NDAs in Fundraising: When Investors Sign and When Not

Your First Line of Defense in an Acquisition

Exploring the sale of your company is a game of information control. You have to reveal your crown jewels—financials, customer data, product roadmap—to a potential buyer. How do you do that without the information leaking, scaring your team, or destroying your business if the deal dies?

This is the job of a Non-Disclosure Agreement (NDA). It’s a legal contract that obligates the buyer to protect your information and use it only to evaluate the acquisition. But not all NDAs are created equal. Using a generic template or blindly signing the buyer's paper can leave you fatally exposed.

More importantly, the timing and strategy of your NDA is a dance. Move too early, and you kill a promising conversation. Move too late, and it's professional malpractice. Let's get tactical.

The #1 M&A Mistake: Asking for an NDA Too Soon

Hear this now: Do not ask a potential acquirer to sign an NDA before a first meeting.

A sophisticated acquirer—a Google, a Salesforce, a major PE firm—looks at dozens of companies a month. Their corporate development teams are lean. They cannot and will not enter into a legal agreement for an exploratory chat. It creates massive administrative overhead and, more importantly, legal risk.

What if they are building something internally that rhymes with your business? Signing your NDA could "contaminate" their internal development, creating a risk of a future lawsuit. They will not take on that liability for a 30-minute intro call. Sending an NDA with your first email is the loudest possible signal that you don't know how the M&A game is played. You will be ignored.

The M&A Information Funnel: When to Deploy the NDA

The M&A process is a funnel of escalating commitment. You only reveal more sensitive information as the acquirer demonstrates more serious intent. Your job is to manage this flow of information.

Stage 1: The Initial Dance (No NDA)

Your first one or two conversations happen without an NDA. You should operate entirely from a non-confidential "teaser" deck. The goal of this deck is not to sell the company, but to get the next meeting .

Team, vision, and the problem you solve. · High-level product overview. · Market size and competitive landscape. · Anonymized, high-level metrics. For example: "Over $2M in ARR, growing 120% YoY," or "Serving 150+ enterprise customers, including 10 of the Fortune 100."

Detailed financial statements or projections. · Customer names or concentration data. · Your cap table. · Your detailed product roadmap or unannounced features.

Stage 2: The Tell (Time for the NDA)

You've had a good first call. They're leaning in. The conversation naturally turns to questions you can't answer with the teaser deck.

Them: "Can you walk me through your unit economics? We'd love to see your LTV:CAC calculations."

Them: "Who are your top 5 customers by revenue? Is there any concentration risk?"

Them: "What are the three biggest features on your 18-month roadmap?"

This is your trigger. You now have permission to set a boundary. You aren't being difficult; you are simply responding to their request for confidential information.

"Great question. We can absolutely provide a detailed breakdown of our unit economics and customer concentration. To do that, we'll need to share some confidential data, so this is the right time to get a simple NDA in place. I'm attaching our standard M&A NDA, which our counsel has prepared. Happy to connect our lawyers to get this finalized so we can schedule that deeper dive."

Stage 3: The Deep Dive (Post-NDA)

Once the NDA is signed, you can open the kimono. You will typically share your full, confidential management presentation and grant access to a virtual data room (VDR). This is where your most sensitive information lives, meticulously organized.

Battle of the Papers: Your NDA vs. Theirs

There are two types of NDAs: unilateral (one-way) and mutual (two-way). As the seller, you are disclosing sensitive information and the acquirer is receiving it. A unilateral NDA , which only binds the acquirer, is therefore the most appropriate form.

You should always start by proposing your own pro-founder, unilateral NDA.

However, reality check: almost every large acquirer will reject your paper and insist on using their own standard M&A NDA. Their legal team is comfortable with it and won't want to review a third-party document. This is a normal part of the process.

What to do: Politely accept their mutual NDA form, but state that your counsel will need to review and suggest a few minor revisions. A mutual NDA is fine—the information flow is 99% from you to them anyway—but you cannot assume their paper is "standard and safe." It is standard and safe for them. Your lawyer must review it for the traps below.

Anatomy of a Pro-Founder NDA: 5 Clauses to Scrutinize

An NDA is not a commodity. The details matter. The buyer's first draft will be slanted in their favor. Here are the clauses you and your lawyer must get right.

1. The "Residuals" Clause: A Deal-Breaking Red Flag

This is the most dangerous clause in an M&A NDA. Large acquirers often insert a "residuals" or "unaided memory" clause to give themselves air cover.

