NDA Template for Software Companies

In this Agreement, the following capitalized terms shall have the meanings set out below:

"Confidential Information" means all information, in any form or medium (written, oral, electronic, visual, or otherwise), whether or not marked as confidential, that is disclosed or made available by or on behalf of the Disclosing Party to the Receiving Party or its Representatives in connection with the Purpose, including without limitation Source Code, object code, algorithms, architecture, designs, specifications, documentation, product roadmaps, trade secrets, know-how, business and financial information, customer and supplier information, pricing, Personal Data, and the existence and terms of the Parties' discussions, together with all notes, analyses, compilations, and other materials prepared by or for the Receiving Party that contain or reflect such information.

"Purpose" means the sole and limited purpose of evaluating a potential business transaction between the Parties, as described in [description of the potential transaction].

"Representatives" means those directors, officers, employees, and professional advisers of the Receiving Party who have a strict need to know the Confidential Information for the Purpose, who have been identified in advance to the Disclosing Party in writing, and who are bound by written confidentiality obligations no less protective than those in this Agreement.

"Source Code" means the human-readable form of any software, including programming statements, scripts, comments, build files, configuration files, data models, and related technical documentation, and any portion or version thereof.

"Proprietary Software" means any software, application, platform, tool, library, or system owned by or licensed to the Disclosing Party, in source or object code form, including all updates, modifications, and derivative works thereof.

"Open-Source Components" means any software, library, or other material that is distributed under a license approved by a recognized open-source standards body or under terms that permit free use, modification, or redistribution, and that is incorporated into or used with the Proprietary Software.

"Personal Data" means any information relating to an identified or identifiable natural person, including user data, that is disclosed by or on behalf of the Disclosing Party, and any information otherwise defined as personal data, personal information, or equivalent under Applicable Data Protection Law.

"Applicable Data Protection Law" means all laws and regulations relating to privacy, data protection, and data security that apply to the Processing of Personal Data under this Agreement, in the jurisdiction of [jurisdiction] and any other relevant jurisdiction.

"Processing" means any operation performed on Personal Data or Confidential Information, whether or not by automated means, including collection, access, storage, use, disclosure, transmission, alteration, deletion, or destruction.

"Security Incident" means any actual or reasonably suspected unauthorized or unlawful access to, or acquisition, use, disclosure, loss, alteration, or destruction of, Confidential Information in the possession, custody, or control of the Receiving Party or its Representatives.

In this Agreement, headings are for convenience only; the words "including" and "includes" mean "including without limitation"; references to a Party include its permitted successors and assigns; and references to writing include email, except where expressly stated otherwise.

The Receiving Party shall use the Confidential Information solely for the Purpose and for no other purpose whatsoever, including without limitation any commercial, competitive, research, development, benchmarking, or product-improvement purpose.

Nothing in this Agreement obliges either Party to enter into any further transaction, and no license, partnership, or other business relationship shall arise unless and until a separate definitive written agreement is executed by authorized signatories of both Parties.

The Disclosing Party shall have sole discretion to determine what Confidential Information, if any, it will disclose, and may withhold, limit, or withdraw access to any Confidential Information at any time without liability.

The Receiving Party shall not, without the prior written consent of the Disclosing Party, use the Confidential Information to solicit, approach, or conduct business with any customer, user, supplier, or employee of the Disclosing Party identified through the Confidential Information.

The Receiving Party shall not use the Confidential Information to file, prosecute, or assist in any patent, copyright, trademark, or other intellectual property application or claim, or to challenge the Disclosing Party's rights in the Confidential Information.

The Receiving Party shall be responsible for ensuring that any use of the Confidential Information by its Representatives is limited to the Purpose, and any use outside the Purpose shall constitute a material breach of this Agreement.

The evaluation of the Confidential Information shall be conducted at the locations, on the systems, and through the access methods approved by the Disclosing Party in writing, as specified in [evaluation environment and access terms].

The Receiving Party shall hold the Confidential Information in strict confidence and shall protect it using at least the same degree of care it uses to protect its own most sensitive information, and in no event less than a reasonable degree of care.

The Receiving Party shall not disclose the Confidential Information to any person other than its Representatives, and then only to the extent necessary for the Purpose and after such Representatives have been informed of its confidential nature.

