This comes up more than you'd think, usually right after a deal closes and someone asks, half-joking, “wait, does the buyer's team still have access to everything?” Sometimes the answer is yes, and nobody had thought about it since diligence wrapped up two months earlier.

Link expiry isn't the most exciting part of running a data room, but it's the part that quietly determines whether your confidential documents are still floating around six months from now in someone's browser tab.

Why this actually matters

A data room usually contains the stuff a company would least want circulating after a deal falls through — cap tables, customer contracts, employment agreements, sometimes source code. During active diligence, broad access makes sense; that's the point of the room. The risk shows up in the gap between “diligence is over” and “someone remembered to revoke access.”

We've heard of deals that fell through at the term sheet stage where the prospective buyer's team retained data room access for weeks afterward, simply because nobody on the seller's side thought to close it. Nothing necessarily went wrong in that specific case. But it's not a risk worth carrying for the sake of forgetting a checkbox.

A rough timeline that works for most deals

During active diligence: Full access for the parties actively reviewing documents, typically set to expire on a rolling 30-day window that gets renewed manually rather than left open indefinitely. This forces a periodic check-in rather than a “set it and forget it” grant.

If the deal stalls or goes quiet: Expire access after two weeks of inactivity. If nobody on the other side has opened a document in that window, there's little cost to closing access and re-opening it if talks resume.

The moment a deal closes (in either direction): Access should be revoked immediately for anyone who isn't part of the surviving entity or an ongoing legal obligation. This is the step that gets skipped most often, usually because everyone's busy with post-close logistics.

For deals that don't close: Same day, ideally same hour. There's no version of “we'll get to it next week” that makes sense here.

What good expiry controls actually look like

Per-recipient expiry, not just per-link. If five people on the buyer's side have access and the deal team shrinks to two as it progresses, you want to be able to cut off the other three without rebuilding the whole room.
Automatic expiry dates set at the time access is granted, not a manual task someone has to remember weeks later.
A log of who had access and when it ended. If a document surfaces somewhere it shouldn't months later, being able to show exactly when a given person's access was active matters more than it seems like it will in the moment.
Watermarking that persists even during the access window, so that if someone does forward a document to a colleague who's not supposed to see it, there's a trail back to who the original recipient was.

The mistake we see most often

Teams set expiry dates that are too generous, usually because nobody wants to be the person who cuts off access mid-negotiation by accident. The fix isn't shorter expiry windows across the board — it's making renewal easy enough that a 14- or 30-day window doesn't feel risky to set. If extending access takes one click, there's no reason to default to “open indefinitely” just to avoid the hassle of doing it again.

This is one of the areas where the tooling matters more than the policy. A written policy that says “revoke access within 24 hours of deal close” is only as good as how easy the platform makes that action. Anything that lets you set expiry per person at the time you grant access, and lets you kill a whole room's access in one action if a deal collapses, removes the excuse for the delay that causes most of the exposure in the first place — which is the specific gap PaperTrack's per-recipient expiry and one-click room revocation are built to close.

Frequently Asked Questions

Should I set an expiry date even during active diligence?

Yes — a rolling 30-day window that you renew manually forces a periodic check-in, rather than leaving broad access open indefinitely by default.

What's the single most common mistake teams make with data room access?

Forgetting to revoke access immediately after a deal closes or falls through — it's rarely intentional, just something that falls off the list during a busy post-close or post-collapse period.

How Long Should a Data Room Stay Open? Link Expiry Best Practices