Mutual Confidentiality Agreement

Template · Version 0.1 · October 2026

Draft template. Not yet reviewed by a lawyer. This page shows the terms we are ready to sign; it becomes binding only when both parties sign a copy. To get a copy for signature, write to ops@nomadgpu.com. We also review your own NDA.

Parties

[Operator's legal name] ("NomadGPU") and [Client's legal name] ("Client"), each a "Party". Each Party may disclose and receive Confidential Information.

1. Confidential Information

Any non-public information one Party discloses to the other in connection with evaluating or using the NomadGPU service, in any form, including: source code, models, weights, datasets, prompts, job specifications, logs, outputs, business plans, prices, account details and access keys. Access keys and credentials are always Confidential Information, whether or not marked.

2. What the receiving Party must do

Use Confidential Information only to provide or use the service.
Protect it with at least reasonable care, and no less than it protects its own similar information.
Share it only with its employees and contractors who need it for that purpose and are bound by similar confidentiality duties. Infrastructure providers that store or process data for the service (listed in the Privacy Policy) are allowed.
Tell the other Party promptly about any unauthorised access or disclosure it becomes aware of.

3. Exceptions

These duties do not apply to information that: is or becomes public through no fault of the receiving Party; was already lawfully known to it; is received from a third party without a duty of confidentiality; or is developed independently. A Party may disclose information when required by law, after notifying the other Party where legally possible.

4. Machines owned by third parties

The Client understands that GPU machines on Vast.ai belong to independent hosts, who can technically access what runs on them. NomadGPU is not responsible for disclosure by hosts or marketplaces, and the Client decides which data to process this way. Encryption of checkpoints at rest is available on request.

5. Return and deletion

On request, or when the service ends, the receiving Party returns or deletes the other Party's Confidential Information within 30 days, except copies in routine backups (deleted on their normal rotation) and records the law requires it to keep.

6. No licence

All Confidential Information remains the property of the disclosing Party. Nothing in this agreement grants a licence or any rights to it beyond the purpose above.

7. Term

This agreement applies from signature for two years. Duties for information disclosed during the term last for three years after it ends; for access keys, trade secrets and personal data — for as long as they remain such.

8. General

Breach may cause harm that money cannot fully repair, so the disclosing Party may seek injunctive relief. Governing law and courts: [to be agreed]. Changes only in writing signed by both Parties.