Do I need an NDA before a demo or investor pitch?
Written by For Founders Law, a Toronto firm licensed by the Law Society of Ontario. About us
Short answer
Usually not. A product demo or a first pitch rarely needs one, and many venture investors won't sign at that stage. You need written confidentiality when you're about to share specific, non-public information that would hurt if misused, such as source code, model architecture or customer data, and in an enterprise pilot it belongs in the pilot agreement itself.
Before a product demo
Usually not. A demo shows what the product does, which is exactly what you want in front of as many buyers as possible. Asking a prospect’s procurement team to sign an NDA before a 30-minute walkthrough adds friction and rarely protects anything valuable.
Control what the demo shows instead. Use a demo environment with synthetic data, avoid admin panels or configuration screens that reveal how the system is built, and keep roadmap slides general. If a prospect wants a deeper technical session, that’s when to put confidentiality terms in place.
Before an investor pitch
In most cases investors won’t sign one. They see a high volume of pitches, often in overlapping markets, and signing an NDA for each would expose them to claims whenever a portfolio company works on something similar. Many have a policy against it, and asking can signal inexperience.
Write your deck on the assumption it may be shared. Explain the problem, traction, team and business model, and hold back the technical details that give you an edge. When an investor moves into due diligence and asks for data room access, it’s reasonable to raise confidentiality for the specific materials you share.
Mutual or one-way
A one-way NDA fits when only you are disclosing, for example to a contractor, advisor or potential acquirer. It’s shorter and easier to agree, though larger counterparties sometimes resist signing something that only binds them.
A mutual NDA fits integration discussions, partnerships and pilots, where the customer may share its systems, security requirements or data while you share your product. Enterprise customers often insist on their own mutual form. Read it closely: some include broad residuals clauses, non-solicits or one-sided remedies.
Either way, the core terms are similar: a clear definition of confidential information, permitted uses, standard exclusions (information already public or independently developed), a term, and return or destruction obligations. Many commercial NDAs set a fixed term for general information and a longer or indefinite one for trade secrets and source code. The right length depends on how long the information stays valuable.
Enterprise pilots
A pilot is where startups most often need real protection, because the customer gets hands-on access and you may receive their data. A standalone NDA isn’t enough. The pilot or proof-of-concept agreement should cover:
- Confidentiality running both ways.
- Who owns feedback, configurations and any custom work created during the pilot.
- Limits on reverse engineering and on using your product to build a competing tool.
- How customer data is handled, stored and deleted, with data processing terms if personal information is involved.
- Liability caps, and what happens when the pilot ends or converts to a paid contract.
These terms usually carry over into the SaaS agreement if the pilot converts. See AI and SaaS contracts.
Confidential information pasted into AI tools
Many NDAs don’t address this yet. If your team, or a customer’s team, pastes confidential documents, code or customer records into a generative AI tool, the provider may retain or use them, depending on the tool’s settings and terms. That can breach an NDA’s use and disclosure limits even if nobody meant to share anything.
Privacy law adds a layer. Under PIPEDA (Principle 4.1.3 of Schedule 1), you remain responsible for personal information you transfer to a third party for processing and must use contractual or other means to protect it. The federal, provincial and territorial privacy commissioners’ principles for generative AI suggest using anonymized or de-identified information in prompts rather than personal information where possible and reasonable.
Practical steps: an internal AI acceptable use policy, NDA wording that deals with AI tools directly, and checking whether the AI services your company uses train on inputs.
An NDA isn’t IP protection
An NDA governs specific information you disclose to a specific party. It doesn’t stop someone from building a similar product independently, and it doesn’t give you ownership of anything. Ownership of code comes from copyright and written assignments, and your brand from trademarks. That’s why your contractors should sign a contractor agreement with confidentiality, an IP assignment and a moral rights waiver, not just an NDA. See who owns code a contractor writes.
Free templates
You can use one, but generic templates often define confidential information too broadly or too narrowly, leave out AI and data handling, or use another country’s law. Check it against the actual deal before signing.