AI Outsourcing NDA: How Agencies Protect Client Data With a Partner

Before your agency sends a client’s files to an AI-native partner, check your client contract, sign an AI outsourcing NDA, and sort the files by how sensitive they are. An ordinary NDA covers people. It often says nothing about AI tools, training or retention, and those are the gaps to close. Treat this as practical guidance, and have your own lawyer review the wording.

Start with the contract you already signed

Everything begins upstream. An NDA with your partner cannot give you rights your client never gave you. Pull up the client agreement and look for:

• Subcontracting. Does it ban subcontractors, or require approval or notice?
• AI wording. Some clients now add clauses that restrict AI use or require you to disclose it.
• Data terms. Is there a data processing agreement, and does it limit who can handle personal data or where they can do it?
• Confidentiality reach. Does your duty extend to the client’s own customers and partners?

If the contract blocks what you had planned, ask the client or change the plan. Do not route around it. Being caught in breach would cost you more than the job is worth.

What an AI outsourcing NDA should add to your template

Most agency templates were written with a freelancer in mind. Keep what you have, and ask your lawyer to consider adding these points:

• A definition that includes AI processing. State that confidential information stays confidential when it is entered into any software or model.
• No training. Your materials are not to be used to train AI models, whether the partner’s or a vendor’s.
• Purpose limit. Files are used only for the task you hired them for.
• Retention and deletion. Say how long files may be kept, how you request deletion and how it gets confirmed.
• Other parties. The partner names the kinds of outside services that touch your data, and it accepts responsibility for them.
• Client identity. The client’s name and the existence of the project are themselves confidential.
• No contact. The partner will not approach your client, directly or indirectly.
• Notice of a problem. The partner tells you promptly if data is exposed.

For comparison, the Wooprex white label program signs an NDA before anything is shared, runs work through business AI services that never train on what you send, touches files only for the task at hand, deletes them on request and stays away from your clients. Hold any partner, including us, to what is in writing.

Sort every file before it leaves your building

The safest data is the data you never send. Most tasks need far less than the client handed you, so give each file a quick sort into one of three piles:

• Send as it is. Published website copy, logos and brand guides, public price lists, approved photos.
• Mask first. Customer lists, analytics exports with personal details, internal figures that the task only needs in shape.
• Hold back. Passwords stored in spreadsheets, health records, payment card data, and strategy documents that have nothing to do with the task.

Do this with someone who knows the account, and make it a set step in your intake. It takes minutes once it is routine, and it lowers your exposure whichever partner you use.

A masking example, hypothetically

Imagine a clinic client wants a dashboard showing missed appointments. Its export holds patient names, phone numbers and visit notes. The agency needs none of that for the build.

Before sending anything, the agency removes the notes and phone numbers, then replaces names with random IDs. What remains is the date, the appointment status and the treatment category. The partner builds and tests the dashboard against that file. Afterward, the clinic’s own staff load the real data inside the clinic’s own system.

Because health data is regulated, the agency also asks the clinic’s compliance contact to approve this plan in writing, before the first file moves.

Questions to put to a partner, in writing

A sales call is the wrong place to settle any of this. Ask by email and keep the replies with your contract:

1. Which AI services do you use, and on what kind of account: business or consumer?
2. Do those services train on what you send them?
3. Who at your company can see my files?
4. Where are files stored during the work?
5. How do I request deletion, and how do you confirm it?
6. How would you tell me if something went wrong?
7. Is there anything in these answers you can show me in documents?

Treat a vague answer as a no. A partner who works this way every day should reply easily. You can see how a Wooprex job moves from brief to review on the How It Works page.

Logins need their own rules

Data is only half the exposure. Access to a client’s live systems can do far more damage than any file.

• Give the lowest permission that lets the job get done.
• Create a named, temporary user. Avoid sharing the owner’s login.
• Share credentials through a password manager, and never in a brief or a chat message.
• Work on a staging copy where you can, with test data.
• Remove the user and change the keys when the job ends, and note the date you did it.

Tighten your own side

A leak from your agency counts the same as one from a partner, and your client will not care about the difference. Some habits are easy to adopt:

• One gateway. One person sends files to a partner, so there is a record of what left and when.
• Code names. Refer to the client by a project name in briefs where the real name adds nothing.
• Clean deliveries. Check file properties on finished work for author names and other vendor details.
• No personal AI accounts. Tell staff never to paste client material into their own consumer tools. It would undercut everything your NDA says.

If something goes wrong

Agree on these steps now, while everyone is calm:

1. Stop sending anything, and find out what was exposed.
2. Tell your lawyer, then check your client contract for its notice requirements and deadlines.
3. Tell the client directly. They should hear it from you.
4. Request written confirmation of deletion from whoever holds the data.
5. Write down what happened and change the step that failed.

Confidentiality questions from agency owners

Does an NDA alone make AI outsourcing safe?

No. An NDA gives you a legal remedy after a problem. Sending less data, limiting access and asking the right questions up front are what reduce the risk.

Can I hide my client’s name from the partner completely?

Often, yes. Plenty of work only needs the brand files and the brief, so a code name will do. Some jobs, such as work on a live site, make the identity obvious, and that is what the NDA is for.

How do I get my files deleted when the job ends?

Ask for it, in writing, and keep the reply. At Wooprex, files are deleted on request. Make the request a routine part of closing each job.

Do I have to tell my client that AI tools and a partner are involved?

It depends on your contract and the law that applies to their data, so check both and take advice. If a client asks you directly, answer truthfully.

Have your NDA ready and a brief to send? Start a Task, say it is white label, and ask for the NDA to be signed before you share anything.