Accepting a diligence invitation
This article is about the one moment a target company hits on the way into Diligence: opening a buyer's invite link and getting from "someone wants to review our numbers" to "I have a control panel…
On this page
What this article covers
This article is about the one moment a target company hits on the way into Diligence: opening a buyer's invite link and getting from "someone wants to review our numbers" to "I have a control panel and nothing has moved yet." For what happens after you land, category by category, see Diligence access: what to share as a target. For the full picture of what Diligence is and how the buyer's side works, see Diligence: the acquisition data room, explained.
You don't go looking for this flow. A buyer, evaluating your company for an acquisition, franchise conversion, or investment, opens an engagement in their own workspace and sends you a link. Everything below starts from that link.
Where it starts: the buyer's email
The invite arrives by email, addressed to whoever the buyer entered as the contact at your company. The subject line and body name the buyer and your company directly, for example "ACME Restoration Network has asked to review Harbor Restoration & Recovery's numbers," and explain, before you click anything:
- You create a free account. There's no obligation to complete a deal.
- You choose exactly what to share, one category at a time.
- Nothing is shared until you grant it, and you can revoke access at any point.
- The buyer only ever sees your normalized ratios next to peer benchmarks, never your raw documents, customers, or individual transactions. Verinode does not sell operator data.
A single button, Accept the invitation, carries a signed link that points at iq.verinode.ai/diligence/accept?token=.... That token is the whole mechanism: it is tied to one specific engagement, it is hashed before Verinode stores anything about it, and it expires on its own 30 days after the buyer creates the engagement. There is no separate password or PIN to enter, the link itself is your credential for this one step.
Note
There is no permanent sidebar entry for Diligence. It only becomes relevant once a buyer has invited you, and the invite link is how you arrive the first time. After you accept, /diligence is where you come back to any time you want to change what you're sharing, you'll want to bookmark it since nothing in the sidebar points to it.
What happens when you click the link
Opening the link takes you to the Diligence invitation screen. If you're not signed in yet, Verinode routes you through sign-in or sign-up first, since accepting has to be tied to an actual operator account. If you don't already have a Verinode account, creating one here is the same free Contributor signup every operator starts on, there's nothing diligence-specific about the account itself.
Once you're signed in, the page runs one step automatically, with nothing for you to click:
- 1Verify the token. Verinode checks the token's signature, confirms it hasn't expired, and confirms it was minted specifically for a diligence invite (a token from any other Verinode email link cannot be replayed here). While this is running, the page reads: "Accepting your invitation…"
- 2Look up the engagement. Verinode reads the diligence engagement the token points to and checks that its stored link hash still matches the token you're holding, that guards against a forwarded copy of an old link whose hash was rotated away in the meantime.
- 3Confirm the engagement is still open. The engagement has to be sitting at Invited or Active. If a buyer has already closed it out (won, lost, or withdrawn) or it expired on its own, the link no longer does anything.
- 4Link your operator account to the engagement. This is the step that actually changes anything: your operator ID gets written onto the engagement as its target, and an entry is added to the engagement's audit trail recording that you accepted, when, and which user did it.
- 5Land on your consent panel. You're sent to
/diligence, where the engagement now shows up under your name with every category still off.
Nothing in that sequence shares any of your data. Linking the engagement to your account only tells Verinode which operator this engagement belongs to, it's the equivalent of confirming you're the right recipient. What a buyer can see is decided entirely by the Share and Revoke controls on the next page, described in Diligence access: what to share as a target.
What you see when it works
Once the steps above succeed, the page reads:
"You're in. Nothing is shared yet. Choose what to share, category by category, and revoke any time."
Below it, one button: Review what to share. It takes you straight to /diligence, where the buyer's engagement now appears with a status of Invited and every category showing Share rather than Revoke, exactly as the confirmation copy promises. Nothing about your business is visible to the buyer at this point, accepting the invite and granting access are two separate actions, and only the second one moves any data.
When it doesn't work
A handful of things can go wrong on this screen, and each one gives you a specific, plain-language reason rather than a generic error.
No token on the URL at all. If you land on /diligence/accept without a ?token=... value, for example someone typed the address by hand, the page skips the working state entirely and reads:
"This link is missing its invitation token. Ask the buyer to resend it."
The token itself doesn't check out. If the signature is wrong, the token has expired past its 30-day window, or it wasn't issued for a diligence invite, the page reads:
"This invite link is invalid or has expired."
The engagement can't be found. If the token is well-formed but points at an engagement Verinode can no longer read, the page reads:
"Engagement not found."
The link is stale relative to a rotated invite. If the buyer generated a fresh invite link for the same engagement after this one was sent (which replaces the stored link hash), the older copy no longer matches, and the page reads:
"This invite link is no longer valid."
Someone else already accepted this engagement. Diligence engagements are one-to-one with the target operator that accepts them. If your account tries to accept an engagement another account has already linked to, the page reads:
"This invite has already been accepted by another account."
The engagement has already been closed out. If the buyer has already resolved the engagement (won, lost, or withdrawn) or it expired before you got to it, the page explains that the engagement is no longer open rather than letting you link to a dead deal.
None of these states are recoverable by retrying the same link. Each one points you back to the buyer: ask them to resend the invitation, and a fresh link with a fresh hash will work.
Heads up
The "already accepted by another account" message usually means the wrong person at your company clicked the link first, most often when the buyer's invite went to a shared inbox. If that happens, the fix is on the buyer's side: they generate a new invite link (which rotates the stored token hash and clears the way for the correct account to accept).
Best-practice example
A buyer sends the invite to your controller. Your controller opens the email on a Tuesday, clicks Accept the invitation, and is prompted to sign up since they've never used Verinode before. They create a free account, land on "Accepting your invitation…" for a moment, and then see "You're in. Nothing is shared yet." They click Review what to share, land on /diligence, and see the buyer's name with a status of Invited and every category, Financials, Jobs & Claims, AP & Procurement, still showing Share. Nothing has moved. From here they read the preview line under each category, check "Your position vs the market" for their own numbers first, and only then decide what to turn on, the subject of the next article.
Related reading
- Diligence: the acquisition data room, explained
- Diligence access: what to share as a target
- Understanding your margin
- How benchmarks work
Data sources
- 1.Your diligence engagement record and invite link. Verinode platform.