Twenty-three providers sell virtual data rooms into the UK market. Fewer than half have a registered UK entity you can trace on Companies House. Of those, only a handful have Cyber Essentials certification you can verify independently, and only two are listed on G-Cloud 14. The rest rely on EU or US legal structures that are opaque to standard UK procurement checks.
This article covers the verified list: which providers are incorporated at Companies House, which are on the G-Cloud framework, which hold independently verifiable Cyber Essentials, and which are routing British buyers through affiliate links without disclosure. For our full UK data room ranking, with scoring across all eighteen assessed providers, see the main guide. For a complete look at UK-based providers verified at Companies House, see the dedicated directory.
How to verify a UK data room provider
To confirm whether a data room provider genuinely operates in the UK, work through four checks in order.
Companies House. Search at find-and-update.company-information.service.gov.uk. A result here confirms the entity exists, is incorporated under UK company law, and is publicly traceable. Note the exact registered entity name: a provider may trade under one name and incorporate under another. Check the status field. A company showing as "dissolved" is no longer a valid UK corporate counterparty, regardless of what the provider's website claims in its footer or marketing.
ICO register.Any organisation that processes personal data in the UK must be registered with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018. Search at ico.org.uk. A provider handling buyer and seller personal data in a UK transaction without an ICO registration is non-compliant under UK GDPR. This is a quick check and is often skipped.
G-Cloud 14 Digital Marketplace. Search under framework RM1557.14 at the Digital Marketplace. A listing here means the supplier has passed the marketplace baseline criteria and can be directly awarded a contract by UK public sector bodies. It does not verify Cyber Essentials Plus or ISO 27001: certification fields in catalogue entries are supplier self-declared. For more on buying a data room through G-Cloud 14, the dedicated article covers the framework in full.
IASME Cyber Essentials register.Search at iasme.co.uk/cyber-essentials/certified-companies. This is the authoritative check for both Cyber Essentials and Cyber Essentials Plus. A logo on a provider's website, a ticked field on a G-Cloud listing, and the phrase "Cyber Essentials certified" in a sales deck are each insufficient. The only check that matters is whether the company name appears as a live entry in this register. It does not block automated lookup, but a manual search takes under a minute.
Self-declaration is not sufficient for any of the four checks above. Run them yourself against primary sources, and keep the results on file for procurement purposes.
UK-native providers: registered at Companies House
Six providers are incorporated at Companies House and describe the United Kingdom as their primary market. Each entry below is verified against its Companies House record.
Projectfusion is operated by OD Consultancy Limited (company number 03389226, active, Discovery Park, Sandwich, Kent). The trading entity has been registered since 1997. Projectfusion dates its first data room, built for a City law firm, to 2001. It offers UK-only hosting as a named option for government and regulated buyers, holds Cyber Essentials and ISO 27001 certification, and positions explicitly against US ownership and US legal exposure. It is not on G-Cloud 14. Pricing is published in tier form but rendered in JavaScript; a reliable price cannot be extracted from the site, so treat any figure from a third-party source as unverified. It is in the league table on this site.
Kahootz is operated by Kahootz Limited (company number 04228932, active, Wallingford, Oxfordshire). Incorporated in 2001, it offers a secure collaboration and deal rooms service listed on the G-Cloud 14 framework. Data storage and processing are declared as United Kingdom on that framework. It holds Cyber Essentials and Cyber Essentials Plus, with ISO 27001 accredited by Socotec. Pricing is published in sterling at £2.50 to £12.50 per user per month on the G-Cloud framework. It is a collaboration platform rather than a purpose-built transaction data room, assessed separately on this site.
Nine23is based at Southampton Science Park (company number 08118696, active) and operates LynX FileShare, a sovereign file sharing service built for the Ministry of Defence supply chain. It holds UKAS-accredited ISO 27001, Cyber Essentials and Cyber Essentials Plus, and is listed on G-Cloud 14 at £1,000 per instance per month. It handles data classified up to OFFICIAL-SENSITIVE and connects to government networks including RLI, LECN, HSCN and PSN. It is not a commercial M&A platform and is assessed separately on this site.
Clinked is a UK-incorporated client portal and secure collaboration platform based in London, with traction among SME professional services firms and smaller transactions. It does not position primarily as a transaction data room and is not in the league table. Certification and G-Cloud status were not independently verified for this article.
Legatics (Legatics Limited, company number 09590941, Covent Garden, London, incorporated May 2015) launched its data room product in July 2026, embedding it inside the legal transaction management workflow its platform already runs. The data room product is new and has no track record, though the parent platform has been used by UK law firms since 2015. Pricing is not published. It is in the league table on this site, listed with that caveat.
