Mutual NDA.

Save this page as a PDF with your browser’s print function, fill in your details in the signature block at the end, sign it, and email it to hello@kaykonsulting.com. We countersign and return it, and from that moment everything either of us shares for the purpose below is covered. You will not need it for the automated services, which only ever look at what your public site shows to everyone.

Kay Konsulting Limited, company number 17445525, registered in England and Wales, registered office 66 Paul Street, London EC2A 4NA (“we”), and the person or company named in the signature block (“you”). Each of us is a “party”.

So that we can discuss, scope and, if we both agree, carry out a review, audit or other engagement between us (the “Purpose”), each of us needs to be able to share things the other must keep quiet.

Anything a party shares with the other in connection with the Purpose that is marked confidential or that any sensible person would treat as confidential. For you that includes source code, architecture, credentials, data, the state of your systems, our findings about them, your business information, and the fact and terms of any engagement between us. For us it includes our methods, tooling, pricing that is not published, and anything we tell you about other work in anonymised form.

It does not include information that:

• is or becomes public other than through a breach of this agreement;
• the receiving party already lawfully had before it was shared;
• the receiving party lawfully obtains from someone else who is free to share it;
• the receiving party develops independently without using it; or
• the receiving party is required by law, a court or a regulator to disclose, in which case it will tell the other party first where the law allows, and disclose no more than it must.

• To use the other’s confidential information only for the Purpose.
• To protect it with at least the care we take over our own confidential information, and never less than reasonable care.
• To disclose it only to our own staff, contractors and professional advisers who need it for the Purpose and are bound by obligations at least as strict as these. For us, that also means the service providers named in our privacy policy, and only as far as each needs in order to provide its service.
• Not to copy it beyond what the Purpose needs.
• To tell the other party promptly if we learn of any unauthorised use or disclosure, and to help put it right.

Anything we find about your systems, including any vulnerability, is your confidential information. We will never publish it, name you in connection with it, or use it as a case study without your written consent. If a finding affects people beyond you, for example a weakness in a widely used library, we will agree with you how and when it is disclosed responsibly, and we will not disclose it without you except where the law requires.

On request, and in any case when the Purpose ends, each party will return or securely delete the other’s confidential information and confirm in writing that it has done so. Each party may keep one archival copy where the law, a regulator or an insurer requires it, and records it is legally obliged to keep, all of which remain covered by this agreement for as long as they are held.

These obligations last for three years from the date each piece of information is shared. For credentials, personal data and any security finding that has not yet been fixed, they last for as long as the information remains confidential.

It gives neither party any licence or ownership of the other’s information beyond the Purpose. It does not oblige either of us to proceed with any engagement, and it does not warrant that anything shared is accurate or complete. It does not stop either party working with other people, provided this agreement is kept. And it does not restrict either party from using the general skills, knowledge and experience its people retain in their unaided memory, as long as that does not include the other’s specific confidential information.

Each party accepts that a breach may cause harm that money cannot properly put right, and that the other party may seek an injunction or similar order as well as damages.

This is the whole agreement between us about confidentiality for the Purpose. Where an engagement is also covered by our terms of business and the two differ, the stricter obligation applies. It can only be changed in writing signed by both parties, neither party may pass it to someone else without the other’s consent, and nobody else can enforce it. It may be signed in counterparts and electronically. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over anything arising from it.