Every quote request we receive for a custom assembly line carries the same tension: you must protect product drawings from leaks, yet our engineers cannot price a machine blind.
To protect product drawings from leaks when sourcing assembly machines, sign an NDA or NNN agreement first, then release only the geometry each stage needs, use neutral file formats, watermark every file, restrict supplier access by role, and define breach liability and data deletion in the contract.
None of these steps works alone. An NDA without file control 1 is a promise with no fence. File control without a contract is a fence with no legal gate. Below, I walk through the four questions buyers ask us most often, in the order they usually come up during a real sourcing project.
A procurement manager in the United States asked me to sign his NDA before he would tell me which part our bowl feeder had to orient. We signed that day.
Find an NDA-willing manufacturer by shortlisting builders with relevant automation experience, asking upfront whether they sign confidentiality agreements before reviewing drawings, sending your own NDA or NNN draft with the first inquiry, and treating any refusal or long delay as a disqualifying signal.
The right order matters. Pick the supplier first, then send the agreement, then send the drawings. Most leaks I hear about started because the buyer reversed that order. A sourcing-security guide we often share with customers points to three recurring exposure points: no NDA, public RFQ distribution, and unclear post-project terms. All three happen before any engineer opens a CAD file.
Avoid open RFQ marketplaces for proprietary parts. Anyone can download a public posting. Instead, approach a small number of machine builders directly through their website, a trade platform inquiry, or a referral. In your first message, say plainly that a non-disclosure agreement 2 is a precondition for drawings. Attach your draft. A serious builder will either sign it or send a marked-up version within a few days. A builder who says "just send the files and we will see" has told you how they treat data.
When the supplier sits in China, as we do in Wenzhou, a jurisdiction-specific NNN agreement often protects you better than a generic Western NDA. Here is how I explain the difference to buyers.
| Clause area | Standard NDA | NNN agreement |
|---|---|---|
| Non-disclosure | Yes | Yes |
| Non-use for other customers or own products | Often weak or implied | Explicit |
| Non-circumvention (bypassing you to sell directly) | Usually absent | Explicit |
| Governing law and venue | Often buyer's home country | Supplier's jurisdiction, so it is enforceable locally |
| Damages | Often undefined | Pre-agreed liquidated damages |
My own rule for any buyer who must give us product drawings, 3D models 3, dimensional tolerances, or assembly process details is a bundle, not a single document: sign the NDA, control the disclosure scope, limit the permitted use to this specific machine, and fix the breach liability in writing. The agreement should name drawings, CAD, photographs, samples, quotations, and derived information as confidential. It should bind authorized personnel and subcontractors. It should require return or destruction of files and set a notice duty for suspected loss. Ask legal counsel to tailor it to the supplier's country. That is cheap compared with a trade secret theft case fought from abroad.
Early in our export work, I learned that "your data is safe with us" means nothing until a buyer asks who, exactly, can open the folder.
Verify a supplier's confidentiality practices by asking who will view your files, where they are stored, whether access is logged and role-restricted, which subcontractors are involved, how printed copies are destroyed, and what happens to data if you do not award the project.
Treat these questions as part of the technical qualification, not a legal afterthought. A builder who can explain its file controls as clearly as its PLC architecture is showing you a real process. A builder who answers with adjectives is not.
With our ten-person team, I can name every person who touches a customer file. A larger builder should be able to do the same by role. Use the table below as a vendor vetting process. Concrete answers count. Vague ones are a warning.
| Question | A good answer sounds like | A weak answer sounds like |
|---|---|---|
| Who will review the drawings? | "One estimator and one mechanical lead, by name" | "Our team" |
| Where are files stored? | "A project folder on our server, not personal inboxes" | "We keep them safe" |
| Is access logged and restricted by user? | "Yes, per project, with download records" | "We trust our staff" |
| Which subcontractors will see files? | "Our panel builder sees wiring only; no product geometry" | "We may use partners" |
| How are prints controlled? | "Numbered copies, shredded at project close" | "We do not print much" |
| What if we do not select you? | "Access revoked and files deleted on request, confirmed in writing" | "No problem" |
Supply chain security is where most buyers stop too early. A machine builder may use outside fabricators 4, a controls programmer, a vision specialist, a tooling shop, or a cloud file-management provider. Each is another copy of your data. Ask for the list. Require written approval before any new party is added. Make the primary supplier responsible for its subcontractors' breaches. Where possible, let subcontractors receive only the task-specific or redacted files they need.
One objection I hear is "we only work with trusted suppliers, so this is overkill." Trust helps, but established firms still suffer employee error, phishing, or a careless partner. And the supplier cannot fix uncontrolled copies that your own procurement or engineering staff forward internally. Contract manufacturing risks run in both directions. A short internal rule, such as "all technical files leave through one portal and one named owner," closes more gaps than any audit of us.
Every week I weigh the same trade-off on our quoting desk: a thinner drawing package protects the buyer, but a missing tolerance can turn a firm quote into a guess.
Yes, you can share partial specifications and still receive an accurate quote. Provide envelope dimensions, critical interfaces, tolerances, materials, cycle-time targets, loading orientation, and inspection requirements as neutral STEP or PDF files, and withhold full assemblies, BOMs, and design rationale until a supplier is selected.
