A startup NDA is short — 2–3 pages — and every clause matters. This guide walks through a standard mutual NDA one provision at a time: how to define the parties and proprietary information, the four core obligations that make an NDA actually protective, the carve-outs courts require, why the non-compete clause has no place in an investor NDA, and the boilerplate that decides whether the whole thing holds up in court.
Key takeaways
- Name the entity, not the individual — the company owns the IP, so the Disclosing Party should always be the corporation, signed by an officer on its behalf.
- Define Proprietary Information with specific categories and standard carve-outs (already known, public, independently developed) — courts enforce specifics.
- The four core obligations are hold, don't disclose, don't use beyond evaluation, and don't reverse-engineer — the reverse-engineer clause is the one counterparties try to soften.
- Bind the counterparty's employees, agents, and subcontractors to the same NDA — without downstream binding, the NDA leaks the moment the recipient forwards it.
- Delete the non-compete clause for investor and partner NDAs — it's unenforceable in California, being targeted federally, and signals inexperience.
- Fill in the governing-law state (usually your state of incorporation) and never accept the counterparty's home state as jurisdiction.
Why the NDA is the most misunderstood document in early-stage fundraising
A startup NDA is short — usually two or three pages — and every clause matters. Most founders treat it as a formality and sign whatever a counterparty sends, or ask an investor to sign one before the first meeting and never hear back. Both are mistakes. This is a clause-by-clause walkthrough of a standard mutual NDA, with the edits and warnings that separate a template that holds up in court from one that leaks in practice. Not legal advice — always have final versions reviewed by counsel.
1. Define the Disclosing Party and Receiving Party as entities, not individuals
The template opens with two named parties: the Disclosing Party (the company sharing information) and the Receiving Party (the person or entity receiving it). Two things founders skip that matter: include the entity type on both sides — "a Delaware C-Corporation", "a California LLC", "an individual residing in [state]" — because ambiguity here is what defense lawyers exploit when an NDA is contested. And if the receiving party is a company, name the entity, not the person you're meeting with. Otherwise you have a signed NDA against Jane Smith personally when Jane's employer is the party you actually need bound.
Founder rule: never sign an NDA where you personally are named as the Disclosing Party. The company owns the IP, not you. Name the entity and sign as "CEO" or "Founder" on behalf of the entity.
2. Define "Proprietary Information" with specific categories and standard carve-outs
A well-drafted NDA covers information shared before the NDA was signed (many first conversations happen ahead of paperwork), during the relationship, and any follow-up disclosures. Two edits to make: add specific categories relevant to your business — "source code, customer lists, financial projections, product roadmap, unreleased pricing, cap table, and investor communications" — because courts enforce specific definitions more reliably than catch-all ones. Then explicitly exclude information the Receiving Party already knew, information that becomes public through no fault of theirs, or information they independently developed. These carve-outs are standard, and their absence makes the NDA look overreaching to a judge.
3. The four core obligations — hold, don't disclose, don't use, don't reverse-engineer
Every NDA needs four obligations: (i) hold the information in strict confidence with the same care used for the Receiving Party's own confidential materials; (ii) do not disclose to third parties; (iii) do not use the information for any purpose other than evaluating the relationship; (iv) do not copy or reverse-engineer. The "reverse-engineer" clause matters more than founders realize — without it, a Receiving Party can legally decompile your software or take apart your hardware and claim they built independently. The "evaluate internally" language on use is load-bearing: it prevents a potential partner from using your data to make decisions unrelated to the deal ("we used your pricing benchmark to reset our own").
4. Bind the counterparty's employees, agents, and subcontractors
The NDA should require the Receiving Party to make its employees, agents, and subcontractors sign a substantially similar NDA before receiving Proprietary Information. This is the clause that distinguishes an NDA that works from one that leaks. Without it, the Receiving Party can hand your data to a contractor in another country with zero contractual obligation. Resist any counterparty edit that softens this to "reasonable efforts to inform employees" — the standard should be signed agreements, not verbal notification. On material engagements (M&A discussions, technical diligence), request the list of specific individuals who will see the information and require each of them to be pre-approved and signed onto the NDA.
5. Return of materials — including cloud copies
The NDA should require the Receiving Party to return all Proprietary Information and copies upon written request, and to destroy or erase anything that can't be physically returned. Two modern additions the standard template lacks but should include: require written certification of destruction from an officer, not a verbal confirmation; and address cloud copies specifically — "including any copies stored in cloud services, backup systems, or personal devices, subject to standard backup retention policies of no more than 90 days". Without cloud language, a Receiving Party can technically comply while leaving your data on Dropbox indefinitely.
