Start with the secret, not with the parties
Most non-disclosure agreements get written in the wrong order. Someone finds a template, drops in two company names, picks a number of years because it sounds about right, and hits send. The parts that got skimmed — what exactly is protected, what the other side may do with it, when the duty ends — are the parts an argument will later be about.
Draft the definition of confidential information first, before the recitals and long before the signature block. Two failure modes bracket that clause. Write “all information disclosed by either party” and you have built something so wide it invites a judge to narrow it, because it technically covers the weather and the lunch order. Write “only material stamped CONFIDENTIAL” and you have created a labelling chore you will forget the first time you explain something over a phone call.
The workable version sits between them. Name the categories that genuinely matter — pricing models, unreleased designs, customer lists, source code, financials — add a catch-all for anything a reasonable person would treat as sensitive in context, and cover spoken disclosures. The test: could an outsider read your definition and sort a stack of documents into covered and not covered?
One-way or mutual: follow the information, not the etiquette
A one-way (unilateral) NDA fits when only one side is handing over anything sensitive. You hire a contractor, show them the codebase, and they show you nothing you need protected. A mutual (bilateral) NDA fits when both sides open the books: two companies exploring a partnership, an integration where each team exposes internal APIs, an acquisition conversation.
The frequent mistake is choosing mutual out of politeness. Signing a two-way agreement when only you are disclosing hands you duties you never intended and gives the other party a lever if they later claim something of theirs ended up in your product. Pick by direction of flow, and if the flow changes later, amend the document rather than assuming the original still describes reality.
One expectation worth setting early: most seed-stage investors will not sign anything before a pitch — they hear variations of the same idea all week, and insisting usually costs you the meeting rather than protecting the idea. Stage what you reveal instead: the shape of the business up front, the implementation once diligence starts.
The clauses that do the actual work
After the definition, the permitted purpose carries the most weight per word. It says what the receiving party may do with the material — “solely to evaluate a possible supply relationship” — and by omission, everything they may not. Pair it with a standard of care and a need-to-know limit naming who may see it: employees, advisors, subcontractors, each bound by terms no weaker than these.
Then come the exclusions, and a serious NDA has all four: information already public through no fault of the receiver, information they already held before disclosure, information they developed independently without using yours, and information lawfully received from a third party. Alongside them sits the compelled-disclosure carve-out: if a court or regulator demands the material, they may hand it over, ideally after giving you notice.
The remaining load-bearing terms are short. Term and survival. Return or destroy on request, with a carve-out for routine backups and anything a legal hold requires them to keep. Remedies, noting that money alone may not fix a leak, so injunctive relief is available. Governing law and venue. And two quiet troublemakers-in-waiting: no licence passes with a disclosure, and neither party is obliged to do the deal.
How long confidentiality should actually last
An NDA carries two clocks, and conflating them is the most common drafting error. The term of the agreement says how long new disclosures keep landing under its protection. Survival says how long the duty lasts for material already shared. A two-year agreement with a five-year survival period is a normal shape, and it means something quite different from “this agreement lasts two years.”
For ordinary commercial information, two to five years of survival is the common range. Trade secrets are usually handled separately, with an obligation that persists for as long as the information stays secret, since a fixed end date on a secret formula defeats the point. Blanket perpetual confidentiality over everything tends to draw pushback from counterparties and, in some places, sceptical treatment as an unreasonable restraint.
Set the number by shelf life rather than habit. Quarterly pricing goes stale in a year; a roadmap matters for two or three; a customer list stays valuable far longer. Ask how long the information would still hurt you if it leaked, then write that down.
The clauses people forget
The residuals clause is the one to read twice. It lets the receiving party use anything their staff retain in unaided memory — harmless-sounding language that quietly hollows out the agreement, and common in paper drafted by larger receivers. Know whether it is in there before you sign. A smaller cousin: the feedback clause, which lets whoever receives your comments use them freely.
Then there is who is actually bound. If you are contracting with an entity, say whether affiliates are covered, and make the signer someone with authority — a name, a title, and the company as the party, not an employee signing in their personal capacity. If subcontractors will see the material, require them to be bound on equivalent terms.
Finally, three practical additions. A notice provision, so the compelled-disclosure carve-out has an address to write to. An acknowledgment that nothing here prevents reporting suspected illegal conduct to a regulator — several jurisdictions require it, and it stops the agreement reading as a gag. And a counterparts and electronic-signature clause, confirming that separate electronic copies make one valid agreement.
What an NDA cannot do
An NDA restricts the use and sharing of information. It does not stop someone leaving, joining a competitor, or hiring your staff — those are non-compete and non-solicitation terms, they belong in their own document, and many jurisdictions limit or refuse to enforce them. Keep them separate so an unenforceable restraint cannot drag your confidentiality terms down with it.
Nor does it retroactively protect information that was already public, stop a subpoena, prevent someone from independently building something similar, or transfer ownership of anything. If you need the other side to assign what they create, that is an intellectual-property assignment, and no confidentiality clause substitutes for it.
The honest limit is the biggest: a signed NDA does not physically prevent a leak. It gives you a documented claim after one, which is worth having and is not the same as safety. If a single disclosure would end your business, share less, share later, or share in stages.
Get it signed, and keep the proof
When the wording is settled, the mechanics are quick. Start from a ready NDA template and edit the terms, or upload the PDF your lawyer sent — the signing flow accepts PDFs up to 4 MB. Place the fields where each party acts: signature, initials, date signed, printed full name, a text field for title. Assign every field to a specific party so nobody can complete someone else's.
For a mutual NDA where both sides sign, choose all-at-once so either party can go first, or one-at-a-time when your countersignature should come last. Add a per-signer access code if the draft itself reveals something sensitive, and share that code through a different channel than the link. When the final signature lands, both parties receive a sealed, tamper-evident PDF and a Certificate of Completion recording who signed, when, and from which IP address.
Sharing signing links is unlimited on the free plan, which also includes 30 emailed signature invitations a month; paid plans raise that allowance and drop the small tuyaform credit from the signing page. This guide is general information about drafting practice, not legal advice — if the stakes are high, an hour with a lawyer is cheaper than the argument.