To share a cap table securely, you first need to know what one is: a capitalisation table is a document, usually a spreadsheet, that sets out who owns what in your company. It lists every shareholder, the number and class of shares each holds, the resulting ownership percentages, and the effect of any options, warrants or convertible instruments still to convert. It is the single source of truth for the equity structure of a business, and it is one of the first things an investor asks to see. This guide explains what belongs on a cap table, why it is sensitive, and how to share it without emailing a spreadsheet into the wild. It is general information, not legal advice.
For a UK founder, the cap table is both a management tool and a due diligence artefact. Internally it tells you where dilution is heading and how much room you have left in your option pool. Externally it is scrutinised line by line by anyone considering putting money in or buying the company. Because it exposes ownership, valuation history and often personal names, it deserves more care than most founders give it.
What a cap table actually contains
A basic cap table starts with the founders' shareholdings and expands outward as the company raises money and grants equity. At its simplest it shows each holder, the class of shares (ordinary, preference, and so on), the number of shares, and the percentage of the total that represents. From there it grows to capture the full picture of ownership on both a current and a fully diluted basis.
A useful cap table also tracks the instruments that are not yet plain shares but will affect ownership. These include the employee share option pool and how much of it is granted versus unallocated, any warrants, and any convertible loan notes or advance subscription agreements that will turn into equity on a future event. Fully diluted ownership, the figure investors care about most, assumes all of these convert, so it shows what everyone will actually own once the dust settles.
As a company matures, the cap table records the history of financing rounds: the price per share at each round, the pre-money and post-money valuations, and the liquidation preferences and other rights attached to each share class. This is where a cap table stops being a simple ownership list and becomes a map of the economic and control rights across the business. It needs to be consistent with the underlying legal documents, the resolutions that authorised each allotment, and the share certificates. Investors' lawyers will cross-check all of it, which is why the cap table usually sits alongside the corporate and financing documents in a data room, next to the items in our fundraising data room checklist.
Why the cap table is sensitive
A cap table is not just numbers. It reveals who owns your company, how much they paid, at what valuation, and what rights they hold. In the wrong hands that information can be used to work out your financial position, approach your shareholders, or undercut you in a negotiation. It also contains personal data about individuals, which brings UK GDPR obligations into play when you share it.
There is a strategic dimension too. During a raise you may be talking to several investors at once. You do not necessarily want each of them to know the exact terms the others are being offered, or to see the full ownership breakdown before they have shown serious intent. Sharing the cap table as a fixed attachment gives you no control over where it goes next: it can be forwarded, saved, and circulated long after the conversation has cooled. A spreadsheet emailed to a prospective investor is, in practice, a spreadsheet you have lost track of.
The cap table also travels with your most sensitive supporting documents. It tends to be shared in the same breath as your financial model and your pitch deck, all of which reveal something a competitor or an opportunistic party would love to see. Controlling how all three move matters, and the cap table is arguably the most sensitive of the set because it exposes real ownership rather than projections.
How to share a cap table safely
The safe way to share a cap table is to stop thinking of it as a file you send and start thinking of it as a document you grant access to. The difference is control: a sent file is gone, while a granted document can be gated, watched, and withdrawn.
Practically, that means four things. First, gate it: require the recipient to verify their email and enter a one-time code before they can open it, so you know who is actually looking. Second, share it as a unique tracked link per recipient rather than one attachment blasted to everyone, so each investor's access is separate and individually controllable. Third, watch engagement: see whether the person opened it and how long they spent, which tells you who is serious. Fourth, keep the power to revoke: if a conversation ends or an investor drops out, you can cut off access immediately rather than hoping they delete the file.
Doing this by hand across email and a shared drive is where mistakes happen: the wrong version gets sent, an old link stays live, a spreadsheet lands in the wrong inbox. A purpose-built room removes those failure points. For the founder-level context around all this, our guide to the founder agreement covers the ownership arrangements that the cap table ultimately reflects, and our explainer on what visits versus verified analytics really show is worth reading before you rely on engagement data.
How 99 Data Rooms handles this
99 Data Rooms is built for exactly this problem: sharing something sensitive with people you do not fully control, while keeping the ability to see and stop what happens next.
You upload your cap table into a room and gate it. Gating and access control lets you require a verified email and a one-time code before anyone opens the file, and on the Business tier you can require them to accept an NDA first. You then share a tracked, revocable link per recipient, with an expiry if you want one. As investors read, page-by-page analytics show you a clear split between a raw visit and a verified viewer who passed the gate, plus how long they spent, so you can tell genuine interest from a quick glance. On the Business tier you can watermark the document with the viewer's identity, which deters casual forwarding. If a conversation ends, one click revokes access, even mid-scroll, and version history means the number an investor sees is always the current one rather than a stale copy floating in an inbox. Gated, tracked, watermarked, revocable: the cap table stays yours.
Share your cap table securely for free
You can upload your cap table, gate it, share it as a tracked and revocable link, and see exactly who opened it, all inside 99 Data Rooms. The free tier is a real tier, not a trial: three rooms, twenty-five active links, forever, no card required. Start for free, put your cap table behind a gate, and move up only when you want unlimited links, NDA gating or watermarking. The wider platform is in beta and improving fast, but controlled sharing of your most sensitive document already works today.
Sources
- Personal data and data sharing obligations: Information Commissioner's Office, UK GDPR guidance, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
What is the difference between a cap table and a share register?
A share register is the statutory record of members that a company must keep. A cap table is a management document that presents ownership in a more analytical way, including options, warrants and convertibles on a fully diluted basis. They should reconcile with each other, but they serve different purposes.
Should I send my cap table as a spreadsheet by email?
It is the riskiest option. Once sent, you cannot control where the file goes, you cannot tell if it was opened, and you cannot withdraw it. Sharing it through a gated, tracked, revocable link keeps you in control and tells you who actually looked.
Does sharing a cap table involve personal data under UK GDPR?
Usually yes, because it names individual shareholders and often their holdings. That brings UK GDPR obligations into play, so you should share it only with people who need to see it and keep control of access. This is general information, not legal advice.
When should an investor see the full cap table?
Many founders share a summary early and the full, fully diluted cap table once an investor shows serious intent and has entered due diligence. Gating and per-recipient links let you stage access rather than exposing everything at once.
How do I keep the cap table version consistent during a raise?
Keep a single working document in your room and share the link to it rather than exporting copies. Version history means every recipient sees the current figures, and you avoid the classic problem of an out-of-date spreadsheet circulating.