# How to Build a Company Brain Workflow for Due Diligence

A company brain workflow for due diligence centralizes corporate charters, financial audits, and commercial contracts into a role-restricted workspace where deal teams and AI agents conduct instant, source-attributed inquiries. By pairing scheduled Cloud Sync with automated document indexing and Metadata Views, acquisition teams cut manual document hunts while keeping confidential deal materials strictly isolated from unapproved personnel.

Source: https://fast.io/resources/company-brain-workflow-due-diligence/
Author: [Derek Labian](https://fast.io/authors/derek-labian/)
Last reviewed: 2026-11-13

## Why Build a Company Brain Workflow for Due Diligence

During an acquisition review or regulatory audit, deal teams rarely stall from an absence of records; they stall because critical terms remain trapped across thousands of unindexed contracts, board minutes, and financial schedules. When buyers ask whether commercial contracts contain change-of-control covenants or assignment restrictions, analysts spend days combing through nested directories, while generic AI chatbots can hallucinate deal terms without verifying clauses against source documents.

Virtual data rooms are built to share transaction files with outside parties under controlled access. The working analysis often happens elsewhere: deal teams assemble disclosure schedules, cross-reference contract amendments, and copy figures into external spreadsheets. When diligence inquiries arrive from buy-side counsel, transaction advisors spend billable hours hunting for specific exhibits instead of evaluating legal risk.

A due diligence company brain is an isolated, permission-bounded workspace containing corporate governance, financial records, and legal contracts indexed for instant, source-attributed semantic review by auditors and acquisition teams. Rather than scattering files across static folders or unmanaged cloud storage, an [intelligent workspace](/product/workspaces/) automatically indexes corporate records upon arrival. Deal teams and authorized AI agents can ask complex questions across the entire document corpus, receiving direct answers that cite the specific file, page, and excerpt supporting each finding.

### The Operational Overhead of Scattered Diligence Assets

In corporate transactions, records originate across fragmented systems. Balance sheets and tax returns live in accounting software or financial drives. Customer agreements reside in sales storage, while patent filings, board minutes, and employment contracts remain isolated in legal repositories. 

Assembling these records into a traditional deal room can create version confusion. Corporate development teams download outdated file versions from local drives, re-upload them to external portals, and lose the revision context. When sellers update a schedule late in the review cycle, buyers often continue reviewing obsolete drafts.

Data room providers increasingly add AI for redaction, bulk Q&A, and search, and some connect AI assistants through MCP servers. What still differs is where the team's working files live. A unified [company brain](/product/company-brain/) keeps the source files, review notes, and agent outputs in one operational workspace where files remain versioned, searchable by meaning, and queryable.

### Why Consumer AI Chatbots Fail Transactional Scrutiny

Confronted with tight diligence deadlines, deal teams often consider feeding commercial contracts into public AI chat interfaces to summarize key terms. This approach introduces serious operational and legal vulnerabilities.

Consumer AI chatbots lack awareness of corporate confidentiality boundaries. Pasting unannounced financial statements, intellectual property disclosures, or customer concentration schedules into public models risks exposing non-public information.

General language models also lack rigorous grounding mechanisms. A consumer chatbot asked to identify termination penalties across fifty supplier agreements will generate fluent summaries that gloss over critical carve-outs, miscalculate notice periods, or invent clauses that do not exist in the executed agreements. Legal and financial diligence permits zero tolerance for hallucination. Reviewers require precise, clause-level grounding where every asserted fact connects directly to a cited source page.

## How to Isolate Diligence Workspaces with Permissions and Cloud Sync

Constructing an effective due diligence company brain requires strict access boundaries. Transaction materials contain sensitive enterprise data: executive severance terms, unredacted customer lists, capitalization tables, and pending litigation assessments. Allowing diligence materials to share permissions with everyday operational workspaces invites catastrophic data leaks.

Fast.io manages permissions per organization, workspace, and share through member roles. Workspace roles include owner, admin, member, guest, and view. Within a workspace, every member accesses all files according to their designated role; Fast.io enforces no folder-level or file-level permissions. This boundary means confidential deal records live in an isolated workspace rather than behind fragile subfolder permissions.

