Mutual NDA template for web projects
A mutual NDA sized for web projects: what actually needs protecting (data, credentials, unreleased plans) and what does not (ideas). Copy, fill two name fields, sign.
Most NDAs sent to developers are borrowed from M&A deals and protect nothing a web project contains. This one is sized for the work: mutual (you share data too — analytics, customers, credentials), plain-language, two years — the window in which any disclosed information actually matters. It pairs with the contract guide; the NDA covers confidentiality, the contract covers everything else. A note from the developer side: reputable developers sign reasonable NDAs without drama — and remember the cliché because it is true: the differentiating asset is execution, not the idea.
The fields, with guidance
Parties
Full legal names and addresses. If you trade as a company, use the company; if as an individual, the individual.
Example: Acme Retail Ltd, 14 High Street, Leeds, and [Developer legal name], Guwahati, India.
Purpose
One sentence: why information is being shared. Scope creep starts here.
Example: Evaluating and executing a website rebuild and related integrations.
Confidential information
Define by category, not “everything” — over-broad NDAs are unenforceable in several jurisdictions and ignored by courts everywhere.
Example: Customer data, analytics, credentials, unreleased plans, pricing, and anything marked confidential in writing.
Exclusions
The standard four: public knowledge, already known, independently developed, rightfully received elsewhere. Without exclusions the document is noise.
Example: Information already public, already known to the receiving party, independently developed, or received from a third party without breach.
Obligations
Same duty both ways: protect as you protect your own, limit access to people who need it.
Example: Same-care standard; access limited to employees/contractors directly involved; contractors bound by equivalent terms.
Term
Two to three years. Longer is theatre — technical information ages out fast.
Example: Obligations run 2 years from signing.
Return/destruction
What happens to data on exit. “Delete on request, confirm in writing” is the working standard.
Example: On written request, confidential materials deleted within 14 days, confirmed in writing; archived backups age out per policy.
No licence
One sentence preventing “you showed me code, so I own it now”.
Example: No licence or IP rights granted by disclosure; ownership governed by the separate services agreement.
Governing law
Pick the client's jurisdiction for enforceability; web-project NDAs rarely get litigated, but the clause makes sure they rarely need to be.
Example: Laws of England and Wales.
Copy this block
MUTUAL NON-DISCLOSURE AGREEMENT
Between: [CLIENT LEGAL NAME], [ADDRESS]
And: [DEVELOPER LEGAL NAME], [ADDRESS]
Date: [DATE]
1. PURPOSE
The parties will share information to evaluate and execute
[PROJECT DESCRIPTION] (the "Purpose").
2. CONFIDENTIAL INFORMATION
Means information disclosed for the Purpose that is marked
confidential or reasonably should be treated as such, including:
customer and analytics data, access credentials, unreleased
business plans, and pricing.
3. EXCLUSIONS
Not confidential: (a) publicly known; (b) known before disclosure;
(c) independently developed; (d) rightfully received from another
source without breach.
4. OBLIGATIONS
Each party will protect the other's Confidential Information with
the same care it uses for its own, and limit access to persons
involved in the Purpose under equivalent obligations.
5. TERM
Obligations run for 2 years from signing.
6. RETURN / DELETION
On written request, each party will delete the other's Confidential
Information within 14 days and confirm in writing, save for
archived backups which age out under standard policy.
7. NO LICENCE
Nothing disclosed grants any licence or intellectual property
rights. Ownership is governed by the separate services agreement.
8. NO OBLIGATION
Neither party is obliged to proceed with any engagement.
9. GOVERNING LAW
[CLIENT JURISDICTION].
Signed:
_______________________ _______________________
[CLIENT] [DEVELOPER]
Plain text on purpose — pastes cleanly into email, docs and project tools.
Fill the brackets, delete the guidance, sign. Want it countersigned from this side before we talk? Ask — standard practice, zero drama.
Quarterly, and only when the numbers move
Get the rate report before you negotiate.
Updated rate bands across the major stacks and regions, plus what changed and why. No other email.