Beamprobeis a specialist data room provider marketed at UK deal teams, with a focus on M&A and real estate. An independent check of its Companies House entity, certifications and pricing was not completed for this article. Treat any claims about it from comparison sites as unverified.
Two additional UK-incorporated providers are included in the league table with their own detailed assessments: Sterling Technology (London EMEA headquarters, UK hosting available, Cyber Essentials Plus, acquired by US-owned TransPerfect in 2022) and Kahootz (covered above).
International providers with verified UK market presence
Several international providers have a meaningful UK market presence, whether through a registered UK entity, UK certifications or G-Cloud listings. The five below are the most relevant to UK buyers in 2026.
Papermark has no registered UK entity. It operates under its German and EU legal structure (Munich headquarters) and prices all tiers in euros: Free at EUR 0, Pro at EUR 24 per month, Business at EUR 59 per month and Data Rooms at EUR 99 per month, with Enterprise on request. The Data Rooms plan includes unlimited data rooms, three team members, custom domain, analytics, NDA agreements, dynamic watermarking and 24/7 email support. It holds SOC 2 Type II and ISO 27001 certification. Hosting is in Frankfurt by default, with a US region available and Enterprise plans offering region selection across more than 38 locations including the UK. It is not on G-Cloud 14 and does not hold Cyber Essentials. See the dedicated Papermark provider assessment and the Papermark website for current pricing. For the full context on what UK data residency requirements mean for EU-hosted providers, see the dedicated guide.
Drooms has a London office at Tokenhouse Yard, EC2R, as part of its German parent (Frankfurt headquarters, Swiss parent company in Zug). It publishes a free Starter tier at EUR 0 with 150MB and two user licences. Paid tiers are available but the pricing page returned inconsistent figures on two separate reads; ask for a written quote. Data processing is strictly in Germany and Switzerland. It holds ISO 27001:2022. Not on G-Cloud, no Cyber Essentials. It is in the league table.
Admincontrol has UK offices in London (Middlesex Street, E1) and Glasgow (St Vincent Place), through its parent Euronext Corporate Solutions. It is the only provider in this market that publishes list pricing in sterling, starting at £685 per month for the Virtual Data Room plan. It holds ISO 27001:2022, SOC 2 Type II, Cyber Essentials Plus and a G-Cloud 14 listing. Storage is in Norway and EU Azure regions: there is no UK data residency despite the UK offices and UK accreditations. The Cyber Essentials Plus claim on the G-Cloud listing has an internal inconsistency worth noting; ask for the certificate before relying on it. It is in the league table.
Virtual Vaults has a registered UK entity, Virtual Vaults Software UK Limited (company number 13163962, active, Shelton Street, London WC2H), through its Dutch parent (Rotterdam headquarters). It publishes sterling pricing starting at £665 per month, with unlimited storage on all tiers and commitment discounts up to 40 percent. Hosting is on Microsoft Azure, but the regions are not published anywhere, so data residency cannot be established without asking directly. It is in the league table.
ContractZenis a Finnish provider with a UK customer base in M&A and board management, operating under its Finnish and EU legal structure without a UK registered entity. Pricing is not published. No Cyber Essentials is claimed. Not on G-Cloud 14. Not in the league table on this site.
For what UK data rooms cost across the full market, including every published price and the providers that will not disclose one, see the pricing comparison.
The affiliate sites: what they are and why the rankings mislead
Three affiliate exact-match domains occupy the first page of Google results for the most commercially valuable UK data room queries. All three funnel buyer traffic to iDeals through tracked redirects, earning commission on signed contracts.
datarooms.org.uk runs to approximately 3,800 words. The outbound links route through a redirect layer before landing on the provider site, and carry utm_medium=partner_referral strings that confirm the commercial relationship. The recommendations are ordered by commission economics, not by buyer outcomes.
dataroom.org.uk is the longest at approximately 8,500 words. It follows the same model: affiliate redirect infrastructure, utm_medium=partner_referral tracking, and rankings that reflect the size of the programme rather than verified product quality.
data-room.co.uk runs to approximately 5,500 words, with the same redirect and tracking pattern.
The commercial arrangement is not disclosed on any of the three pages in a way that a search-referred reader would notice before clicking a provider link. A buyer relying on these rankings is making a purchase decision based on commission rates.
The practical consequence is visible and verifiable. At the time of research, one of these three pages still carried EthosData as an active recommendation in its top five. EthosData Ltd (company number 06343947) was dissolved at Companies House on 19 May 2026. The EthosData product continues under its iDeals parent, incorporated in Luxembourg, but the UK entity no longer exists. A buyer who contracts with a dissolved UK entity has no UK company law recourse against it. This is not an isolated editorial lapse. It is the predictable output of a model that does not re-verify recommendations against primary sources.
