A startup NDA is a confidentiality contract you put in front of someone before they see information your company treats as non-public, and it belongs in a narrower set of situations than most founders assume. Use one with contractors, vendors, technical job candidates doing real assessments, and potential partners exchanging sensitive data. Skip it for casual conversations and investor pitches. And understand what it does not do: it stops disclosure, it does not transfer ownership of anything the receiving party creates.
When You Actually Need One
The trigger is specific. Someone outside your core team is about to see information that has independent economic value because it isn’t publicly known. That describes a handful of recurring situations and not much else.
Contractors and freelancers come first. Before a developer touches your codebase or a designer sees the product roadmap, the agreement should already be signed. The same goes for third-party vendors who need access to backend systems or internal databases to deliver their work. During hiring, an NDA makes sense when a candidate has to review proprietary technology or internal strategy to complete a technical assessment; for a routine interview where you’re describing the role at a high level, it’s friction without a purpose.
Strategic partnership and joint venture discussions are the other common trigger. Once two companies start exchanging financial data, customer metrics, or technical architecture to evaluate a deal, both sides need protection in place before the real conversation starts.
Handing an NDA to every person you meet, including coffee chats with fellow founders, builds a reputation for paranoia without meaningfully protecting anything.
One-Way or Mutual
Two structural options exist, and the wrong choice either leaves gaps or creates needless tension.
A one-way (unilateral) NDA covers situations where only one party is disclosing: employer-employee relationships, consultant engagements where you’re handing over proprietary data for someone to do their job, and investor pitches in the rare cases where confidentiality applies at all. A mutual (bilateral) NDA fits joint ventures, potential mergers, and partnership talks where each side needs to evaluate the other’s financials, technology, or operations.
Counterparties often push back on a one-way agreement and ask for a mutual version even when the information flow is mostly one direction. That’s usually fine. A mutual NDA gives the other side comfort without weakening your protection. The problem is only if the mutual structure dilutes what counts as confidential information to accommodate both sides. Keep your definition specific and tight regardless of the format.
What the Agreement Has to Contain
Enforceability depends on what’s inside the document more than on the fact that one exists. A vague NDA can be worse than none at all, because it creates false comfort.
The Parties
Full legal names and registered addresses for both sides. For a startup, that means the legal entity name (not the brand name), state of incorporation, and principal address. For an individual contractor, full legal name and address. Getting this wrong creates ambiguity about who is actually bound.
The Definition of Confidential Information
This is where most startup NDAs succeed or fail. The definition has to be specific enough that a court can tell exactly what was protected, and broad enough to cover the categories you’re actually sharing. Typical categories: source code, product designs, customer data, financial projections, pricing models, marketing strategies. A clause that says “any and all information shared between the parties” is so sweeping that courts may refuse to enforce it as an unreasonable restraint on the receiving party’s ability to work in their field.
Courts increasingly scrutinize whether a confidentiality clause is functioning as a disguised noncompete. If the definition is so broad that everything the receiving party learned could arguably be covered, the clause may be reclassified as a noncompete and judged under stricter standards. The Restatement (Third) of Unfair Competition treats confidentiality agreements covering non-trade-secret information as restraints of trade, ordinarily unenforceable unless the information is secret enough to justify the restriction. Define the covered information with enough specificity that a reasonable person could tell it apart from general industry knowledge.
Governing Law and Venue
Specify which state’s law governs and where disputes will be resolved. Without this, a breach triggers expensive preliminary litigation just to settle which court has jurisdiction. The startup’s home state is the typical choice, and the clause matters even more if the receiving party is overseas.
Non-Solicitation
Some NDAs include a clause preventing the receiving party from recruiting your employees or poaching clients for a defined period. These have to be reasonable in scope and duration. A clause barring any contact with any employee, anywhere, forever, gets struck down. Limiting the restriction to people the receiving party actually interacted with during the engagement, for one to two years, holds up better.
The Whistleblower Notice You Can’t Skip
Federal law requires every NDA with an employee or contractor to carry a specific notice about whistleblower immunity. Under the Defend Trade Secrets Act, a person who discloses a trade secret to a government official or an attorney for the purpose of reporting a suspected legal violation cannot be held liable for that disclosure.1Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions The same immunity covers disclosures made under seal in a lawsuit.
If the notice is missing, the employer forfeits the right to recover exemplary damages (up to double actual damages) or attorney fees in a later misappropriation suit against that person.1Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions Actual damages are still available, but losing the multiplier and fee-shifting can mean the difference between a case worth filing and one that costs more to litigate than you’d recover. A cross-reference to a company policy document describing these rights satisfies the requirement, so you don’t need the full statutory text in every agreement.
An NDA Is Not an IP Assignment
This is the single most dangerous misunderstanding in startup contracting. An NDA stops someone from sharing your secrets. It does not transfer ownership of anything they create. If a freelance developer builds your app under an NDA but without a separate intellectual property assignment, the developer may own the code they wrote.
Under copyright law, work created by an independent contractor is generally not “work made for hire” unless it falls into one of nine narrow statutory categories (such as a contribution to a collective work or a translation) and the parties have signed a written agreement designating it as such.2U.S. Copyright Office. Circular 30 – Works Made for Hire Custom software, mobile apps, and most startup deliverables don’t fit those categories. Without a written assignment, the contractor keeps the copyright.
