A due diligence process run through email and a shared Drive folder loses track of what has been reviewed, what is still outstanding, and whether anything concerning has surfaced, until someone manually audits the whole thing days before signing. This workflow gates access behind a signed NDA, classifies every uploaded document against your DD checklist automatically, and has AI flag concerning clauses the moment a document lands, not during a last-minute review sprint.
Workflow diagram
flowchart TD
A[New DD Request] --> B[Send NDA]
B --> C[Wait Signature]
C --> D[Provision Data Room]
D --> E[Send Access + Checklist]
F[Document Uploaded] --> G[AI Classify Type]
G --> H{Checklist Category}
H -->|Financials| I[Update Financials]
H -->|Contracts| J[Update Contracts]
H -->|Other| K[Update Other]
I --> L[Merge Checklist]
J --> L
K --> L
L --> M[AI Scan Red Flags]
M --> N{Red Flag?}
N -->|Yes| O[Alert Deal Team]
N -->|No| P[Merge]
O --> P
P --> Q[Log Document & Summary]
R[Daily Schedule] --> S[Get Completion %]
S --> T{100% Complete?}
T -->|Yes| U[Notify Deal Lead]
T -->|No| V[Send Missing Items Reminder]
W[Access Event] --> X[Store Access Log] Every branch shown here (IF/Switch outcomes) exists as a real conditional in the downloadable JSON, not a simplification for this diagram.
Why the NDA gate is a hard stop, not a formality
Wait For NDA Signature blocks Provision Data Room Folder Structure entirely until DocuSign confirms full execution. This sounds obvious, but the actual failure mode in real deals is a data room link shared informally "while the NDA is being finalized," which has caused real legal exposure in transactions that later fell through. The workflow makes the sequence structurally impossible to skip.
Classification and checklist tracking as documents arrive, not at the end
AI Classify Document Type reads each upload and routes it to the correct DD checklist category (financials, contracts, HR, IP, litigation) automatically, updating completion percentage in real time. This replaces the alternative most deal teams actually use: a spreadsheet someone updates manually, usually a day or more behind the actual data room state.
The Daily Checklist Check Schedule branch means the deal lead always knows current completion status without asking, and the counterparty gets a specific, current list of what remains outstanding rather than a generic reminder.
Red-flag detection at the moment of upload, when it is still useful
AI Scan For Red Flags checks each document for the specific things that actually change deal terms: change-of-control clauses that could trigger on the transaction itself, undisclosed litigation, unusual indemnification language. Alert Deal Team Immediately fires the moment something is found, while there is still time to investigate and factor it into negotiation, not during a final review when the timeline has no slack left.
Every access event is also logged via Store Access Log, giving a complete audit trail of who viewed what and when, which is both a security control and frequently a specific requirement from legal counsel on either side of the transaction.
Node-by-node reference
| Node | Type | Role |
|---|---|---|
| Wait For NDA Signature | Wait (webhook resume) | Structurally blocks data room access before NDA execution |
| Provision Data Room Folder Structure | HTTP Request | Creates the standard DD folder tree automatically |
| AI Classify Document Type | HTTP Request | Routes each upload to the correct checklist category in real time |
| AI Scan For Red Flags | HTTP Request | Flags concerning clauses at upload time, not during final review |
| Daily Checklist Check Schedule branch | Schedule Trigger + IF | Always-current completion status without manual tracking |
| Store Access Log | Webhook + HTTP Request | Full audit trail of who viewed what and when |
26 total nodes in the downloadable file, including sticky-note documentation embedded directly on the canvas.
Key logic, in code
Checklist completion calculation
const totalRequiredDocs = $json.checklistItems.length;
const uploadedDocs = $json.checklistItems.filter(i => i.status === 'uploaded').length;
const completionPercent = Math.round((uploadedDocs / totalRequiredDocs) * 100);
return [{
json: {
...$json,
completionPercent,
missingItems: $json.checklistItems.filter(i => i.status !== 'uploaded').map(i => i.name),
}
}];Before / after
| Metric | Before | After this workflow |
|---|---|---|
| Checklist completion visibility | Manually updated spreadsheet, often stale | Real-time, updated on every upload |
| Time to flag a concerning clause | During final review, days before signing | Within minutes of upload |
| Access audit trail | Incomplete or nonexistent | Every view logged automatically |
| Data room access before NDA | A real, documented risk in informal processes | Structurally impossible |
Prerequisites
- n8n v1.40+ with webhook-resume Wait support
- DocuSign eSignature API access
- Google Drive OAuth2 or a dedicated virtual data room API
- Anthropic API key for classification and red-flag scanning
- Airtable PAT, Slack Bot Token, Resend API key
Common pitfalls
AI red-flag scanning supplements legal review, never replaces it
This surfaces things worth a lawyer's attention faster, it does not substitute for actual legal due diligence on flagged documents.
Access logging requires the data room tool to support event webhooks
Confirm your specific VDR or Drive configuration actually fires access events before relying on Store Access Log for audit purposes.
Checklist categories must match your actual DD framework
Generic categories (financials/contracts/other) are a starting point, tailor them to the specific deal type and industry before relying on completion percentage as a real signal.
Want this deployed, configured and monitored?
The template is free. Wiring in your real credentials, tuning the logic to your business, and keeping it running when an upstream API changes is what we do.
Get my free automation plan →Frequently asked questions
Can this replace a dedicated virtual data room platform?
For smaller deals, this pattern built on Google Drive covers the core need. For large, multi-party transactions with complex permissioning, a dedicated VDR (Datasite, Intralinks) still offers permission granularity this template does not replicate.
What happens if the AI misclassifies a document?
Misclassified documents still get logged and are visible in the checklist for manual correction, they are not silently lost, just temporarily filed under the wrong category until someone notices.
Does this work for both buy-side and sell-side due diligence?
Yes, the same structure works for either side, whoever is uploading the checklist items in a given deal role.