NDA-gated security documents
An NDA gate is there to record acceptance of a restriction, not to start a negotiation. Most companies make it far harder than it needs to be.
Gate security documents behind a short click-through NDA that a requester accepts in the request flow, with a record of who accepted it and when. Accept an existing NDA or master agreement instead when it already covers security documents. Do not send a bespoke NDA for each request: legal review of a one-page document for every prospect is the most common reason a SOC 2 report takes a week to reach a buyer.
Which documents need an NDA?
The SOC 2 report, the bridge letter, penetration test summaries or letters, full security policies, business continuity and incident response plans, completed questionnaires and architecture material. The public layer of the trust centre needs no NDA at all. What to publish sets out the line.
What kind of NDA should we use?
| Option | Speed | When to use it |
|---|---|---|
| Click-through NDA in the request flow | Minutes | The default for prospects and anyone without an agreement |
| Existing mutual NDA or master agreement | Minutes, once confirmed | Customers and prospects already under paper that covers security documents |
| The buyer's own NDA | Days, if legal reviews it | Large buyers who insist; accept it if your counsel has a standard position |
| Bespoke NDA drafted per request | Days to weeks | Avoid |
What should the NDA say?
- Purpose. Evaluating or managing the requester's use of your service.
- Permitted sharing. With the requester's employees, auditors and advisers who need it, under the same terms.
- No onward distribution beyond that group.
- Return or destruction on request.
- Term. A fixed confidentiality period your counsel is comfortable with.
This page is not legal advice. Have your counsel approve the template once, then use it for every request.
What should we record?
Name, email, company, the document and version, the NDA version accepted, the date and time, and who approved the release. That record answers the question your auditor or a customer may one day ask: who has our report?
Common questions
Is a click-through NDA enforceable in Canada?
Click-through agreements are commonly used and Canadian courts have generally enforced online agreements where the terms were clearly presented and accepted. Have your counsel confirm the wording and the acceptance record you keep.
Should existing customers sign an NDA again?
Not if their agreement with you already covers confidential security information. Check once, record the agreement reference, and release without another signature.