Datasite
The deepest certification stack, and a 90 day free preparation period.
- Headquarters
- Minneapolis, Minnesota, USA
- Founded
- 1968, as Merrill Corporation
- Segment
- Large-cap and upper mid-market M&A, IPOs, restructuring
- Hosting
- Servers in the United States, Australia and Germany
- Encryption
- Encryption at rest and in transit
- Free trial
- 90 days
The assessment
Datasite is a US virtual data room provider headquartered in Minneapolis, trading since 1968 as Merrill Corporation before rebranding. It is a large-cap M&A specialist and claims involvement in 40 percent of the world's top 100 M&A transactions.
On security credentials it is the strongest here. Five ISO certifications, including ISO/IEC 42001 for AI management systems which no other provider on this table claims, plus SOC 2 Type II. Its UK legal posture is also the most explicit of any provider assessed: the privacy notice names UK GDPR, the Data Protection Act 2018 and UK International Data Transfer Agreements directly, rather than treating the UK as an afterthought to EU compliance.
What it does not offer is UK data residency. Servers are in the United States, Australia and Germany. Nor does it publish a price. The 90 day free preparation period is a genuinely useful way to start work before committing, and it converts into a live room without re-uploading, but the eventual cost is a negotiation.
The right answer for a large, adviser-led UK sell-side where the certification stack has to survive a buyer's security review and budget is not the binding constraint. Take the 90 day free preparation period seriously: it is the most generous evaluation offer on this table and it lets you build the index before you sign anything. Two things to raise with them directly. Their strong UK GDPR language is not backed by UK data residency, and if you are also considering Firmex, note that Datasite owns it.
Owns Firmex, acquired 26 July 2021.
Datasite UK Limited, 15 Bonhill Street, London. Note that their about page and their privacy notice give different postcodes for the same address, so we do not publish one.
Strengths
- The deepest verified certification stack here: five ISO standards plus SOC 2 Type II, and the only provider claiming ISO/IEC 42001 for AI management
- The most explicit UK legal posture of any provider assessed, naming UK GDPR, the DPA 2018 and UK International Data Transfer Agreements
- Up to 90 days free on the preparation product, converting into a live room without re-uploading anything
- 24/7/365 support in 20 languages with a dedicated project specialist
- A registered UK entity and a real London office
Limitations
- No UK data residency: storage is the United States, Australia and Germany
- No published pricing at any tier
- Built for large-cap M&A, so over-specified and over-priced for most UK mid-market deals
- A factual error sits on their own compliance page, misdescribing ISO/IEC 27001 as the AI governance standard when that is 42001
- Their own pages give two different postcodes for their London office
- Owns Firmex, so the two are not independent alternatives to one another
Pricing, hosting and certification
Not published. Datasite states that pricing is customised for every transaction.
✗ No price published
Servers in the United States, Australia and Germany. Data is stored in the United States and Europe, which allows EU localisation. No UK data residency.
- ISO/IEC 27001
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- ISO/IEC 42001
- SOC 2 Type II
Counted only where named publicly by the provider.
Typical use cases
- Large-cap mergers and acquisitions
- Initial public offerings
- Restructuring
- Due diligence
- Capital markets
Sources consulted
- Datasite compliance and certifications ↗
- Datasite privacy notice ↗
- Datasite Prepare ↗
- Datasite acquires Firmex ↗
Last reviewed 26 July 2026
What we could not confirm
Published openly, because a gap in the evidence is information too. Anything listed here could not be verified from a primary source, so we have not scored Datasite as though it were true.
- The year of the rebrand from Merrill Corporation to Datasite
- The correct postcode for their London office: their own site gives two
- Any pricing figure
- Which cloud provider underlies the service