Updated Oct 17, 2026
How we rate virtual data rooms
Every provider gets a score out of 10 from five criteria, each built from documented facts. The same model drives the ranking, the use-case lists and the quiz.
How the overall score is built
- Privacy and security25%
- Deal workflow22%
- Access control and audit20%
- Usability and support17%
- Cost in Canadian dollars16%
| Criterion | Weight | The question | How it is calculated |
|---|---|---|---|
| Privacy and security | 25% | Would the room clear a PIPEDA or Law 25 privacy review, and the vendor questionnaire a Canadian bank, pension plan or acquirer sends? | Security rating x 0.85; +0.6 with a SOC 2 report; +0.6 with ISO 27001; +0.3 when logins need a second step. Maximum 10. |
| Deal workflow | 22% | Could a Canadian deal run end to end in this one tool, index through final answers? | Feature rating x 0.55; +2.2 when questions and answers are handled inside the room; +0.7 for folder-tree uploads; +1.1 for vendor-listed AI; +0.3 for signing on the platform. Maximum 10. |
| Access control and audit | 20% | Do you control which guest reads each document, with a record you can produce later? | Security rating x 0.5; +0.9 each for page watermarks, per-file read/print/download settings and an exportable history; +0.8 for second-step login; +0.6 for on-platform blacking out. Maximum 10. |
| Usability and support | 17% | Will a team in Toronto, Calgary or Montreal have a working room by end of day, with help reachable during Canadian business hours? | Ease-of-use rating x 0.7 plus support rating x 0.3. |
| Cost in Canadian dollars | 16% | Is the price in dollars visible up front, and can you try the room before paying? | Value rating x 0.5, plus 1.8; +2.4 when the vendor posts its price; +1 when there is a no-cost trial. Maximum 10. |
The five criteria
The table above shows each criterion, its weight and exactly how it is calculated. In short:
- Privacy and security (25%) asks whether the platform will pass a PIPEDA or Law 25 privacy review and the security questionnaire of a Canadian bank, pension fund or buyer.
- Deal workflow (22%) asks whether the room can carry a full Canadian deal process, from the index to the last Q&A answer.
- Access control and audit (20%) asks whether you can decide who sees each file and prove later who opened what.
- Ease of use and support (17%) asks whether a team can open a working room the same day and get help in Canadian business hours.
- Cost in Canadian dollars (16%) asks whether the price is visible before a sales call and whether you can test the product first.
Sources
We use vendor documentation and help centres, published price pages, security attestations (SOC 2 reports, ISO 27001 certificates), our tracked list of twelve features and our own ratings of security, features, ease of use, support and value, which are kept in one research file shared across our pages so the facts agree everywhere. Prices in US dollars are converted at the Bank of Canada daily rate shown on each page.
Canadian hosting is marked “Canadian region listed” only when the vendor publishes a Canadian hosting option. Everything else is “Ask the vendor”.
Use cases
Each use case changes the weights. A CCAA sale process puts more weight on access control and audit; a seed round puts more on cost and ease of use. Providers whose documented focus matches the use case get a small bonus of up to 0.3 points. The resulting list is shown on each use-case page.
Editorial ordering
Editors may adjust the final order within a ranking.
Updates
We recheck prices, features and certifications monthly and when a vendor tells us about a change. Scores are recalculated from the same model each time.
What a score does not tell you
A score cannot settle where your data will be hosted, whether a vendor will sign your data processing agreement, how it handles French or which support hours it covers. Each review lists these questions so you can put them to the vendor.