The Receiving Party shall not disclose the Confidential Information to any third party, including any affiliate, contractor, consultant, investor, or financing source, without the prior express written consent of the Disclosing Party, which may be withheld in its sole discretion.

The Receiving Party shall maintain a written record of all Representatives who have been given access to the Confidential Information and shall provide such record to the Disclosing Party promptly upon request.

The Receiving Party shall be fully liable for any act or omission of its Representatives that would constitute a breach of this Agreement if committed by the Receiving Party, regardless of whether the Representative's engagement has ended.

The Receiving Party shall not remove, alter, or obscure any proprietary, confidentiality, or copyright notices contained in or on the Confidential Information.

The Receiving Party shall promptly notify the Disclosing Party in writing upon becoming aware of any unauthorized use or disclosure of Confidential Information and shall take all reasonable steps, at its own cost, to prevent further unauthorized use or disclosure and to assist the Disclosing Party in remedying the same.

The obligations of confidentiality under this Agreement shall not apply to information that the Receiving Party can demonstrate by contemporaneous written records: (i) is or becomes generally available to the public other than through a breach of this Agreement or any other duty of confidentiality; (ii) was lawfully known to the Receiving Party, free of any obligation of confidentiality, before its disclosure by the Disclosing Party; (iii) is lawfully received from a third party who was entitled to disclose it without restriction; or (iv) is independently developed by the Receiving Party without use of or reference to the Confidential Information.

The burden of proving that any exclusion applies shall rest solely on the Receiving Party.

Confidential Information shall not be deemed to fall within the exclusions merely because it is embraced by more general information that is publicly available or in the Receiving Party's possession, or because individual features of it are publicly known but their combination or compilation is not.

The exclusions in this Section shall not apply to Personal Data, which shall remain subject to the obligations of this Agreement and Applicable Data Protection Law at all times.

The exclusions in this Section shall not apply to Source Code, which shall remain Confidential Information regardless of whether any functionality, behavior, or output of the Proprietary Software is publicly known.

Information shall not be deemed to be independently developed if any person who had access to the Confidential Information participated in, directed, or influenced such development.

If the Receiving Party or any of its Representatives is required by law, court order, or the binding requirement of a competent governmental or regulatory authority to disclose any Confidential Information, the Receiving Party shall, to the extent legally permitted, give the Disclosing Party prompt prior written notice, and in any event sufficient time to seek a protective order or other remedy.

The Receiving Party shall cooperate with the Disclosing Party, at the Disclosing Party's request and at the Disclosing Party's reasonable expense, in contesting or limiting the scope of the required disclosure, and shall not oppose any action by the Disclosing Party to obtain such relief.

If, absent a protective order or other remedy, disclosure is nonetheless legally compelled, the Receiving Party shall disclose only that portion of the Confidential Information that, on the written advice of its legal counsel, it is legally required to disclose, and shall use reasonable efforts to obtain assurance that confidential treatment will be accorded to it.

Any Confidential Information disclosed pursuant to this Section shall remain Confidential Information for all other purposes and shall continue to be subject to this Agreement as against all other persons.

The Receiving Party shall not be entitled to disclose Source Code under this Section except pursuant to a final order of a court of competent jurisdiction, and then only under the strictest available confidentiality protections, such as filing under seal.

The Receiving Party shall provide the Disclosing Party with a copy of the disclosure made and the identity of the recipient promptly after such disclosure.

The Receiving Party acknowledges that the Source Code and Proprietary Software constitute the most valuable trade secrets of the Disclosing Party, and that any unauthorized use or disclosure thereof would cause irreparable harm.

Access to Source Code, if granted by the Disclosing Party in its sole discretion, shall be limited to named individuals approved in writing by the Disclosing Party, and shall be provided only through a secure environment designated by the Disclosing Party, as described in [source code review procedure].

The Receiving Party shall not download, copy, transcribe, photograph, print, screen-capture, transmit, or otherwise reproduce Source Code in any form or by any means, except as expressly authorized in writing by the Disclosing Party.

The Receiving Party shall not upload, input, or expose any Source Code or Proprietary Software to any third-party service, including any cloud-based tool, code repository, or artificial intelligence or machine learning system, nor use it to train or improve any model.

