency can be anywhere the customer puts it, including on premise. The qualifier is that both routes sit above the self-serve tiers: managed region selection is an Enterprise feature, and supported self-hosting needs an enterprise licence. A buyer on Pro or the base Data Rooms plan chooses between Europe and the US.

What sets it apart, though, is not a feature. It is that the price is on the website. The Data Rooms plan is €99 per month for three team members and unlimited data rooms, with additional seats at €33, and a user can sign up and put a room live without speaking to anyone. Unlimited rooms at that price is unusual in a market where most vendors charge per room or per project. Five of the providers ranked below it will not disclose a price at all.

Admincontrol is a Norwegian provider of board portal and virtual data room software, founded in 2005 and headquartered in Oslo. It is now part of Euronext Corporate Solutions and operates seven offices across the Nordics, the UK and France, including London and Glasgow.

It is one of very few virtual data room vendors that publishes list pricing at all, and the only one on this table that publishes it in pounds. The Preparation Portal is £250 per month with unlimited storage for the sell side, and the live data room starts at £685 per month. The catch is in the allowance: 500MB is included and everything above it is billed at £0.90 per MB, which on a document-heavy process is where the real cost appears.

On credentials it is strong. ISO/IEC 27001:2022, SOC 2 Type II, Cyber Essentials Plus and a G-Cloud 14 listing, backed by a public sub-processor register that names the exact data centres. That register is also what reveals the gap: the storage locations are Oslo and EU Azure regions, with no UK option anywhere.

Projectfusion is a UK virtual data room operated by OD Consultancy Limited from Discovery Park in Sandwich, Kent. The trading entity has been registered since 1997 and the company dates its first data room, built for a City law firm, to 2001.

Its entire positioning is data sovereignty, and it is more specific about it than anyone else here. UK-only hosting is offered as a named option for government and regulated buyers, alongside EU and custom setups, and the company states plainly that it has no US ownership, no US legal exposure and no hidden subprocessors. Its ISO 27001 certification is stated to cover both the organisation and the hosting, which is a meaningfully stronger claim than the data-centre-only scoping several larger vendors rely on.

It also holds Cyber Essentials and carries out BS7858 staff vetting, the combination UK public sector procurement actually looks for. The commercial presentation is weaker: the tier structure is published but the figures are rendered in JavaScript and could not be extracted reliably, so we do not quote a price.

Sterling Technology is a virtual data room provider whose EMEA headquarters is in London and whose lineage runs back to Sterling Financial Print, established in London in 1988. It launched its data room in the UK in 2010, demerged into a standalone company in 2018, and was acquired by the US language and technology group TransPerfect in 2022.

It is the strongest UK-native option on this table for conventional deal work. Clients can choose EU, UK or US hosting in separate environments, it claims Cyber Essentials Plus alongside ISO 27001 and SOC 1, 2 and 3 reports, and it states plainly that it is compliant with UK as well as EU GDPR. Support is 24/7/365 and, unusually, they commit publicly to never outsourcing it.

The reservations are commercial and structural. Nothing about price is published. And the UK sovereignty story has an asterisk: the company has been US-owned since 2022, so a buyer whose concern is US legal reach should ask about the group structure rather than stopping at the London address.

Datasite is a US virtual data room provider headquartered in Minneapolis, trading since 1968 as Merrill Corporation before rebranding. It is a large-cap M&A specialist and claims involvement in 40 percent of the world's top 100 M&A transactions.

On security credentials it is the strongest here. Five ISO certifications, including ISO/IEC 42001 for AI management systems which no other provider on this table claims, plus SOC 2 Type II. Its UK legal posture is also the most explicit of any provider assessed: the privacy notice names UK GDPR, the Data Protection Act 2018 and UK International Data Transfer Agreements directly, rather than treating the UK as an afterthought to EU compliance.

What it does not offer is UK data residency. Servers are in the United States, Australia and Germany. Nor does it publish a price. The 90 day free preparation period is a genuinely useful way to start work before committing, and it converts into a live room without re-uploading, but the eventual cost is a negotiation.

