The banker's email arrives on a Monday morning with a data room link, a process letter and a date for first-round bids. The room holds 1,200 files in eight folders: the CIM, three years of management accounts, a 40-tab model, a few hundred customer contracts, the credit agreement and every amendment to it. The fastest way to start looks obvious. Drag the CIM into ChatGPT or Claude and ask what matters.
Before anyone does that, three people on the deal will have a question. The associate wants to know whether it will work on a room this size. The compliance lead wants to know where the files go. The partner wants to know whether the NDA allows it at all. This guide answers all three, then covers the question that comes up the night before the investment committee: who answers when something breaks.
One data room, three ways in
A data room of 1,200 files. Each square is 10 files. Teal: what the AI works on. Pale: stored, searched when a question needs it.
The assistant reads what you attach. The other files stay in the data room.
ChatGPT projects hold up to 40 files. Claude switches large projects to search, and each answer draws on the passages it finds.
Every file is indexed, and new or changed files are picked up as the room changes.
Limits as each provider documents them, November 2026. Illustrative room.
Does your NDA allow it?
A data room is opened under a confidentiality agreement, and that agreement decides what you may do with the files before any tool does. Most buy-side NDAs let you share information with your Representatives, a defined list of employees, officers, advisers and financing sources, for the sole purpose of evaluating the transaction. Whether an AI provider that processes the files is a Representative, or a third party you need consent to share with, depends on the wording.
Five clauses to read before the first upload
Typical wording in a buy-side confidentiality agreement. Every deal's text differs.
| Clause | What it usually says | What to check before you use AI |
|---|---|---|
| Permitted recipients | Information may go to your Representatives: employees, officers, advisers and financing sources. | Whether a software provider that processes the files counts as a Representative, or needs the seller's consent. |
| Purpose | Information is used solely to evaluate the transaction. | Whether the tool uses your inputs for anything else, such as training or improving its models. |
| Return or destroy | On request, or when talks end, return or destroy every copy and confirm it in writing. | Whether you can delete every copy the tool holds, including chats, projects, files and logs, and how long deletion takes. |
| Standard of care | Protect the information at least as carefully as your own confidential information. | Certifications, encryption, access controls and audit logs you can point to if asked. |
| Terms on AI tools | Newer agreements and data room terms may bar public AI tools, bar tools that train on inputs, or require consent first. | Whether your tool and your plan meet each condition, in writing. |
General guidance, not legal advice. Ask your counsel about a specific agreement.
Law firms now say so plainly.
"…may constitute disclosure to a third party in breach of the NDA."
Baker Donelson, on uploading a target's data room to a third-party AI tool
Stephenson Harwood notes that "many existing confidentiality provisions were not drafted with these scenarios in mind". Sellers are writing AI into the agreements as well. In data from Ontra, a contract software vendor, covering more than 645,000 negotiated NDAs, clauses restricting AI use rose from 0.65% of NDAs in the first quarter of 2025 to 6.12% in the second quarter of 2026, and 77% of firms had received at least one. Some require written consent before AI is used in diligence.
Sellers are writing AI into the NDA
Each grid is 100 squares: NDAs in the first two, firms in the third.
Ontra, more than 645,000 negotiated NDAs. Vendor data, September 2026.
The return-or-destroy clause deserves the most care. When a process ends, the NDA usually requires you to return or destroy the seller's information and, on request, confirm it in writing. Every place a file was uploaded is a place it has to be deleted from: chat histories, project folders, connected drives and the provider's own retention window. Before the first upload, find out how deletion works, how long it takes and whether you can show it was done.
Where do the files go?
Three things decide what happens to a file after it is uploaded: whether the provider may use it to train models, how long it is kept, and whose servers process it. The answers depend more on the plan and the deployment than on the brand.
Where a file goes after you upload it
The plan and the deployment decide the answer more than the brand does.
| Consumer plans | Business and enterprise plans | Specialist platforms | Your own cloud account | |
|---|---|---|---|---|
| Who runs the servers | The AI provider | The AI provider | The vendor, shared or single-tenant | You. Your AWS or Azure account |
| Trains on your files | Setting. Depends on a user setting | No. Off by default | Usually no. Check the contract | No. Written into the agreement |
| How long files are kept | Set by the provider and the user | Set by your admin, within the provider's limits | Set by contract | Set by you |
| Who holds the keys | The provider | The provider, or your keys on some plans | The vendor, or your keys on some plans | You. Your key service |
| Where models run | The provider's cloud | The provider's cloud, with region options | The vendor's choice of providers | Your cloud's model service, such as Amazon Bedrock |
Provider and vendor documentation as of November 2026. Details vary by plan and contract.