The Receiving Party shall not compile, execute, deploy, or test any Source Code or Proprietary Software except within the evaluation environment, and only to the extent expressly permitted by the Disclosing Party.

The Disclosing Party may monitor, log, and audit all access to Source Code and Proprietary Software, and the Receiving Party consents to such monitoring.

Any evaluation access to Proprietary Software, including any object code, demonstration, or test version, is granted on a limited, revocable, non-exclusive, non-transferable, and non-sublicensable basis solely for the Purpose and shall not constitute a license for any other purpose.

The Receiving Party acknowledges that the Proprietary Software may incorporate or interoperate with Open-Source Components, and that the Disclosing Party's selection, configuration, integration, and combination of such components constitute Confidential Information, notwithstanding that the underlying components may be publicly available.

Nothing in this Agreement shall be construed as restricting the Receiving Party's rights, under the applicable open-source license, in respect of any Open-Source Component obtained independently from a public source and without use of Confidential Information.

The Receiving Party shall not use any information regarding the identity, version, configuration, vulnerabilities, or manner of use of Open-Source Components within the Proprietary Software to exploit, attack, or compromise the Proprietary Software or the Disclosing Party's systems.

Any disclosure of Confidential Information to the Receiving Party shall not be deemed a distribution, conveyance, or release of any Open-Source Component or of the Proprietary Software under any open-source license, and the Receiving Party shall not assert otherwise.

The Receiving Party shall not contribute, publish, or submit any Confidential Information, or any code derived from it, to any open-source project or public repository.

The Receiving Party shall not take any action that would cause any Proprietary Software or Source Code to become subject to any open-source license or to any obligation to disclose, license, or distribute it on open-source terms.

Any open-source license compliance information, inventory, or audit report provided by the Disclosing Party shall constitute Confidential Information.

The Receiving Party shall not, and shall not permit any third party to, copy, reproduce, duplicate, or replicate any Confidential Information, in whole or in part, except for the minimum number of copies of non-Source Code materials strictly necessary for the Purpose and approved in writing by the Disclosing Party.

The Receiving Party shall not reverse engineer, decompile, disassemble, decrypt, or otherwise attempt to derive, discover, or reconstruct the Source Code, algorithms, structure, sequence, organization, data models, or underlying ideas of any Proprietary Software or any other Confidential Information, whether by analysis, testing, observation, or any other means.

The Receiving Party shall not modify, adapt, translate, enhance, or create any derivative works, competing products, or functionally equivalent software based on or informed by the Confidential Information.

The Receiving Party shall not circumvent, disable, or interfere with any technical protection measure, license key, access control, watermark, or security feature in or associated with the Confidential Information or Proprietary Software.

The Receiving Party shall not perform any benchmarking, performance, security, vulnerability, or penetration testing of the Proprietary Software, or publish the results of any evaluation of it, without the prior written consent of the Disclosing Party.

Any copy, derivative work, or reconstruction created in breach of this Section shall be the property of the Disclosing Party, and the Receiving Party hereby assigns to the Disclosing Party all rights, title, and interest therein, to the extent such assignment is permitted, and shall deliver the same to the Disclosing Party upon request.

The Parties agree that the prohibitions in this Section are absolute and apply regardless of any right the Receiving Party might otherwise have, to the fullest extent permitted by applicable law.

The Receiving Party acknowledges that the Confidential Information may include Personal Data, and that, as between the Parties, the Disclosing Party determines the purposes and means of the Processing of such Personal Data, as described in [categories of Personal Data, data subjects, and nature of Processing].

The Receiving Party shall Process Personal Data only for the Purpose, only on the documented instructions of the Disclosing Party, and in compliance with Applicable Data Protection Law, and shall immediately inform the Disclosing Party if it believes any instruction infringes Applicable Data Protection Law.

The Receiving Party shall not sell, share, transfer, or disclose Personal Data to any third party, nor transfer Personal Data outside [permitted territory] without the prior written consent of the Disclosing Party and the implementation of appropriate legal transfer safeguards.

The Receiving Party shall not attempt to re-identify any individual from anonymized, pseudonymized, or aggregated data, nor combine Personal Data with any other data set, and shall not contact any data subject.

