Investor permissioning, roles, and lifecycle

Access in Waafir resolves two questions independently: who a person is and what they may do in a specific data room. A person's role lives at the organisation level and rarely changes; their permission lives at the data room level and controls how much of a deal to expose. This page covers the two ways an investor enters, the role and permission model, and the lifecycle from invitation to revocation.

Access mechanisms

There are two distinct access mechanisms. Identify which one applies first.

Registered investor. The investor signs in with their own account (via Auth0) and is recorded against your organisation with the investor role. Use this for an investor expected to return across a raise: they have a durable identity, and you can change what they see over time without re-inviting them.

Guest investor. The investor opens a share link, accepts the NDA and terms, and is issued a short-lived guest session (a signed token, valid for seven days by default) without creating an account. Use this for a wider top-of-funnel send where account friction would cost responses.

Both paths converge at runtime. When the investor opens a file, Waafir resolves their effective permission from the data room's access record. The mechanism differs; the check does not.

Organisation roles

Every member of an organisation has exactly one role, assigned per organisation. The role sets the baseline reach before any per-data-room tuning.

Note the asymmetry: owners, admins, and members all bypass the per-data-room access table entirely — they implicitly reach every data room in their own organisation. Only investors are per-data-room: their reach is exactly the set of data rooms they hold an explicit grant for, and nothing else.

Data room permissions

Within a data room, an investor's grant carries one of four permission tiers. This controls how much of a deal an investor sees.

Most investors sit at viewer or downloader: they read the deal, not change it. Contributor covers the rarer case where an investor must upload — a signed term sheet or a counter-proposal. Manager is normally a deal-team tier, not an investor one.

A fine-grained override layer also exists: individual files or folders can carry their own permission that takes precedence over the data-room-level grant. Use it for exceptions ("this one investor can also see the cap table"), not as the primary mechanism. The data-room tier should carry the weight of access decisions.

What an investor never sees

Some surfaces are deal-team-only by design — a guarantee, not an implementation detail. A registered or guest investor never sees engagement analytics, audit logs, the identities of other investors, or the deal team's internal activity. The engagement analytics page details the analytics side of this boundary.

Share links and NDA gating

A share link is the entry point for guest investors. When you create one, choose its mode:

• Open — anyone with the link enters their email, accepts the NDA and terms, and is in. Best for a broad send prioritising reach.
• Restricted — only emails on the link's allow-list can enter; everyone else is turned away. Best when you know exactly who should have access.

In both modes the investor accepts the NDA and terms before any document is visible. Acceptance is recorded as a consent record — email, timestamp, IP, and user-agent — an auditable trail that the person agreed to the terms before seeing anything. Only then is the guest session issued.

The guest session does not carry the permission tier. The tier is evaluated live on every file request from the data room's access record. This is what makes a permission change or revocation take effect immediately, without waiting for a session to expire.

Waiving the NDA for one person

Sometimes a person is already covered, for example by an NDA signed on paper. In Investors, open the person's Change access level and switch NDA required off. Waafir records who waived it and when. You can add a reason, such as "Signed on paper", or a link to the agreement that covers them. Both are optional. Switching the NDA back on is recorded the same way. Every change appears in the audit log.

A firm's NDA

When an investor firm has signed an NDA with your organisation, attach it to the firm once and its members skip the NDA step in every one of your data rooms.

1. In Investors, open the firm's actions and choose Attach executed NDA. If the people sit under their email domain with no firm yet, use Name this firm first: everyone listed becomes a member.
2. Pick the fully signed envelope from E-signatures, or upload the signed PDF if it was signed outside Waafir. The list shows the envelopes you can see: ones you sent or signed, and ones whose documents you can open. An envelope a colleague sent from their Personal workspace is never listed, because nobody else sees a personal file; its sender attaches it. Anyone on your deal team can attach an NDA envelope they sent themselves: in E-signatures, open the completed envelope's actions, choose Attach as firm NDA, pick the firm and confirm the execution date and term. An upload is kept as a completed envelope marked signed outside Waafir, so it never looks Waafir-sealed.
3. Optionally choose Read the PDF. Waafir proposes the signatories, the execution date and the term. Check each value and tick it as confirmed. Nothing is saved until every value is confirmed.
4. Choose Attach NDA. An uploaded NDA's signatories are emailed the executed copy.

Covered members accept only the terms of use and privacy policy. They are covered through their membership of the firm, never through their email domain alone. The firm row shows Firm NDA executed with its date, and links to the signed copy. Every member of your organisation's deal team and every member of the firm can open it. Guests and share-link visitors cannot.

