Mutual NDA for a security tool evaluation: what to share and what not

A mutual confidentiality agreement lets you share architecture and test results with a vendor, and lets the vendor share product details with you. It protects against disclosure, not against bad handling, so decide what to share before signing. Never give production secrets or customer data to a vendor under an NDA alone.

What a mutual NDA should cover

• Definition of confidential information: your code, findings, architecture, and the vendor's non public product, roadmap and security documents.
• Permitted use: evaluation of the tool only. Not product development, not training, not marketing.
• Who can see it: named staff or roles with a need to know, and any subcontractors bound by equivalent terms.
• Duration: how long the duty lasts, and a longer period for trade secrets and source code.
• Return or destruction: on request or at the end of the evaluation, with written confirmation.
• Exclusions: information already public, independently developed or lawfully received from someone else.
• Compelled disclosure: the party told to disclose by a court should notify the other first where the law allows.

Have counsel check governing law and how disputes are handled. This post is general information, not legal advice.

What an NDA does not do

An NDA does not encrypt anything, does not stop a breach at the vendor, and does not limit what happens to personal data. For personal data, you need a data processing agreement. See whether a scanner needs a DPA.

What to share in an evaluation

Share in this order, only as far as you need to:

1. Public information: your languages, frameworks and CI platform.
2. Architecture level description with no hostnames or credentials.
3. Results from a test repository or a sanitised copy.
4. Read only access to named, non production repositories.

What to keep out

• Production secrets, keys and tokens.
• Customer data, including copies in fixtures.
• Incident reports and unpatched vulnerability details about your own systems that you have not fixed.
• Credentials for cloud accounts.
• Other vendors' confidential documents you hold under your own NDAs. Those NDAs may prohibit sharing them.

What to ask in return

Ask the vendor to confirm in writing who will see your material, where it is stored during the evaluation and when it will be deleted. Ask what happens to your findings if the vendor is acquired during the pilot.

Before you sign

Read the NDA the vendor sends. Check the permitted use clause and the duration. A one way NDA that only protects the vendor is not suitable for an evaluation where you share your code.

Quick check

Last reviewed: 19 October 2026.