Consumer plans
On ChatGPT's Free, Plus and Pro plans, the setting that lets OpenAI use chats to improve its models is on by default, and each user can turn it off. Temporary chats are not used for training and are deleted after 30 days. Anthropic changed its consumer terms in 2025: users of Claude's Free, Pro and Max plans choose whether their chats can be used for training, and chats that are used are kept for up to five years instead of 30 days. In both cases the control sits with the individual user rather than the firm, which is the core problem for deal documents.
ChatGPT and Claude business and enterprise plans
Business and enterprise plans change the defaults.
- TrainingOpenAI and Anthropic both say they do not train on business or enterprise inputs by default.
- ControlsTheir enterprise tiers add single sign-on, user provisioning, audit logs and a compliance API for exporting activity.
- RetentionChatGPT Enterprise lets admins set how long data is kept, and Claude Enterprise keeps data until it is deleted unless an admin sets a period of 30 days or more.
- LocationWhere the data sits differs. ChatGPT Enterprise offers storage in ten regions, from the US and Europe to India and Singapore, with processing in Europe, the US or the UAE. Claude stores data in the US, offers a US-only processing option, and serves other regions through Amazon Bedrock and Google Cloud.
- KeysBoth offer customer-managed encryption keys on enterprise plans, and Anthropic notes that turning its version on switches off project search and audit log export.
- CertificationsBoth publish SOC 2 Type II reports and hold ISO 27001 and ISO 42001 certificates.
Specialist diligence platforms
Most diligence platforms run as SaaS in a cloud the vendor operates. Several also offer an isolated instance or customer-held keys.
- HebbiaCan deploy on a dedicated tenant, with processing in the US or the EU.
- ToltIQ and AuquanDescribe single-tenant deployments.
- AlphaSenseCan keep your files in your own AWS storage, with your own keys, while processing runs in its cloud.
- DatasiteRuns its AI providers under zero-data-retention terms and now connects Rogo and Hebbia to its data rooms.
- IntralinksRuns its own AI inside the data room.
Hebbia, Rogo, AlphaSense and most of the others state that customer data is never used to train models. Before signing, ask each vendor which subprocessors see the documents and which model providers they send text to.
Inside your own cloud account
Some firms' terms, or their sellers' terms, rule out a vendor's cloud altogether. Needl.ai offers three deployment options: our cloud, a single-tenant instance with your own keys and region, or the whole platform inside your own AWS or Azure account. In your AWS account, documents stay where they already sit, under the access roles, network boundary and keys your team already operates, and the models run through Amazon Bedrock inside the AWS boundary.
The usual controls apply in every option. Needl.ai is ISO 27001 certified, holds a SOC 2 Type II report, is CASA assessed and GDPR compliant, never trains on customer data, and follows each source system's permissions, so a person sees only the files they could already open (trust and security). It is listed on AWS Marketplace and Microsoft Marketplace, so the purchase can run through an agreement your procurement team already has.
Will it work on a whole data room?
Assume the agreement allows it and the plan is right. The next problem is size.
The general assistants handle large single files and limit how many you work on at once. ChatGPT accepts files up to 512 MB, up to 20 at a time on the web, and a project on a business or enterprise plan holds up to 40 files. Claude accepts up to 20 files per chat and PDFs of up to 1,000 pages, and its projects have no fixed file count. Context windows have grown too: Claude's current models read up to 1 million tokens, and ChatGPT Enterprise's reasoning models about 256,000. A data room is larger still.
A data room is larger than any context window
Estimate: 1,200 files, 20 pages each on average, about 600 tokens a page. A token is roughly three quarters of a word.
Context sizes as documented by the providers, November 2026.
When a set of files is larger than the context window, an assistant falls back on search: it retrieves the passages that look most relevant to the question and answers from those. That works well for a question about one clause in one contract. It is weaker when the job is coverage, such as checking every customer contract for a change-of-control clause, or reconciling revenue across the CIM, the model and the audited accounts. Nothing in the answer tells you which files were never read.
Two more things change at data room scale. Spreadsheets carry much of the evidence, and a 40-tab model needs every tab read with the cell each figure came from. And the room keeps changing: sellers add files until the week of the committee, so an upload made on Monday is out of date by Thursday.
How Needl.ai handles a room this size
Needl.ai treats the data room as a live source rather than a set of uploads.
How a data room moves through Needl.ai
From the drive the room lives in to a first-pass assessment.
- 1ConnectRead-only access to the drive the room lives in, or an upload
- 2SyncResumes where it stopped and checks for changes every five minutes
- 3ReadServerless workers read many files at once, a 300-page file in about a minute
- 4CatalogueUp to 5,000 files per analysis, each with its type, status and period
- 5AnalyseOne analyst agent per section, working in parallel
- 6ReportA first pass in around 30 minutes, a cited memo in hours
Built for the size of a real data room
The analysis itself is built for coverage. Each run catalogues up to 5,000 files and records what each one is: executed agreement, draft, deck, model, memo or public filing, and the period it covers. Three planning agents draft the report plan in parallel, and a critic running on a different model challenges it the way an investment committee would. Each section then goes to its own analyst agent, and the analysts work in parallel.
