Confidentiality Clause

What is a confidentiality clause?

A confidentiality clause (sometimes a built-in NDA) sets three rules. It defines what counts as "Confidential Information." It says how carefully each side must protect it. And it lists when disclosure is allowed, such as to staff who need it or when a court orders it.

A typical version, like the one in Zendesk's customer agreement, asks each side to protect the other's information "with no less than reasonable care." It then excludes information that is already public, already known or developed independently.

Does it cover your data?

This is the part people miss. Some vendors put the data you upload inside the definition. HubSpot's terms treat Customer Data as Confidential Information whether or not it is labeled that way, and list confidentiality among the sections that survive after the contract ends. If a clause defines it more narrowly, for example only information marked as confidential, your customer data may be protected only by other parts of the contract.

Confidentiality clause vs DPA

The two documents do different jobs. The confidentiality clause protects business secrets in both directions: your pricing, roadmap and data, and the vendor's own non-public information. A data processing agreement covers personal data only, and adds rules the clause does not. Under GDPR Article 28, a processor contract must cover things like acting only on your instructions, conditions for using subprocessors, security measures, breach help, and deleting or returning data at the end. A confidentiality clause rarely says any of that.

Why it matters to you

• If your data falls outside the definition, a leak or misuse may not be a breach of the confidentiality clause at all.
• Exceptions decide a lot. "Service providers" or "affiliates" in the allowed list can mean your information reaches many other companies.
• Time limits matter. Some clauses end a few years after the contract, while your data or trade secrets may need protection longer.

What to check

• Whether "Confidential Information" includes customer data, or only information marked as confidential.
• Who the vendor may share it with, and whether those parties must follow the same rules.
• Whether the vendor must tell you before handing your information to a court or government, where the law allows.
• How long the duty lasts after the contract ends, and whether it appears in the survival clause.
• Whether you also have a DPA in place for personal data, since the confidentiality clause does not replace it.

How Venpo helps

Venpo watches your vendors' terms of service, DPAs and privacy policies and emails you when they change. If a vendor narrows what counts as confidential or adds new parties it may share with, the alert explains what changed and why it matters to you.