Mutual Non-Disclosure Agreement

1. Parties

This agreement is made between [PARTY A LEGAL NAME], of [ADDRESS], and [PARTY B LEGAL NAME], of [ADDRESS], and takes effect from [DATE].

It applies to information disclosed by either party to the other in connection with [DESCRIPTION OF ENGAGEMENT].

2. What is confidential

Confidential Information means non-public information disclosed by one party (the Discloser) to the other (the Recipient), in any form, that is either marked confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure.

It includes, without limiting the above: system architecture and configuration; source code; credentials; security findings and vulnerability details; business plans, pricing and customer information; and the testing methodology, tooling and report formats of the Tester.

3. What is not confidential

This agreement does not apply to information that:

• ▸was already lawfully known to the Recipient without an obligation of confidence, and the Recipient can show it;
• ▸is or becomes public through no act or omission of the Recipient;
• ▸is lawfully received from a third party who is free to disclose it;
• ▸was independently developed by the Recipient without reference to the Confidential Information.

4. Obligations

The Recipient will use the Confidential Information only for the purpose described in section 1, will protect it with at least the care it applies to its own confidential information and in no case less than reasonable care, and will not disclose it to anyone except employees, contractors or advisers who need it for that purpose and are bound by obligations no less protective than these.

The Recipient remains responsible for any breach by a person it discloses to.

5. Required disclosure

If the Recipient is required by law, regulation or court order to disclose Confidential Information, it may do so — but will, where lawful and practicable, notify the Discloser first and in enough time for the Discloser to seek protection, and will disclose only what is required.

6. Security findings

Vulnerability details disclosed under this agreement are Confidential Information and will not be published, presented or shared without the Discloser's written permission.

This does not prevent either party from reporting a vulnerability in third-party software to that software's vendor, provided the report does not identify the Discloser or its systems.

7. Term

The obligations in this agreement begin on the date in section 1 and continue for [3] years after the engagement ends, except for information that constitutes a trade secret under applicable law, where they continue for as long as it remains one.

8. Return and destruction

On written request, the Recipient will return or destroy the Confidential Information in its possession and confirm in writing that it has done so, except for copies retained automatically by routine backup systems and copies it is required by law to keep — which remain subject to this agreement for as long as they are held.

9. No licence, no obligation

Nothing here transfers ownership of, or grants any licence to, any intellectual property. Nothing here obliges either party to disclose anything, or to enter into any further agreement.

10. General

This agreement is governed by the laws of [JURISDICTION], and the courts of [JURISDICTION] have exclusive jurisdiction over any dispute arising from it.

It is the entire agreement between the parties on this subject and replaces any prior understanding about it. Any change must be in writing and signed by both parties. If any provision is found unenforceable, the rest continues to apply.

[PARTY A] Name: ____________________ Signature: ____________________ Date: __________

[PARTY B] Name: ____________________ Signature: ____________________ Date: __________