Unified Startup Enablement & Growth Platform

Why Document Management Is a Non-Negotiable for Indian Startups

The average Indian startup generates over 200 legally significant documents in its first two years — from incorporation certificates and shareholder agreements to GST filings, employment contracts, and IP assignments. Losing or mismanaging even one of these during investor due diligence can delay a funding round by weeks or kill it entirely.

Investor due diligence: VCs and PE investors typically request 40–80 documents across legal, financial, and operational categories — all within 2–3 weeks
Regulatory audits: ROC inspections, GST audits, and IT assessments can request documents going back 7–8 years; missing records attract penalties
Dispute resolution: Employment, IP, and co-founder disputes are nearly impossible to resolve without documented agreements
India's DPDP Act 2023: The Digital Personal Data Protection Act requires documented data processing records, consent logs, and breach response procedures

A well-organised document vault is not overhead — it is infrastructure. This guide covers what to store, how to organise it, access controls, and retention timelines under Indian law.

Master Document Checklist — By Category

Category	Documents to Store	Retention Period	Authority / Act
INCORPORATION & CORPORATE
Certificate of Incorporation	CoI from ROC / MCA, PAN, TAN, CIN	Permanent	Companies Act 2013
MoA & AoA	Memorandum and Articles of Association — original + all amendments (MGT-14 filings)	Permanent	Companies Act 2013, Sec 10
Board Resolutions	All board meeting minutes, circular resolutions, shareholder meeting minutes	8 years	Companies Act 2013, Sec 118
Register of Members	Share register, ESOP register, cap table snapshots at each allotment date	Permanent	Companies Act 2013, Sec 88
ROC Filings	All MGT-7, AOC-4, PAS-3, SH-7, DIR-12 annual and event-based filings with SRN numbers	8 years	Companies Act 2013
EQUITY & INVESTMENT
Shareholder Agreements	SHA with each investor round — term sheet, SHA, SPA, subscription agreement	Permanent (+ 6 years post-termination)	Indian Contract Act 1872
ESOP Plan & Grant Letters	Board-approved ESOP scheme, individual grant letters, exercise notices, vesting schedules	Permanent	SEBI (SBEB) Regulations 2021
Valuation Reports	FMV valuation certificates from CA/merchant banker at each funding round (required for FEMA compliance)	8 years	FEMA NDI Rules 2019
FEMA Filings	FC-GPR, FC-TRS filings with RBI for foreign investment; ECB forms for foreign debt	10 years	FEMA 1999, RBI Regulations
TAX & FINANCE
Financial Statements	Audited P&L, Balance Sheet, Cash Flow — Schedule III format; all working papers	8 years from end of relevant assessment year	Income Tax Act 1961, Sec 44AA
GST Records	GSTR-1, GSTR-3B, GSTR-9 annual returns; all invoices issued and received; ITC claim workings	6 years from due date of annual return	GST Act 2017, Sec 36
TDS Records	Form 16A (vendor TDS), Form 16 (employee TDS), 26Q/27Q quarterly returns, TRACES certificates	7 years	Income Tax Act 1961
Bank Statements	All business account statements, investment account statements, FD certificates	8 years	RBI Guidelines, IT Act
HR & EMPLOYMENT
Employment Contracts	Offer letters, employment agreements, NDA/NCA, IP assignment agreements for all employees	6 years after separation	Indian Contract Act 1872
PF & ESI Records	EPF registration, monthly ECR challans, employee PF contribution records, Form 5A	5 years	EPF & MP Act 1952
Payroll Records	Monthly salary slips, payroll register, full & final settlement records	7 years	Payment of Wages Act, IT Act
IP & TECHNOLOGY
Patent Filings	Provisional and complete patent applications, correspondence with Indian Patent Office	Permanent (20-year patent life)	Patents Act 1970
Trademark Registrations	TM application receipts, registration certificates, renewal reminders	Permanent (10-year cycles)	Trade Marks Act 1999
Software Licences	Open-source licence compliance records, commercial software licences, SaaS subscription agreements	6 years after expiry	Copyright Act 1957, IT Act 2000
Data Processing Records	Data flow maps, consent logs, DPDP Act compliance documentation, data sharing agreements	As long as data is processed + 3 years	DPDP Act 2023

Investor Data Room — 60-Document Standard Checklist

When a VC or PE fund sends a term sheet, they will typically follow with a due diligence request list within 48–72 hours. Having these documents instantly accessible in a structured data room can cut due diligence time from 12 weeks to 4–6 weeks — a significant competitive advantage in competitive rounds.

