Field Manual: Contractor & Vendor NDAs
How to review NDAs from clients, vendors, and subcontractors. Covers IP carve-outs, subcontractor flow-down, indemnity traps, and when to walk away.
If you are a contractor, agency, or vendor, most NDAs you sign are inbound — written by the client or enterprise procurement team, optimised for their risk, not yours.
You are not being paranoid if you pause before signing. You are doing your job.
This field manual covers the clauses that matter when you are the receiving party: confidentiality scope, work product, subcontractors, survival, indemnity, and jurisdiction. Use it alongside our freelancer NDA review guide and complete NDA review guide.
Mission profile: contractor vs vendor
| Role | Typical NDA direction | Primary risk |
|---|---|---|
| Contractor / freelancer | Client sends one-way NDA before project kickoff | IP grab, broad definitions, one-sided indemnity |
| Vendor / SaaS supplier | Customer sends security + confidentiality pack | Flow-down to your subprocessors, audit rights |
| Subcontractor | Prime contractor forwards client NDA verbatim | Double liability without double margin |
The review checklist is similar; the negotiation leverage is not. Enterprise customers rarely budge on their template. Smaller clients often will — if you show specific redlines instead of "my lawyer said no."
Phase 1: Confidentiality definition
Everything flows from what counts as confidential. Client templates often define it as:
- "All information disclosed in connection with the engagement"
- Oral disclosures without a confirmation window
- Your feedback, suggestions, and improvements as confidential
Field rule: If the definition is broader than marked documents + reasonably understood sensitive materials, flag it. Cross-check confidential information definitions against standard exclusions (public domain, prior knowledge, independent development).
| Signal | Action |
|---|---|
| "Any and all information" | Negotiate category list + written marking for oral disclosures |
| No exclusion carve-outs | Insist on market-standard four exclusions |
| Your pre-existing tools included | Add explicit reservation of background IP |
Phase 2: Work product and IP
Contractor NDAs frequently smuggle assignment language into confidentiality sections:
"Any work product, improvements, or derivative works based on Confidential Information shall belong to the Client."
That may be appropriate in a statement of work — not in a pre-discussion NDA.
| Clause pattern | Threat | Counter-move |
|---|---|---|
| Assignment of improvements | Critical | Limit to deliverables under a separate SOW |
| Residuals / "retained in memory" | High | Remove or narrow — see residuals clause |
| Feedback licence | Medium | Limit to purpose of the project, non-exclusive |
| Work-for-hire without SOW | Critical | Delete from NDA; address in services agreement |
Field rule: The NDA should protect their secrets. Your methodologies, reusable libraries, and general skills stay yours unless you are explicitly paid to assign deliverables.
Phase 3: Subcontractors and flow-down
Enterprise clients require:
"If Contractor engages subcontractors, Contractor shall ensure they are bound by equivalent confidentiality obligations."
Reasonable in principle — painful if you must get a five-person sub team to sign a 12-page enterprise NDA before sharing a Figma link.
Negotiation levers:
- Approved subprocessors list — attach exhibit of known subs instead of per-person signature
- NDA flow-down via MSA — subcontractor bound through your master terms, not client's full pack
- Liability cap alignment — you are not indemnifying for subs beyond your fee
Phase 4: Survival, return, and destruction
| Term | Contractor-friendly target | Client pushback |
|---|---|---|
| Survival | 2–3 years post-termination | 5 years or trade-secret perpetual |
| Return / destroy | 30 days, backups carved out | 5 business days, no backup exception |
| Certification | Reasonable written confirm | Affidavit-style certification |
Long survival periods on broad definitions mean you carry compliance cost years after the project ends. Align survival with the sensitivity of what you actually received.
Phase 5: Indemnity and remedies
Client NDAs often stack:
- One-sided indemnification
- Injunctive relief without bond
- Exclusive jurisdiction in their state
Walk-away triggers for contractors:
- Uncapped one-sided indemnity on a sub-€10k project
- Indemnity for third-party claims without causation limit
- Personal guaranty (sole proprietors — this binds you personally)
Acceptable compromise: Mutual indemnity for your respective breaches, capped at project fees or 1× contract value.
Phase 6: Jurisdiction
If you operate in the EU and the NDA requires Delaware courts, every dispute is a travel-and-counsel event for you.
| Your location | Reasonable ask |
|---|---|
| EU contractor | EU member state law + courts where you perform work |
| US remote contractor | Your state or neutral arbitration |
| Global agency | Governing law of prime contract + arbitration (ICC or similar) |
See governing law for negotiation framing.
Decision matrix: sign, negotiate, or walk
| Burn Score estimate | Relationship value | Recommendation |
|---|---|---|
| Low (≤30) | Any | Sign after quick read |
| Medium (31–55) | Repeat client | Negotiate 2–3 redlines |
| High (56–75) | Strategic account | Full review + cap indemnity |
| Critical (76+) | One-off small gig | Walk or require separate SOW |
Upload the document for an actual Burn Score — this matrix is orientation only.
Vendor-specific: security exhibits
SaaS vendors often receive a security schedule plus NDA. Watch for:
- Unlimited audit rights on your infrastructure
- Breach notification windows shorter than your SOC process allows
- Customer data definitions that sweep your own product analytics
Treat security exhibits as part of the same review — not a separate "legal already approved it" packet.
Tooling workflow
- [Risk quiz](/quiz) — 2-minute orientation if you have not read the doc yet
- NDAShield upload — clause classification + Burn Score
- Redlines — send specific edits, not "we need our lawyer to review"
- Counsel — customer data, regulated industries, or indemnity above your insurance cap
Compare AI options: NDAShield vs ChatGPT, vs Claude, vs Gemini.
Bottom line
Contractor and vendor NDAs are designed to protect the party with the template — not to be fair by default. Your job is to separate genuine confidentiality needs from IP grabs, uncapped indemnity, and jurisdiction traps.
Sign when the scope is narrow, IP is carved out, survival is bounded, and liability matches the deal size. Negotiate when it is a repeat relationship worth keeping. Walk when the template treats a €5k project like an acquisition.