# Mutual Non-Disclosure Agreement

> **REVIEW BEFORE USE.** v2 draft, 2026-05-18. Have a qualified attorney
> review before binding execution. Bracketed placeholders `[LIKE_THIS]`
> are filled in per engagement. This NDA is part of Provider's
> procurement cluster alongside the
> [PR Replay SOW](https://github.com/Cranot/roam-code/blob/main/templates/legal/sow-pr-replay.md),
> the [Data Processing Agreement](https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md),
> and the [security procurement packet](https://github.com/Cranot/roam-code/blob/main/templates/legal/security-procurement-packet.md);
> see also the public [trust page](https://roam-code.com/trust). Where
> this NDA is signed *before* a SOW for a sensitive engagement, the SOW
> and DPA supersede the relevant confidentiality and personal-data
> handling clauses on execution (Section 10A).

---

This Mutual Non-Disclosure Agreement ("**Agreement**") is made effective `[EFFECTIVE_DATE]` between:

- **`[PARTY_1_LEGAL_NAME]`**, `[TBD: PARTY_1_LEGAL_FORM]` (e.g., Greek
  sole-trader / atomiki epicheirisi), tax ID `[TBD: PARTY_1_TAX_ID]`
  (Greek `[PARTY_1_AFM]` / EU VAT-ID / other), of `[PARTY_1_ADDRESS]`
  ("**Party 1**"); and
- **`[PARTY_2_LEGAL_NAME]`**, `[TBD: PARTY_2_LEGAL_FORM]`, tax ID
  `[TBD: PARTY_2_TAX_ID]`, of `[PARTY_2_ADDRESS]` ("**Party 2**").

(Each a "Party" and together the "Parties".)

## 1. Purpose

The Parties wish to explore a potential or ongoing business relationship around codebase audits, AI-agent tooling, and related professional services (the "**Purpose**"), and may exchange Confidential Information for that purpose.

## 2. Confidential Information

"Confidential Information" means any non-public information disclosed by one Party (the "Discloser") to the other (the "Recipient") in connection with the Purpose, including but not limited to: source code, repository structure, internal documentation, business plans, customer lists, financial information, technical architectures, AI tooling configurations, security findings, and any information marked or that a reasonable person would understand to be confidential.

Confidential Information **does not include** information that:

(a) is or becomes publicly available without breach of this Agreement;
(b) was already in the Recipient's possession without confidentiality obligation prior to disclosure;
(c) is independently developed by the Recipient without reference to the Discloser's Confidential Information;
(d) is rightfully received from a third party without confidentiality restriction; or
(e) is required to be disclosed by law, court order, or regulatory authority — provided the Recipient gives the Discloser prompt notice (where lawful) and an opportunity to seek protective measures.

## 3. Obligations

The Recipient shall:

(a) use Confidential Information **solely** for the Purpose;
(b) protect Confidential Information with at least the same degree of care it uses for its own confidential information of similar sensitivity, and in no event less than reasonable care;
(c) not disclose Confidential Information to any third party except to its directors, officers, employees, contractors, professional advisors (lawyers, accountants), and sub-processors who (i) have a need to know for the Purpose, (ii) are bound by confidentiality obligations no less protective than this Agreement, and (iii) are notified of the confidentiality nature of the information; and
(d) not reverse-engineer, decompile, or disassemble any software or systems disclosed except to the extent permitted by mandatory law.

## 4. No licence

Disclosure of Confidential Information does not grant any licence — express or implied — under any patent, copyright, trademark, or trade secret. All Confidential Information remains the property of the Discloser.

## 5. Term

This Agreement is effective from the Effective Date and remains in force for **2 years**, after which either Party may terminate by written notice. The confidentiality obligations in Section 3 survive termination for **3 years** from the date of disclosure of the relevant information.

## 6. Return or destruction

Upon written request from the Discloser, or upon termination of the business relationship contemplated by the Purpose, the Recipient will (at the Discloser's option) return or securely destroy all Confidential Information in its possession, including copies and derivatives, and certify destruction in writing within 14 calendar days. The Recipient may retain one archival copy in compliance backup systems for the period required by its document retention policy.