Adding people to a firm

Only a member of a firm is covered by its NDA. Waafir never makes someone a member because of their email address. It suggests the firm, and you confirm.

• Inviting into a firm. Choose Invite someone else at a firm from the firm's row. Everyone you invite there becomes a member.
• Inviting from the header. When an address is on a firm's email domain, the invite panel shows the firm with Add to the firm. It is off until you turn it on. Turned on, the invitee becomes a member once the invite is sent.
• Suggested people. Someone whose email domain matches a firm, but who was never added to it, is listed under the firm marked Suggested. They are not covered. Choose Confirm member to add them.

When someone joins a firm with an executed NDA, they are covered from that moment, and Waafir tells you so. Merging a firm into one with an executed NDA covers the merged firm's people in the same way. Each of their pending invites that asked for an NDA is recorded in the audit log as met by the firm's NDA. The invite keeps its own setting, so it applies again if the firm's NDA ends.

If the NDA has a term, coverage ends when it expires. You can also choose Revoke firm NDA, with an optional reason. Either way, members must accept your standard NDA on their next room entry. The signed copy and its history are kept.

Signing a firm NDA on Waafir

You can also have the firm sign its NDA on Waafir.

1. Open a data room that holds the NDA document.
2. In Investors, open the firm's actions and choose Start firm NDA. The usual signature request opens with the firm's people already added as signers. Add yourself if you want to countersign.
3. Pick the NDA document and set its term: no expiry, a fixed end date, or a number of months from signing.
4. Place the fields and send.

While it is out for signature, the firm row shows Firm NDA out for signature. The firm's people cannot open your data rooms yet, even if they accepted your standard NDA before. They see: "Your firm's NDA with this organization is still being signed. You can open the data room once it is fully signed."

The NDA counts as executed once everyone on the firm's side has signed. Your countersignature can follow later and does not hold them up. The firm's people are then emailed that they can go in, and every signer gets the executed copy by email once the last signature is in.

If the request is voided, declined or expires before everyone on the firm's side has signed, the hold is lifted and the firm's people go back to your standard NDA rules. Withdraw firm NDA does the same and voids the request.

Once the firm's side has signed, the NDA stays executed even if the request then expires or is declined before your countersignature. The firm's people stay covered, and your organisation's owners and admins are emailed once that the countersignature is missing. The firm row says the countersignature is outstanding, or that it was never given, and offers the signed copy only once everyone has signed. To end the NDA, choose Revoke firm NDA.

Voiding the request after the firm's side has signed ends the NDA, the same as revoking it. Waafir warns you before you void.

With a term, the deal team's owners and admins are emailed 30 days before the NDA expires. After it expires, the firm row shows Firm NDA expired and the firm's people fall back to your standard NDA rules on their next request. To renew, choose Renew firm NDA (or attach a newly executed NDA); the expired record is kept in the history.

What the NDA badge on the investor list means

A firm's row counts only the people who still have to accept the NDA. People whose NDA is waived are never counted as pending.

The investor lifecycle

A registered investor moves through a predictable arc. Each step maps to a concrete operation.

1. Invite. The deal team invites the investor (POST /api/investors/invite), which sends a sign-in link.
2. NDA and terms. The investor accepts the NDA and terms before any document is reachable. Consent is recorded.
3. Optional identity verification. The deal team can ask the investor to verify their identity, and pays for it. It does not gate access: a verified investor gets a verified icon beside their name. The KYC and KYB page covers this flow in depth.
4. Active. The investor reads the data room at the granted permission tier.
5. Role or permission change. The deal team adjusts what the investor can do (PATCH /api/investors/[id]/role) — for example, moving an investor from viewer to downloader past first screen. The change is live on the next file request.
6. Extension. An access grant nearing expiry can be extended (POST /api/investors/[id]/extend) without re-inviting.
7. Revocation. The deal team revokes access (DELETE /api/investors/[id]/access). Revocation is durable: a revoked investor cannot regain entry by re-clicking a share link, regardless of the link's mode. Only explicit reinstatement by the deal team restores access, by design.

Access requests and reinstatement

If someone reaches a restricted share link without being on the allow-list, they can request access. The request lands with the deal team, who can approve it — moving the person to a pending invite — or reject it. Approval also restores any file-level permissions the person previously held, so an approved re-entry resumes where they left off.

This covers a common case: an investor forwards the deal to a colleague, the colleague hits the link, and the deal team decides on the spot whether to grant access — without pre-enumerating every possible email.