Vetting a Manufacturer for Confidential Work

The NDA is the floor

Every contract manufacturer will sign one. That makes it a poor differentiator, and a poor predictor of what actually happens to your files.

An NDA does two useful things: it establishes that the information was confidential, and it allocates liability if it escapes. Both matter after a leak. Neither prevents one, and both depend on a court you can actually reach.

So treat the NDA as the entry condition and spend your diligence somewhere more informative: on how the work is physically organized, and on what recourse exists if it goes wrong.

The exposure most brands never check: subcontracting

If your design is worth protecting, the question that matters more than any clause is how many organizations will hold a copy of it.

A factory that presents itself as your single point of contact may still send:

• the mold to an outside tool shop
• the board to a separate PCBA house
• the firmware to a contract software team
• the enclosure finishing to a coating vendor

Each handoff is a copy of part of your design, held by a company you did not assess, whose NDA you did not write, and whose employees you cannot audit. Your agreement may say subcontracting requires consent. That clause is only as good as your ability to detect a breach of it, which in practice is close to zero unless you asked at the start.

The concrete question: which operations happen in-house, named one by one, and for anything outsourced, who is the vendor and what binds them. A partner that keeps mold making, board assembly and firmware under one roof is not just simpler to manage. It is a smaller attack surface, and it is the same fact that makes country-of-origin determinations tractable.

→ Why the same in-house question also decides your duty rate: Taiwan vs China Sourcing: Tariffs and Origin

Ask operational questions, not policy questions

Policy questions produce policy answers. Every supplier will say they take confidentiality seriously. Operational questions produce facts you can check:

Instead of	Ask
Do you protect our IP?	Who in your organization can open our 3D files today, and how many people is that?
Do you have security procedures?	When an engineer leaves, what is the sequence that removes their access, and who executes it?
Are our drawings safe?	Where do the mold drawings physically live, and is there a copy at the tool shop?
Do you use our name as a reference?	Will you commit in writing to no public reference, no trade-show display, and no photographs of our product on your line?

The last one is worth its own line. A factory’s incentive to show what it can build runs directly against your interest in not announcing your roadmap. Get the answer before the relationship, not after you see your unreleased housing in someone’s exhibition booth.

Tooling custody is a confidentiality question too

Ownership of the mold is usually negotiated as a cost question. It is also a control question.

If the tool is physically held by a subcontracted shop, then whoever controls that shop controls a precise, three-dimensional record of your product. Two things follow, and both belong in the agreement rather than in an assumption:

• Where the tool is stored, and who has physical access. A tool sitting in a vendor’s yard is not under your partner’s control regardless of what the invoice says.
• What happens at the end of the relationship. Transfer conditions decided while everyone is happy are very different from transfer conditions negotiated during a dispute.

→ How tooling cost, ownership and transfer are usually structured: Tooling Cost and MOQ Explained for OEM Projects

Jurisdiction is verifiable before you sign

Most of this article is about operations, because operations are what actually keep a design contained. But if containment fails, what remains is the legal system where your counterparty sits, and that is a structural fact you can check in advance rather than a matter of trust.

Three things are worth confirming for any jurisdiction you are considering:

1. Which court hears the dispute, and does it have technical competence? A specialized intellectual property court where technical examination officers sit alongside judges resolves engineering disputes differently from a general civil docket.
2. Do trade secrets carry criminal as well as civil remedies? Civil damages arrive years later. The availability of criminal prosecution changes the calculus for the person considering the leak, which is the only point at which prevention is still possible.
3. Can customs act on your rights at the border? Border seizure is often the fastest practical remedy against a copy in circulation, and it depends on whether the jurisdiction provides that route.

Taiwan, for instance, protects invention, utility model and design patents through its patent office, runs a first-to-file trademark system, and protects trade secrets that are non-public, economically valuable and kept under reasonable confidentiality measures. Disputes go to a dedicated Intellectual Property and Commercial Court, and enforcement tools include customs seizure, civil injunctions and damages, and criminal prosecution.

Whether that matters to you depends on how much of your product’s value is the design rather than the assembly. For a mechanically simple product it may not. For a device where the enclosure, the firmware and the tooling are the differentiator, it is a material part of the decision.

→ The wider comparison beyond IP alone: Taiwan as a China+1 for Health Devices

Visitability is an underrated control

The ability to show up matters more than most audit clauses.

A site you can reach in a day, where you can walk the line and see which operations are actually running under that roof, gives you something no document does: the ability to verify that the answers you were given are true. Announced audits show you a prepared factory. The credible deterrent is that an unannounced visit is possible at all.

This is worth weighing against travel distance and time zone when the design is the asset. It is also the cheapest form of diligence available, and the one most often skipped.

What a good answer sounds like

You are not looking for reassurance. You are looking for specificity:

• Named operations, in-house versus outsourced, without hedging.
• A named person who owns access control, and a described sequence for revocation.
• A written position on references, photography and trade-show display.
• Tooling location and transfer conditions in the agreement, not in an email.
• A willingness to put process descriptions in writing, which is the same capability that supports an origin determination.

A supplier that answers these precisely is telling you something real about how they operate. One that answers them with policy language is telling you something too.

A note on scope

This is general guidance on evaluating manufacturing partners, not legal advice, and the protections available differ by jurisdiction and by the specific facts of your program. Have your agreements and IP strategy reviewed by qualified counsel in the relevant jurisdictions before relying on any of it.

→ The manufacturing side of these questions, from schematic to SMT line: Consumer Electronics Contract Manufacturing