What an NDA Before Scoping Actually Covers in the US

Published by CodeNicely, the product studio founded by Meghal Agrawal and Ujjwal Agrawal in 2017

For: A VP of Engineering or COO at a 300-person US enterprise who is about to share proprietary process logic, internal system architecture, and customer data flows with a shortlisted offshore development partner during a paid discovery sprint — and has just been handed a one-page mutual NDA by the vendor's sales team

A pre-scoping NDA in the US should do five things, and most vendor-drafted one-pagers do three. It should (1) cover oral and visual disclosures, not just documents marked "Confidential"; (2) bind the vendor's subcontractors and rotated-off personnel by name or by category; (3) either omit a residuals clause or include an explicit residuals waiver; (4) carve out trade secrets from any time-limited confidentiality period; and (5) include the DTSA whistleblower-immunity notice required by 18 U.S.C. § 1833(b). If the document in your inbox is missing any of these, you are about to share your internal system architecture and customer data flows under weaker protection than you think. This is not legal advice — have your counsel red-line the final version — but these are the gaps to flag before it reaches them.

The context matters. US enterprises are now the single largest buyer group in offshore development, generating roughly $46 billion of a $178 billion global market, with 76% of IT leaders using offshore teams according to Deloitte's 2024 Global Outsourcing Survey. Which means vendor-side legal templates get reused thousands of times a quarter, optimized for the vendor's risk, not yours. The one-page mutual NDA is a sales-cycle lubricant. It is not a protection document.

What a discovery sprint actually exposes

Before we get to clauses, be honest about what gets disclosed in a paid two-to-four-week discovery sprint with a shortlisted partner:

• Whiteboard sessions where your architect sketches the current-state system — on a Miro board the vendor controls
• Screen-shares of production dashboards, admin panels, and sometimes de-identified customer data
• Access to Confluence, a Slack channel, or a shared Google Drive with internal runbooks
• Interviews with ops leads who describe the real (not the documented) version of your fulfillment, pricing, or underwriting logic
• Sample data extracts for a feasibility proof-of-concept

Four of those five are oral, visual, or screen-based. A standard NDA that only protects "information marked Confidential and delivered in writing" protects almost none of it. That is gap number one.

Clause-by-clause: what to check before you sign

1. Definition of Confidential Information

What it is for: defining the scope of what the receiving party has to protect.

The wording that protects you: "Confidential Information includes all information disclosed by the Disclosing Party, whether in written, oral, visual, electronic, or any other form, whether or not marked, designated, or otherwise identified as 'confidential,' that a reasonable person would understand to be confidential given the nature of the information and the circumstances of disclosure."

The wording that quietly does not: "Confidential Information means information disclosed in writing and marked 'Confidential,' or disclosed orally and reduced to writing and marked 'Confidential' within thirty (30) days." This sounds procedural. In practice no one on your side will remember to send follow-up memos within 30 days after every whiteboarding session, and the vendor's lawyers know that.

The question to put to the vendor: "Will you accept oral and visual disclosures as confidential by default, with no marking requirement?"

2. The residuals clause (or its absence)

This is the clause that trips up more enterprise buyers than any other, and it is the reason this post exists.

What it is: A residuals clause lets the receiving party retain and use "residual knowledge" — the information that remains in the unaided memory of its personnel after exposure to your confidential information. Legal practitioners describe it as "one of the most heavily negotiated NDA provisions" and a potential "massive loophole in confidentiality protection."

Why it matters for offshore scoping: Vendors rotate engineers. The architect who spent three weeks reverse-engineering your pricing engine during discovery may be assigned to a competitor's project six months later. A residuals clause makes it legal for her to apply what she remembers — which, for a senior engineer, is substantially everything that matters.

The wording to strike or replace: Anything resembling: "Nothing in this Agreement shall restrict either party from using Residuals for any purpose, including use in the development, manufacture, promotion, sale, and maintenance of its products and services. 'Residuals' means information in non-tangible form which may be retained in the unaided memory of persons who have had access to Confidential Information."

What to add instead: "No Residuals Rights. The Receiving Party acknowledges that it has no right to use any Confidential Information retained in the memory of its personnel, and nothing in this Agreement shall be construed as granting any license, express or implied, to any Confidential Information or any derivative thereof."