The Receiving Party shall ensure that all persons authorized to Process Personal Data are bound by binding obligations of confidentiality and receive appropriate data protection training.

The Receiving Party shall promptly, and in any event within [number] hours, notify the Disclosing Party of any request, complaint, or inquiry received from a data subject or supervisory authority relating to the Personal Data, and shall not respond except on the Disclosing Party's instructions.

The Receiving Party shall provide all assistance reasonably requested by the Disclosing Party to enable it to comply with its obligations under Applicable Data Protection Law, and, if so requested, shall enter into such additional data protection terms as the Disclosing Party may reasonably require.

The Disclosing Party may, on reasonable notice, audit or require evidence of the Receiving Party's compliance with this Section.

The Receiving Party shall implement and maintain appropriate technical and organizational measures to protect the Confidential Information against Security Incidents, including encryption in transit and at rest, access controls based on least privilege, multi-factor authentication, logging, and secure disposal, consistent with recognized industry standards and any additional requirements specified in [security requirements].

The Receiving Party shall store Confidential Information only on systems that are under its control, appropriately secured, and logically segregated from other data, and shall not store Confidential Information on personal devices or unapproved removable media.

The Receiving Party shall notify the Disclosing Party in writing of any Security Incident without undue delay and in any event within [number] hours after becoming aware of it, directed to [Disclosing Party security contact].

Such notice shall describe, to the extent known, the nature of the Security Incident, the Confidential Information and categories of individuals affected, the likely consequences, and the measures taken or proposed to address it, and shall be supplemented as further information becomes available.

The Receiving Party shall, at its own cost, promptly take all steps necessary to contain, investigate, and remediate the Security Incident, shall preserve all relevant evidence, and shall cooperate fully with the Disclosing Party and any competent authority.

The Disclosing Party shall have the sole right to determine whether, when, and how to notify affected individuals, authorities, or other third parties of a Security Incident, and the Receiving Party shall bear all reasonable costs of such notification and of any credit monitoring or similar remedial measures, to the extent the Security Incident arises from the acts or omissions of the Receiving Party or its Representatives.

The Receiving Party shall permit the Disclosing Party, on reasonable notice, to assess the Receiving Party's security measures relating to the Confidential Information.

All Confidential Information, and all intellectual property rights therein, shall remain the sole and exclusive property of the Disclosing Party or its licensors, and nothing in this Agreement grants the Receiving Party any right, title, license, or interest in or to the Confidential Information, except the limited right to use it for the Purpose in accordance with this Agreement.

All rights not expressly granted to the Receiving Party are reserved by the Disclosing Party.

The Disclosing Party's disclosure of Confidential Information shall not constitute a waiver of any trade secret, copyright, patent, or other intellectual property right, nor a public disclosure or publication for any purpose.

If the Receiving Party or its Representatives provide any suggestions, ideas, or feedback regarding the Proprietary Software or other Confidential Information, the Receiving Party grants the Disclosing Party a perpetual, irrevocable, worldwide, royalty-free, transferable, and sublicensable license to use and exploit the same without obligation or attribution.

The Receiving Party shall not register, or apply to register, any intellectual property right in or relating to the Confidential Information or the Disclosing Party's names, marks, or products.

Any improvement, modification, or derivative of the Confidential Information made by or for the Receiving Party, in breach of this Agreement or otherwise, shall be owned by the Disclosing Party to the extent permitted by law.

All Confidential Information is provided "as is" and "as available." The Disclosing Party makes no representation or warranty, express, implied, or statutory, as to its accuracy, completeness, performance, quality, non-infringement, merchantability, or fitness for a particular purpose.

Neither the Disclosing Party nor its affiliates, directors, officers, employees, or advisers shall have any liability to the Receiving Party or its Representatives arising from the use of, or reliance on, the Confidential Information, or from any errors or omissions therein.

Only those representations and warranties, if any, that are expressly set out in a definitive written agreement executed between the Parties shall have any legal effect.

Nothing in this Agreement shall be construed as a representation or warranty that the Confidential Information, Proprietary Software, or Open-Source Components are free from defects, vulnerabilities, or third-party claims.

The Receiving Party acknowledges that it has made, and will make, its own independent evaluation and assessment, and it assumes sole responsibility for any decision made in connection with the Purpose.

