An NDA is the contract your startup will sign most often and read least. Most are boring, mutual, and fine. But "mutual NDA" on the cover page tells you nothing about what is inside, and the dangerous ones are dangerous precisely because everyone treats them as routine. Here are the six red flags worth two minutes of your attention before you sign, and one that belongs in your own template.
"Mutual" on the cover, one-sided inside
The label is not the deal. Plenty of NDAs open with mutual language, then quietly define "Confidential Information" as information disclosed by them, or load the obligations, remedies, and injunctive relief in one direction. Read the definitions and the obligations section, not the title.
A balanced mutual NDA also carries the four standard exclusions. If any are missing, that is a red flag on its own:
The four exclusions every NDA needs
-
Already known: Information you had before the disclosure, without an obligation of confidence.
-
Public: Information that is or becomes publicly available through no fault of yours.
-
Independently developed: Work your team builds without using their information.
-
Rightfully received: Information a third party gave you without breaching anyone's NDA.
The cover page says mutual. The definitions decide.
A residuals clause is a license
A residuals clause says the receiving party may freely use anything its people retain in "unaided memory." That sounds harmless and is anything but: it converts your confidential disclosure into a royalty-free license to whatever a smart engineer remembers after the meeting.
Large companies love residuals clauses because they meet hundreds of startups a year and cannot police what their teams recall. That is exactly why you should hate them. If the value of your company is the thing you are about to disclose, a residuals clause guts the NDA. Strike it, narrow it to general know-how excluding trade secrets, or share less.
They keep what they remember. And they'll remember the good parts.
Restrictions that aren't about secrecy
An NDA has one job: protect information. Watch for clauses doing a different job under a confidentiality heading. Common stowaways:
-
Non-solicits: A ban on hiring or soliciting the other side's employees, smuggled in as a "standard" term.
-
Non-competes: Language restricting you from operating in their space after seeing their information.
-
Exclusivity: A promise to negotiate only with them, with no end date.
-
IP assignment: Language that assigns or licenses your feedback, ideas, or improvements to the counterparty.
None of these are automatically evil. All of them deserve their own negotiation, their own consideration, and their own document, not a signature reflex on page four of an NDA.
If it isn't about secrecy, it doesn't belong here.
A term that's too short, or too forever
Terms fail in both directions. A confidentiality obligation that expires in one year is a problem when you have disclosed trade secrets, because trade secret protection lasts only as long as the information stays secret. Standard market practice is a stated term with a trade secret carve-out that continues for as long as the information remains a trade secret.
The opposite failure: perpetual obligations on everything, including routine business information, with no exclusions doing real work. That leaves you carrying compliance obligations forever for information that stopped mattering years ago, and it is a drag on every diligence review you go through.
-
3 to 5 years: A common confidentiality term for general business information in startup NDAs.
-
As long as secret: The right duration for trade secrets, via an express carve-out from the term.
Trade secrets shouldn't expire on a schedule. Everything else should.
The missing immunity notice
This one is a red flag in your own template. The federal Defend Trade Secrets Act gives whistleblowers immunity when they disclose trade secrets confidentially to the government or an attorney to report a suspected violation of law, or in a sealed court filing. Under 18 U.S.C. § 1833(b), any agreement with an employee or contractor that governs trade secrets or confidential information must include notice of that immunity.
Skip the notice and the agreement is still enforceable, but you lose real remedies: no exemplary (double) damages and no attorney's fees in a DTSA suit against that worker. The fix costs one paragraph. Most template NDAs written before 2016, and plenty written after, still omit it.
-
2x damages: What the DTSA allows for willful and malicious misappropriation, forfeited if your NDA lacks the notice.
-
One paragraph: The full cost of compliance.
One missing paragraph. Half your remedies gone.
Process red flags: no term sheet, no purpose
Two structural tells, visible in ten seconds. First, an NDA with no stated purpose. A well-drafted NDA limits use of confidential information to a defined purpose, like "evaluating a potential commercial relationship." No purpose clause means they can use your information for anything, including sizing you up as a competitor. Second, an NDA that arrives with pressure to sign same-day, before anyone has said what the discussion is about. Legitimate counterparties survive a 24-hour review.
Routine is not the same as safe
The volume is the trap. You will sign more NDAs than any other contract, and the twentieth one gets less attention than the first. The answer is not to slow every deal down; it is to have a calibrated template you send first, and a two-minute checklist for the ones you receive. That is the kind of work OneGC does for startups every day: NDA templates built for your actual risk, fast review of inbound paper, and flat monthly pricing for covered services instead of an hourly meter for a ten-minute read. Sign fast. Just know what you're signing.
Sources
-
18 U.S.C. § 1833(b), Cornell Legal Information Institute. The DTSA whistleblower immunity provision, the notice requirement for agreements governing trade secrets or confidential information, and the loss of exemplary damages and attorney's fees when notice is omitted.
-
Cooley GO, What You Need to Know About the NDA. Market guidance on mutual vs. one-way NDAs, standard exclusions, term length, and why trade secret disclosures need protection for as long as the information remains secret.
-
Katten, The Notice Provision of the Defend Trade Secrets Act. Analysis of which agreements the DTSA notice duty covers, including NDAs and consulting agreements, and the consequences of non-compliance.