Why this is not paranoid: Dentons has warned that a poorly drafted residuals clause can terminate trade secret protection for information historically protected as a trade secret, and in some cases has been read to grant a royalty-free license to use the disclosing party's IP. If your pricing logic or underwriting model qualifies as a trade secret today, a loose residuals clause can quietly disqualify it tomorrow.

The question to put to the vendor: "Will you remove the residuals clause entirely, or add an explicit no-residuals-rights paragraph?" A vendor that pushes back hard here is telling you something.

3. Subcontractor and personnel binding

What it is for: making sure the NDA travels with every human and entity that touches your information, not just the signing legal entity.

The wording that protects you: "The Receiving Party shall not disclose Confidential Information to any employee, contractor, subcontractor, affiliate, or agent except those who (a) have a need to know for the Permitted Purpose, (b) have been informed of the confidential nature of the information, and (c) are bound by written confidentiality obligations no less protective than those in this Agreement. The Receiving Party shall remain fully liable for any breach by such persons. The Receiving Party shall provide, upon request, a list of all personnel and subcontractors with access to Confidential Information."

The wording that quietly does not: "The Receiving Party may disclose Confidential Information to its employees and representatives on a need-to-know basis." Note the missing words: subcontractor, affiliate, written confidentiality obligations, liability, right to a list. Offshore vendors frequently use third-country subcontractors or affiliated entities under different legal names. Without these words, those entities are outside the agreement.

The question to put to the vendor: "Will you name the specific legal entities and subcontractors that will access our information, and will you accept liability for their breaches?"

4. Trade secret carve-out from the confidentiality term

What it is for: most NDAs set a confidentiality period of two to five years. US trade secret law protects information for as long as it remains secret — potentially forever. If your NDA says "all confidentiality obligations expire after three years," you have just contractually sunset your trade secret protection against this vendor.

The wording that protects you: "The confidentiality obligations in this Agreement shall survive for a period of five (5) years from the date of disclosure; provided, however, that with respect to any Confidential Information that constitutes a trade secret under applicable law, the obligations shall survive for so long as such information remains a trade secret."

Why this matters now: Federal trade secret enforcement is at an all-time high. Lex Machina's 2026 report notes DTSA claims appear in more than 80% of new federal trade secret lawsuits each year, with $716M in actual damages and $510M in punitive damages awarded by juries from 2023–2025. And plaintiffs win roughly 84% of federal trade secret cases that reach a verdict, per Stout's 2024 analysis. The legal tool is real and sharp — but only if your contract has not blunted it.

5. DTSA whistleblower-immunity notice

What it is: under 18 U.S.C. § 1833(b), any contract with an employee, contractor, or consultant that governs trade secrets must include a notice of whistleblower immunity. If it does not, the disclosing party forfeits the right to recover exemplary (punitive) damages and attorney's fees against that individual under the DTSA.

The wording to include verbatim or by reference: "Notice of Immunity Under the Defend Trade Secrets Act. An individual shall not be held criminally or civilly liable under any federal or state trade secret law for the disclosure of a trade secret that is made (i) in confidence to a federal, state, or local government official, either directly or indirectly, or to an attorney; and (ii) solely for the purpose of reporting or investigating a suspected violation of law…" (the full statutory language runs a short paragraph).

Why it matters here: an NDA between your enterprise and a vendor company does not directly govern the vendor's individual engineers. But the vendor's agreements with its own engineers do — and if your NDA requires the vendor to flow down protections to its personnel, you want to require that those downstream agreements include the DTSA notice. Otherwise, when you later try to pursue punitive damages against a specific engineer who walked off with your pricing model, you lose that remedy before you start.

6. Governing law, venue, and injunctive relief

Short version. Three things to look for:

• Governing law and venue: a US state (Delaware, New York, or your home state) with US federal court jurisdiction, not the vendor's home country. Enforcement across borders is possible but slow and expensive.
• Injunctive relief: explicit acknowledgment that breach would cause irreparable harm and that the disclosing party is entitled to seek injunctive relief without posting a bond. Without this, your first move in a breach is a damages lawsuit, not an order to stop.
• Return or destruction of materials: on request, within a defined window (30 days is standard), with written certification. Include backups and derivative works.