"...the Receiving Party shall be free to use for any purpose the residuals resulting from access to the Disclosing Party's Confidential Information. 'Residuals' means information in non-tangible form retained in the unaided memory of persons who have had access to the Confidential Information."

This language single-handedly destroys the entire purpose of the NDA. It says their team can use anything they happen to remember from your data room. You must politely but firmly insist this clause is struck entirely. There is no middle ground. If a buyer refuses to remove the residuals clause, it is a massive red flag about their intentions. Be prepared to walk away.

2. Definition of "Confidential Information"

You want this definition to be as broad as possible. It must explicitly cover financials, source code, IP, customer lists, and employee data. But the most critical piece to include is this:

The existence and content of the M&A discussions themselves must be defined as Confidential Information. A leak that you are "shopping the company" can cause customers to churn and employees to flee. This is not a theoretical risk.

3. Employee Non-Solicitation ("No-Poach")

What if the deal falls through? You've just given a huge, well-funded company a detailed look at your best engineers, product managers, and salespeople. A "no-poach" clause prevents the acquirer from soliciting or hiring your employees for a set period (typically 12-24 months) after talks end.

This is a critical, reasonable protection. If they push back hard, ask yourself: are they shopping for a company, or are they just on a fishing expedition for talent?

Note: This typically doesn't apply to employees who respond to general public job postings. The focus is on preventing the acquirer from actively targeting your team.

4. Term (Duration of Confidentiality)

Look for a term of at least 2-3 years for general business information. However, your most valuable secrets don't have a shelf life. Your NDA must state that "trade secrets" will be kept confidential indefinitely (in perpetuity). Work with your lawyer to ensure the definition of "Confidential Information" properly carves out trade secrets for this perpetual obligation.

5. Scope and Enforcement

The buyer will need to share data with their "Representatives" (lawyers, accountants, consultants). This is normal. Ensure the NDA includes language making the buyer legally responsible for any breach by their representatives. If their banker leaks your projections, it's the buyer's breach.

Also confirm the clause requiring the return or destruction of all materials (including all notes and analyses) is strong and clear if the deal terminates.

How to Apply This This Week: Your M&A Readiness Checklist

Don’t wait for a buyer’s email to get your house in order. Being prepared puts you in a position of strength.

Engage M&A Counsel. Not your buddy who does real estate law. You need a corporate attorney who has done dozens of tech M&A deals. Find them now and build a relationship. · Draft Your "Perfect" NDA. Work with your counsel to prepare a pro-founder, unilateral NDA. This is your opening bid and your baseline for evaluating the buyer's paper. Expect this to cost $2,000 - $5,000. · Build Your Two Decks. Create your non-confidential "teaser" deck and your full, confidential "management" deck. Know exactly what lives in each. · Outline Your Data Room. Create a folder structure for your virtual data room before you need it. Common top-level folders include: Corporate, Financials, Product & Tech, Sales & Marketing, and Team. · Identify Your Crown Jewels. Make a specific list of the top 5-10 pieces of information that give you a true competitive advantage. Is it a pricing algorithm? A specific data set? A manufacturing process? Know precisely what you're protecting.

An NDA is a critical tool that signals professionalism and sets legal guardrails. But it is not a magic shield. Enforcement is slow and expensive. Your best protection is a disciplined process, a clear-eyed view of your counterparty's intentions, and the wisdom to know what to share—and when.

How companies manage NDAs and confidentiality in a fundraising process

The rule most founders learn late: institutional venture investors do not sign NDAs to look at your deck, and asking them to is read as inexperience. They see hundreds of overlapping companies a year and cannot accept the litigation exposure. Acquirers, strategic corporate investors, lenders and family offices generally will sign, because a sale process narrows to one counterparty rather than a portfolio.

So confidentiality in a raise is managed by staging information rather than by paperwork. The public tier is your deck: market, team, product, traction shape, ask. The second tier, released after real interest, is a data room with cohort and revenue detail, gated by per-recipient links so you can see who opened what. The third tier — customer names, source code, unredacted contracts, security architecture, key employee compensation — is released only under a signed agreement during confirmatory diligence, and often only to a named diligence team.

When an agreement is appropriate, keep it narrow: a two-year term, a definition of confidential information that excludes anything the recipient already had or receives independently, no residuals clause you have not read, and no exclusivity or standstill smuggled in beside it. Track every executed copy and every data-room grant in one log so you know exactly who holds what when the round closes.