Investor information rights: what should a startup report after funding?

Suppose Jacob, Tim and Celina run a SaaS startup, and a fund has just acquired 20% of its shares. The first request is straightforward: revenue, costs and a cash forecast. Celina sends the spreadsheet. A few days later, the fund asks for CRM access so it can check the numbers directly. Customer contracts and individual salaries follow.

Jacob wants to answer promptly. Tim checks the CRM permissions and finds that the proposed account would also reveal customer contacts, sales notes and conversation history. The founders need a process that gives the fund a reliable view of the business and makes the scope of each disclosure clear.

The investor needs to understand how its investment is performing. The startup needs to control who can see its records and customer data. Information rights set out what an investor can receive and inspect. A promise to provide “all information on request” leaves the operating details for the next email thread.

Build the process around regular reports, follow-up inspection and any separately agreed system access. This is a broadly useful approach to investment negotiations; the statutory baseline depends on the company’s jurisdiction and legal form. Below, the Polish sp. z o.o. example explains why a reporting schedule and a shareholder’s legal inspection rights need separate treatment.

What this guide covers

In brief

• Information rights and approval rights serve different purposes. Receiving a report does not itself create a veto.
• Define the recipients, metrics, deadlines and events requiring an earlier update.
• System access needs its own scope and safeguards; inspecting records does not automatically require an unrestricted login.
• Contractual reporting does not erase applicable statutory shareholder rights.
• An investment agreement alone does not authorise unrestricted disclosure of employee or customer personal data.

What should an investor receive each month?

Start with a repeatable package showing cash, customer performance and progress against the plan. The following is a suggested negotiation framework, not a reporting obligation imposed on every startup by law.

Celina proposes the 15th of the following month as the reporting deadline. Jacob asks whether the accounts will be closed by then. Put those decisions in the agreement: who prepares it, who receives it and whether the figures are provisional or reflect the accounting close. Explain subsequent corrections. Otherwise, the same meeting can end up with four spreadsheets and no agreement about which one everyone should use.

Keep forecasts visibly separate from confirmed results. If Jacob expects a large enterprise sale, Celina should identify it as a forecast assumption until the customer signs. It carries a different weight from contracted revenue. Cash collected for an annual subscription is different from monthly recurring revenue. Definitions help the investor understand the business and keep one-off work from appearing as recurring growth.

When does a report need supporting documents?

A summary should make the position understandable, with a route to verify the relevant records. An investor worried about customer concentration can first receive a schedule showing revenue shares, renewal dates and account status. If it raises a specific concern, the next step may be inspection of the relevant contracts or other source documents.

The CRM request becomes easier to assess once the fund explains its concern: does most revenue depend on one customer that has just given notice? Celina prepares a revenue-concentration schedule. Jacob finds the customer contract and termination notice so the figures can be checked. Tim examines which unrelated records a CRM account would expose.

That question can be investigated without automatically exposing every sales note, contact and user support ticket. Equally, the company should not use its summary as a substitute for document access to which the investor is legally entitled.

If additional CRM access is genuinely useful and can lawfully be provided, agree named accounts, visible fields, read-only permissions, export controls and when access ends. These are operating safeguards to design into contractual access, not a licence to obstruct statutory inspection. Administrator permissions usually go well beyond checking revenue.

What belongs in the investment agreement?

Define the company or person responsible for reporting and make sure the document actually binds them. A founder’s promise is not automatically a company obligation to operate an investor portal. If the company signs, check that it is properly represented under the applicable rules.

The information-rights schedule should cover:

• recipients, reporting content, metric definitions and deadlines;
• material events requiring earlier notice, such as a significant dispute or loss of a customer above an agreed threshold;
• follow-up questions and inspections, including coordination, channel and costs;
• confidentiality, advisers and data safeguards;
• duration and any ownership threshold for additional contractual rights;
• delivery of overdue reports, escalation and agreed consequences of breach.

You can see the separation between financial reporting, inspection and confidentiality in the NVCA model Investors’ Rights Agreement. It includes options addressing competitors and protected information. This is a US contractual reference for negotiation questions, not a universal rule or a ready-made document for a Polish company. Statutory waivers and exclusions must be assessed under the law that actually applies.

Discuss the main reporting expectations at term-sheet stage. Do not leave an agreement about “reasonable reporting” to become a dispute over system access after the money arrives.

