How Diligence protects the target's data

Why this article exists

Every other Diligence article in this section walks through a screen: how a buyer opens an engagement, how a target grants or revokes a category, how an engagement gets resolved. This one is different. It pulls together the guarantees that sit underneath all of those screens, the rules Diligence enforces no matter which page you are on, and states them plainly in one place so a target company (or anyone advising one) can check exactly what Verinode will and will not do with their numbers before they accept an invitation.

There are five guarantees. Each one is a real rule enforced in Verinode's code, not a policy promise sitting in a separate document:

1. Nothing is visible to a buyer until a grant is live, and a grant stops being live the instant it is revoked or expires.
2. What a grant unlocks is never a raw document, a raw ledger, or a named customer, vendor, or employee. It is a small set of normalized ratios, the same ones Verinode already computes for your own margin and benchmark pages.
3. Every number a buyer sees carries a fixed completeness disclaimer, because Verinode has not audited what was fed in.
4. Real, non-demo engagements stay switched off until a set of legal and insurance gates clear, so nobody's live deal runs ahead of the protections meant to cover it.
5. Consent and the records it produces are time-boxed on both ends: a grant lapses on its own, an unaccepted invite lapses on its own, and a closed engagement's record ages out on its own.

The rest of this article covers each guarantee in the detail an operator (or their advisor) would actually want before deciding whether to trust the process.

Guarantee 1: nothing unlocks until a grant is live

A Diligence engagement is the container for one deal between a buyer and a target company. Inside it, each of the four data categories has its own consent grant, and a grant only ever exists in one of three states: granted, revoked, or expired.

Whether a buyer can actually see a category's numbers comes down to one rule, applied the same way everywhere a grant is checked in Verinode's code: a grant is live only when its status reads granted and its expiry date has not yet passed. If either half of that fails, whether because the target tapped Revoke, because the 90-day window quietly ran out, or because the grant was never made in the first place, the category is dark. There is no partial-credit state and no cached copy of a number that used to be visible.

That single rule is what makes the target-facing promise on the consent page literally true: "You control what each buyer sees. Grant a category to share your normalized numbers next to peer benchmarks, and revoke any time." Revoking is not a request that goes into a queue for the buyer to approve. It is an update to that one grant record, and the buyer's next read of that category simply comes back empty.

On the buyer's engagement page, this shows up as a simple binary: a category reads Shared (in green) the moment its grant is live, or Awaiting consent for every other case, not yet decided, declined, revoked after being shared, or expired. The buyer's view intentionally does not distinguish "you said no" from "you said yes and later changed your mind," it only tells them the current state, not the history.

On the target's own Diligence access page, the same state renders as the preview line above each category: "Shared now: " when the grant is live, or "If you share: " when it is not, followed by the same one-line preview of exactly what that category would hand over. A Share button appears when a category is not currently granted; a Revoke button replaces it the moment it is. Both actions only appear while the engagement itself is still live (Invited or Active). Once a buyer resolves an engagement, closing it as Closed: Won, Closed: Lost, or Withdrawn, every grant on it is revoked at that same instant and the controls disappear along with the buyer's access. See Resolving an engagement: won, lost, or withdrawn for exactly what that close does.

Guarantee 2: what moves is normalized numbers, never raw data

Granting a category never hands a buyer your books, your invoices, your job files, or anyone's name. It hands over a small, fixed set of already-normalized ratios and medians, computed the same way for every operator on Verinode, and placed next to a peer benchmark. Each of the four categories has its own preview line, shown verbatim to the target before they decide, and repeated as "Shared now:" once they do:

| Category | Covers | Exactly what a buyer sees if you share it | |---|---|---| | Financials | Profit & loss and chart of accounts. | "Your normalized profit-and-loss ratios next to peer benchmarks. Not your raw books." | | Jobs & Claims | Job and claim volume, cycle time, and outcomes. | "Your job cycle time and payment timing next to peer benchmarks. Not individual jobs or customers." | | AP & Procurement | Accounts payable and materials spend. | "Your materials and AP ratios next to peer benchmarks. Not individual invoices or vendors." | | Team & Compensation | Headcount and compensation structure. | "Your headcount and compensation ratios next to peer benchmarks. Not individual employees." |

Concretely, the metrics a grant can ever surface are net margin, gross margin, and operating-expense ratio under Financials, the materials ratio under AP & Procurement, cycle time and days-to-pay under Jobs & Claims, and labor ratio and revenue per employee under Team & Compensation (once that category clears its antitrust review, see the callout below). That is the entire list. There is no path in Diligence from a granted category to a line-item invoice, a customer address, a claim number, or an individual paycheck. If a buyer wants more than that in a real deal, it happens outside Verinode entirely, through the target's own advisors and a separate data room, not through this consent panel.

