Why an NDA comes before the numbers
In a business sale, information is the asset you hand over long before money moves. A serious buyer needs to see revenue by month, gross margin, customer concentration, the cost of serving each customer and, for AI products, how much of each dollar goes to the model provider. A competitor or a casual browser could use the same information to copy your pricing, approach your largest customers or hire your best engineer.
The NDA sets the rules for that exchange. It defines what counts as confidential, who may see it, what they may do with it and what happens when the talks end. A good one lets a genuine buyer move fast while giving you a clear remedy if someone misuses what they saw.
On Acquisitions, the NDA is a gate in the deal route. A buyer signs in the app before the detailed listing opens, and the seller decides which buyers get past the gate. Public listing pages show only the summary a seller chooses to publish.
One-way or mutual
Most business sale NDAs are one-way: the seller discloses, the buyer promises to keep it confidential. A mutual NDA makes sense when the buyer also shares something sensitive, such as its own acquisition thesis, portfolio data or the terms of financing. Funds sometimes prefer mutual terms because they do not want their pipeline exposed either. For a founder selling a single product, a one-way agreement is usually simpler and easier to enforce.
Definition of confidential information
This is the clause that decides everything else. A narrow definition, such as "documents marked confidential", leaves gaps, because a lot of valuable information travels in calls, screen shares and chat messages. A sound definition covers information disclosed in any form, including oral and visual disclosure, and names the categories that matter in your deal:
- financial records, revenue, margins, pricing and forecasts
- customer lists, contracts, usage data and support history
- source code, prompts, model configurations, evaluation sets and training data
- supplier terms, including what you pay your AI model provider
- the fact that the business is for sale and the fact that talks are happening
That last point matters more than founders expect. If customers or employees learn of a sale through a leak, churn and resignations can follow before any deal closes.
Standard exclusions
Every reasonable NDA excludes information that is already public, that the recipient already knew, that the recipient develops independently, or that it receives lawfully from someone else. Buyers will insist on these, and courts expect them. The point to watch is the burden of proof. A careful seller asks that the recipient show, with written records, that an exclusion applies.
Permitted use
The agreement should limit use to one purpose: evaluating and negotiating the possible acquisition. Anything else, including building a competing feature, approaching your customers or recruiting your team, falls outside that purpose. Spell the purpose out in one sentence so there is no room for creative readings.
Who may see the information
Buyers rarely work alone. They bring lawyers, accountants, technical reviewers and sometimes lenders or co-investors. The NDA should allow disclosure to these representatives only on a need-to-know basis, and the buyer should stay responsible for any breach by them. If the buyer is a fund, ask whether portfolio companies count as representatives. They usually should not, especially when one of them operates in your space.
Non-solicitation of employees and customers
A strong NDA for business sale adds a clause that stops the buyer from hiring your staff or contractors and from contacting your customers, suppliers or partners for a set period. Twelve to twenty-four months is a common range, though what is enforceable depends on local law. General job postings that your people happen to answer are usually carved out. For a small AI company, where two or three people hold the knowledge of the product, this clause can matter more than the confidentiality promise itself.
No contact without permission
Related but separate: the buyer should not contact anyone connected with the business about the deal without your written consent. Many sellers allow contact with key customers only late in due diligence, after a letter of intent is signed, and only with the seller present.
Term and survival
How long does the obligation last? Two to three years after the talks end is typical for general business information. Trade secrets, including source code and proprietary datasets, are often protected for as long as they remain trade secrets. Make sure the confidentiality duty survives the end of negotiations, because that is exactly when a disappointed bidder walks away holding your data.
Return or destruction
When talks stop, the buyer should return or destroy everything it received, including copies and notes derived from it, and confirm in writing that it has done so. Buyers will ask to keep copies required by law or stored in automatic backups. That is reasonable, provided the retained copies stay under the same confidentiality terms.
Remedies
Damages after a leak are hard to prove and arrive too late. Most business sale NDAs therefore state that the seller may seek injunctive relief, a court order that stops the misuse quickly, without first proving monetary loss. Some sellers also add an indemnity or a fee-shifting clause. Buyers push back on these; the outcome depends on leverage.
Governing law and jurisdiction
Cross-border deals are common in AI. Pick one governing law and one forum for disputes, and make sure it is a place where you could realistically enforce the agreement against this buyer.
No obligation to sell
The NDA should say plainly that neither side is committed to a transaction. It is a framework for sharing information, not a promise to close. Exclusivity, price and deal terms belong in a separate letter of intent, covered in our guide to the Letter of intent to buy a business.