### Restricting Workspace Join Settings for Transaction Enclaves

By default, a Fast.io workspace allows any member of the parent organization to join. While this open posture supports general internal collaboration, a due diligence company brain requires an isolated enclave.

To secure the transaction room, administrators must restrict the workspace join setting to invite-only. Once restricted, general employees within the organization cannot join the workspace without an invitation. Restrict the member-management setting to admins and owners as well, since by default any workspace member can add others, so access stays with designated corporate officers, legal counsel, and authorized transaction advisors.

Connected AI agents operate with the permissions of the user account that provisioned their API key or OAuth connection. When connecting an autonomous agent for contract review, provision the agent through an account restricted solely to the diligence workspace. On the OAuth Review Permissions screen, grant the agent access only to the transaction space. Because answers come only from the workspaces and shares the connecting account belongs to, an account that belongs only to the diligence workspace keeps the agent's searches inside the transaction.

### Scheduled Cloud Sync Without Permission Leakage

Transaction teams rarely need to migrate existing file systems manually. Fast.io [Cloud Sync](/product/cloud-sync/) connects Google Drive, Dropbox, Box, and OneDrive folders directly to a workspace. SharePoint document libraries connect through the OneDrive connector. Cloud Sync runs one-way or two-way, on a schedule or on demand.

Files synced into a workspace take the Fast.io workspace's member roles. The source drive's sharing settings do not carry over.

When accounting teams maintain financial audits in corporate Google Drive folders, scheduled Cloud Sync pulls those files into the due diligence workspace. Staff members who hold view access to the original Google Drive folder cannot access or query those documents inside Fast.io unless they are added to the diligence workspace. The transaction enclave remains protected from ambient corporate access.

## How to Extract Structured Contract Terms with Metadata Views

Unstructured semantic search helps reviewers answer broad narrative questions, but mergers and acquisitions diligence demands structured comparative analysis across full portfolios. Deal teams must review hundreds of commercial contracts to identify change-of-control provisions, governing law jurisdictions, non-compete covenants, and liability limits. Manually compiling these data points into comparison tables takes weeks of junior attorney time and introduces mechanical transcription errors.

Fast.io solves this structural challenge through [Metadata Views](/product/document-data-extraction/). Metadata Views turn unstructured documents into a live, queryable database. Users describe the fields they need extracted using plain language, and the system automatically designs a typed schema across formats including Text, Integer, Decimal, Boolean, URL, JSON, and Date & Time. Reviewers can filter and sort findings across the whole collection.

### Defining a Standard M&A Diligence Schema

Setting up a Metadata View requires no manual template building, bounding-box training, or brittle optical character recognition rules. Reviewers describe their analytical targets, and the system extracts structured values across scanned PDFs, Word documents, and spreadsheets.

A standard due diligence Metadata View incorporates essential contractual dimensions:

* **Agreement Title (Text)**: The formal legal name of the contract.
* **Counterparty Name (Text)**: The primary entity bound by the agreement.
* **Execution Date (Date & Time)**: The formal effective or signing date.
* **Governing Law Jurisdiction (Text)**: The governing legal jurisdiction specified in the contract.
* **Change of Control Flag (Boolean)**: Identifies whether an ownership transfer or merger requires counterparty notice or consent.
* **Assignment Consent Required (Boolean)**: Flags whether the contract restricts assignment to an acquiring entity without prior written approval.
* **Limitation of Liability (Text or Decimal)**: The financial cap on damages, expressed as a fixed currency amount or contract multiplier ratio.
* **Termination Notice Period (Integer)**: The required advance notice window in days for non-renewal or convenience termination.

If a buyer suddenly requests audit data on intellectual property indemnification caps, teams can add a new column to the Metadata View without reprocessing or re-uploading the document collection.