The numbers themselves come from the exact same normalized facts Verinode already builds for your own margin and benchmark views. Diligence does not compute a second, separate set of figures for buyers to see; it reads your own numbers and simply decides, category by category, whether a particular buyer is currently allowed to see them.

Guarantee 3: every number carries the same completeness disclaimer

Underneath the category checklist on the buyer's request form, underneath the Data access section on every engagement's detail page, and next to the comparison table itself, one line repeats without exception:

Computed from the documents provided; Verinode does not verify completeness or audit the underlying data.

Read that literally, because it is the honesty check on the entire feature. Diligence normalizes whatever documents and connected data the target has fed into their own Verinode account. It does not independently confirm that what was fed in is the whole picture, and it does not audit the underlying figures against source records. A category reading Shared tells a buyer the target chose to open that data to them. It is not, by itself, a claim that the underlying books are complete or accurate, that verification is still the buyer's own diligence work.

This is the same posture that governs benchmarks everywhere else on Verinode: the platform surfaces the numbers and the questions worth asking, it does not attest to them and it does not decide anything on either party's behalf. When a granted category's figure sits meaningfully off the market median in the direction that matters (a materials ratio running high, a margin running low, a cycle time running long), Diligence adds a "Questions to resolve before close" line, phrased strictly as a verification prompt, for example, "Materials ratio is 22% above the market median. Verify purchasing controls, inventory shrinkage, and any owner add-backs before close." It never states that a number is good or bad. It tells the buyer what to go check, and leaves the read to them.

Guarantee 4: real deals stay off until the launch gates clear

Diligence ships with a hard switch that keeps every non-demo engagement from going live at all. As of this writing, that switch is off, and creating a real engagement returns this message in full:

Live engagements aren't enabled yet. The confidentiality undertaking, insurance review, and no-reliance clause must clear before a real deal.

That switch exists so that no target's real financial data is ever exposed to a buyer workspace before the legal protections meant to sit around this feature (a signed confidentiality undertaking, an insurance review, and a no-reliance clause in Verinode's terms) are actually in force. It is not a soft warning a buyer can click past; the create action is rejected outright for any workspace that is not running on a seeded demo dataset.

Demo engagements are unaffected by this gate. They exist specifically so a buyer team can practice the entire flow, opening an engagement, sending an invite, watching a synthetic target grant categories, reading the comparison, resolving the deal, end to end, on synthetic data, while the legal and insurance steps for the first real engagement are still being finalized. A demo engagement is always labeled with a Demo pill wherever it appears, so it is never mistaken for a live one.

Guarantee 5: consent, invites, and closed records are all time-boxed

Nothing in Diligence is designed to sit open indefinitely by default, and nothing is designed to disappear the instant a deal closes either. Three separate windows govern the lifecycle:

• A consent grant runs for a limited window from the moment you share it, not indefinitely. If you do not revisit and re-share it before that window closes, it lapses on its own, and the buyer's view goes dark exactly as if you had tapped Revoke yourself. You do not have to remember an exact expiry date: if you are still mid-diligence when a grant is getting close to lapsing, sharing that category again simply refreshes it.
• An invite link is time-boxed too. If the person you invited never accepts it within that window, the link itself stops working, the same way any other stale, single-purpose link would.
• A resolved engagement's record is retained for a further fixed window after it closes, not deleted immediately and not kept forever. Resolving (Mark won, Mark lost, or Withdraw) revokes every live grant at that instant, so the target's data goes dark for the buyer right away, but the closed record itself, what was requested, what was shared, and how the deal ended, stays available to the buyer as an audit artifact until that retention window runs out. After it does, the record ages out.