What happens inside one analysis
Planning, review, parallel work and reconciliation before anything is written.
Catalogue
Plan
Review
Analysts
Write
Two design choices matter for checking the result. Needl.ai indexes the full text of every document rather than relying on a vector database, and a sourced finding opens the passage it came from with the quote highlighted, with the full document one click away. When two documents disagree, such as a deck and the model on the size of a round, the report carries both figures and both sources as a finding instead of picking one silently. On the OfficeQA Pro benchmark, Needl.ai was 16.5 points more accurate, 13 times faster and 4.6 times cheaper than Claude Opus 4.6 in the benchmark's own setup (method and results).
Than Claude Opus 4.6 on the OfficeQA Pro benchmark, in the benchmark's own setup. Method and results
The output frames the decision. It sets out what the record establishes, what it does not and what remains open. Needl.ai does not make investment recommendations. The committee decides.
Who answers when something breaks?
A chat assistant is a productivity tool. A diligence platform becomes part of a deal timetable, so its service terms matter as much as its features. Three questions cover most of it: how fast the vendor responds by severity, what uptime it commits to, and how long an analysis takes on a room your size.
Few providers publish uptime figures. OpenAI describes 24/7 support with service levels for ChatGPT Enterprise but publishes no uptime percentage, and its 99.9% uptime commitment applies to a separate API tier. Anthropic publishes no uptime commitment for Claude's plans. Among the specialist platforms we reviewed, none publishes an uptime percentage or a document limit per workspace. The commitments may still exist in contracts, so ask for them in the order form.
At Needl.ai, response targets are set by severity and backed by contract.
Needl.ai support response targets
First response by severity. The targets are part of the contract.
P0 Critical
1 hour
24 hours a day, 7 days a week, until resolved
Production down or data affected. Root cause analysis the same day.
P1 High
4 hours
business hours
A major feature unavailable with no workaround.
P2 Medium
1 day
business day
Degraded, with a workaround available.
P3 Low
2 to 3
business days
Questions, minor issues and feature requests.
How the options compare
Each option is strong at a different job. The table sets out what each one documents publicly for the work a data room involves, including Needl.ai's own gaps.
How the options compare on a data room
What each one documents publicly, as of November 2026.
| ChatGPT business and enterprise | Claude business and enterprise | Specialist platforms | ||
|---|---|---|---|---|
| Built for | Work across the firm, with finance data apps and an Excel add-in | Long documents and analysis, with finance connectors and Office add-ins | Document diligence or research, each with its own focus | Data room diligence for private equity and private credit, to a cited IC memo |
| Files in one go | 20 per message, 40 per project | 20 per chat. Large projects are searched | No published limit | Up to 5,000 per analysis |
| Keeping up with the room | Connectors fetch files when asked | Connectors fetch files when asked | Several connect to Intralinks or Datasite rooms | Read-only sync from five drive types, checked every five minutes. No Intralinks or Datasite connector yet |
| Spreadsheets | Analysed with Python | Analysed with code, or in the Excel add-in | Varies by platform | Every tab read, sheet and range cited. Excel add-in on the roadmap |
| Where it runs | OpenAI's cloud, with regional storage on Enterprise | Anthropic's cloud, data stored in the US | The vendor's cloud. Some offer a dedicated tenant or your own storage | SaaS, single-tenant, or your own AWS or Azure account |
| Trains on your files | No, by default | No, by default | No, per their documentation | Never |
| Uptime commitment | No published figure | None published | None published | In each enterprise agreement, with published response targets |
| Certifications | SOC 2 Type 2, ISO 27001, ISO 42001 and others | SOC 2 Type II, ISO 27001, ISO 42001 | Commonly SOC 2 Type II and ISO 27001, some ISO 42001 | SOC 2 Type II, ISO 27001, CASA, GDPR |
Provider and vendor documentation, November 2026.
Where each one fits
ChatGPT business and enterprise
Where it shines: drafting, analysis and everyday work across the firm, with an Excel add-in and finance data apps. Strongest on one document or a handful, in a tool the team already uses.
Claude business and enterprise
Where it shines: long documents and careful reasoning, with up to a million tokens of context, finance connectors and Office add-ins. Projects search large sets of files, which suits research questions more than full coverage.
Specialist platforms
Where they shine: Hebbia for one set of questions across large document sets, AlphaSense for market and expert research, Rogo for deliverables built from market data, and Datasite and Intralinks for AI that stays inside their own data rooms.
