Loading…
This Mutual Non-Disclosure Agreement (the “Agreement”) is entered into as of [DATE] by and between:
[CLIENT NAME], a company registered in [JURISDICTION] with registered number [COMPANY NUMBER], whose registered office is at [CLIENT ADDRESS] (“the Client”); and
VAVELIO LTD, a company registered in England and Wales with registered number 16558123, whose registered office is at 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London, W1T 6EB (“Vavelio”);
each a “Party” and together the “Parties”.
The Parties wish to discuss a potential business relationship concerning the design, deployment, and operation of datacenter infrastructure, global networks, and security architecture (the “Purpose”).
“Confidential Information” means any information disclosed by one Party (the “Discloser”) to the other (the “Recipient”) in connection with the Purpose, before or after the date of this Agreement, in any form, including technical designs, architecture, security configurations, business plans, client information, pricing, and financial information. Information disclosed orally is Confidential Information only if identified as confidential at the time of disclosure and confirmed in writing within 14 days.
Without limitation, all architecture documents, service designs, and everything relating to the Purpose are highly confidential.
This Agreement supplements, and does not limit, the Parties’ obligations under the common law of confidence and the Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597), to the extent any Confidential Information constitutes a trade secret.
The Recipient shall:
Confidential Information does not include information that:
The Recipient may disclose Confidential Information to the extent required by law, court order, or a competent regulator, provided it gives the Discloser prompt notice where lawful and limits disclosure to what is required.
The Client shall not publicly disclose — on its website, in marketing materials, or in any public forum — that it works with Vavelio, without Vavelio’s prior written consent. A private mention in a friend-to-friend conversation is permitted, provided no Confidential Information is disclosed.
Vavelio will never sell, rent, or share any client information with third parties. Client information is used solely to deliver the services under this Agreement. Any personal data is processed in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.
In the event of a breach of this Agreement, the non-breaching Party shall be entitled to damages as determined by a court of competent jurisdiction.
Separately, and as a matter of Vavelio’s own principles rather than any legal obligation, Vavelio’s first and preferred course is to provide the Client with compensation equal to double the Client’s monthly cost, as an acknowledgment of accountability. This is wholly Vavelio’s decision. If Vavelio declines to provide such compensation, Vavelio encourages the Client to make the matter public and to judge Vavelio accordingly; and where the Client does so, Vavelio will happily publish its own statement explaining why it disagreed with the decision. Any compensation provided shall, at the Client’s election, be delivered as either (a) a credit against future services, (b) a refund of monies paid, or (c) consulting hours.
No employee or contractor of the Client shall be given access to any information about Vavelio until they have signed this Agreement (or an equivalent confidentiality undertaking) and Vavelio has been informed of their identity.
Where the engagement involves the construction of a physical datacenter, a psychological or mental-fitness assessment is mandatory for all personnel assigned to sections that are Vavelio-related. For sections that are Client-related, any such assessment is left entirely to the Client’s judgment. Any assessment shall be conducted with the individual’s prior consent and in accordance with applicable data protection law.
Access control to all Vavelio-related sections is managed entirely by Vavelio. Any person who requires access to such sections must first register with Vavelio and provide all information Vavelio requires before access is granted. Entry to these sections is protected by three levels of security: a card ID, a fingerprint scan, and an eye scan. All access to these sections is monitored by camera. Signal-blocking devices and any unauthorized electronic devices are prohibited. A metal-detector scanner at the entrance will disable access if metal is detected, and access will remain disabled until no metal is present.
Any biometric data collected for access control is stored in the Client’s databases in encrypted form. Vavelio has no direct access to the data, and verifies only the encrypted data — never the raw biometric data — solely through Vavelio’s software, on a strictly read-only basis. Each device has access only to its own table, and Vavelio does not itself retain the biometric data.
The Client has the right to refuse the assessment, in which case the Client may dissolve the partnership in accordance with the handoff procedures described on its website (see vavel.io/independence).
If Vavelio reasonably determines that any personnel of the Client constitute an active threat to the security of Vavelio’s infrastructure, Vavelio shall provide the Client with a written explanation of the grounds for that determination, and may require the immediate removal of such personnel’s access to any Vavelio infrastructure.
If the Client disagrees with Vavelio’s determination without providing documentation or evidence demonstrating why Vavelio’s assessment is incorrect, Vavelio shall have the right to dissolve this Agreement and any related relationship with the Client, and to follow its standard handoff procedures as described on its website (see vavel.io/independence).
No person has access to any datacenter node, whether by root access or through the user interface. The Client may request its appointed engineer to carry out any task, and that engineer will deploy it — including autoscaling — through an API gateway.
In exceptional circumstances requiring direct access, Vavelio will issue a card ID or virtual ID. Such access requires the engineer to be present at the time of login to the node. Any direct access is temporary, limited to thirty (30) minutes, and is automatically revoked thereafter. During any such access the engineer holds read-only access only, and never administrative access.
All Vavelio products — including VINS, VNTP, and VDNS — operate entirely outside the Client’s jurisdiction.
All access is strictly monitored through Kratos, Vavelio’s access portal, replicating military access systems with cases and ranks. If Vavelio determines that an employee ID has been misused or used by an impersonator, Vavelio may block that person entirely and refuse to issue them any new ID.
The Client has direct administrator access to every virtual machine built for the Client’s own applications or requirements, provided that machine is not a Vavelio-related service.
The Client may grant external access to such virtual machines. Any network scanning solution is strictly prohibited and will be blocked immediately, with the risk of a temporary block of the virtual machine.
Where the Client grants a third-party vendor access to its virtual machines, the Client assumes full responsibility for the vendor’s actions.
Any third-party vendor login shall be provided through Vavelio’s PAM solution. The use of remote desktop software, or any related remote access software, is prohibited. If Vavelio discovers the use of such software, Vavelio may disable the access entirely until the Client provides an explanation of the situation. All services remain running without interruption; only the access is blocked.
This Agreement remains in force for the entire duration of the Parties’ business relationship — for so long as the Client is a client of Vavelio. Following termination of the relationship, the obligations continue indefinitely in respect of any information that constitutes a trade secret.
On the Discloser’s written request or on termination of this Agreement, the Recipient shall promptly return or destroy all Confidential Information and confirm the same in writing.
No licence or other rights are granted except as expressly stated. Confidential Information is provided “as is” without any representation or warranty of any kind.
Nothing in this Agreement obliges either Party to enter into any further agreement or transaction.
This Agreement is governed by and construed in accordance with the laws of England and Wales. The Parties submit to the exclusive jurisdiction of the courts of England and Wales. A person who is not a Party has no right to enforce any term of this Agreement under the Contracts (Rights of Third Parties) Act 1999.
Signed for the Client
Signed for Vavelio LTD
Template last updated: August 2026. For a completed copy, contact support@vavel.io.