Why Deal Room Logins Get Shared (And How to Stop It

Three people used the same login on your last deal. I know because I have watched it happen on almost every transaction I have sat near, and nobody thought they were doing anything wrong. A partner hands their credentials to an associate at midnight because the associate needs one spreadsheet. The associate forwards them to an outside counsel who is billing by the hour. By the time the buyer asks a simple question about who opened a file, the access log points at one name and three humans. If you are shopping for a secure platform in the first place, sites like diliroom.fr sell themselves on exactly this problem, which tells you how common it is.

Here is the uncomfortable part. Shared logins almost never come from malice. They come from a deadline, a missing permission, and a person who would rather break a rule than slow down a deal worth a lot of money to them. So the fix cannot be another stern email from legal. It has to make the compliant path easier than the shortcut.

This piece walks through how credentials actually leak, why the usual crackdowns fail, and a five step access policy you can put in place before your next room opens. You’ll also get the one metric I think every deal lead should watch, and it isn’t the number of documents uploaded.

How a Deal Room Login Actually Leaks

It starts small. Someone gets added to the room as a viewer when they need to edit. They ask for a permission change. Nobody answers because the deal team is in back to back calls. So a colleague gives them their own credentials for fifteen minutes. Fifteen minutes becomes three weeks.

Then there’s the group email. A managing director shares a login with the whole associate class so everyone can pull the same valuation model. That is one credential, six people, zero contribution to your audit trail.

The third path is the most expensive. People reuse passwords across work tools, which means a credential stolen from some unrelated personal account can open a room full of contract drafts. Weak or reused credentials remain one of the most exploited openings in any system, and the Federal Trade Commission has been warning consumers and businesses about credential stuffing and password reuse for years. Your deal room is not special. It inherits every bad password habit your team already has.

Why the Obvious Crackdowns Backfire

Most teams respond to shared logins with stricter rules and longer passwords. That is exactly backwards. Complexity rules push people toward writing passwords down, and forced resets push them straight back to the same recycled string with a new number on the end.

Others respond by removing access from anyone who doesn’t obviously need it. Then a week later the deal stalls because the buyer’s tax advisor can’t open a folder, and someone quietly issues a shared login to unblock things. You have now trained your team that the policy is the obstacle.

I have watched a general counsel ban credential sharing, announce it in a meeting, and then personally hand her login to an outside lawyer two days later because the alternative was missing a signing deadline. Policy loses that fight every single time. Design wins it. If you want a room that people use correctly without being nagged, the tooling has to make the correct action faster than the shortcut.

The Four Locks Framework

I built this after one too many “who actually opened that file” conversations. Four locks, in order, and each one closes a specific leak instead of vaguely promising security.

Lock one, identity. Every person gets their own account, no exceptions, and multi factor authentication is on by default. This is the only lock that matters if the others fail, because it turns a stolen password into a dead end. The National Institute of Standards and Technology maintains the digital identity guidance most serious platforms now build against, and checking that a vendor follows it is a fair question to ask in any demo.
Lock two, scope. Give the smallest permission that lets someone do their job, and give it an expiry date. A bank’s advisor reviewing one folder should not hold view rights to the whole room next quarter.
Lock three, trace. Every document carries a watermark tied to the viewer, and every open, download, and print is logged against a name. This is what turns “I think it was the associate” into a fact.
Lock four, friction. Approvals for new access must complete in minutes, not days. Friction is what pushes people toward sharing credentials, so the compliant road has to be the fast road.

Notice what is missing. There’s no lock called trust. Assuming your team will follow the rules is not a control. I would take a well configured room over a well intentioned team every time, and I say that as someone who likes the teams.

A Five Step Access Policy You Can Set Up This Week

This is the part you can actually do something with before the weekend.

List every named party on the deal and the exact folder they need. If you can’t name the folder, you don’t know the permission level yet.
Assign roles in tiers, viewer, contributor, and full access, and write down who approved each one. Two minutes per person now saves an hour of finger pointing later.
Set expiry dates on every external account. Outside counsel, accountants, and consultants should lose access automatically when their work ends. No cleanup meeting required.
Turn on multi factor authentication for admins first, then everyone else. Admins are the highest value target and the least likely to complain about an extra step.
Review the activity log weekly. Look for one credential opening documents in two time zones, logins at odd hours from unfamiliar locations, and download spikes right before a deadline.

That fifth step is where most teams find their problem. The pattern shows up fast once you look for it. One name, two continents, four in the morning. That’s almost never a hacker. That’s an associate borrowing a login, and the fix is a permission change, not a security incident.

What to Measure Besides Downloads

Deal leads love counting documents and users. Neither number tells you anything about whether your controls hold. Watch the ratio of account logins to unique devices instead, and watch how often someone requests a permission change. A rising permission request queue means people are asking instead of sharing, which is exactly the behavior you want. A flat queue with heavy traffic usually means someone has stopped asking.

Access control is also not a solve once problem. Teams change, buyers change, and a policy that fit a two week diligence sprint will not fit a six month regulatory review. Revisit the tier list at every major milestone, and don’t be precious about it. Closing arguments from an old deal have no place in a new room.

One more thing, and this is where I’d push back on a lot of standard advice. Don’t hide the activity log from your own team. People behave differently when they know the record is shared. Sending a monthly note that says “here’s what our access log looked like” does more for compliance than any training deck. There’s a useful framing of transparency and accountability from the Electronic Frontier Foundation that applies here too, even though your use case is commercial rather than civil liberties work.

Start With the Logins You Already Have

You don’t need a new platform to fix most of this. Pull your current user list today and ask two questions about every name on it. Does this person still need access, and would you be able to tell if they handed their credentials to someone else? Any name where the answer is no or maybe is your next task. The buyers who ask hard questions about your audit trail are not being difficult. They’re doing what you would do.

So here’s the question worth sitting with before your next data room opens. If a buyer asked you to prove who opened a specific document last Tuesday, could you answer in under a minute, or would you be making phone calls? Fix that gap now, while the stakes are small, because the room where it matters won’t give you time to retrofit a policy.