The one-page NDA scorecard

Hand the vendor's draft to your counsel with this checklist attached. If more than two boxes are empty, do not sign the discovery SOW until the NDA is redlined.

What this is not

This is not legal advice, and your counsel should review and finalize the agreement — the above are the gaps most commonly missed, not a substitute for a lawyer who knows your industry, your trade secret posture, and the specific jurisdictions involved. Trade secret law is federal (DTSA) and state (every state has adopted some form of the Uniform Trade Secrets Act, with meaningful variations). Healthcare, financial services, and defense contractors have additional sectoral obligations — HIPAA business associate agreements, GLBA, ITAR — that an NDA alone does not satisfy.

This also is not a substitute for operational controls. The strongest NDA in the world does not help if your team pastes production customer records into a shared Miro board. Pair the paper with: a named point of contact on your side who approves every disclosure, a shared workspace you control (not the vendor's), de-identified sample data for POCs, and session recordings retained on your systems.

How CodeNicely can help

We sign the version of the NDA the enterprise's counsel sends us. On our Cashpo engagement — building AI-driven credit scoring and KYC flows for a regulated lending product — the discovery phase involved exposure to underwriting logic, bureau data handling, and PII flows that would be career-ending to leak. The NDA, DPA, and sub-processor list were drafted by the client's counsel, flowed down to every engineer by name, and included the exact kind of residuals-waiver and trade-secret carve-out language described above. We did not push back on any of it, because for the kind of work we do — AI products for US enterprises where the moat is the process logic, not the UI — the client's confidentiality posture is the engagement's foundation, not an obstacle to it.

If you are evaluating partners for an AI or custom software build and want to see how we structure IP ownership, sub-processor transparency, and personnel binding, start a conversation and send us your paper. We will mark it up with our counsel and come back with questions, not objections.

Frequently Asked Questions

Should I use my NDA or the vendor's for a discovery sprint?

Yours, if you have one your counsel has already approved. Vendor NDAs are drafted for the vendor's risk and reused across thousands of deals; your version will be built around the specific information you actually disclose. If the vendor insists on their template, treat it as a starting draft and expect to redline the five clauses above at minimum.

Is a mutual NDA weaker than a one-way NDA?

Not inherently — the protections for your information are the same whether or not the vendor also discloses something to you. The practical risk is that mutual NDAs are often shorter and more generic because they are written for symmetry rather than for either party's specific exposure. Check that the definition of Confidential Information, the subcontractor binding, and the residuals language protect your side as strongly as you would demand in a one-way agreement.

Does an NDA actually stop an engineer from using what they remember?

Only if the NDA lacks a residuals clause (or includes an explicit no-residuals-rights paragraph) and your trade secret protections are preserved. With those in place, memory-based use of your confidential information is a breach of the NDA and, for trade secrets, actionable under the federal DTSA and state law. Without those clauses, residuals language in many vendor templates expressly permits exactly that memory-based reuse.

How much does getting an NDA properly reviewed by counsel cost?

The cost model depends on three things: whether your in-house counsel handles it or you use outside firm time, how far the vendor's draft is from your standard, and whether sector-specific regimes (HIPAA, GLBA, ITAR, GDPR for EU data) are in scope. A clean redline of a one-page mutual NDA against a known checklist is a short exercise; a negotiation across multiple rounds with an offshore vendor's counsel, especially where governing law is contested, is a longer one. The two specifics that turn a range into a quote: how many iterations of negotiation you expect, and whether the NDA will later be referenced from a master services agreement that your counsel will also draft.

What is the difference between an NDA and a DPA, and do I need both?

An NDA protects confidential business information; a Data Processing Agreement (DPA) governs the processing of personal data and is required under GDPR, often expected under CCPA/CPRA, and best practice regardless. If any part of discovery will expose personal data of customers or employees — even de-identified samples — you need both documents, and the DPA should list named sub-processors and their locations. Your privacy counsel, not your commercial counsel, should own the DPA.