Reviewed by Zohaib KhalidCEO & Co-founder, Innovation Insight·Updated Short answer
A mutual NDA for software development protects both sides when a company shares its product plans, code or data with a vendor, and the vendor shares its methods and pricing. This template has fourteen sections: parties, purpose, what counts as confidential (including source code, architecture, roadmaps, pricing and customer data), exclusions, obligations, compelled disclosure, term and survival, return or destruction, no licence, remedies, governing law, entire agreement and signatures. It is a general template, not legal advice.
How to use this mutual NDA template
Fill in the parties, the purpose and the governing law, then send it. Nothing else should need editing for a normal vendor conversation. The purpose clause matters most: specific enough that information shared for this evaluation cannot be used for something else, broad enough that you do not need a new NDA when a demo turns into a proposal. Two years is the term we usually agree for the obligations, with trade secrets protected for as long as they stay secret.
A mutual NDA is the right form when both sides will say something they would not want public: the company shares product plans, data and code, the vendor shares methods and its rate card. A one-way NDA covers the vendor's proposal with nothing in return, so most vendors push back on it.
When to sign an NDA for software development
Before the first detailed conversation about the product, and always before code, data, credentials or customer information change hands. That is our rule: as our security page says, we sign a mutual NDA before any technical discussion, yours or ours. After the NDA, the statement of work carries confidentiality into the project and adds a data processing or business associate agreement where personal or health data is involved.
What a mutual NDA should and should not do
- It should define confidential information broadly enough to cover the things a software project actually involves: source code, architecture, infrastructure details, roadmaps, pricing, customer lists and data. Generic templates often leave code and data out.
- It should carve out what is already public or independently known, so neither side is accused of misusing something it could have found online.
- It should allow disclosure to people who need to know, including subcontractors bound by equivalent terms. A vendor that cannot show the brief to its engineers cannot quote it.
- It should not contain an obligation to do business, a non-compete or an IP assignment. Those belong in the SOW or master agreement, and an NDA that hides them gets rejected by legal teams on both sides.
- It should not run forever for ordinary information. Two to three years is what we sign most often; longer terms are for trade secrets.
How we handle NDAs
We will sign your NDA if it is mutual and reasonable, and send the one below when you do not have your own. Signing takes a day. Then we ask for the brief, the current codebase if there is one, and read access to whatever we need to estimate. Access is granted per project and revoked at the end; client material lives only in your systems or on company-managed, encrypted devices. If you would rather talk first, contact us and keep the call to the problem rather than the solution.
Free download
Get the Mutual NDA Template for Software Development
Markdown that opens anywhere (Google Docs, Notion, GitHub, your AI coding tool) or a Word file. Tell us where to send it and a senior engineer will answer any question you add.
Just want the file? Download Markdown without the form or the Word version.
The template
Every section below is in the download. Replace each blank line with your own text and delete the guidance paragraph once you have written the section.
1. Parties
Full legal names, registration details and addresses. Both parties are both a disclosing party and a receiving party under this agreement.
- Party A legal name, registration number and address: ____
- Party B legal name, registration number and address: ____
- Effective date: ____
- Each party is a Disclosing Party when it discloses Confidential Information and a Receiving Party when it receives it.
2. Purpose
State why information is being exchanged. Information may be used only for this purpose. Keep it specific to the relationship but wide enough to cover evaluation, proposal and, if agreed, the project itself.
- The parties wish to exchange Confidential Information to evaluate, negotiate and, if agreed, carry out a potential software development engagement concerning ____ (the Purpose).
- Confidential Information may be used only for the Purpose.
3. Definition of confidential information
Everything non-public disclosed by one party to the other in connection with the Purpose, however disclosed. The list of examples is what makes this fit a software project; keep it.
- Confidential Information means all non-public information disclosed by a Disclosing Party to a Receiving Party, in any form, including information that is marked confidential and information a reasonable person would understand to be confidential.
- It includes, without limitation: source code, object code, repositories and build artefacts; software architecture, designs, schemas, infrastructure and security details; product plans, roadmaps, specifications, prototypes and research; business plans, financial information, pricing and rate cards, proposals and contracts; customer, user and supplier lists and data, including personal data; methods, processes and know-how; and the existence and terms of the discussions between the parties.
- Information disclosed orally or visually is Confidential Information if identified as confidential at the time or within ____ days afterwards in writing, or if a reasonable person would understand it to be confidential.
4. Exclusions
The standard four carve-outs. The Receiving Party bears the burden of proving an exclusion applies, and must show it with written records.
- Confidential Information does not include information that the Receiving Party can demonstrate by written records:
- (a) was publicly available at the time of disclosure, or became publicly available afterwards through no fault of the Receiving Party;
- (b) was lawfully in the Receiving Party's possession before disclosure, without an obligation of confidentiality;
- (c) was lawfully received from a third party without restriction and without breach of any obligation to the Disclosing Party; or
- (d) was independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information.
5. Obligations of the receiving party
Use only for the purpose, protect with reasonable care, share only with people who need to know, and make those people bound by equivalent terms. Subcontractors are allowed with the same conditions; this is what lets a vendor staff a proposal.
- The Receiving Party shall use Confidential Information solely for the Purpose.
- The Receiving Party shall protect Confidential Information using at least the same degree of care it uses for its own confidential information, and no less than reasonable care, including appropriate technical measures such as access control and encryption.
- The Receiving Party may disclose Confidential Information only to its employees, officers, professional advisers, contractors and subcontractors who need to know it for the Purpose and who are bound by written confidentiality obligations no less protective than this agreement. The Receiving Party is responsible for any breach by those persons.
