Document Vault Blog

If you are starting out on your M&A process and are not sure if you need a data room or your are concerned about the costs of operating a data room then you will probably consider using Dropbox.

Dropbox is a globally accepted file hosting service operated by Dropbox Inc in the USA. It offers up to 2 gigabytes of free online storage space for users and also offers paid platforms allowing up to 1 terabyte of storage. It is arguably easy to use with a simple drag-and-drop interface for adding files to the cloud storage.

There are however a number of security concerns:

If you are a UK company about to embark on an M&A transaction, you will be concerned about where your data is stored. A quick Internet search will reveal that Dropbox stores its data in the USA. Upon further investigation you will find that they have recently added a European location for storing data through Amazon Web Services (AWS) data centres in Frankfurt, Germany, although this is reserved for companies with more than 250 staff. On closer inspection, you will find that you specifically have to request that your data is switched to the German location.

So, if you use Dropbox, your data will not reside in a data centre in the UK. It will most probably be in USA, which means that it will be subject to the laws of the USA, in particular the Patriot Act which gives US Federal agencies the right to intercept your data. It doesn't mean they are going to, only that they have the right!

In setting up your M&A transaction, you will want to share documents with both the Selling team and the prospective Buyers. In Dropbox, this is achieved by setting up a Shared folder into which documents are dragged and then inviting users to access the folder. You can choose whether users have the right to edit/update information or just have read only capability. Sharing is achieved by sending an email with a link to this Dropbox folder. Dropbox lets you choose whether everyone receiving the link can open the files or just the people you choose. Clearly, if you make the wrong choices, it is possible that anyone with who receives this link will potentially be able to view and download the documents in your shared folder, which means that unwanted users could potentially have access to your data. See: Communicating the Data Security Risks of File Sharing & Cloud Storage.

This highlights the need to track what users have viewed/downloaded. While Dropbox does provide the means to track which files have been looked at, you need to subscribe to one of the paid plans in order to see this.

Finally, the use of a system which uses email as the primary means of inviting other users to access the shared data reminds us that email itself is not secure...

What does a Document Vault data room offer which Dropbox does not:

• All your documents are stored in a data centre in the UK.
• You can control what individual users will see to the extent that if they are not supposed to know about a file or folder, they will not know it exists.
• Users can be completely anonymous to each other.
• There is a full audit trail of what individual users have viewed and when.
• The system does not rely on email for sharing content.

If you would like any further information about our data room solutions, please contact us or phone 0808 221 0440 during business hours.

See also:

1. How secure is email?
2. How secure is your data?
3. Restricting access to data.
4. Guaranteeing anonymity.