Contract tool / NDA

NDA Generator

Settle confidentiality before the first network diagram is shared.

With our NDA generator, you can create a template for your non-disclosure agreement in seconds – mutual or unilateral, in English or German. The generator works exclusively locally in your browser: none of your information is transmitted to us or to any third party.

Runs locally in your browser
English & German
Mutual or unilateral

Create your NDA now Request a pentest quote

Your non-disclosure agreement

Choose the type and language, add the details of both parties, and open the preview. The template is tailored to security services such as penetration tests; for professionals bound by professional secrecy, you can optionally include an additional clause under § 203 StGB (German Criminal Code, professional secrecy).

* Required – if such a field is left empty, the document will contain a blank line to fill in at that point.

Agreement

Type of agreement

Mutual: both parties disclose confidential information and are equally bound to confidentiality. Unilateral: only one party discloses information, and only the other party is bound.

Who discloses confidential information?

Typical for a penetration test: your company (Party B) provides information, and Rootsektor (Party A) commits to confidentiality. The agreement automatically assigns the roles “Disclosing Party” and “Receiving Party”.

Contract language

Language of the generated agreement. Pre-filled default values are translated automatically as long as you haven’t changed them.

Party A

Pre-filled with the details of Rootsektor IT-Security GmbH – you can change all fields.

Name / company

Address

Commercial register (optional)

Registry court and registration number. If the field is left empty, this detail is omitted from the agreement.

Represented by

The person signing on behalf of the party, ideally with their title – e.g., managing director, authorized signatory, or owner. Leave empty for individuals.

Party B

Your company or your contracting partner.

Name / company

Address

Commercial register (optional)

Registry court and registration number. If the field is left empty, this detail is omitted from the agreement.

Represented by

The person signing on behalf of the party, ideally with their title. Leave empty for individuals.

Contract details

Effective date

The agreement applies from this date. It also covers information exchanged earlier with regard to the purpose.

Term in years

years

The period during which information is exchanged under this agreement. After that, the confidentiality obligation continues for the same period; trade secrets remain protected for as long as they remain secret.

Purpose

The exchanged information may be used only for this purpose. Describe it as specifically as possible and as broadly as necessary – ideally in keywords and without a period at the end.

Return / deletion in days

days

Deadline for returning or deleting confidential documents – counted from a corresponding request, at the latest from the end of the term. Statutory retention obligations and automatic backups are excluded.

Governing law

Inserted into the agreement after “the laws of …”, so include the article. The template is designed for German law – if you choose a different law, the entire text should be legally reviewed.

Place of jurisdiction

Location of the competent court in the event of disputes. Under German law, a choice-of-court agreement is generally only effective between merchants, legal entities under public law, and special funds under public law; otherwise, the statutory place of jurisdiction applies.

Optional additional clause Additional clause for professionals bound by secrecy (§ 203 StGB)

For law firms, tax advisory firms, audit firms, medical practices, and other professionals bound by professional secrecy. The agreement receives an additional section: the party that may gain insight into professional secrets commits to confidentiality as a person involved in the other party’s professional activities and is informed that violations are punishable under § 203 StGB. Please check professional rules, for example under the BRAO (Federal Lawyers’ Act), StBerG (Tax Advisory Act), or WPO (Public Accountants Act), on a case-by-case basis.

Confidentiality in pentesting

Why sign an NDA before a penetration test?

During a penetration test, information changes hands that would make an attack considerably easier in the wrong hands: network diagrams and IP ranges, test accounts, details about firewalls and security solutions – and, at the end, a report that describes vulnerabilities along with how to exploit them. A non-disclosure agreement – also called a confidentiality agreement or NDA for short – sets out in binding terms that this information may only be used for the agreed purpose, must be carefully protected, and must be returned or deleted once the work is complete.

An NDA also creates clarity before the actual work begins. In the scoping call, it’s easier to talk openly about systems, known vulnerabilities, and past incidents once confidentiality is settled. In addition, an NDA can be one of the reasonable confidentiality measures that the German Trade Secrets Act (GeschGehG) requires for trade secrets to be legally protected.

Our template is tailored to security services: it explicitly lists findings, exploit details, credentials, and architecture information as confidential, assigns test results to the tested company, and governs the deletion of access credentials provided for the test. This means you are free to present reports and test certificates to your auditors, insurers, and business partners.