- The Receiving Party shall not reverse engineer, decompile or disassemble any software, prototype or sample provided as Confidential Information, except as required to carry out the Purpose and agreed in writing.
- The Receiving Party shall notify the Disclosing Party promptly, and within ____ hours of becoming aware, of any unauthorised use or disclosure, and shall cooperate to limit the damage.
- Neither party shall copy Confidential Information beyond what is reasonably required for the Purpose; all copies remain the property of the Disclosing Party.
6. Compelled disclosure
Disclosure required by law or court order is permitted, with notice to the other party where lawful, and limited to what is required.
- The Receiving Party may disclose Confidential Information to the extent required by law, regulation or a court or governmental order, provided it (a) gives the Disclosing Party prompt written notice where legally permitted, (b) discloses only the portion legally required, and (c) cooperates reasonably with the Disclosing Party's efforts to obtain protective treatment.
7. Term and survival
The agreement covers information disclosed during a fixed window; the obligations last for a period after that. Trade secrets are protected for as long as they remain trade secrets under applicable law.
- This agreement covers Confidential Information disclosed during the period from the Effective Date until ____ (the Disclosure Period), or until terminated by either party on ____ days' written notice, whichever is earlier.
- The obligations in sections 5, 6 and 8 continue for ____ years after the end of the Disclosure Period, and for trade secrets for as long as they remain trade secrets under applicable law.
- Termination does not affect obligations relating to Confidential Information disclosed before termination.
8. Return or destruction
On request or at the end, the Receiving Party returns or destroys the information and confirms in writing. Allow a narrow exception for routine backups and legal retention, which cannot practically be purged.
- Within ____ days of the Disclosing Party's written request or the end of the Disclosure Period, the Receiving Party shall return or securely destroy all Confidential Information and copies, including repository clones and credentials, and confirm this in writing.
- The Receiving Party may retain copies held in routine automated backups or required by law or professional rules, provided they remain subject to this agreement and are not accessed for any other purpose.
9. No licence or obligation to proceed
Sharing information grants no rights in it and commits neither side to a contract. Information is provided as is; warranties belong in the eventual services agreement.
- All Confidential Information remains the property of the Disclosing Party. No licence or other right under any patent, copyright, trade secret, trade mark or other intellectual property is granted or implied by this agreement.
- Nothing in this agreement obliges either party to disclose any particular information, to enter into any further agreement or to proceed with the Purpose.
- Confidential Information is provided as is. The Disclosing Party makes no warranty as to its accuracy or completeness, except that it has the right to disclose it.
10. Remedies
Acknowledge that money alone may not repair a leak, so the Disclosing Party may seek an injunction without having to prove damages first, alongside any other remedy.
- The parties acknowledge that unauthorised use or disclosure of Confidential Information may cause harm for which damages alone would not be an adequate remedy. The Disclosing Party is entitled to seek injunctive or other equitable relief to prevent or stop a breach, without the need to post a bond where permitted, in addition to any other remedy available at law.
- Liability caps or exclusions in any other agreement between the parties do not apply to a breach of this agreement unless expressly stated to do so.
11. Governing law and venue
Leave blank until you agree it. Cross-border pairs often choose the client's jurisdiction or a neutral one such as England and Wales, Delaware or Singapore. Arbitration is an option if court enforcement across borders is a concern.
- This agreement is governed by the laws of ____.
- The courts of ____ have exclusive jurisdiction over any dispute arising from this agreement, or: any dispute shall be finally resolved by arbitration under the rules of ____ seated in ____.
12. Entire agreement and general terms
The usual closing terms: whole agreement, changes in writing, no assignment without consent, no waiver by delay, severability and counterparts. If the parties later sign a services agreement with its own confidentiality clause, state which one controls.
- This agreement is the entire agreement between the parties on its subject matter and supersedes prior discussions. It may be amended only in writing signed by both parties.
- Neither party may assign this agreement without the other's written consent, except to a successor in a merger or sale of substantially all its assets, with notice.
- Failure or delay in exercising a right is not a waiver. If any provision is unenforceable, the rest remains in effect.
- Neither party shall publicise the other's name or the existence of discussions without written consent.
- This agreement may be signed in counterparts and electronically; each counterpart is an original.
- If the parties enter into a services agreement with its own confidentiality terms, ____ shall control in the event of conflict.
13. Signatures
Signed by an authorised representative of each party. Electronic signatures are valid in most jurisdictions (the ESIGN Act in the US and the eIDAS Regulation in the EU).
- For Party A: name ____ | title ____ | signature ____ | date ____
- For Party B: name ____ | title ____ | signature ____ | date ____
14. Notes before you sign
Not part of the agreement. A short checklist for both sides so the NDA does not hold up the project.
- Both parties' legal names and addresses are correct and match their registration.
- The Purpose is wide enough to cover evaluation, proposal and project.
- The definition covers code, architecture, data and pricing.
- Subcontractor disclosure is permitted with equivalent obligations.
- Term, survival period and governing law are filled in.
- No non-compete, non-solicit, IP assignment or exclusivity has been added without discussion.
- A lawyer in the governing jurisdiction has reviewed it.
Filled it in?
Send us the document and get a written estimate.
A senior engineer replies within one business day with the assumptions we would make and a range per milestone.
Zohaib Khalid
CEO & Co-founder, Innovation Insight
Zohaib leads strategy, client partnerships and delivery at Innovation Insight. He has spent a decade turning founder briefs into products that ship and still reviews every proposal that leaves the company.
LinkedIn