Confidentiality and NDA terms.

These are our standard confidentiality terms. They apply once both parties sign them, or once they are incorporated into a signed engagement agreement.

If a signed engagement agreement, statement of work or mutual NDA contains different confidentiality terms, that signed document governs. Nothing on this page replaces it.

A website enquiry, a vulnerability report or a referral does not create a confidentiality relationship on its own. Tell us first if you need an NDA before you share anything sensitive.

Confidential information is information one party gives the other that is marked confidential, or that a reasonable person would treat as confidential given its nature and the circumstances.

For a client, this includes system details, architecture, source code, credentials, vulnerability findings, evidence, business logic, customer data and the contents of reports.

For Riftweld, this includes our methods, tooling, internal notes, pricing, and the non-public parts of our reports.

Information that is already public, or that the receiving party already lawfully held, is not confidential.

Each party agrees to use the other's confidential information only for the engagement, and not for any other purpose.

Each party agrees to share it only with named personnel and advisers who need it for the engagement and who are bound by confidentiality obligations at least as protective as these terms.

Each party agrees to protect it with reasonable technical and organisational controls, including access control, encryption in transit and at rest where appropriate, and a record of who has access.

Each party agrees to tell the other promptly if it becomes aware of a suspected or actual unauthorised disclosure, and to co-operate on containment and notification.

We do not sell client data, and we do not use client data in public case studies or marketing without written approval.

Confidential information does not include information that the receiving party can show was already lawfully known to it without a duty of confidence.

It also does not include information that becomes public through no breach of these terms, or that the receiving party independently develops without using the disclosing party's confidential information.

A party may disclose confidential information where a law, court, regulator or binding order requires it. Where lawful, that party will give the other prompt notice and reasonable help to limit the disclosure.

Engagement data is handled under the signed engagement documents. Those documents set out who can access it, where it is stored, how it is encrypted, which sub-processors are involved, and how an incident is notified.

We remove access at close-out. We minimise and redact evidence where the work allows, and we use synthetic data where that is sufficient to prove a point.

The published confidentiality terms describe our standard position. A client-specific data processing agreement can add to or replace them for that engagement.

We name the suppliers that may touch engagement data before work starts, and we do not add a new sub-processor for an engagement without the client's approval.

Each sub-processor is bound to confidentiality and security obligations consistent with these terms and the engagement documents.

At the end of the engagement, or when the period set in the signed engagement terms ends, we return or destroy confidential information as those documents require.

Client engagement data is kept for the period set in the signed engagement terms. We return or destroy it when that period ends, and confirm destruction in writing where the terms require.

Backup copies are deleted on our rolling backup schedule. A copy may remain in backups until it rolls off, but we do not restore it for any purpose other than backup integrity or a legal obligation.

You can ask us to return or delete data earlier. We agree the response period in the engagement terms and tell you if a legal or security reason prevents deletion.

These terms run for the engagement and for 5 years after it ends. Obligations about trade secrets and personal data continue for as long as the information remains protected by law.

The return and destruction obligations survive the end of the engagement.

These terms do not give either party a licence to the other's intellectual property except as needed to run the engagement.

They do not create a partnership, agency or employment relationship.

If a clause is found to be unenforceable, the rest of the terms continue to apply.

These terms are governed by the laws of Kenya, and the courts of Kenya have jurisdiction, unless the signed engagement documents say otherwise.

To request the mutual NDA, ask a question about these terms, or agree a different position for an engagement, email hello@riftweld.com. For security reports, use security@riftweld.com.

See also the security statement, the client assurance pack and the privacy policy.