This is a specific, falsifiable claim about the accuracy of the information these pages deliver to buyers. Run the Companies House check yourself before placing a contract, rather than relying on a ranked list whose incentive structure runs against accuracy.
Papermark for UK deal teams: best for EU-hosted rooms with published pricing
Papermark is best for deal teams prioritising EU hosting, transparent published pricing and unlimited data rooms on the base tier. It is an EU-incorporated provider with no UK registered entity. For most private UK transactions this is straightforward: it operates under GDPR, holds SOC 2 Type II and ISO 27001 certification, and its published pricing removes the discovery cost that most alternatives impose.
Its four published tiers are: Free at EUR 0 (document sharing, no data room), Pro at EUR 24 per month, Business at EUR 59 per month, and Data Rooms at EUR 99 per month. Enterprise is on request. All tiers are priced in euros, with no sterling billing option. Annual billing reduces the monthly equivalent by up to 35 percent. The Data Rooms plan at EUR 99 includes unlimited data rooms on a single subscription, three team members, analytics, NDA gates, dynamic watermarking, custom domains and 24/7 email support.
Hosting is in Frankfurt by default. Enterprise plans offer region selection across more than 38 locations, including the United Kingdom, which is the path to UK-resident storage for deals where that matters. The self-serve tiers choose between Europe and the United States. Papermark is not on G-Cloud 14 and does not hold Cyber Essentials, which rules it out for UK public sector procurement under PPN 014.
For a regulated UK financial services firm or a UK public sector body, the absence of a UK registered entity is worth raising with your compliance team. UK GDPR applies to personal data of UK data subjects regardless of where the processor is incorporated, but some procurement frameworks require a UK-registered counterparty. For a private company running a carve-out, a fundraise or a standard M&A process, the compliance stack, the published pricing and the ability to put a room live without a sales conversation make it the most practical starting point in this market.
For the full scored assessment, see the Papermark provider assessment.
A worked example: Albion Capital Partners LLP
Albion Capital Partners LLP is a fictional London mid-market private equity house with seven investment professionals and a track record in business services carve-outs. It is running a controlled sale process with a data room launch in six weeks. Their head of compliance runs a three-step verification check on their preferred provider before the contract is signed.
Step one:Companies House search at find-and-update.company-information.service.gov.uk. The provider's UK entity, which appears in the footer of the provider's own website, returns a result with status "dissolved" dated four months earlier. The trading entity has continued operating under its overseas parent, but the UK incorporated entity no longer exists. The compliance officer escalates.
Step two:ICO register check. The provider's UK entity, now known to be dissolved, was the registered data controller for UK processing. The overseas parent is registered separately, but the UK- specific registration has lapsed alongside the dissolved entity.
Step three:IASME Cyber Essentials search. The provider does not appear in the register. The provider's website carries a certification logo. No live certificate is found.
Albion switches to Papermark: EU entity, published pricing at EUR 99 per month for the Data Rooms plan, SOC 2 Type II and ISO 27001 certification, hosting in Frankfurt by default. No UK entity means no Companies House entry to check for dissolution, but the governance structure is clear and the compliance stack is independently verifiable. The room is live before the end of the working week.
The three-step check took under one working hour. The cost of not running it would have been a signed contract with a counterparty that no longer existed as a UK legal entity.
Common mistakes when choosing a UK data room provider
Trusting affiliate rankings without checking Companies House. The three pages that dominate UK data room queries are affiliate sites. Their recommendations reflect commission rates, not buyer outcomes. One still listed a provider whose UK entity was dissolved in May 2026 as a current recommendation at the time of writing.
Assuming a G-Cloud listing means Cyber Essentials Plus. The Digital Marketplace carries a certification field in each service listing. That field is supplier self-declared and the Government Digital Service does not verify it. Some entries are inconsistent with the current IASME register. Always check the register itself.
Not verifying whether the contracted entity matches the trading entity. A provider may have a prominent UK trading name but contract through an overseas parent. If the UK entity that appeared on your procurement checklist has been dissolved, your contractual counterparty is not what you thought. This is a Companies House check, not a marketing review.
Signing without an exit clause. Several providers bill storage overage at peak usage across the billing period. Reducing the room after a process closes does not reduce that charge. Read the billing terms before signing, not after the room spikes.
Assuming a UK office means a UK-registered entity. A London mailing address does not create a UK legal entity. A registered office at Companies House does. The two are different things, and more than one provider on this market has one without the other.