Drooms is a German virtual data room provider founded in 2001, headquartered in Frankfurt with a parent company in Zug, Switzerland. It has a real London office and more than two decades of operating history, with particular depth in European real estate and asset lifecycle work alongside M&A.

It is one of only three providers on this table that publishes prices. The Starter tier is free forever at 150MB for two users, Professional is €49 per month, and Business is €398 per month, with annual billing discounts on both. The storage allowances are the thing to watch: they are small enough that a genuine diligence exercise will push you up a tier or two.

Its positioning is data sovereignty. Processing happens exclusively in the EU or Switzerland, and Drooms markets this explicitly against the reach of the US CLOUD Act. For a UK buyer that argument needs care, because since Brexit the UK is itself a third country to the EU, and Drooms publishes no UK-specific data protection language and offers no UK storage region.

Intralinks, owned by SS&C Technologies, is a US virtual data room provider headquartered in Waltham, Massachusetts, with a London office at Citypoint. It is one of the oldest platforms in this market and remains deeply embedded in banking, capital markets and private equity workflows.

It is one of the few large platforms offering genuine UK data residency. Data centres sit in the US, UK, Germany, Japan and Australia, and its Distributed Content Nodes architecture keeps content in-region with encryption, indexing and virus scanning handled locally rather than shipped elsewhere. For a UK buyer with a hard residency requirement that is a serious technical answer.

The problem is what surrounds it. The GDPR page treats the regulation as an EEA matter and never mentions UK GDPR or the Data Protection Act 2018, which is a strange omission for a vendor running a UK data centre. It also still claims certification under the EU-US Privacy Shield, a framework invalidated in 2020. The dedicated certifications page, meanwhile, lists no standards whatsoever.

Virtual Vaults is a Dutch dealmaking platform founded in 2014 and headquartered in Rotterdam, with a registered UK entity and a London office. It sells three products: Workspaces for preparation, the Data Room itself, and an Archive.

Commercially it is one of the more transparent vendors here. Prices are published with a sterling toggle, starting at £665 per month, and the commitment discounts of 15, 30 and 40 percent are stated openly. Unlimited storage on every tier is a genuine differentiator in a market where storage overages are the standard way a quoted price becomes a larger invoice.

The gap is in what it will tell you about security and location. Certification amounts to ISO/IEC 27001 alone, with no SOC 2, and their own pages disagree about which version of the standard applies. More significantly, the platform runs on Microsoft Azure but the regions are never published, so a UK buyer cannot determine data residency from public information at all.

Ansarada is an Australian deal platform founded in 2005 and headquartered in Sydney, with a London office at Bishopsgate and use across 170 countries. It is built around the idea of deal readiness rather than document storage, and its workflow tooling for adviser-led processes is among the strongest assessed here.

Commercially it sits in an unusual middle position. There is no published price list, but there is an interactive quote builder that produces a tailored figure immediately, which spares a buyer the demo cycle. Rooms are free until they go live or for 90 days from creation, whichever comes first, so preparation genuinely costs nothing.

Its UK data protection language is better than most non-UK vendors manage, naming the UK GDPR and its January 2021 commencement directly. What it does not offer is any choice of hosting region, so a UK residency requirement cannot be met. The commercial small print also deserves attention: overage bills at peak usage for the period, and reducing a room later does not reduce that charge.

SecureDocs is a virtual data room founded in 2012 in Santa Barbara and acquired by the legal technology company Onit in January 2022. It is now marketed from Onit's site as part of the Onit contract lifecycle management portfolio, and is headquartered with Onit in Atlanta.

Its commercial model is the simplest here. A flat fee of $250 per month billed annually, or $400 billed quarterly, covering unlimited users and unlimited documents with no per-page or per-user charging, plus a 14 day trial and a room you can launch in around ten minutes. For a small UK deal that is a genuinely low-friction proposition.

What makes it interesting for a UK buyer specifically is buried in the legal documents. SecureDocs publishes a data processing agreement incorporating the 2021 EU standard contractual clauses together with a UK Addendum built on the ICO template, explicitly invoking the Data Protection Act 2018. That is the correct current mechanism for a UK restricted transfer, and no other US provider assessed here has one live. It is a shame it sits alongside a parent company GDPR page still citing Privacy Shield.