                Data Room Folder Structure (Standard VC Format)
                01 — Corporate: CoI, MoA/AoA, board resolutions, statutory registers, ROC filings
— Cap Table: Fully diluted cap table, all SHA/SPAs, ESOP plan, grant letters
— Financials: Audited statements (3 years), MIS reports (12 months), GST returns, bank statements
— Tax: ITR filings (3 years), TDS returns, advance tax workings, 80-IAC/DPIIT certificates
— Legal & Contracts: Key customer contracts, vendor agreements, NDAs, lease agreements
— HR: Org chart, employment contract templates, ESOP grants, PF/ESI registration
— IP: Patent filings, trademark certificates, domain registrations, software IP assignments
— Product: Technical architecture, security audit reports, penetration test results
— Regulatory: All licences (DPIIT, FSSAI, RBI, IRDAI, etc.), compliance certificates
— Business Plan: Latest business plan, financial model, pitch deck

            

Access Control Best Practices

View-only by default: Grant investors view-only access; never give download access unless explicitly agreed in the NDA
Watermarked PDFs: Watermark every document with the recipient's name and date — discourages unauthorised sharing
Audit trails: Use data room tools (Corpfy Knowledge Hub, Digify, Firmex, or Google Drive with audit log) to track who viewed which document and when
NDA first: Execute a mutual NDA before sharing any data room link — include provisions on return or destruction of materials
Time-limited access: Set access expiry of 30–60 days; renew if diligence is ongoing; revoke immediately if the process ends

Document Version Control

Use a consistent naming convention: YYYYMMDD_DocumentType_Version (e.g., 20250115_SHA_Series-A_v2.pdf)
Never overwrite files — maintain all versions with clear v1/v2/FINAL suffixes
Maintain a change log for all critical documents (SHA, employment contracts, ESOP plan) noting what changed and who approved
After each funding round, create a sealed archive of all closing documents — label it with the round name and closing date

Document Security & Compliance under Indian Law

Digital Personal Data Protection (DPDP) Act 2023

India's DPDP Act 2023 imposes obligations on how businesses store and process personal data of Indian citizens. For your document vault, this means:

Consent records: Maintain documented proof of consent for every category of personal data you process (employee data, customer data, vendor contact data)
Data localisation: Certain categories of sensitive personal data must be stored on servers located in India — ensure your cloud provider has India region availability (AWS Mumbai, GCP Mumbai, Azure Central India)
Breach notification: If a breach occurs, notify the Data Protection Board of India within a prescribed timeframe (rules pending finalisation)
Retention policy: Personal data must be deleted when the purpose for which it was collected has been fulfilled — document your retention-and-deletion policy
Data Fiduciary obligations: Appoint a Data Protection Officer (DPO) if your processing meets the "significant data fiduciary" threshold (to be notified by government)

IT Act 2000 — Electronic Records

Section 4: Electronic records have the same legal effect as paper records if they meet the prescribed standards
Section 65B: Any electronic record presented as evidence in court must be accompanied by a Section 65B certificate from a responsible official — retain the ability to generate this certificate for all business records
Digital signatures: Use Class 3 DSC (Digital Signature Certificate) from TCS, e-Mudhra, or Sify for all statutory filings; store DSC backup securely

Cloud Storage Security Checklist

Encryption at rest (AES-256) and in transit (TLS 1.2+)
Multi-factor authentication (MFA) for all vault users
Role-based access control — Finance team sees financial docs only; HR sees HR docs only
Automated daily backups with point-in-time recovery to a separate region
Annual penetration testing and vulnerability assessment
No personal email accounts for business document access — use company domain email only