How should confidentiality work when a fund has competing investments?

Specify permitted purposes and onward recipients, rather than relying on a confidentiality label. Does the information stay with the deal team, reach external advisers or circulate within the fund’s group? Agree safeguards, responsibility for onward disclosure and handling after the right to receive information ends, taking legally required retention into account.

Suppose the fund also invests in a direct competitor. Jacob is concerned about sharing customer-specific pricing and the product roadmap. Identify the actual risk and consider limited recipients, a confidentiality agreement or appropriately supervised inspection. A contractual process can address these concerns, but it must respect the shareholder’s statutory position where applicable. Neither an NDA nor a competitor clause has the same legal effect in every jurisdiction.

Keep supervisory-board membership separate from the fund’s contractual rights. A board representative may receive information in that role subject to duties owed to the company. It should not be assumed that every board document can then be forwarded to the investor’s wider organisation.

What changes when GDPR applies?

Establish the purpose, lawful basis and necessary scope of any personal-data disclosure. An investment agreement does not make employees or users parties to it. Performance of that agreement is therefore not automatically a contract-based lawful basis for processing their data. Statutory inspection and additional reporting need separate assessment under GDPR Articles 5 and 6, including necessity, transparency and security.

When the fund asks for individual salaries, Tim suggests totals by function for routine cost reporting. Celina points out that some functions have only one person in their small team. Removing a name would still leave that person identifiable. Consider aggregation, but check whether it actually reduces identification. Redaction must preserve information required for lawful inspection; it should not become a blanket reason to withhold relevant records.

Treat customer-controlled data separately. Where the SaaS processes personal data on a customer’s behalf, documented instructions and applicable law govern disclosure. A new promise to the investor does not by itself permit an export of user records (GDPR Article 28). Access or recipients outside the EEA also require an assessment under the international-transfer rules in Chapter V.

Polish sp. z o.o.: what can a shareholder inspect without a reporting clause?

As a starting point, every shareholder has an individual inspection right, regardless of its percentage holding. Under Article 212 of the Polish Commercial Companies Code (Polish source), a shareholder may examine the company’s books and documents, request explanations from management and prepare a balance sheet for its own use, alone or with an authorised person.

Jacob cannot dismiss the request simply because the fund owns only 20%. It does not have to control the company to exercise its inspection right. The statutory right does not, however, define a monthly SaaS reporting pack or automatically establish permanent access to every system. Arrange access so that inspection can actually take place.

If the company has a supervisory board or audit committee, its articles of association may limit or exclude individual shareholder inspection under Article 213(3). Establishing the body alone is insufficient; check the articles too. A supervisory board has separate information powers under Article 219, and its members have a continuing duty not to disclose company secrets under Article 214¹. These are Polish rules, not a general description of investor rights worldwide.

When may Polish management refuse inspection?

There must be a justified concern that the shareholder will use the information against the company’s interests and thereby cause significant harm. Article 212(2) sets that threshold. A competing investment is not automatically enough, and simply calling the records confidential does not establish it.

Assess the facts, information requested and possible safeguards. Do not assume that signing any NDA the company proposes is always a statutory prerequisite to inspection.

The shareholder may ask for the refusal to be resolved by a shareholders’ resolution, which should be passed within one month of the request. It can then apply to the registry court within seven days of notification of the resolution, or of the expiry of that month if no resolution was passed. Record the dates immediately if a dispute arises. This is a specific Polish procedure under Article 212(3) and (4).

Keep reporting, inspection and approval separate

Jacob, Tim and Celina can agree a monthly report, earlier notice of material events and meaningful verification of source records, while protecting data and respecting statutory rights. At the next request, the team knows which report to prepare, where to find supporting records and how to check the scope of any system access. The fund knows when to expect information and how to verify it. A fall below an agreed ownership threshold may end enhanced contractual reporting. It does not automatically extinguish statutory rights attached to shares the investor still owns.

Receiving information about proposed borrowing also does not itself give the fund a right to approve it. That belongs to the separate reserved-matters framework, which defines decisions requiring additional consent.

When preparing investment documents, compare the proposed reporting schedule with the actual product, data and team’s operating process. Through our startup legal support, we can help assess that fit and the Polish implementation where relevant. For a discussion about investor information rights, bring the proposed clause, a sample report and the systems the investor wants to access.