### Differentiating Intelligence Mode from Metadata Views

Understanding the distinction between Intelligence Mode and Metadata Views is essential for building an effective due diligence workflow:

* **Intelligence Mode**: Operates as the unstructured retrieval and reasoning layer. It indexes text upon upload, enabling semantic search, document summarization, and interactive conversational queries with exact snippet citations.
* **Metadata Views**: Operates as the structured data extraction layer. It extracts discrete, typed parameters across multiple files into a filterable, sortable spreadsheet.

Combining both capabilities provides complete diligence coverage. Analysts use Metadata Views to filter for all contracts where the Change of Control Flag is True and the Termination Notice Period exceeds thirty days. Once filtered, analysts use Intelligence Mode to query those specific agreements regarding exact assignment exceptions and penalty calculations.

## How to Connect Autonomous AI Agents for Diligence Review

A company brain workflow becomes substantially faster when autonomous AI agents assist human deal teams with document review, risk scoring, and exhibit verification. Rather than requiring human analysts to prompt a chat interface manually for every agreement, autonomous agents can systematically examine corporate disclosures using the Model Context Protocol (MCP).

Fast.io provides a remote MCP server running over Streamable HTTP. The server connects directly to modern AI clients, including Claude Desktop, Claude Code, Cursor, ChatGPT, and custom agent runtimes, without requiring local software packages or complex proxy daemons. Agents and humans share the same file context, ensuring that analysis reflects the latest executed agreements and amendments.

### Connecting AI Review Clients to the Remote MCP Server

Connecting an AI agent to a Fast.io due diligence workspace requires zero local package installation. Depending on the client environment, teams connect to dedicated Streamable HTTP endpoints:

* **Claude Desktop and General Agent Clients**: Add a custom connector pointing to `https://mcp.fast.io/mcp/tools` using OAuth authentication in the browser.
* **Coding Agents and IDE Environments (Claude Code, Cursor, VS Code)**: Connect to `https://mcp.fast.io/mcp/code`. In Claude Code, run `claude mcp add --transport http fast-io https://mcp.fast.io/mcp/code` and authenticate with OAuth in the browser. In Cursor, configure `~/.cursor/mcp.json` with the `/mcp/code` URL.
* **ChatGPT and Codex Environments**: Install the Fast.io plugin from the plugin directory, or configure a custom MCP connector at `https://mcp.fast.io/mcp/operations`.

Step-by-step setup guides are documented at `https://mcp.fast.io/docs`. When reviewers connect with a Read Only scope, tools that alter data are completely withheld from the toolset. The agent has no tool to delete, overwrite, or move sensitive diligence exhibits.

### Citation-Backed Retrieval and Collaborative Notes

When an agent queries a Fast.io workspace with Intelligence Mode enabled, the platform executes a hybrid search combining full-text keywords, semantic embeddings, and metadata values. The search returns exact citations detailing the source file name, page number, and text excerpt.

Prompt instructions direct the agent to ground its findings strictly in retrieved citations:

```markdown
You are an M&A diligence review agent inspecting commercial contracts in the Diligence Workspace.
Analyze retrieved documents for assignment restrictions, change-of-control triggers, and governing law.
For every finding, cite the document title, the page, and the quoted text provided in the context.
If an exhibit or disclosure is missing or ambiguous, explicitly flag it in the discrepancy register.
Do not assume or extrapolate terms that are not supported by the cited text.
```

Agents record their findings directly in Fast.io Collaborative Notes kept alongside the repository files. Notes co-edit live, so people and agents with the same note open see each other's labeled cursors and edits as they type, allowing human auditors and AI agents to maintain structured discrepancy logs, diligence memos, and disclosure summaries that remain fully auditable.

When multiple agents or human reviewers analyze contracts concurrently, advisory per-file locks help avoid overlapping work. Agents acquire advisory leases via `lock-acquire` on `storage_manage` and check status via `lock-status` on `storage`. If a lease expires without a heartbeat, other reviewers can safely proceed without blocking the review pipeline.

