Software developers face unique confidentiality challenges. Unlike other freelancers, you routinely receive access to source code, databases, API keys, user data, and the technical architecture of a business's most valuable assets. A standard NDA template may not adequately address the specific risks and boundaries that tech work requires. This guide covers what your NDA should include as a developer or tech contractor.
What Makes Developer NDAs Different
Standard NDAs cover business information, strategy, and financials. As a developer, you need coverage for:
- Source code and version control repository access
- System architecture and infrastructure details
- Database schemas and user data
- API keys, server credentials, and admin access
- Pre-release features and product roadmaps
- Security vulnerabilities discovered during the engagement
These are all things a generic NDA may not explicitly cover — and in an NDA dispute, ambiguity hurts the party trying to enforce it.
Defining Confidential Information for Tech Work
Your NDA's definition of confidential information should explicitly include:
- All source code, compiled code, and version history
- Database structures, schemas, and contents
- Technical documentation, system specifications, and architecture diagrams
- Access credentials, API keys, and authentication tokens
- Security configurations and known vulnerabilities
- User data, customer records, and personally identifiable information
- Any information that a reasonable developer would understand to be proprietary
Pre-Existing Code and Third-Party Libraries
A critical issue for developers: pre-existing code and reusable components. Before signing any NDA, ensure the agreement:
- Excludes code you wrote before the engagement that you incorporate into the project
- Explicitly reserves your right to use generic skills, techniques, and general coding knowledge after the engagement
- Clarifies that open-source libraries and third-party components used in the project are not covered by the confidentiality obligation (they're already public)
- States that the client does not own boilerplate, utility functions, or reusable components you bring to the project
Without these carve-outs, an overly broad NDA could prevent you from reusing code you legitimately own in future projects.
AI Tools and Code Confidentiality
This is a rapidly evolving area. Many developers use AI coding assistants — GitHub Copilot, ChatGPT, Claude, and others. The concern: if you paste confidential client code into an AI tool, are you breaching the NDA?
The answer depends on:
- Whether the AI tool stores or uses inputs for model training
- Whether the NDA prohibits disclosure to "third parties" (AI service providers may qualify)
- The specific terms of both the NDA and the AI tool's privacy policy
Best practice: if you plan to use AI coding tools, include an explicit clause: "The Contractor may use AI-assisted coding tools in the course of the engagement, provided that no Confidential Information is submitted to any AI tool or service that uses inputs for model training or that does not maintain appropriate confidentiality." Enterprise tiers of most major AI tools offer data isolation and non-training guarantees that satisfy this requirement.
Access Credentials and Repository Access
Your NDA should address the lifecycle of access credentials:
- You will keep credentials strictly confidential and not share them with anyone not authorized by the client
- You will not retain access to client systems beyond the engagement period
- Upon termination, you will confirm deletion of all stored credentials
- The client will revoke all access granted to you upon termination
As a practical matter, use a password manager rather than storing credentials in plain text files, and use separate SSH keys or access tokens for each client rather than sharing credentials across engagements.
User Data and GDPR/CCPA Compliance
If your development work involves access to user data, additional legal obligations apply beyond the NDA. Under GDPR (UK/EU), accessing personal data means you may need to be named as a "data processor" in the client's data processing records. A data processing agreement (DPA) may be needed alongside or within the NDA.
Your NDA should state that you will handle any user data you access strictly in accordance with the client's data protection obligations, will not retain user data after the engagement, and will notify the client immediately of any accidental exposure or breach.
Portfolio Rights
Unlike a graphic designer who can show a logo in their portfolio, sharing a client's source code is almost always prohibited. Negotiate a specific portfolio rights clause that allows you to describe the project in general terms, show the live application or website, and reference the technologies used — without exposing any proprietary code or architecture.
Generate a Developer-Friendly NDA
Create a customizable NDA for your tech projects — free.
Create NDA Free →Frequently Asked Questions
What should a software developer NDA include that a standard NDA doesn't?
A developer NDA should explicitly address: source code and technical architecture, pre-existing code and third-party libraries, access credentials and API keys, user data and database contents, AI tool usage restrictions, and the distinction between project-specific code (owned by client) and general reusable components (retained by developer).
Can I use a client's code as a sample in my portfolio?
Only if the client has given explicit permission. Source code is confidential by default. Showing the live website or app is usually acceptable; sharing underlying code, database structure, or architecture typically is not without a specific portfolio rights clause.
Does an NDA prevent me from using AI coding tools?
It depends on the NDA's terms and the AI tool used. Some AI tools may use inputs for model training. If client code is confidential, using it with third-party AI tools could breach the NDA. Use enterprise AI tiers with data isolation or include an explicit AI tool clause in your NDA.
What happens to access credentials when a development contract ends?
Your contract should require return or deletion of all access credentials upon termination. The client should immediately revoke any access. Never retain access to client systems after the engagement ends, even informally.
Should a developer NDA cover subcontractors?
Yes. If you plan to use subcontractors, your NDA should permit this on a need-to-know basis and require you to bind subcontractors to equivalent confidentiality obligations. Check whether the client's NDA restricts disclosure to third parties before engaging subcontractors.