In plain English
An NDA redline checklist is a pass you run before signing a confidentiality agreement: confirm mutual vs one-way, cap how broad "Confidential Information" is, decide residuals, set a real term, and kill non-solicit that snuck in from an MSA. Flag, accept, counter, or escalate, don't treat NDAs as harmless cover sheets.
Not legal advice. Escalate unusual, high-stakes, or personally guaranteed paper to a licensed attorney.
By version90 staff Published How this was made
How should you use this NDA redline checklist?
Use it as a shared standard: open the latest .docx, work the boxes, and mark each fail accept, counter, or escalate. Pin it next to the Startup MSA redline checklist. Review NDAs with the same founder/ops pass as an MSA: How to review an MSA without a lawyer. If AI helps, require citations: AI contract review with citations.
Mutual vs one-way: which NDA should you sign?
A mutual NDA binds both sides. A one-way NDA binds only the receiving party. Default to mutual whenever both sides will actually talk. Accept one-way only when the information flow is deliberately one direction, and you are the party being protected, or you are comfortable being the only one on the hook.
One-way paper is common in vendor diligence. That is a bargaining position, not physics. If both sides will share anything real, mutual is the adult form. Redline cue: if the title says "Mutual" and the body only binds you, believe the body.
How broad should "Confidential Information" be?
The definition should cover what you need protected, not the entire observable universe. Over-broad language ("any information relating to the Discloser's business, whether marked or not") turns public decks and your own independent work into potential breaches.
Check marking rules you can actually follow, exclusions that work (public, independently developed, rightfully received, compelled disclosure), and whether personal data is stuffed in when you need a DPA instead. An NDA is not a substitute for an MSA. If they are governing services, payment, or IP ownership here, you are negotiating the wrong instrument.
What is a residuals clause, and should you accept it?
A residuals clause lets a receiving party use knowledge that stays in unaided memory after the NDA ends. It exists because people cannot un-know a meeting. It becomes a problem when "residuals" is so wide it legalizes reuse of your secret sauce as long as nobody photocopied the deck. Treat it as a decision, not a vibe.
| Residuals flavor | What it usually does | Founder/ops cue |
|---|---|---|
| Narrow / unaided memory | General knowledge retained without notes or source | Often acceptable in ordinary talks |
| Broad "ideas and concepts" | Reuse of concepts that were the meeting | Counter or delete if you are disclosing product/IP |
| Residuals plus no injunction | You cannot stop use, only maybe sue later | Escalate; pairs badly with a tiny cap |
| None | Strict duty; harder for teams who sit many pitches | Fine for short, high-sensitivity disclosures |
Pitching a product? Broad residuals are a leak with a polite name. Sitting ten vendor demos a week? Narrow residuals may be how your team keeps working.
How long should an NDA last?
Split agreement term (how long you keep exchanging information) from survival (how long duties last after). A defined talk window plus multi-year survival on ordinary commercial secrets is a common pattern, not a rule. Trade secrets, if you actually have them, often need longer protection as long as they remain trade secrets.
Watch perpetual confidentiality on everything, 12-month survival on secrets you will still use years later, and terms that never end. "In effect until terminated" with no convenience out is not simple, it is an open tab.
Where does non-solicit creep into NDAs?
Non-solicit creep is MSA language hitchhiking into an NDA: no hiring each other's people, no talking to customers, sometimes a stealth non-compete. Diligence NDAs do not need to freeze recruiting. If you want a non-solicit, put it in the deal documents with a scope you can explain.
Typical hitchhikers: employee or customer non-solicit, non-competes, IP assignment of "all feedback," uncapped indemnity. Confidentiality breach is a classic carve-out from a liability cap. Non-solicit plus uncapped damages is not "please don't leak the deck."
What should you check on every NDA redline?
- Legal names match the entities that will actually share information
- Mutual vs one-way matches the real information flow (header matches body)
- Purpose / permitted use is specific, not "any business purpose"
- Definition of Confidential Information is broad enough to matter and narrow enough to live with
- Standard exclusions present and not gutted
- Residuals: none, narrow, or broad, conscious choice
- Agreement term and confidentiality survival are both stated
- Return / destruction on request is practical (archival backups excepted if needed)
- Compelled-disclosure procedure exists
- No non-solicit, non-compete, or IP assignment unless you meant to negotiate those
- No personal data processing pretending to be an NDA: DPA pointer if needed
- Governing law / venue you can live with for a two-party talk
- One canonical
.docxwith Track Changes on; noNDA_final_FINAL(2).pdf
Escalate or walk: one-way duties while they disclose nothing; residuals that swallow the definition; non-solicit plus perpetual term; uncapped damages for ordinary talk; silent edits vs the last draft.
About this page
Who. Written by version90 staff at Latent Ape LLC, the company that builds version90, working with AI tools. We build contract software and run our own contracts through it; we are not a law firm, and nothing here is legal advice.
How. Each piece starts from the review workflow version90 is built around. AI drafts and structures the text; staff edit, fact-check, and rewrite it before it is published, and we update the date shown above whenever the substance changes.
Why. The library exists to give founders and ops teams a shared standard for reviewing contracts without a legal department. If you spot an error, email [email protected] and we will fix the page.