Skip to content

Founder Confidentiality & Security Undertaking

Purpose. A confidentiality and security commitment for Soon's founders and shareholders, who hold the deepest access to customer data and production systems but who — being directors rather than employees — may have no employment contract carrying those terms. Satisfies A.6.6 (confidentiality agreements) and SOC 2 CC1.1.

Why this exists separately from the NDA. The mutual NDA template is a one-way Discloser / Recipient agreement written for third parties — suppliers, prospects, consultants. Between a company and its own directors it reads as nonsense, and an auditor notices. Use the NDA for external parties such as CyberSquad; use this for the four founders.

Why this is short. SOC 2 control #2 and ISO A.6.6 both require a signed confidentiality agreement from everyone with access, founders included — so something has to exist. This is deliberately the minimum that satisfies it: a confidentiality commitment and a pointer to the policies. Operational obligations stay in the policies where they can be changed without re-signing anything.

Not legal advice. Worth a quick check with Soon's legal adviser that it sits alongside each founder's management or shareholder agreement rather than cutting across it — §3 says those take precedence, which should make that a short conversation.

Undertaking

Between: Soon Technologies B.V. ("Soon") and: ______________________ ("I", "me")

In my capacity as: founder / shareholder / director of Soon

1. What this covers

"Confidential Information" means anything I learn through my involvement with Soon that is not public: customer personal data (the workforce data of our customers' employees), customer lists and commercial terms, source code and infrastructure design, credentials and security configuration, security vulnerabilities and incidents, financial and employee information, and Soon's own business plans.

It does not cover information that is genuinely public through no failure of mine, that I already lawfully held, or that I am required to disclose by law — in which case I will tell Soon first where I am lawfully able to.

2. What I undertake

  1. I will keep Confidential Information confidential, and use it only for Soon's business.
  2. I will not disclose it to anyone who does not need it for their own work for Soon.
  3. Customer personal data is not mine to browse. I will access it only where there is a genuine operational reason.
  4. I will follow Soon's information security policies as they apply from time to time, and report anything that looks like a security incident promptly.

(The detail behind point 4 — password manager, multi-factor authentication, device baseline, AI tool rules — lives in the policies themselves and is confirmed annually through the Policy Acknowledgement Form. It is deliberately not restated here: a contract that duplicates a policy goes stale the moment the policy changes, and leaves two documents disagreeing in front of an auditor.)

3. On leaving

If I stop being involved with Soon, I will return or destroy the Confidential Information in my possession. My confidentiality obligations continue for two (2) years afterwards. Trade secrets and personal data remain protected for as long as the law requires.

Nothing here limits my rights as a shareholder or director, or overrides my management or shareholder agreement — where they conflict, those agreements take precedence.

4. Governing law

Dutch law. Courts of Amsterdam.

Signed

Founder Soon Technologies B.V.
Name
Signature
Date

Signed for Soon by a director other than the individual signing.

Administration

One signed copy per founder in Google Drive → Legal → People, and one row per person in the Schedule of Confidentiality Agreements.

Change log

Version Date Author Comments
0.2 2026-08-25 ISMS Cut back on the owner's challenge that it was heavier than anything anyone had asked for. The operational obligations — Enpass, MFA, device baseline, AI rules — were duplicating the policies they point at, which would have made a founder contractually in breach over a lapsed screen lock and left two documents to keep in step. They now live only in the policies, confirmed annually by acknowledgement. Survival reduced from three years to two, and a clause added so the shareholder and management agreements take precedence.
0.1 2026-08-22 ISMS First version — written because the existing NDA is a third-party instrument unsuited to directors, leaving the four founders with no confidentiality terms on file.