I wouldn't even give the founder of the company root access unless he had a legitimate reason to need it; let alone outside investors. That's a security issue,

I wouldn't even give the founder of the company root access unless he had a legitimate reason to need it; let alone outside investors. That's a security issue, and to a large extent you have to protect people from themselves (carrying an SSH key on your laptop comes with a lot of responsibility that that person might not be prepared to wield, or even understand). Codebase, maybe; but that's because not-all projects have a convincing reason to keep the codebase private in the first place. (Think single-page applications where all the code is available to the browser anyway). If your competitive edge is based on the particular construction of your codebase, or you have some secret-sauce in there that is ahead of it's time (and not just standard-practice kind of code) then you should treat that codebase like a bank vault. I'd err on the side of caution. Give speedy curated walkthroughs of the codebase (so they can see it and do some due-diligence to make sure your engineers are competent), then lock them back out.