Safelink was founded in Jersey in 2010 and moved into virtual data rooms in 2012 through work with the Jersey courts. Its data room product is Expero, with a free-forever Expero Lite tier, alongside Lexiti for litigation workspaces.

For a UK buyer the jurisdictional position is more favourable than it first appears. Jersey is a Crown Dependency rather than part of the United Kingdom, which sounds like a complication, but the ICO grants Jersey full adequacy. That makes Jersey an approved destination for UK personal data without additional safeguards, unlike the United States. And UK hosting is in any case one of five named options.

Its genuine technical differentiator is key management. Safelink offers per-workspace customer-held encryption keys, marketed as Titan, and states that it does not retain the keys itself. Very few providers at any size offer that. Set against it: no published pricing, ISO 27001 as the only certification, and a website whose contact and jurisdictions pages return errors, which is not confidence-inspiring.

Digify is a Singapore-headquartered secure document sharing and virtual data room platform operating since 2011, with a US entity serving American and Canadian customers. It claims more than 800,000 professionals across 138 countries.

Its distinctive feature is protection that persists after download. Where most providers control access inside the platform, Digify's rights management, screenshot protection and dynamic watermarking are designed to survive the file leaving it. Combined with page-level analytics and one-click NDA acceptance, that makes it a natural fit for fundraising and investor relations rather than large adviser-led processes.

For a UK buyer the notable point is residency. Digify offers nine file locations including the United Kingdom, and unlike most competitors that choice is available at organisation level on every plan rather than reserved for enterprise contracts. What it does not offer is a UK entity, a UK address, or sterling pricing, and its own published prices conflict.

Imprima is a virtual data room and AI due diligence provider founded in 2001 and headquartered in Amsterdam, with a London office operated through Imprima iRooms Limited.

It is worth being precise about this, because a great many comparison sites are not. Imprima is routinely described as London-headquartered, and routinely credited with UK-soil data hosting. Its own company page gives Amsterdam as the headquarters with London as one of five offices, and its own security page states that all data, primary and backup, is stored in EU locations on Microsoft Azure. We found no UK hosting claim anywhere on Imprima's site.

On its merits it is a capable European provider with a long history and a genuinely deep AI toolset for diligence work, including smart indexing, automated summaries, review and redaction. Its ISO 27001 certification is scoped to the whole business rather than just its infrastructure, which is a stronger claim than several larger competitors make.

Firmex is a Canadian virtual data room provider founded in 2006 and headquartered in Toronto, with an EMEA headquarters in London. It targets the lower mid-market and has particular depth in life sciences, mining, oil and gas and renewables.

It was acquired by Datasite on 26 July 2021 and now runs as a business unit within it. This matters for anyone building a shortlist: Firmex and Datasite are frequently compared as alternatives to one another, and they are not. Firmex's own sub-processor list names five Datasite entities.

On data location it offers something useful and something awkward. Customers select document storage in Germany, Canada or the United States, with an explicit guarantee that documents do not reach the US unless chosen. But there is no UK region, and metadata and user information sit in Canada whatever you pick. Its UK GDPR language is among the clearest here, with a published DPA and sub-processor list, which makes the absence of a UK region more conspicuous rather than less.

Legatics is a London-headquartered legal transaction management platform, incorporated in 2015, whose Data Rooms capability launched in July 2026 as an alternative to standalone virtual data rooms.

Its argument is structural rather than featural. Most data rooms are a silo that a law firm has to work alongside; Legatics puts document access control inside the transaction workflow the firm is already running, next to its checklists, signing and binders, and integrates natively with iManage and NetDocuments. For a firm that lives in those systems, that removes real friction.

The honest caveat is maturity. The data room launched in July 2026 and has no track record, there is no confirmed UK data residency despite the London base, and there is no published price. It is ISO 27001:2022 certified by the British Assessment Bureau and belongs to the NCSC information sharing partnership, but it does not hold Cyber Essentials or SOC 2.