nickgallick SKILL 78: Due Diligence Preparation
Purpose
Be ready for investor, partner, and acquirer due diligence before they ask. Deals die and valuations drop when due diligence reveals messy legal foundations. Build the data room from day one.
Virtual Data Room (VDR) Structure
Set up from day one. Tools: DocSend (best for investor tracking), Carta (integrated with cap table), Google Drive (with strict sharing controls), Dropbox DataRoom.
/Corporate
├── Certificate of Incorporation / Articles of Organization
├── Bylaws / Operating Agreement (most recent version)
├── All board/member resolutions
├── Good standing certificates (update quarterly)
└── Foreign entity registrations
/Equity
├── Cap table — fully diluted (Carta export)
├── Stock purchase agreements (all founders)
├── SAFEs and convertible notes (all)
├── Option grants and plan
├── 409A valuations (all versions)
└── Vesting schedules
/IP
├── Trademark registrations and applications
├── Domain name registrations
├── IP assignment agreements (ALL signatories)
├── Open source license audit report
└── Patent applications (if any)
/Contracts
├── TOS, privacy policy, market rules (current)
├── Vendor/SaaS agreements (key vendors)
├── Contractor agreements (all active)
├── Employment agreements
├── Partnership and distribution agreements
└── Lease or office agreements
/Regulatory
├── Legal opinions (gaming, securities, money transmission)
├── Regulatory registrations (MSB, state licenses, DIA)
├── Compliance program documentation
├── AML/KYC policies
└── Privacy policies and DPAs
/Financial
├── Financial statements — P&L, balance sheet, cash flow (monthly)
├── Tax returns (last 3 years)
├── Bank statements (last 12 months)
├── Revenue projections with assumptions
└── Unit economics (CAC, LTV, retention)
/Insurance
├── Active policies (D&O, cyber, E&O, general liability)
└── Claims history
/Litigation
├── Pending or threatened litigation
├── Regulatory inquiries or investigations
└── Prior settlements or consent decrees
/Team
├── Org chart
├── Key employee bios and LinkedIn profiles
├── Employment agreements
├── Contractor agreements
└── Advisory agreements
Red Flags Investors Look For (Fix Before Raising)
| Red Flag | Impact | Fix |
|---|---|---|
| Missing IP assignments | Deal-killer | Get retroactive assignments signed immediately |
| Messy cap table (unresolved SAFEs, unclear ownership) | Reduces valuation | Clean up in Carta; resolve all SAFEs |
| No 409A valuation despite option grants | Tax liability for option holders | Get valuation; it cures prospectively |
| No regulatory legal opinions | Perceived existential risk | Get gaming attorney + regulatory counsel opinions |
| Key-man dependency | Reduces valuation | Document processes; build team depth |
| Outstanding litigation | Reduces valuation or kills deal | Settle, disclose, or resolve |
| Customer concentration | Business risk | Note in materials; explain growth plan |
| No security review | Technical risk | Commission pentest; fix critical findings |
| Founder equity without vesting | Investor won't lead | Implement vesting retroactively |
| Co-founder without signed IP assignment | IP ownership unclear | Get signed immediately |
The VDR Timeline
- Day 1 (formation): open the VDR with /Corporate folder and populate it
- Month 1–2: add /IP, /Equity, /Regulatory as documents are created
- Pre-fundraise (6 weeks before first investor meeting): complete all folders, update all documents
- Data room request from investor: grant access via DocSend (you can track what they read and for how long — invaluable for follow-up conversations)
Due Diligence Questionnaire — Common Investor Questions
Pre-draft answers to these so you're not scrambling:
- Describe all pending or threatened legal proceedings
- Is the company subject to any regulatory investigations?
- Are there any IP ownership disputes?
- List all outstanding equity grants and confirm vesting schedules
- Have all founders, employees, and contractors signed IP assignments?
- Is there a 409A valuation in place?
- What is the status of your regulatory compliance (MSB, state licenses)?
- Have you received any cease and desist letters?
- What AI providers do you use, and have you reviewed their AUP for your use case?
- Describe your data privacy compliance program
This is legal research and intelligence, not legal advice. Consult qualified legal counsel before taking action.