The Disclosing Party's election not to disclose any particular information shall not give rise to any claim or liability.

Upon the Disclosing Party's written request at any time, and in any event upon the termination or expiration of this Agreement or the conclusion of the Purpose, the Receiving Party shall, within [number] days, cease all use of the Confidential Information and, at the Disclosing Party's election, return or securely destroy all Confidential Information in its possession, custody, or control, and that of its Representatives.

The destruction of Confidential Information shall be carried out in a manner that renders it permanently irrecoverable, including secure deletion from all systems, backups, and storage media, in accordance with recognized industry standards.

The Receiving Party shall, within the same period, deliver to the Disclosing Party a written certificate, signed by an authorized officer of the Receiving Party, confirming that it has complied fully with this Section.

Notes, analyses, and other materials prepared by or for the Receiving Party that contain or reflect Confidential Information shall be destroyed, and shall not be returned unless the Disclosing Party so requests.

Personal Data shall be returned or deleted as instructed by the Disclosing Party, and the Receiving Party shall not retain any copy except where retention is required by mandatory law, in which case the Receiving Party shall notify the Disclosing Party of the legal basis and shall continue to protect such data in accordance with this Agreement.

Any Confidential Information that cannot reasonably be deleted from automated backup systems shall remain subject to this Agreement for as long as it is retained, and shall not be accessed or restored for any purpose.

The return or destruction of Confidential Information shall not relieve the Receiving Party of any of its obligations under this Agreement.

This Agreement shall commence on the Effective Date and, unless earlier terminated, shall remain in effect for a period of [number] months (the "Term"), provided that the Disclosing Party may terminate this Agreement or suspend further disclosures at any time upon written notice to the Receiving Party.

The Receiving Party may terminate this Agreement only upon [number] days' prior written notice, and subject to its continuing obligations under this Agreement.

The Receiving Party's obligations with respect to Confidential Information disclosed during the Term shall survive the expiration or termination of this Agreement and shall continue for a period of [number] years from the date of such expiration or termination.

Notwithstanding the foregoing, the Receiving Party's obligations with respect to Source Code, Proprietary Software, and any information constituting a trade secret shall continue indefinitely, for so long as such information remains a trade secret or is otherwise not within the exclusions in this Agreement.

The Receiving Party's obligations with respect to Personal Data shall continue for as long as the Receiving Party or its Representatives retain or have access to any Personal Data, and thereafter for the period required by Applicable Data Protection Law.

The provisions of this Agreement that by their nature are intended to survive, including Sections relating to ownership, no warranty, remedies, indemnification, governing law, and return and destruction, shall survive its expiration or termination.

Expiration or termination of this Agreement shall not affect any rights, remedies, or liabilities that have accrued prior thereto, including in respect of any prior breach.

The Receiving Party acknowledges that the Confidential Information is unique and valuable, that any breach or threatened breach of this Agreement would cause the Disclosing Party immediate and irreparable harm for which monetary damages would be an inadequate remedy.

Accordingly, the Disclosing Party shall be entitled to seek and obtain injunctive relief, specific performance, and other equitable relief to prevent or restrain any breach or threatened breach, without the necessity of proving actual damages and, to the fullest extent permitted by law, without the requirement of posting a bond or other security.

The Receiving Party shall not oppose the granting of such relief on the ground that damages would be an adequate remedy.

The remedies provided in this Agreement are cumulative and in addition to, and not in substitution for, any other right or remedy available to the Disclosing Party under this Agreement or applicable law.

In the event of a breach, the Receiving Party shall, upon request, account for and pay over to the Disclosing Party any profits or benefits obtained as a result of such breach.

The prevailing Disclosing Party shall be entitled to recover from the Receiving Party its reasonable costs and expenses of enforcement, including reasonable attorneys' fees and costs of investigation, in any proceeding in which a breach is established.

No failure or delay by the Disclosing Party in exercising any right or remedy shall operate as a waiver thereof.

The Receiving Party shall indemnify, defend, and hold harmless the Disclosing Party, its affiliates, and their respective directors, officers, employees, agents, successors, and assigns (the "Indemnified Parties") from and against any and all losses, damages, liabilities, claims, fines, penalties, judgments, settlements, costs, and expenses, including reasonable attorneys' fees, arising out of or relating to any breach of this Agreement by the Receiving Party or its Representatives.