## 7. No warranty

Confidential Information is disclosed "as-is". Neither Party makes any representations or warranties as to its accuracy, completeness, or fitness for any purpose.

## 8. No obligation to enter further agreements

Nothing in this Agreement obligates either Party to enter into any further commercial agreement or to disclose any specific information. Each Party reserves the right to pursue similar opportunities with other parties.

## 9. Equitable relief

The Parties acknowledge that monetary damages may be inadequate for breach of this Agreement, and either Party may seek injunctive or equitable relief in any competent court without posting bond.

## 10. Governing law and venue

This Agreement is governed by the laws of **Greece**, matching the
governing law of Provider's
[PR Replay SOW §13](https://github.com/Cranot/roam-code/blob/main/templates/legal/sow-pr-replay.md)
and [DPA §11](https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md).
Disputes are subject to the exclusive jurisdiction of the courts of
**Athens, Greece**, except for emergency injunctive relief which may be
sought in any competent court.

Where the Parties have agreed in writing to a different governing law
appropriate to the Parties' jurisdictions (e.g., the law of an EU Member
State or the law of a US state), that written election supersedes this
default and the agreed forum applies. The agreed election must be
recorded in `[GOVERNING_LAW_OVERRIDE]` / `[FORUM_OVERRIDE]` and signed
by both Parties.

For EU consumer disputes only, the EU Online Dispute Resolution
platform (`https://ec.europa.eu/consumers/odr`) is also available.

## 10A. Relationship to SOW and DPA

Where the Parties subsequently sign a Statement of Work or Data
Processing Agreement covering the same Confidential Information:

- the SOW governs commercial terms, deliverables, fees, and acceptance;
- the DPA governs Personal Data processing within the meaning of the GDPR;
- this NDA continues to govern Confidential Information that falls
  outside the scope of the SOW or DPA, and survives for the term in
  **Section 5**.

In case of conflict on the same subject matter, the SOW or DPA prevails
to the extent of the conflict; this NDA otherwise remains in force.

## 11. Miscellaneous

- **Entire agreement**: this Agreement supersedes all prior NDAs between
  the Parties on the same subject. The relationship between this NDA and
  any subsequently executed SOW or DPA is governed by **Section 10A**.
- **Amendments**: only by writing signed by both Parties.
- **Severability**: unenforceable clauses are severed; the rest remains
  in force.
- **Assignment**: neither Party may assign this Agreement without the
  other's written consent, except that either Party may assign to a
  successor in connection with a merger, acquisition, or sale of all or
  substantially all assets. For Provider, an assignment to a successor
  legal entity (e.g., on incorporation of the Greek sole-trader into an
  IKE) may be made on 30 days' written notice.
- **Notices**: by email to `[PARTY_1_EMAIL]` and `[PARTY_2_EMAIL]`.
- **Counterparts**: may be signed in counterparts, including electronic
  signatures, each of which is an original.

## 12. No certification or compliance claim

Nothing in this Agreement, and nothing disclosed under it, **certifies**
either Party's codebase, processes, or systems as compliant with any
law, regulation, framework, or standard (e.g., SOC 2, ISO/IEC 42001,
ISO/IEC 27001, the EU AI Act, GDPR Article 12 record-keeping). Where
either Party shares evidence artefacts derived from Provider's tooling,
those artefacts **map to** and **supports evidence for** control
families; they do not constitute formal conformity assessment.

---

## Signatures

**`[PARTY_1_LEGAL_NAME]`**

- Signed: ____________________
- Name: `[PARTY_1_SIGNATORY]`
- Title: `[PARTY_1_TITLE]`
- Date: ____________________

**`[PARTY_2_LEGAL_NAME]`**

- Signed: ____________________
- Name: `[PARTY_2_SIGNATORY]`
- Title: `[PARTY_2_TITLE]`
- Date: ____________________
