Most agencies start working with an outsourcing partner on goodwill and a few emails. That holds up fine until the first awkward moment: a client asks who touched their database, a partner wants to show a project in their portfolio, or a site breaks after a job and both sides remember the scope differently. At that point, whatever was written down is all anyone has.
This post walks through what an NDA and a working agreement with a WordPress partner usually need to cover, and why each point matters. It is general information, not legal advice. Contract law differs between countries and US states, and an agreement that crosses borders raises its own questions. Use this as a checklist for the conversation with your partner and with a lawyer who can review the final wording for where you operate.
Two documents, two jobs
Agencies often treat “the NDA” as the whole agreement. It is only half. The two documents answer different questions:
- The non-disclosure agreement covers what the partner may know, keep, share and say. It is about information.
- The service agreement (sometimes called a master services agreement, with a statement of work for each job) covers what the partner will do, how it is accepted, how it is paid for and what happens when it goes wrong. It is about work.
Some agencies combine them into one document. That is fine as long as both sets of questions are answered.
What the NDA should cover
What counts as confidential
Spell it out rather than relying on a vague catch-all. For a WordPress agency that usually means client names and identities, the fact that you work with a particular client, site credentials, hosting details, code written for the client, designs, business plans, pricing you charge, and any personal data the partner might see in a site’s database or forms.
Your client relationship
This is the part specific to white-label work. State that the partner will not contact your clients directly, will not solicit them for work, and will not reveal their involvement unless you agree in writing. If you want the partner to avoid working directly for your clients for a period after the arrangement ends, say so explicitly and have a lawyer check whether that kind of restriction is enforceable where you both are.
Portfolio and credit
Decide whether the partner may mention the work at all. Many white-label arrangements say no: no portfolio entries, no case studies, no “built by” footer links, no metadata in themes or plugins that names the partner. If you are happy for them to show anonymised work, define what anonymised means.
How long it lasts
Confidentiality should outlast the working relationship. Agree how long, and whether some information, such as credentials and personal data, stays confidential indefinitely.
Return and deletion
When the arrangement ends, or a client leaves, what does the partner do with files, database copies, backups and notes? A clear clause says they return or delete them, and confirm in writing once done.
What the service agreement should cover
Scope and change control
Each job should have its own written scope: what will be done, on which site, with what assumptions. The agreement then explains how changes are handled. A simple rule works well: anything outside the written scope needs a new estimate and your approval before work starts. This protects your margins as much as the partner’s schedule, and it is the clause you will rely on most often.
Acceptance
Define how a job is accepted. For example: the partner delivers on staging or with notes, you review, and the job is accepted when you confirm or after a set review period passes without comments. Without this, “finished” can stay open for weeks.
Ownership of the work
For client sites, you usually want the code, designs and content created for the job to belong to you (or to your client, depending on your own contract with them) once paid for. Agree what happens with the partner’s reusable tools or snippets that they brought to the job. Note how third-party items like premium plugins and themes are licensed; those licences belong to whoever bought them, and the agreement should say who that is. This is an area where wording matters, and a lawyer’s review is worth it.
Access and credentials
Write down how access is granted, the principle of giving only the access a job needs, and how access is removed afterwards. Agree that the partner will not share credentials within their team beyond the people doing the work, and will report any suspected exposure quickly. Our post on sharing client logins safely covers the practical side.
Data protection
Client sites hold personal data: form entries, orders, customer accounts. The agreement should say how the partner handles it, where it may be stored, and what happens if there is a breach. In the US, privacy rules vary by state and by industry; in the UK and EU, there are specific requirements for anyone processing personal data on someone else’s behalf. Again, general information only. Our post on client data and privacy when outsourcing goes further.
Responsiveness and support
If you expect the partner to handle urgent problems, write down what “urgent” means and how they will be reached. Avoid vague promises in either direction. If you want measurable targets, put them in a separate service level section and make sure both sides can actually meet them; the post on what an SLA is and what to put in one explains the structure without suggesting numbers.
Payment
Currency, invoicing schedule, payment method and what happens if a payment is late. For partners abroad, agree who bears transfer fees and exchange differences. Services such as PayPal and Wise are common for cross-border payment; whichever you use, write it down.
Warranty period and fixes
Agree what happens if something breaks after delivery because of the partner’s work. A common approach is a defined period during which defects caused by the job are fixed without charge, separate from new problems caused by later updates or third parties. Keep the wording precise about cause, because “it broke after you touched it” and “your change broke it” are not the same thing.
Liability
Who is responsible if a mistake causes real loss, such as a broken checkout for a day? Agreements usually cap liability and exclude certain kinds of loss. This is one of the clauses most worth having reviewed by a lawyer, because it interacts with your own contract with the client.
Ending the arrangement
How much notice either side gives, how unfinished work is handled, how final invoices are settled, and how access is handed back. A tidy exit clause makes it far easier to start a partnership, because neither side feels locked in.
Governing law and disputes
When the agency and partner are in different countries, the agreement should say which country’s (or state’s) law applies and how disputes are resolved. This is legal territory. Do not guess; ask.
Line up the partner agreement with your client contract
Your contract with your client and your agreement with your partner should fit together. If you promise the client something, check that your partner agreement lets you deliver it. Common mismatches:
- You promise the client ownership of all code, but the partner agreement keeps ownership with the partner until a later date.
- You promise the client a quick response to emergencies, but the partner agreement says nothing about urgent work.
- Your client contract restricts where data may be stored, but the partner’s process involves downloading database copies.
- You offer the client a long fix period, but the partner’s covers a shorter one.
If you sell ongoing care, our post on what a maintenance contract with a client should contain is useful to read alongside this one.
Questions to ask your partner before signing
- Who in your team will have access to our clients’ sites, and how do you control that?
- Where do you keep copies of client files or databases while working, and for how long?
- Do you ever use other subcontractors, and if so, are they bound by the same terms?
- What do you do if you suspect a credential has leaked?
- Have you signed agreements like this before, and is there anything in ours you would want changed?
A partner’s reaction to these questions tells you a lot. Calm, specific answers suggest they have thought about it. Defensiveness suggests they have not.
A checklist to take into the conversation
- Confidential information defined, including client identities and personal data
- No direct contact with or solicitation of your clients
- No partner branding, credits or portfolio use without written consent
- Confidentiality period that outlasts the relationship
- Return or deletion of files and data at the end
- Written scope per job and a clear change rule
- Acceptance process and review period
- Ownership of work, and who holds third-party licences
- Access granted on need, removed after
- Data handling and breach reporting
- Expectations for urgent work, without numbers either side cannot meet
- Payment terms, currency and fees
- Fix period for defects caused by the job
- Liability limits reviewed by a lawyer
- Notice period and handover on exit
- Governing law and dispute route
Keep it proportionate
A partnership that starts with one small job does not need a forty-page contract. But it does need the essentials in writing: confidentiality, client contact, scope, ownership and access. Add detail as the relationship grows. A document both sides understand is worth more than a long one neither has read.
For more on how agencies structure outsourced WordPress work end to end, see our agency outsourcing guide.
We are happy to sign an NDA with any agency we work with, and we keep to the client-contact rules above. If that is what you need, our page on partner development for agencies explains how the work is scoped and handed over.
Next in this series: Agency Time Zone Workflow: Handoffs That Work
