Editorial Policy

This page documents how content on DataRoomPro is produced, reviewed and updated. If you're trying to figure out whether to trust what you read here — or whether to flag something I got wrong — this is the page that explains the rules I work to.

I keep this policy plain rather than legalistic. The goal is for any reader, vendor or journalist to be able to scan it in five minutes and know exactly what kind of content they're dealing with.

Who is responsible for the content

Every article on DataRoomPro is written, edited and published by Carlos Esteban. There is no anonymous content team, no rotating cast of "experts" and no ghostwritten reviews under a fake byline. If a page on this site is published, I have read it, edited it and signed off on it.

My background is summarised on the About page and verifiable via LinkedIn. Short version: PhD in Biochemistry, MBA from Imperial College Business School, more than a decade as a venture-capital investor with hands-on experience running and reviewing data rooms in real transactions.

What this site covers

DataRoomPro covers virtual data rooms (VDRs) and the transactions they support. That includes provider reviews, head-to-head comparisons, use-case guides for specific deal types, and educational pillars on M&A and due diligence.

What we don't cover: general document-management software, consumer file-sharing tools, generic SaaS reviews, or anything outside the VDR / deal-execution domain. If a topic isn't directly useful for someone running, joining or evaluating a transaction, it doesn't belong here.

How a review is produced

Every provider review goes through the same checklist before it is published:

• Use status declared. The review opens with a clear note on whether I have used the provider on a real deal, only seen it in a demo, or assessed it from documentation alone. That status is never hidden in a footnote.
• Pricing and contract terms sourced from primary documents. Where the provider does not publish public pricing, that is stated explicitly and any figures shared come with the source (vendor quote on file, public customer reference, third-party procurement database).
• Security claims cross-checked. ISO 27001, SOC 2 Type II, GDPR, HIPAA and similar claims are verified against the vendor's own trust-centre or audit reports. If a certification is claimed but not evidenced, the review says so.
• Features tested or noted as untested. Anything described as "fast", "intuitive" or "secure" in a review is something I have actually tried — or it is qualified with the phrase "according to the vendor".
• Ratings and rankings come from a written methodology. No invented star scores, no unexplained "Editor's Choice" badges. Where I rank providers, the criteria and weights are written out.

Sourcing standards

Order of preference for sourcing, in descending order of weight:

• Primary documents from the provider (trust centre, security white papers, master service agreements, pricing pages).
• Independent third-party audits and certifications (ISO certificates, AICPA SOC reports).
• Public customer references with a verifiable name and link.
• Reputable industry analysts (Gartner, Forrester) where their methodology is disclosed.
• My own hands-on observations from real deals, clearly labelled as such.
• Conversations with peers in M&A, PE and VC, used for context but not as the sole source for any factual claim.

Quotes and statistics are dated and linked to source wherever possible. Numbers without a source do not get published.

Updates and freshness

Every provider review and pillar guide carries a "last reviewed" date at the top. Standard cadence is one full re-review per year. Outside that, any of the following triggers an immediate update:

• A material pricing change.
• A security incident, breach disclosure or loss of certification.
• A change in ownership or major leadership change at the vendor.
• A product change that materially affects who the tool is suited for.
• A reader-flagged factual error (see corrections below).

When a page is updated, the change log lives at the bottom of the page so you can see what moved.

Independence and conflicts of interest

DataRoomPro participates in affiliate programs and accepts modest display advertising on its educational pages. Neither income source influences editorial decisions. The full breakdown is on the Affiliate Disclosure page.

Specific commitments:

• I do not accept payment in exchange for a positive review, a higher ranking or a "featured" placement.
• Vendors do not see drafts before publication and do not get a right of reply on opinion sections.
• If a vendor offers a higher commission rate, the ranking does not change.
• If I have a personal conflict of interest with a particular provider — for example, I or a fund I'm involved in have invested in or against a VDR vendor — that conflict will be disclosed at the top of any article that mentions them.

Use of AI in content production

I use AI tools — large language models, transcription, research assistants — in the production process. They are useful for drafting outlines, surfacing sources, summarising long documents and catching typos. They are not used to auto-generate reviews. No article on DataRoomPro is published without me writing the substantive parts, reading every line and making the editorial calls myself.

If that ever changes — for example, if I publish anything that is substantially AI-written — it will be labelled as such on the page itself.

Corrections and complaints

If you spot a factual error — outdated pricing, a misattributed quote, a misread certification, a feature I described that no longer exists — the fastest way to flag it is the contact page. Include the URL of the page, the specific claim, and the source you'd like me to consider.

How corrections are handled:

• Minor edits (typos, broken links, small clarifications) are made silently.
• Material corrections — anything that changes a recommendation, ranking, price or factual claim — are noted in a clearly visible "Correction" line at the top of the article, with the date.
• If a vendor disputes a characterisation, I will engage in good faith and update the page if the evidence supports it. I will not retract accurate but unfavourable analysis under commercial pressure.

Reader data and privacy

How DataRoomPro handles your data — analytics, cookies, affiliate tracking, contact-form submissions — is covered separately in the Privacy Policy and Cookie Policy. The editorial team does not have access to anything beyond aggregated analytics; nothing about who you are or what you read is fed back into editorial decisions about individual readers.

Contact for editorial questions

Press, vendors wanting to flag a factual correction, researchers and readers with questions about the methodology behind a specific page — please use the contact page. I read everything; I prioritise factual corrections over pitches.

This editorial policy is reviewed annually and updated whenever the operating standard changes. Last published: May 2026.