The practical consequence is brutal. A startup that paid for the work, built a product on top of it, and attracted investor interest can find itself unable to prove it owns its own technology. Due diligence will ask for assignment documentation, and a gap here can kill a deal. Pair every contractor engagement with an IP assignment clause or a standalone assignment agreement that explicitly transfers all rights in the work product to the company.
Standard Carve-Outs
Every well-drafted NDA excludes categories of information that don’t count as confidential regardless of the definition. These exist because courts won’t enforce a contract that claims ownership over information the receiving party legitimately obtained on their own.
- Information that enters the public domain through no fault of the receiving party.
- Information the receiving party can prove they already possessed before signing, typically through time-stamped files, internal emails, or earlier work product.
- Information the receiving party develops independently without using or referencing anything you disclosed. Development logs and version histories do the work here.
- Information received from a third party who had no confidentiality obligation to the startup.
- Disclosures the disclosing party authorizes in writing.
Founders sometimes resist these, thinking they weaken the agreement. The opposite is true. An NDA without standard exclusions looks overreaching, and a court is more likely to narrow or void an agreement that tries to claim protection over publicly available facts or independently developed work.
How Long It Lasts
Duration is one of the most negotiated terms, and getting it wrong leaves you either unprotected or holding an unenforceable document.
For general business information (financial projections, marketing plans, customer metrics), a fixed term of two to five years is the industry standard. Technology companies tend to push for the longer end; receiving parties prefer shorter. The duration has to be reasonable in light of how quickly the information loses competitive value.
Trade secrets need different handling. Setting a fixed expiration date on trade secret protection can destroy the trade secret itself. Courts have pointed to NDA expiration dates as evidence that the disclosing party failed to take reasonable steps to maintain secrecy, effectively ruling that the information lost its protected status when the agreement ended. The safer practice is a survival clause that keeps the obligation alive for trade secrets as long as the information still qualifies as one under applicable law, while letting the obligation for general business information expire on a set date.
A survival clause specifies which provisions continue after termination. For startup NDAs, the confidentiality obligation, the return-of-materials requirement, and the dispute resolution provisions should all survive. Without an explicit survival clause, a receiving party might argue every obligation ended when the contract did.
Investors Will Not Sign
Venture capital firms and angel investors almost universally refuse to sign NDAs before an initial pitch. This isn’t negotiable, and asking signals inexperience. Investors review hundreds of pitches each year, many in overlapping markets. Signing a confidentiality agreement with every founder would create constant litigation risk whenever the firm backed a company in a similar space.
Pitch your vision, market opportunity, and traction without revealing the specific technical secrets or proprietary data that would need contractual protection. Most investors will consider a confidentiality agreement once a relationship moves into deep due diligence and the firm needs access to financial records, cap tables, proprietary code, or technical audits. Until that point, treat every slide and every conversation as potentially public.
If Someone Breaches It
An NDA is only as valuable as your ability to enforce it. When a breach happens, the Defend Trade Secrets Act provides several paths to recovery.
A court can order the receiving party to stop using or disclosing the information immediately. The startup has to show irreparable harm, meaning damage that money alone can’t fix, such as a trade secret reaching a competitor. A clause where the receiving party acknowledges breach would cause irreparable harm makes injunctive relief easier to obtain but doesn’t guarantee it.
Actual damages cover the real financial losses from the breach, plus any profits the breaching party earned by misusing the information. If the misappropriation was willful and malicious, a court can award exemplary damages up to double the actual damages, and attorney fees are available for willful and malicious misappropriation or claims brought in bad faith.3Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings to Enjoin Violations
Some NDAs include a liquidated damages clause setting a predetermined amount for breach. Courts enforce these only when actual damages would be hard to calculate and the amount is a reasonable estimate of potential loss. A number wildly out of proportion to the likely harm gets struck down as an unenforceable penalty. These clauses work best for trade secrets and customer relationships, where real-world damage is genuinely hard to measure.
The uncomfortable reality is cost. Business litigation attorneys typically charge $300 to $1,500 or more per hour, and even a straightforward breach case can take months. For a seed-stage company, litigating can exceed the value of the information that leaked. Prevention through onboarding, access controls, and sharing only what’s strictly necessary reduces exposure more reliably than any after-the-fact lawsuit.
Return of Materials, Signatures, and Records
Every startup NDA should require the receiving party to return or destroy all confidential materials when the agreement ends or the relationship terminates, whichever comes first. That includes physical documents, digital files, copies in cloud services, and any notes or derivative works containing the protected information. For digital data, a certificate of destruction identifying what was destroyed and the method used gives you a documented record if a dispute surfaces later.
Electronic signatures carry the same legal weight as handwritten ones. Federal law provides that a contract cannot be denied legal effect solely because it was signed electronically.4Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity Most e-signature platforms record IP address, timestamp, and email address, which creates an audit trail that can matter in court. Physical signatures still work but require scanning and digital storage so the only copy isn’t sitting in a drawer.
Once both parties sign, each side should receive a fully executed copy immediately. Keep a centralized, backed-up repository of signed NDAs with a log tracking who signed, when, which version was used, and what was disclosed. If a breach surfaces months or years later, you’ll need to prove exactly what was covered and when the obligation began. You can’t enforce terms you can’t produce.