Permissions & document controls

Data room permissions, access groups & document controls

Give each party exactly the access they need. Group recipients into access groups, control folder access down to the document, and lock down download, print, copy and watermarking, the full enterprise VDR permission set, in a few clicks.

Open your data room See setup steps

Access groups & sub-groups

Like security groups. Invite people into an access group; they inherit its access. Sub-groups inherit the parent and can be tightened.

Folder access

Allow, Deny or Inherit per folder. Denied folders are completely hidden, not greyed out, everywhere a recipient looks.

Document controls (DRM)

Per access group and folder: download, print, copy, and dynamic per-viewer watermarking that stamps each recipient's email and date.

Three folder states, with a live preview

For each access group, every folder is one of three states. A live preview shows exactly what the group will see before you save.

Allow

The group can see this folder and its contents.

Deny

Completely hidden from the group's index, never greyed out.

Inherit

Follows the parent folder / group default. Subfolders inherit unless overridden.

Document controls, per access group and folder

Download
Turn off to keep files in the secure viewer only.
Print
Block printing of the rendered document.
Copy
Disable text selection and copy in the viewer.
Watermark
Stamp the viewer's email + date across every page.

Honest framing: document controls are a strong deterrent plus full traceability, never an absolute lock, no browser can stop a phone camera. That is the same posture the enterprise VDRs (iDeals, Datasite) take. Dynamic watermarking is what makes a leaked screenshot traceable back to the recipient.

Setting it up

1

Open the Access Groups tab

In a data room, choose Access Groups in the sidebar (admins only).
2

Create access groups for groups, not individuals

For example Buyer A, Advisors, Internal. Add a sub-group when a subset needs less access (one level deep).
3

Set folder access

On the Folder access tab, set each folder to Allow, Deny or Inherit. Tip: default the group to Hidden, then Allow only the folders it needs.
4

Set document controls

On the Document controls tab, toggle download, print, copy and watermark per access group, and override per folder where needed.
5

Invite people to an access group

From the Recipients tab, pick the access group when you invite someone. They inherit its access and controls, with no per-person setup.

Enforced everywhere, fail-closed

Permissions hold across every path: document viewing, folder index, search, the AI assistant, exports and downloads. An out-of-scope folder simply does not exist for that recipient. No-download rendering happens on the server, so the file never reaches the browser as a saveable copy. Staff and admins are never restricted; only invited recipients.

Control every party's access in minutes

Enterprise-grade permissions and document controls, with Australian data residency by default.

Get started