How to Share a Cap Table Securely With Potential Investors

To share a cap table securely, use a document-sharing platform that requires a signed NDA before granting access, disables downloads and watermarks every viewing session with the recipient's identity. A cap table is one of the most sensitive documents in a fundraising process, as it reveals your full ownership structure, individual shareholder stakes and any dilution terms from prior rounds. Sharing it without controls exposes you to significant competitive and legal risk.

---

Why Cap Table Security Matters

Your cap table shows exactly who owns what percentage of your company. This information can be used by competitors to understand your investor relationships, by former employees or co-founders to challenge equity arrangements, and by any bad actor who gains access to identify vulnerabilities in your ownership structure.

In the EU, cap tables often contain personal data — individual shareholder names, identification details and financial interests. Under GDPR, you must handle this data with appropriate technical and organisational measures, and you must be able to demonstrate that you shared it only with authorised recipients.

---

Step 1: Require an NDA Before Granting Access

The first line of defence is legal. Before any investor sees your cap table, they should have signed a non-disclosure agreement that explicitly covers ownership information and fundraising details.

Modern document platforms such as SendNow allow you to gate access behind a digital NDA. The investor must sign before the document is revealed — there is no way to view the content without completing the NDA step. This creates a binding legal agreement and a clear audit record.

Cap table document with NDA gate and download disabled in SendNow

---

Step 2: Disable Downloads

Even after an NDA is signed, the investor should not receive a downloadable copy of your cap table. A downloaded file can be:

• Forwarded to other parties outside the NDA
• Retained indefinitely after the deal closes or falls through
• Shared with competing founders or journalists

Enable download restrictions so the cap table is viewable only within the secure browser session. This is a standard feature on platforms designed for professional document sharing.

Related reading: How to Share a Financial Model With an Investor Securely

---

Step 3: Apply Dynamic Watermarks

Apply a watermark displaying the viewer's email address across every page of the document. This serves as a strong deterrent against photographing the screen and sharing images of your cap table. If a leak does occur, the watermark allows you to identify the source immediately.

NDA gate screen before cap table access in SendNow

---

Step 4: Create Individual Links Per Investor

Generate a unique access link for each investor. This allows you to:

• See exactly when each investor viewed the cap table
• Revoke access for individual investors without affecting others
• Track time spent on the document, which can indicate how carefully it was reviewed

Avoid sharing a single URL with multiple investors. A shared link cannot be selectively revoked and gives you no per-investor visibility.

---

Step 5: Revoke Access After Due Diligence

Once an investor has made their decision, revoke their access to the cap table. For investors who complete the round, you can convert access to a permanent record. For those who pass or are otherwise excluded from the round, revoke access immediately to protect your ownership information going forward.

---

GDPR Considerations for Cap Table Sharing

Cap tables contain personal data in the legal sense under GDPR, including individual names and financial interests. To comply:

• Lawful basis: Use legitimate interests or consent as your basis for processing
• Data minimisation: Share only with investors who have reached due diligence stage
• Access controls: Restrict viewing to authenticated, NDA-signed recipients
• Audit trail: Maintain a log of every access event — when, by whom and for how long

SendNow stores access logs on EU-based infrastructure and provides exportable audit reports, making GDPR compliance straightforward.

Related reading: How to Send Investor Updates That Get Read | Share Pitch Deck with Investors: Complete Guide

---

Cap Table Sharing: Security Methods Compared

---

Frequently Asked Questions

At what stage of fundraising should I share my cap table? Share your cap table after an investor has signed an NDA and you have reached the formal due diligence stage. Do not share it at the pitch stage or in response to casual requests.

Should I share my full cap table or a simplified version? Sharing a simplified version — showing percentage ownership by category (founders, option pool, investors) without individual names — is a reasonable approach early in discussions. Share the full cap table only under NDA during due diligence.

Can investors demand a copy of my cap table? During due diligence, investors may request a downloadable copy for their records. Explain that your process uses a secure viewer and offer to arrange additional review sessions if needed. Most institutional investors accept this.

What information is typically included in a startup cap table? A full cap table includes shareholder names, share class, number of shares, percentage ownership, the price paid per share, and details of any options, warrants or convertible notes.

Is it safe to use a spreadsheet tool like Google Sheets to share a cap table? Google Sheets provides basic access control but no NDA gating, no download prevention, no watermarking and no EU-hosted audit trail. It is not suitable for cap table sharing during a formal fundraise.

What is dynamic watermarking and does it work? Dynamic watermarking overlays the viewer's email or name across the document in real time. It does not prevent viewing but acts as a strong deterrent against forwarding or photographing, and provides traceability if a leak occurs.

How do I handle cap table access for investors based outside the EU? GDPR applies whenever you, as a EU-based data controller, share personal data with anyone, regardless of their location. Use a platform that provides appropriate transfer safeguards and stores data on EU-based servers.

Can I share the cap table with multiple investors simultaneously? Yes, but use separate links for each investor. This maintains individual traceability and lets you revoke access selectively.