Before you share a client’s brief, designs or logins with an outside developer, you need two things in writing: an agreement to keep it confidential, and a clear statement of who owns the finished work. This checklist covers what to include in each. It is a starting point for the conversation, not legal advice, so have a lawyer in your own country review the final wording.
Why it matters
Agencies hold their clients’ trust. A developer who works under your brand sees unreleased products, customer lists and passwords. If something leaks, or if ownership is unclear when you hand the site over, the damage lands on you. A short, clear agreement removes most of that risk, and a good partner will happily sign one.
Part one: the NDA (confidentiality)
- Who is bound. Name the parties, and say that the developer’s staff and any helpers are bound too.
- What counts as confidential. Define it broadly: briefs, designs, code, data, passwords, business plans and the fact that you work together.
- What does not count. Information that is already public, or that the developer already knew or learned from someone else legitimately.
- How it may be used. Only to do the agreed work, and for nothing else.
- How long it lasts. A fixed number of years after the work ends, and longer for trade secrets.
- Return or deletion. What happens to files and access when the work ends.
- Legal requirements. What happens if a court or regulator orders disclosure.
- Remedies. What each side can do if the agreement is broken.
Part two: IP (who owns what)
- Ownership of the finished work. State clearly that the code, designs and content created for the project belong to you (and through you, to your client).
- Timing. Ownership should pass on payment, not on a promise.
- Work made for hire and assignment. Use wording that assigns rights, because the rules differ between countries.
- The developer’s own tools. Reusable code, libraries and frameworks the developer already had usually stay with them, with a licence for you to use them in the project. Make sure that licence is permanent and cannot be withdrawn.
- Credits and branding. Confirm that nothing in the work shows the developer’s name unless you agree.
- Portfolio rights. Say whether the developer may show the work. For a white label arrangement the answer is normally no, unless you give written permission.
Part three: the clauses people forget
- Third-party code and licences. Who buys premium plugins and themes, whose name the licences are in and what happens when they renew. A site can break when a licence tied to a developer’s account expires.
- Open-source software. Most WordPress work uses it, and it comes with its own licences. A good developer tells you what is used.
- Subcontractors. Whether the developer may use outside help, and whether those people are bound by the same terms.
- Client data and privacy. How personal data is handled, where it is stored and who can access it.
- Access and passwords. Use a shared password manager, never email, and remove access at the end.
- Backups and security. What each side is responsible for.
- What happens at the end. A handover of all files and access, and a clean exit if you part ways.
- Governing law and disputes. Which country’s law applies and how a disagreement is resolved.
- Limits of responsibility. What each side is and is not liable for.
Questions to ask a partner
- Will you sign an NDA before I send any client material?
- When does ownership of the work pass to me?
- Do any parts of the work use your own code, and how am I licensed to use it?
- Who holds the licences for any paid plugins or themes?
- Do you use subcontractors, and are they covered by the same terms?
Mutual or one-way?
A one-way NDA protects only one side, normally the agency that shares information. A mutual NDA protects both, which is fairer and common between partners, because the developer may also share ways of working or code they want kept private. For a long-term relationship, mutual is usually the better choice.
How to read an agreement you are handed
If a partner sends their own paperwork, read it for the points above, and pay special attention to who owns the work and when, what the developer may reuse, and whether the terms let them show your project in their portfolio. Ask for changes in writing. A partner who refuses reasonable changes is telling you something about how the relationship will go.
Keep it practical
An agreement nobody reads does not protect you. Keep the wording as plain as your lawyer allows, store signed copies where your team can find them and refer to them in your onboarding. Review your standard terms once a year, because your work and the rules around data change. And remember that an NDA is a safety net, not a substitute for choosing a partner you trust.
Please note that this checklist is general information, not legal advice. Laws about confidentiality and ownership differ between countries, so have a qualified lawyer review your final agreement.
Points specific to US and Canadian agencies
These are questions to raise with your own lawyer, because the details depend on your state or province.
- US: assignment as well as “work made for hire”. Work made for hire rules for independent contractors are narrow, so US agreements usually include a written assignment of rights too.
- Canada: moral rights. Canadian copyright law gives authors moral rights, which cannot be transferred but can be waived. Agreements often include a waiver, so ask for one.
- Governing law and disputes. Decide whose law applies and where a dispute would be heard. Many agencies choose their own state or province.
- Client personal data. Privacy rules differ, from California’s laws to Canada’s PIPEDA and Quebec’s Law 25. Limit what the developer can see to what the work needs, and say how data is stored and deleted.
- Invoicing and currency. State the currency of the invoice, and when ownership passes. Ownership should pass on payment.
We work under NDA with agencies in the US and Canada, and you can see how our work is set up on the US and Canada pages.
How we handle it
We sign an NDA before seeing any client information, we never put our name on your work and the code, designs and files are yours. Our NDA and IP page explains our approach in plain language. If you are comparing partners, our guide to outsourcing WordPress development covers the other steps worth checking, and our white label web development page explains how we work with agencies.