For professionals bound by professional secrecy – such as law firms, tax advisory firms, audit firms, and medical practices – the generator offers an optional additional clause: it commits the party that may gain insight into professional secrets during the assessment to confidentiality as a person involved in the other party’s professional activities, limits its access to what is necessary, and informs it that violations are punishable under § 203 StGB.

In three steps

How the NDA generator works

No account, no sign-up, no data transfer – all you need is an up-to-date browser.

01
Enter your details

Choose the type and language of the agreement and add the details of both parties. Party A is pre-filled with Rootsektor’s details; purpose, term, and deadlines contain sensible default values that you can adjust. Professionals bound by professional secrecy can activate the additional clause under § 203 StGB if needed.
02
Review the preview

The preview shows the complete contract text with your details. Take your time to read it – if something doesn’t fit, close the preview and adjust the relevant fields.
03
Save and sign

Print the agreement or save it as a PDF via the print dialog. Alternatively, download the text as a Markdown file or copy it into your word processor to edit it further. Then both parties sign the agreement.

Please note

Important notes on use

The generator takes the drafting off your hands. The contracting parties remain responsible for the content of the agreement.

What the NDA covers

The agreement protects information that is exchanged in the course of the collaboration or obtained during the assessment.

What counts as confidential – including findings, credentials, and architecture details
Use only for the agreed purpose, disclosure only on a need-to-know basis
Term and continuing effect of the confidentiality obligations
Return and deletion after completion
Legal consequences of breaches, governing law, and place of jurisdiction

What the NDA does not replace

A non-disclosure agreement is neither an engagement nor permission to attack systems.

The written engagement with test authorization – only this defines the scope, timeframe, and methods and authorizes the test
A data processing agreement (DPA, German: AVV) under Art. 28 GDPR as soon as personal data is processed on your behalf as part of the service
Agreed rules of engagement with testing times, exclusions, and emergency contacts

Not legal advice: The generator creates a template under German law that does not replace an individual legal review. Review the text before signing and seek legal advice if needed – especially if you choose a different governing law or need special provisions.

Ask about engaging us

Confidentiality settled? Then let’s plan your penetration test.

Tell us about your systems and goals. After scoping, you’ll receive a fixed-price quote within 24 hours (on business days) – including a free retest of remediated vulnerabilities.

Request a pentest quote

FAQ

Frequently asked questions about the NDA generator

Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.

Is the NDA generator free?

Yes. You can use the generator without signing up and free of charge. Party A is pre-filled with Rootsektor’s details but can be changed as you like – so the template is also suitable for agreements with other partners.

Are my entries stored or transmitted?

No. The generator runs entirely in your browser; your information is neither transmitted to Rootsektor or any third party nor stored. As soon as you close or reload the page, it’s gone. A file is only created if you download the agreement yourself or save it as a PDF.

Mutual or unilateral – which is right for a penetration test?

In a penetration test, it’s primarily the tested company that provides confidential information. A unilateral agreement in which the service provider commits to confidentiality is then often sufficient. If both sides exchange sensitive information – such as terms, methods, or proprietary tools – the mutual version is the more balanced choice.

Is there a version for law firms, tax advisors, and medical practices?

Yes. For professionals bound by professional secrecy – such as lawyers, tax advisors, auditors, or physicians – you can optionally include an additional clause on § 203 StGB. It commits the party that may gain insight into professional secrets to confidentiality as a person involved in the other party’s professional activities and informs it of the criminal consequences of a breach. This clause is also a template: you should check professional rules, for example § 43e BRAO, § 62a StBerG, or § 50a WPO, on a case-by-case basis.

Is the generated agreement legally binding?

The agreement becomes binding once both parties have signed it; German law does not prescribe a specific form for non-disclosure agreements. The template follows German law and takes the German Trade Secrets Act into account. Because every case is different, however, it does not replace legal advice – review the text before signing and adapt it if necessary.

Can I also send Rootsektor my own NDA?

Yes. If your company works with its own non-disclosure agreement, feel free to send it to us at info@rootsektor.de before the scoping call. We’ll review it and get back to you if we have any questions or comments.

Questions about confidentiality or your pentest?

Would you like to sign the agreement before the scoping call, or do you have questions about engaging us? Write to us using the form, email us at info@rootsektor.de, or call us at +49 2932 465265-0.