6. Legally required disclosures — with prompt notice
The NDA should allow the Receiving Party to disclose Proprietary Information if required by law or court order, provided they use reasonable efforts to limit disclosure and give the Disclosing Party a chance to seek a protective order. This is standard and non-negotiable — courts won't enforce an NDA that requires a party to defy a subpoena. Two founder-side edits: require prompt written notice ("within 5 business days, or immediately if the disclosure is imminent"); and require the Receiving Party to cooperate with any protective-order motion at the Disclosing Party's expense.
7. No obligation to disclose or transact
Include a clause stating that nothing in the NDA requires either party to actually disclose information or to proceed with the transaction. This is the "this is just an NDA, not a deal" clause. Its absence is what lets a jilted party sue for expectation damages when a deal falls apart. It clarifies that signing an NDA doesn't create a duty to negotiate in good faith, doesn't create exclusivity, and doesn't obligate either side to write a check or ship code.
8. The non-compete clause — delete it for investor and partner NDAs
Many templates contain a one- or two-year non-compete ("Receiving Party agrees not to compete as a direct business with Company for the next two years"). This is the most legally fragile clause in a startup NDA and the most-litigated. Three warnings: California voids most non-competes against individuals — this clause is unenforceable there and can invalidate the entire agreement in some readings. Federal FTC rules have targeted non-competes broadly — check current status before relying on this. If you keep it, tighten the scope massively — "directly competing product in the same customer segment", not "any related business".
Founder rule: for investor and partner NDAs, delete the non-compete entirely. Investors will not sign an NDA with a non-compete, and requesting one signals inexperience that will end most conversations before they start.
9. Waiver, severability, assignment, and governing law
The last few provisions are boilerplate but critical. Waiver language ensures that letting one violation slide doesn't waive your right to enforce the next. Severability keeps the rest of the agreement intact if one clause (like the two-year non-compete above) is thrown out — without it, a single overreaching clause can void the entire NDA. Assignment language should block transfers without consent, but carve out an exception for assignment to a successor entity in an acquisition, so a future acquirer inherits the NDA without needing counterparty consent. Governing-law: fill in the state where your company is incorporated or headquartered — most Delaware C-Corps put Delaware. Never leave the blank empty and never accept the state of the Receiving Party — that hands enforcement to whichever jurisdiction is least favorable to you.
The six mistakes that make a startup NDA unenforceable
Asking investors to sign an NDA before a first meeting. The request itself ends the conversation with top-tier funds. Reserve NDAs for later diligence. · Leaving the governing-law state blank. A court's first question in a dispute is "under whose law?" Fill in your state of incorporation. · Keeping the non-compete clause in an investor or vendor NDA. Delete it entirely for investor and partner NDAs; keep a narrow version only where limited non-compete is customary. · Not extending the NDA to the counterparty's employees, agents, and subcontractors. Without downstream binding, your data can be handed to third parties with zero obligation. · Signing personally instead of on behalf of the entity. The Disclosing Party should always be the company entity. Sign "CEO, [Company Name]" — never just your name. · Not addressing cloud copies in the return-of-materials clause. Modern engagements share data via Google Drive, Notion, Slack, and Dropbox. Add explicit cloud-copy language or your data lives forever in the recipient's SaaS tools.
The bottom line
An NDA is a short document that does one job: it makes a court willing to hear you if a counterparty misuses your information. The clauses that decide whether that job gets done are the four core obligations, the downstream binding of employees and subcontractors, the cloud-aware return of materials, the removal of the non-compete, and the choice of governing law. Get those right and the rest is procedure. Get them wrong and the NDA is theater.
Frequently asked questions
- Should I ask an investor to sign an NDA before pitching?
- No. Top-tier investors will not sign NDAs on inbound pitches, and requesting one is a hard filter that ends most conversations. Reserve NDAs for later-stage diligence, technical deep-dives, or when sharing information beyond the deck — customer lists, source code, unreleased financials, and cap table.
- What are the four core obligations in a startup NDA?
- Hold the information in strict confidence with at least the same care used for one's own confidential materials; do not disclose to third parties; do not use the information for any purpose other than evaluating the relationship; do not copy or reverse-engineer. The reverse-engineering clause is critical for software and hardware startups and is often the first clause deleted by a counterparty who intends to do exactly that.
- Should the NDA include a non-compete clause?
- For investor and partner NDAs, no — delete it. Non-competes are unenforceable in California, being targeted by the FTC federally, and signal inexperience when requested from investors. For contractor or advisor NDAs, a narrow non-compete scoped to a specific competing product in the same customer segment can be reasonable.
- Which state's law should govern the NDA?
- The state where your entity is incorporated or headquartered — most Delaware C-Corps put Delaware, California and New York are also common. Never leave the governing-law blank empty and never accept the state of the Receiving Party — that hands enforcement to a jurisdiction chosen by the party most likely to breach.