Document Retention — Statutory Timelines at a Glance

Document Type	Retention Period	Legal Basis	Consequence of Non-Compliance
Statutory registers (members, directors)	Permanent	Companies Act 2013, Sec 88	Penalty up to ₹5,000/day on company + officers
Board & shareholder meeting minutes	8 years	Companies Act 2013, Sec 118	Penalty up to ₹25,000; officer in default liable
Audited financial statements	8 years from assessment year end	Income Tax Act 1961, Sec 44AA	Penalty ₹25,000 for failure to maintain; scrutiny risk
GST invoices and returns	6 years from annual return due date	CGST Act 2017, Sec 36	GST demand + penalty of 100% of evaded tax
TDS records	7 years	Income Tax Act 1961, Rule 6F	Interest u/s 201 + penalty u/s 271C
PF / ESI contribution records	5 years	EPF & MP Act 1952	Penalty up to ₹5,000 + 1 year imprisonment for wilful default
Employment contracts	6 years after employee separation	Indian Contract Act / Limitation Act 1963	Inability to defend employment disputes; litigation risk
Foreign investment records (FC-GPR, FC-TRS)	10 years	FEMA 1999, RBI Regulations	FEMA penalty up to 3× the amount involved or ₹2 lakh/day
Patent and trademark records	Permanent (life of IP + 3 years)	Patents Act 1970, Trade Marks Act 1999	Loss of IP rights; inability to enforce or defend
Customer contracts (B2B)	3 years after contract end (Limitation Act)	Limitation Act 1963	Cannot enforce contractual rights if disputed after limitation period

Frequently Asked Questions

What is the best tool for managing a startup document vault in India? +

For early-stage startups (pre-Series A), Google Drive or Corpfy Knowledge Hub with a well-structured folder hierarchy works well and is free. Organise by the 10-folder data room structure from the start — retrofitting structure during due diligence is painful. Use Google Drive's audit log to track access.

For Series A and beyond, purpose-built data room tools like Digify, Firmex, or Intralinks offer watermarking, access expiry, granular permissions, and Q&A workflows that investors expect. Indian-specific tools like Corpfy Contract Management offer e-signing with Aadhaar-based authentication, which provides stronger legal standing for agreements under the IT Act 2000.

Are digitally signed documents legally valid in India? +

Yes — under Section 5 of the IT Act 2000, electronic signatures are legally equivalent to handwritten signatures for most business documents. There are two categories: (1) Digital Signature Certificate (DSC) — a cryptographic certificate issued by a licensed Certifying Authority (CA) like TCS, e-Mudhra, or Sify — which is the most legally robust and required for all ROC/MCA filings; and (2) Electronic signatures via platforms like Corpfy Contract Management or Corpfy Contract Management — legally valid for contracts under the IT Act but not accepted for statutory filings.

Documents that require physical signatures (wet ink) by law in India include: property sale deeds, wills, power of attorney, and negotiable instruments (cheques, promissory notes). All other business contracts can be executed digitally.

What happens if we lose a key corporate document like our original MoA? +

All documents filed with the ROC (MoA, AoA, all MGT and AOC forms) are available on the MCA21 portal at mca.gov.in. You can download certified copies of filed documents by paying a nominal fee. For the Certificate of Incorporation, you can request a certified copy from the ROC of the jurisdiction where your company is registered.

This is one key reason to maintain complete records of all SRN (Service Request Numbers) for every filing — it makes retrieval from MCA21 instantaneous. Document these SRNs in your vault index alongside the actual documents.

How should we handle document access when an employee or co-founder leaves? +

Immediately on separation (same day if possible): revoke all access to the document vault and any shared drives. Change passwords to any shared accounts the departing person had access to. Ensure the Full & Final settlement letter includes a clause confirming return or deletion of all company confidential documents from personal devices.

For a departing co-founder, this is especially critical — ensure their NDA, IP assignment agreement, and non-compete obligations are documented and that their access to the cap table data room is revoked. For founders leaving before a vesting cliff, retrieve all unvested equity documentation and prepare a share cancellation board resolution.

