Mutual Non-Disclosure Agreement
The confidentiality terms CRRB Solution offers before and during security engagements.
1. Why we sign an NDA first
A meaningful scoping conversation for VAPT, red teaming or SOC work usually requires naming real hostnames, architecture details, or sample data. We sign the NDA before that conversation, not after, so nothing sensitive is exchanged unprotected.
The same agreement protects our side too — our testing methodology, tooling configuration and reporting templates.
2. Parties and scope
The agreement is mutual: both CRRB Solution and your organization owe the same confidentiality obligations to each other, rather than a one-sided commitment.
"Confidential Information" is defined broadly to include technical, business and security-related information disclosed by either party — architecture and system details, credentials and access provided for testing, vulnerability findings and proof-of-concept material, pricing, and any material marked or reasonably understood as confidential.
3. Permitted use
Confidential Information may only be used to evaluate a potential engagement or to perform a contracted engagement — never for any other purpose, and never disclosed to a third party without written consent, except to employees or subcontractors who need it to do the work and are themselves bound by equivalent confidentiality terms.
4. Standard exclusions
Information is not treated as confidential if it was already lawfully known before disclosure, becomes public through no fault of the receiving party, is independently developed without reference to the disclosed information, or must be disclosed under a valid legal or regulatory requirement (with notice given first, where legally permitted).
5. Vulnerability and finding data
Findings, proof-of-concept evidence and reports produced during an engagement are treated as your Confidential Information. We do not publish, reference or use them — including in marketing or case studies — without your prior written approval and, where used, only after removing identifying details.
6. Term and return of information
Confidentiality obligations typically survive for a defined period after disclosure (commonly three years, or longer for trade secrets, as agreed in the signed document) and require secure deletion or return of confidential materials at the end of an engagement on request, subject to standard backup-retention and legal-hold exceptions.
7. No obligation, no license
Signing an NDA does not commit either party to proceed with an engagement, and does not grant any license, ownership or intellectual-property rights beyond what is needed for the stated purpose.
8. Governing law
Our standard template is governed by the laws of India, with courts at Patna, Bihar having jurisdiction, unless the signed agreement states otherwise for a specific client.