These three windows are deliberately conservative in the same direction: access defaults to closing itself down rather than staying open by default, and a closed engagement is retained only long enough to serve as an honest record of what happened, not indefinitely.

1. 1A buyer opens an engagement and sends an invite. The invite link itself is time-boxed; if it sits unaccepted long enough, it expires.
2. 2The target accepts and grants one or more categories. Each grant it makes starts its own consent window from that moment.
3. 3If the target does nothing further, each grant lapses on its own once its window closes, the same as an explicit revoke from the buyer's point of view.
4. 4If the target revokes a category directly, the effect is identical and immediate: the buyer's next read of that category comes back empty.
5. 5When the buyer resolves the engagement (won, lost, or withdrawn), every remaining live grant is revoked at that same moment, and a retention window opens on the closed record itself.
6. 6Once the retention window passes, the record ages out.

Where these guarantees show up on screen

You do not need to go looking for a separate "trust" page inside Diligence, these guarantees are the actual behavior of the two screens that make up the feature:

• The target's own control panel, at iq.verinode.ai/diligence. This is where Guarantee 1 and Guarantee 2 are lived experience: every category is off until you tap Share, every preview line tells you exactly what turns on, and Revoke takes effect immediately. See Diligence access: what to share as a target for the full walkthrough of this page.
• The buyer's engagement workspace, at /diligence inside Verinode | HQ (or /franchise/diligence depending on your workspace). This is where Guarantee 3 (the completeness note) and the consequences of Guarantee 1 (a revoked category disappearing on the next read) are visible from the other side. See Reading the data-access state on an engagement for that page in full.

If you have not been invited into a diligence review yet, your own /diligence page reads:

When a prospective buyer invites you into a diligence review, it shows up here. You choose exactly what to share, category by category, and you can revoke access at any time.

That is the entire empty state. There is nothing pending and nothing to configure until a buyer actually opens an engagement naming you as the target.

Your position vs the market: a mirror that never depends on sharing

One more piece of this trust model is worth calling out on its own, because it exists specifically so a target is never negotiating from a position of ignorance about their own numbers. Above the list of buyers on your /diligence page, if at least one buyer has asked about a category where you actually have data, a section called "Your position vs the market" appears:

Where your numbers sit against peer operators. This is yours to see whether or not you share anything.

This mirror shows the same normalized figures a buyer would eventually see, in a You column next to a Market column, computed whether or not you have granted anything to anyone. It is your own tool, never visible to a buyer, and it exists so you can walk into a conversation already knowing whether a given number reads as a strength worth defending in price or a gap you should expect questions about, before you decide what, if anything, to share. A dash in either column simply means Verinode does not yet have enough of your own data to compute that particular figure.

Frequently asked

If I revoke a category, does the buyer keep a copy of what they already saw? No. The buyer's workspace reads live on every visit to the engagement; it does not cache category data between visits. The moment a grant stops being live, whether by revoke or by expiry, the next read of that category comes back empty on the buyer's side.

Does accepting an invite share anything by itself? No. Accepting only links your operator account to that specific engagement so you are able to grant categories. The confirmation screen says exactly this: "You're in. Nothing is shared yet. Choose what to share, category by category, and revoke any time." Sharing only happens when you tap Share on an individual category.

Can a buyer ask for more than the four categories, or for raw documents, through Diligence itself? No. The product has no path for that. The four categories and the specific ratios each one surfaces are fixed. Anything beyond that would happen outside Verinode, through the parties' own advisors.

What happens to my data if the deal falls through? The moment the buyer resolves the engagement, as Closed: Lost or Withdrawn, every grant you made is revoked immediately, the same as if you had revoked each one yourself. The closed record is retained afterward as the buyer's audit artifact of what was requested and shared, then ages out.

Is any of this visible to anyone besides the one buyer I granted it to? No. Grants are scoped per category, per buyer, per engagement. Sharing Financials with one buyer never shares it with a different buyer, and it never shares any other category. If you are in parallel conversations with more than one buyer, each engagement's sharing is completely independent of the others.

Related reading

• Diligence: the acquisition data room, explained
• Diligence access: what to share as a target
• The four data categories you can request
• Reading the data-access state on an engagement
• Resolving an engagement: won, lost, or withdrawn
• Understanding your margin
• How benchmarks work
• Reading a benchmark