The principle is minimum necessary disclosure. A machine builder needs to know what the part looks like where the machine touches it, how fast it must move, and how it will be checked. The builder does not need the product's commercial story. Tiered information disclosure lets you stage that information as trust and commitment grow.
| Stage | Send | Hold back |
|---|---|---|
| Initial inquiry | Product category, approximate size, target volume, broad material, process type | Product name, distinctive geometry |
| Capability review | Representative or modified sample drawing, labeled as evaluation data | Exact production part |
| After NDA, quotation | Individual part STEP or PDF, critical tolerances, interfaces, takt time, loading direction, inspection criteria, sample photos | Complete assembly, BOM, design rationale, unrelated subsystems |
| Final engineering, selected supplier only | Full package under purchase contract 5 | Source code, algorithms, customer data, export-controlled technology unless strictly required |
For a bowl feeder and pick-and-place cell, we need the part's outer geometry, its weight, the features that define orientation, surface finish sensitivity, and the required parts per minute. For a cable lug or terminal station, we need crimp zone dimensions, wire range, and the pull-test requirement. We do not need the mating connector, the housing, or the reason the flange has that angle. If a supplier insists on the whole assembly to quote a single station, ask why.
Native CAD files carry feature trees, sketch relations, prior revisions, author names, and internal notes. A STEP or dimensioned PDF strips most of that history. Export individual parts, remove hidden components and construction geometry, and clear metadata and project codenames. Some buyers go further with geometry decimation or feature wrapping, which simplifies proprietary internal features while keeping external interfaces exact. Others use browser-based viewers that let our engineers measure and rotate a model without downloading an editable file. One caution: a modified drawing must not mislead on tolerances, material, or difficulty, or the quote will be wrong and the schedule will suffer later. Label it clearly as representative data.
One more objection: "neutral formats solve the problem." They do not. A STEP file still contains valuable geometry. Keep it under the same NDA and the same access controls as everything else.
On a terminal crimping line we built for a German customer, the vision recipe and the fixture nest revealed more about his part than his drawing ever did.
Keep intellectual property protected throughout OEM/ODM manufacturing by stating in the purchase contract that you own drawings, derivative works, custom tooling, and machine programs, requiring approval for subcontractors, using logged secure file sharing, serializing each release, and enforcing data deletion with written confirmation at project close.
The NDA covers the quoting phase. The build phase needs the manufacturing services agreement or purchase contract to carry the weight. This is where ownership of everything created during the project must be spelled out, because a project generates far more than drawings.
| Project asset | Typical default if unstated | Recommended contract term |
|---|---|---|
| Product drawings and CAD | Buyer, but disputes happen over "improvements" | Buyer owns; supplier gets a limited license for this project only |
| Custom nests, grippers, gauges, test adapters | Often retained by builder | Buyer owns when paid for by buyer; builder may not reuse |
| PLC, robot, and vision programs | Builder keeps source | Buyer receives source or a defined copy; builder keeps only standard library code |
| Derivative works and project-specific engineering | Unclear | Buyer owns; builder's pre-existing standard modules stay with builder |
| Process parameters and calibration data | Left on the machine | Documented and delivered to buyer |
That last distinction protects both sides. Our standard feeder tooling and PLC framework existed before your project. Your product-specific nest did not. Separating background technology from project IP prevents the patent infringement risk of either party claiming the other's work later.
Keep every exchange in a controlled portal with named users, expiring links, download logs, and instant revocation. Ban USB sticks and consumer cloud links. Some buyers add file-level CAD file encryption or DRM that lets them pull viewing rights after download. Watermark each release with the supplier name, project number, revision, and date. A few customers embed a tiny, non-functional geometric variation unique to each supplier so a leaked drawing can be traced to its source. Watermarks deter and trace; they do not block copying, so pair them with role-based access inside the builder: sales sees the commercial scope, controls engineers see test data, fabricators see only their components.
Buyers sometimes ask whether to split the line across several vendors so no one sees the full recipe. It reduces the value of any single leak. It also raises cost, integration risk, and finger-pointing when a station fails. For most products, one vetted integrator with compartmentalized internal access is the better balance.
If a leak is suspected, preserve logs and watermarked copies first, revoke access, ask the supplier for an incident report, and involve counsel before any public accusation. Evidence wins; anger does not.
Leaks rarely come from hackers; they come from loose process. Classify, limit, sign, trace, and delete, and sourcing an assembly machine from us or anyone else stops being a gamble.
Interested in sourcing the products mentioned in this article? See details and request a quote here:
1. NIST MEP provides guidance on operational controls and file management for small and medium-sized manufacturers. ↩︎
2. WIPO is the global authority on protecting trade secrets and confidential information in industrial sourcing. ↩︎
3. ISO develops the international technical standards for CAD data exchange and 3D modeling specifications. ↩︎
4. Trade.gov provides resources for managing international supply chains and vetting foreign subcontractors and fabricators. ↩︎
5. The ITC provides model international contracts to protect intellectual property during manufacturing and sourcing. ↩︎