What documents are required specifically for DPIIT recognition? +

The DPIIT recognition application on startupindia.gov.in requires: Certificate of Incorporation (or registration certificate for LLP/Partnership), a brief description of innovation/scalability of the business (300–500 words), and the company PAN. For IMB (Inter-Ministerial Board) approval under Section 80-IAC (the profit deduction benefit), additional documents are required: audited financials, business plan, customer references demonstrating innovation, and a detailed innovation narrative.

DPIIT recognition does not require an in-person visit — it is entirely online. The recognition is typically granted within 2–4 weeks if the application is complete and the business description clearly demonstrates innovation, scalability, and potential for employment or wealth creation.

Key Takeaways for Document Vault

Structure Your Vault Before You Need It — Not During Due Diligence:

Retrofitting a document structure when a VC sends a 60-item due diligence list is the worst possible time to get organised. Implement the 10-folder data room structure from the month of incorporation. Founders who have an organised vault close funding rounds 4–6 weeks faster than those who scramble to locate documents under pressure.

Statutory Retention Periods Are Legal Minimums, Not Suggestions:

GST records must be kept 6 years, financial statements 8 years, FEMA filings 10 years, and statutory registers permanently. Deleting records before these periods — even accidentally — creates regulatory exposure. Build a retention schedule and automate deletion reminders only after the statutory period has expired.

Revoke Access Immediately When Someone Leaves:

On the day any employee or co-founder separates, revoke all document vault access, change shared account passwords, and confirm return of confidential materials in the Full & Final settlement letter. For departing co-founders, ensure ESOP and share-related documents reflect the separation accurately and are stored with a clear audit trail.

Digital Signatures Are Legally Valid for Almost All Business Documents:

Under the IT Act 2000, electronically signed contracts carry the same legal weight as wet-ink signatures for nearly all business agreements. Use DSC (Digital Signature Certificate) for all MCA/ROC filings and Aadhaar-based eSign platforms like Corpfy Contract Management for commercial contracts. The only exceptions requiring wet ink are property deeds, wills, and negotiable instruments.

India's DPDP Act 2023 Requires Documented Data Processing Records:

The Digital Personal Data Protection Act 2023 mandates documented consent logs, data flow maps, and breach response procedures for any business processing personal data of Indian citizens. These records must be maintained as long as data is processed plus 3 years. Non-compliance can attract penalties from the Data Protection Board of India — treat DPDP documentation as a required business record from 2024 onwards.

MCA21 Is Your Recovery Mechanism for Lost Corporate Documents:

Every document filed with the ROC — MoA, AoA, all annual and event-based forms — is permanently available on the MCA21 portal. Maintain a log of every SRN (Service Request Number) for all filings, which makes retrieval instantaneous. This is why ROC compliance records are as important as the documents themselves.

Inside Corpfy Document Vault

Corpfy Vault is a secure document store organised to mirror your company's operational structure — Finance, Legal, HR, Compliance, and Product folders — with role-based access so your finance team only sees finance documents and your legal team only sees what they need. Documents are auto-saved from connected Corpfy dashboards so your vault is always current without manual uploads.

What you get in the dashboard

Feature	What it does	Founder benefit
Structured Folder Hierarchy	Pre-built folder structure matching Corpfy modules: Finance, Legal, HR, Compliance, Product — with sub-folders per function	Documents are findable in seconds — no more "it's somewhere in the shared Drive" conversations
Role-Based Access Control	Each folder has defined roles: Admin, Finance, Legal, HR, Advisor — users see only the folders their role permits	Sensitive payroll and legal documents aren't visible to every team member by default
Auto-Save from Dashboards	Tax compliance filings, payroll runs, policy documents, and IP filings are saved to Vault automatically from their respective dashboards	The vault stays current without anyone manually uploading — compliance evidence is there when an auditor asks
Investor Data Room	Share specific folders with investors via a view-only link — tracks who viewed what and when	Professional data room experience without paying for a separate VDR tool
Version History	Every document version is preserved with timestamp and author — restore any prior version	Legal documents especially need version control — know exactly which version was signed and when