## Compare Diligence Delivery Options, Activity Tracking, and Costs

Once internal legal and financial teams verify disclosure materials, the transaction enters external review. Buy-side investment teams, outside counsel, forensic accountants, and regulatory auditors must inspect corporate records under strict distribution controls without jeopardizing confidentiality. Traditional diligence workflows often break down during external delivery because administrators lose track of which counterparties hold local copies of sensitive schedules.

Fast.io provides branded shares that give external reviewers controlled web access to specific folders or documents without consuming organization user seats. Deal teams preserve operational momentum while enforcing granular delivery parameters across counterparties, ensuring that sensitive financial disclosures remain bounded within authorized review windows.

### Delivering Scoped Shares to Buy-Side Reviewers

Administrators create customized shares (Send, Receive, or Exchange) tailored to external transaction parties:

* **Expiring Links**: Set shares to expire automatically on transaction closing dates or upon conclusion of exclusivity periods.
* **Download Restrictions**: Disable file downloads on sensitive shares. External auditors inspect balance sheets and IP filings directly in the browser viewer instead of saving local copies to buyer laptops.
* **Branded Portals**: Apply company branding to delivery portals, presenting professional disclosure packages that reflect corporate authority.

Because permissions in Fast.io are set per organization, workspace, and share by member role, external reviewers accessing a share only reach the specific files assigned to that share. They cannot inspect other transaction folders, discover internal review notes, or browse unrelated corporate workspaces.

### Maintaining Audit Integrity with the Detailed Activity Log

Maintaining a verifiable record of document revisions is essential for transaction defense. Fast.io maintains a detailed activity log that records system changes, including file uploads, content edits, file moves, deletions, member additions, permission updates, and share creations.

The activity log tracks modifications across human operators and automated AI agents alike. If an agent uploads a revised disclosure summary or an administrator adjusts a reviewer's role, the activity log captures the exact identity, action, and timestamp.

The activity log records changes rather than read-only events. It does not record file views, previews, opens, or downloads, and Fast.io provides no view analytics. Deal teams manage exposure by disabling file downloads on external shares and setting clear expiration parameters.

### Comparing Diligence Architectures

Evaluating corporate diligence solutions requires comparing storage flexibility, intelligence capabilities, and operational friction:

| Diligence Capability | Virtual Data Rooms | Enterprise Search Tools | Standard Cloud Drives | Fast.io Intelligent Workspaces |
| :--- | :--- | :--- | :--- | :--- |
| Core Document Storage | Hosts the deal documents in a room built for controlled outside review | Indexes documents that stay in connected apps | Hosts files in each drive under that drive's sharing model | Active workspace storage with version history and advisory locks |
| Document Intelligence | AI features vary by provider; some add semantic search, bulk Q&A, and redaction | AI search and answers across connected apps | Built-in search; some drives add AI assistants | Built-in Intelligence Mode with hybrid search and page-level citations |
| Structured Extraction | Varies by provider | Search and answers over connected apps | Some drives add AI extraction (Box AI, for example) | Native Metadata Views creating typed, queryable databases |
| Agent Connectivity | Some providers run MCP servers (Datasite, for example) | MCP servers for search over connected apps; the files stay in those apps | Some drives run MCP servers; each covers only its own files | Remote Streamable HTTP MCP server where agents search, take file locks, co-edit Notes, and save outputs beside the sources |
| External Reviewer Access | Built for controlled access by outside parties | Built mainly for internal search | Link and folder sharing set in each drive | Branded shares with expiring links and download restrictions |

### Plan Structure and Usage Credits

Fast.io provides predictable subscription pricing based on workspaces, storage capacity, member seats, and usage credits. Every organization operates on a paid subscription.

Monthly plans include a `14-day` free trial that requires a credit card:

* **Starter (`$29/mo` or `$290/year`)**: Includes `5` organization seats, `1 TB` storage, `10` workspaces, and `300,000` credits per month. Maximum upload size is `25 GB`.
* **Business (`$99/mo` or `$990/year`)**: Includes `20` organization seats, `10 TB` storage, `100` workspaces, and `1,200,000` credits per month. Maximum upload size is `50 GB`.
* **Enterprise (`$299/mo` or `$2,990/year`)**: Includes `50` organization seats (additional seats available at `$1` per seat per month, up to `200`), `50 TB` storage, `300` workspaces, and `4,500,000` credits per month. Maximum upload size is `100 GB`.