Confidentiality in AI and SaaS deals
AI businesses carry a few kinds of information that general templates miss. Name them explicitly.
- Prompts, system instructions and agent workflows. These are often the real product, and they are easy to copy once seen.
- Evaluation sets and quality benchmarks. They reveal where the product is strong and where it fails.
- Fine-tuned model weights, embeddings and proprietary datasets, including the rights under which the data was collected.
- Inference cost per customer and per feature, which tells a competitor how far you can be undercut.
- API keys, credentials and infrastructure details. These should never be shared during evaluation at all; give access through read-only views instead.
That last point is also why Acquisitions verifies revenue and traffic through read-only connections to the seller's payment processor and analytics. Buyers see verified figures without anyone sending raw exports or login details. The details are on the Revenue verification page.
Staged disclosure in a business sale
An NDA reduces risk; it does not remove it. The safest approach combines a sound agreement with disclosure in stages, so each buyer sees only what it needs at its current step.
- Stage one, before the NDA. A public summary with category, verified revenue range, growth trend and asking price. No name, no URL if you prefer anonymity.
- Stage two, after the NDA. Verified metrics in detail, product walkthrough, cost structure, customer concentration without customer names.
- Stage three, after a letter of intent. Code review, contracts, named customers, supplier agreements and employee terms, usually inside a structured due diligence process.
- Stage four, at closing. Credentials, repositories, domains and accounts move under a handover checklist, often after funds sit with an independent licensed escrow provider.
Staging keeps a curious browser from collecting your most valuable information while still letting a committed buyer reach a decision quickly. Our SaaS due diligence checklist shows what usually belongs in stage three.
Common points of negotiation
Sellers and buyers tend to disagree on the same handful of points. Knowing them in advance shortens the back and forth.
- Length of non-solicitation. Buyers want it short and narrow; sellers want it long and broad.
- Residuals clauses. Some buyers ask to use information retained in the unaided memory of their people. For a small software business, a residuals clause can quietly undo the whole agreement, and many sellers refuse it.
- Affiliates. Funds want to share with affiliates freely; sellers want each affiliate bound directly or excluded.
- Liability for representatives. Sellers want the buyer fully responsible; buyers want responsibility limited to people they control.
- Marking requirements. Buyers prefer that only marked documents count; sellers prefer a broad definition.
Red flags in a buyer's draft
Be careful when a buyer's own NDA contains a broad residuals clause, a very short term of a few months, no non-solicitation at all, a definition limited to written and marked material, or language that lets it share with "affiliates and portfolio companies" without limits. None of these automatically means bad faith, but each deserves a question before you sign.
Practical tips for sellers
- Use one standard NDA for all buyers. Comparing many custom drafts costs time and invites mistakes.
- Keep a log of who signed and what each buyer received, with dates.
- Share through controlled views rather than file attachments where you can.
- Watermark sensitive documents with the buyer's name.
- Do not share credentials, keys or customer personal data before closing.
- Ask a lawyer to review your template once, then reuse it.
Practical tips for buyers
- Read the non-solicitation clause carefully if you operate a portfolio of similar products.
- Agree on a sensible term instead of signing anything to see the numbers faster.
- Keep evaluation materials in one place so you can return or destroy them cleanly.
- Use the NDA period to test whether the verified numbers support the asking price, and then move to a letter of intent.
FAQ
No law requires one in most places, but almost every serious sale uses one. Without an NDA, a seller has little control over how buyers use sensitive information, and many buyers will not engage without a clear framework either.
Usually the seller, because the seller discloses most of the information. Using your own template keeps terms consistent across buyers. Some funds insist on their own form; a short review by your lawyer then pays off.
Two to three years after talks end is common for general information. Trade secrets such as source code and proprietary datasets are often protected for as long as they stay secret. The right term depends on your business and local law.
No. A well drafted NDA states that neither side has any obligation to complete a transaction. Price, exclusivity and deal structure belong in a later letter of intent and the final purchase agreement.
An NDA limits use of your confidential information, not competition in general. A non-solicitation clause can restrict hiring your staff or approaching your customers for a period. A full non-compete is unusual at this stage and may not be enforceable.
Buyers sign an NDA in the app before a detailed listing opens, and the seller approves which buyers proceed. Acquisitions is a listing and deal-workflow platform, it is not a party to your agreement and it does not give legal or investment advice.