Where it shines: diligence on the whole room, with every file catalogued, every tab read, findings linked to their sources, covenant analysis for credit deals, and deployment in your own cloud account when your terms require it. Not the pick if you need AI inside an Intralinks or Datasite room today, or a native Excel add-in.
Using them together
The choice is rarely either or. Needl.ai connects to Claude and ChatGPT through its MCP connector, so an analyst can ask a question in the assistant they already use and get an answer drawn from the whole data room, with sources, within their own permissions. Only the passages each answer needs go to the assistant, under your plan's terms, and the room itself stays where it is.
Ask in the assistant you already use
The room stays where it is. Answers come back with their sources.
A checklist for your next data room
Run through these twelve points with counsel, your IT team and the vendor before the first file goes in. They apply to any tool.
Before the data room goes in
Twelve points to clear with counsel, IT and the vendor.
The agreement
The data
The room
The service
Tick each point you can answer yes to today.
Not ready yet. Each unticked point is a question for counsel, your IT team or the vendor before the room goes in.
Ready. Keep the written answers with the deal file, so you can show them if the seller or an auditor asks.
Back to Monday
The associate with the 1,200-file room now has a sequence.
- Check the NDA and the data room terms, or ask counsel for the firm's standing position.
- Choose a setup the terms allow: an enterprise assistant for drafting and single-document questions, and a platform that reads the whole room for the diligence itself.
- Connect the room once and let it sync.
- A first pass is back in around half an hour, with every finding linked to its source, and the team spends the rest of the week on the questions that decide the bid.
If your terms require the work to run inside your own cloud account, or your rooms run to thousands of files, that is the job Needl.ai was built for. See how AI due diligence works, or read our buyer's guide to AI due diligence platforms.
FAQs
Can I upload a data room to ChatGPT or Claude?
Often yes, if three things hold: your NDA and the data room terms allow it, you use a business or enterprise plan that does not train on your files, and you can delete every copy when the process ends. Even then, a chat works on about 20 files at a time, so for a whole data room most teams use a platform that indexes every file and keeps the room in sync.
Does ChatGPT or Claude train on uploaded files?
Not on business and enterprise plans, by default. OpenAI and Anthropic both exclude business and enterprise inputs from training. On consumer plans the choice sits with each user: ChatGPT's setting is on by default, and Claude's consumer users choose whether to allow training, with up to five years of retention if they do.
Is uploading a CIM to an AI tool a breach of the NDA?
It can be. Most NDAs limit disclosure to named Representatives and limit use to evaluating the deal, and some newer agreements restrict AI tools directly. Whether an AI provider is allowed depends on the wording, the tool's terms and any consent from the seller. Ask counsel before uploading, and keep the answer with the deal file.
How many files can ChatGPT and Claude handle?
ChatGPT takes up to 20 files at a time on the web, files up to 512 MB, and up to 40 files in a project on business and enterprise plans. Claude takes up to 20 files per chat and PDFs up to 1,000 pages, and switches large projects to search. A data room with hundreds or thousands of files is more than any chat reads at once.
What is the best way to analyse a whole data room with AI?
Connect the room to a platform that indexes every file, reads every tab of every workbook, keeps the room in sync and links each finding to its source. Use a chat assistant alongside it for drafting and for questions about a single document.
Can Needl.ai run inside our own AWS or Azure account?
Yes. Needl.ai runs as SaaS, as a single-tenant instance with your own keys and region, or inside your own AWS or Azure account. On AWS, documents stay in your account and models run through Amazon Bedrock. It can be bought through AWS Marketplace or Microsoft Marketplace.
How large a data room can Needl.ai analyse?
Each analysis catalogues up to 5,000 files, and the room is the set of folders you choose. Files sync from Google Drive, OneDrive, SharePoint, Dropbox or Box, with changes checked every five minutes, and up to 50 files at a time can be uploaded directly.
How long does Needl.ai take on a data room?
Most teams get a first-pass assessment with a go or no-go checklist around 30 minutes after loading the room, and a fully cited investment committee memo in hours. Time depends on the size and mix of the room.
What support response times does Needl.ai offer?
Critical issues get a response within 1 hour, around the clock, with a root cause analysis the same day. High-severity issues get a response within 4 business hours, medium within 1 business day and low within 2 to 3 business days. The targets are part of the contract.
Does Needl.ai make investment recommendations?
No. Needl.ai sets out what the data room establishes, what it does not and what remains open, with sources. The investment decision stays with the deal team and the committee.
How to Choose an AI Due Diligence Platform in 2026: Rogo, Hebbia and Alternatives Compared
From GPU Servers to Serverless: Reading 300 Pages in a Minute
Why Needl.ai Doesn't Rely on Vector Databases