Credits cover AI work: chat, file ingestion, agent runs, and document processing (including Metadata Views extraction). Additional credits cost `$10` per `100,000` credits. Extra storage is billed at `$0.015` per GB per month, and additional bandwidth costs `$0.04` per GB, billed separately and not in credits.

Because external auditors and buy-side analysts accessing branded shares do not consume member seats, companies can conduct complex transactions on the Business plan with their core deal team.

## Frequently asked questions

### What is a due diligence company brain?

A due diligence company brain is an isolated, permission-bounded workspace containing corporate governance, financial records, and legal contracts indexed for instant, source-attributed semantic review by auditors and acquisition teams. Unlike static data rooms, an intelligent company brain combines automatic semantic indexing, structured metadata extraction, and remote MCP connectivity so human reviewers and AI agents can query contracts with checkable citations.

### How do you organize files for an AI-assisted due diligence workspace?

Organize files into functional workspaces matching key diligence streams, such as Corporate Governance, Commercial Agreements, Financial Audits, and Intellectual Property. Because Fast.io manages permissions at the organization, workspace, and share levels rather than per folder, separate sensitive categories into their own workspaces. Enable Intelligence Mode across each space so incoming contracts and spreadsheets are indexed automatically for hybrid search.

### Can auditors query financial contracts using natural language with checkable citations?

Yes. When Intelligence Mode is enabled, Fast.io combines keyword search, semantic embeddings, and metadata values to answer natural language queries. Every response cites the specific file name, page number, and text excerpt containing the evidence. Auditors can check the exact contractual clause or financial line item without searching manually through hundreds of pages.

### How are permissions controlled in a due diligence company brain?

Permissions are assigned per organization, workspace, and share by member role, including owner, admin, member, guest, and view. Within a workspace, every member reaches all files according to their role; Fast.io enforces no folder-level or file-level permissions. To isolate transaction records, set the workspace join policy to restricted (invite-only). Files imported via Cloud Sync take the Fast.io workspace's permissions exclusively, completely ignoring source drive permissions.

### What is the difference between Intelligence Mode and Metadata Views for due diligence?

Intelligence Mode provides unstructured retrieval-augmented generation, allowing users and agents to run conversational semantic searches that return natural language answers with exact page citations. Metadata Views provide structured data extraction, turning unstructured contracts into a typed, sortable database with columns such as governing law, change of control provisions, and termination notice days without requiring manual OCR templates.

### How do external buyers and legal counsel access files without consuming workspace seats?

External reviewers access disclosure packages through branded shares configured with custom expiration dates and optional password protection. Administrators can disable file downloads, allowing auditors to inspect sensitive agreements in their web browser without saving local copies. External reviewers viewing shared links do not consume organization user seats and do not need to register accounts.

## Sources

- [DFIN: Legal Data Rooms: Secure Document Management and Collaboration](https://www.dfinsolutions.com/knowledge-hub/blog/legal-data-rooms): Virtual data rooms provide centralized repositories where deal teams securely share and review essential disclosures while preserving confidentiality throughout corporate due diligence.
- [Datasite: Data Room Overview](https://www.datasite.com/en/resources/data-room-overview): Due diligence data rooms provide secure environments to organize and share financial, legal, and operational documents while controlling access during transaction reviews.

## About Fast.io

Fast.io provides shared workspaces where people and AI agents work on the same files, with built-in semantic search and citation-backed chat over what they hold. Agents reach it through a remote MCP server, a REST API at https://api.fast.io/current/, and a command line client published on npm as @vividengine/fastio-cli. MCP setup is at https://mcp.fast.io/docs: Claude and most MCP clients connect to https://mcp.fast.io/mcp/tools, ChatGPT to https://mcp.fast.io/mcp/operations, and coding agents to https://mcp.fast.io/mcp/code.