The indemnity in this Section shall expressly extend to any claim, demand, regulatory action, or proceeding brought by any data subject, authority, or other third party arising from any Security Incident, or from any Processing of Personal Data by the Receiving Party or its Representatives in breach of this Agreement or Applicable Data Protection Law.

The Disclosing Party shall give the Receiving Party notice of any third-party claim for which indemnification is sought, provided that any delay in giving notice shall relieve the Receiving Party of its obligations only to the extent it is materially prejudiced thereby.

The Receiving Party shall assume the defense of any such claim with counsel reasonably acceptable to the Disclosing Party, but the Disclosing Party may participate with its own counsel at its own expense, and the Receiving Party shall not settle any claim in a manner that imposes any obligation or admission on an Indemnified Party without the Disclosing Party's prior written consent.

If the Receiving Party fails to assume the defense promptly, the Disclosing Party may defend and settle the claim at the Receiving Party's expense.

No limitation or exclusion of liability, cap, or similar restriction shall apply to the Receiving Party's liability under this Agreement for breach of confidentiality, misuse of Source Code, or breach of the Personal Data provisions, except to the extent prohibited by applicable law.

The Disclosing Party shall have no obligation to indemnify the Receiving Party under this Agreement.

This Agreement, and any dispute, claim, or controversy arising out of or in connection with it, including its formation, validity, breach, or termination, and any non-contractual obligations, shall be governed by and construed in accordance with the laws of [governing law jurisdiction], without regard to its conflict of laws principles.

The Parties shall first attempt in good faith to resolve any dispute through negotiation between senior representatives for a period of [number] days following written notice of the dispute, provided that nothing in this Section shall prevent the Disclosing Party from seeking urgent injunctive or equitable relief at any time.

Any dispute not resolved under the preceding clause shall be finally resolved by [courts / arbitration institution and rules], seated in [city, jurisdiction], and conducted in the English language.

If arbitration applies, the tribunal shall consist of [number] arbitrator(s), and the award shall be final and binding upon the Parties and may be entered and enforced in any court of competent jurisdiction.

The Receiving Party irrevocably submits to the non-exclusive jurisdiction of the courts of [jurisdiction] for the purposes of any action by the Disclosing Party for injunctive or other relief, and the Disclosing Party may bring proceedings in any other court having jurisdiction over the Receiving Party or the Confidential Information.

The Receiving Party irrevocably waives any objection to venue or any claim of inconvenient forum, and any right to trial by jury, to the extent permitted by law.

All proceedings and awards shall be treated as Confidential Information of the Disclosing Party, to the extent that they relate to it.

This Agreement constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior and contemporaneous understandings, negotiations, and agreements, whether written or oral, relating thereto.

No amendment or modification of this Agreement shall be effective unless made in writing and signed by authorized representatives of both Parties. No waiver shall be effective unless in writing and signed by the waiving Party.

The Receiving Party shall not assign, delegate, or otherwise transfer this Agreement or any of its rights or obligations, whether by operation of law, change of control, or otherwise, without the prior written consent of the Disclosing Party. The Disclosing Party may assign this Agreement, in whole or in part, to any affiliate or to any successor to or acquirer of the relevant business or assets, upon notice to the Receiving Party.

If any provision of this Agreement is held to be invalid, illegal, or unenforceable, such provision shall be enforced to the maximum extent permissible and modified to the minimum extent necessary, and the remaining provisions shall continue in full force and effect.

All notices under this Agreement shall be in writing and delivered by hand, recognized courier, or email with confirmation of transmission to the addresses set out in the signature section or such other address as a Party may notify, and shall be deemed received on delivery or, if sent by email, on the next business day after transmission.

Each Party warrants that it has full power and authority to enter into this Agreement and that the individual signing on its behalf is duly authorized. The Receiving Party further represents that it has entered into this Agreement for business purposes only.

Nothing in this Agreement creates any partnership, joint venture, agency, or employment relationship between the Parties. No third party shall have any right to enforce this Agreement, other than the Indemnified Parties.

This Agreement may be executed in counterparts, including by electronic signature, each of which shall be deemed an original and all of which together shall constitute one instrument.