BEST·UK·DATA ROOMS

Method · Edition Q3 2026

The scoring model, published in full.

A ranking is only worth reading if you can check its working. Below is every criterion, its weight, and each of the 34 individual checks behind it. This page is generated from the same file that produces the scores in the table, so the published method cannot drift from the numbers.

5
Criteria
34
Individual checks
18
Providers assessed
0
Paid placements

Weighting

Security 25%
Pricing 20%
Residency 20%
Workflow 20%
Support 15%

Weights sum to 100%. Each criterion is scored 0 to 10, multiplied by its weight, and the result is expressed out of 100.

0125% of total

Security and certification

Independently audited security posture, not marketing claims. Certifications count only where the provider names the standard on its own site.

What we check (8)

  • ISO/IEC 27001 certification held and stated publicly
  • SOC 2 Type II report available
  • Cyber Essentials or Cyber Essentials Plus, the UK government scheme increasingly required in public sector and regulated procurement
  • Encryption at rest and in transit, with the standard named
  • Granular folder and document level permissions
  • Dynamic watermarking, download control and screenshot protection
  • Two-factor authentication and SSO
  • Complete, exportable audit trail
Scores 9 to 10

ISO 27001 and SOC 2 Type II both held, AES-256 named, full permission and watermarking controls, audit log exportable.

Scores 0 to 4

No named certification, vague encryption claims, or controls only available on an enterprise tier.

0220% of total

Pricing transparency

Whether a buyer can find out what the product costs without entering a sales process. This is the criterion the incumbent providers most consistently fail.

What we check (6)

  • A price published on the provider's own website
  • The unit of pricing stated plainly: per month, per room, per page or per user
  • No mandatory demo or quote before a number is visible
  • A free tier or trial that does not require a card
  • Overage and storage charges disclosed up front
  • Contract length and minimum term stated
Scores 9 to 10

Full price list on the public site, self-serve signup, free tier, no minimum term.

Scores 0 to 4

Price on application only, with a mandatory demo before any figure is disclosed.

0320% of total

UK and EU data residency

Where the documents actually sit. Since Brexit the UK operates its own GDPR regime, and UK-only, EU-only and transatlantic hosting are now three genuinely different propositions.

What we check (7)

  • UK data residency offered as a named option
  • EU data residency offered as a named option
  • The customer, not the vendor, chooses the region
  • Sub-processors and their locations disclosed
  • A signable Data Processing Agreement available without negotiation
  • Data Protection Act 2018 and UK GDPR posture stated
  • Certified deletion and post-deal archive on exit
Scores 9 to 10

Customer picks UK or EU hosting at room level, sub-processors published, DPA available on request.

Scores 0 to 4

Single undisclosed region, or hosting outside the UK and EU with no residency choice.

0420% of total

Deal workflow

How much of an actual transaction the product carries: indexing, Q&A, redaction, permissions at scale, and the reporting a seller needs mid-process.

What we check (7)

  • Automatic index numbering and bulk upload
  • Q&A module with routing to subject experts
  • Redaction, ideally assisted rather than manual
  • Full-text and OCR search across the room
  • Per-page engagement analytics on viewers
  • Bulk permission management by user group
  • Post-deal archive delivery
Scores 9 to 10

Auto-indexing, routed Q&A, assisted redaction, page-level analytics and a certified archive on close.

Scores 0 to 4

Storage with permissions attached, and little that is specific to running a transaction.

0515% of total

Support and setup

How fast a room can be live, and who answers when something breaks at 9pm the night before a deadline.

What we check (6)

  • Time from signup to a usable room
  • Support hours, and whether cover is genuinely 24/7
  • Published or independently reported response times
  • Whether support is a shared inbox, a project manager, or the product team
  • UK-hours coverage specifically
  • Onboarding and migration assistance included rather than charged
Scores 9 to 10

Room live in minutes, named contact or fast direct-from-team response, UK-hours cover included.

Scores 0 to 4

Multi-day onboarding, ticket queue only, or support gated behind a higher tier.

What we will not do

  • Accept payment, equity, commission or affiliate revenue in exchange for placement, inclusion or a higher score.
  • Let a provider preview, approve or negotiate its score before publication.
  • Score a certification a provider does not name publicly on its own site or in an accessible trust report.
  • Estimate a price. Where a provider does not publish one, the table says so, and that is reflected in the pricing score.
  • Quietly change a score. Revisions are dated and the previous figure is stated.

How the assessment is run

  • Every check is made against the provider's own public material first: pricing page, security or trust page, DPA and sub-processor list.
  • Where a claim cannot be verified from a primary source, it is treated as absent rather than assumed.
  • Providers are reassessed each quarter, and rank movement since the previous edition is shown in the table.
  • Sources consulted are listed at the foot of each provider assessment.
  • Corrections are welcome. If something here is wrong, we would rather fix it than defend it.

The model above produces the ranking on the front page.

See the league table