How to send a document behind an NDA (without a signature tool)

To send a document behind an NDA, put the terms on the link, not in a separate signing round: the reader sees your confidentiality notice, accepts it, and only then does the first page appear — with their name, email and the moment of acceptance recorded against that open. For most business documents that is the proportionate answer, and it takes minutes instead of a signature-platform round trip.

Last updated: August 2026

When a click-through NDA is enough — and when it is not

A click-through (or "browsewrap-plus") acceptance is standard practice for protecting commercially sensitive material you are showing someone: pricing, methodology, client lists, a pitch deck with real numbers in it. It creates a record that a named person was shown the terms and affirmatively agreed before being given access.

It is not the right tool for an agreement that needs negotiating, that carries obligations beyond confidentiality, or that a lawyer on either side expects to mark up. Those want a real signature process. The distinction is simple: if the document is the deal, sign it properly. If the document is information you are sharing on the way to a deal, an accepted notice on the link is the proportionate control.

This article is practical guidance, not legal advice; if the material is genuinely high-stakes, ask a lawyer which side of that line you are on.

How to put an NDA in front of a shared document

1. Write or paste the terms. Keep them short and readable. A confidentiality notice that fits on one screen gets read; six pages of boilerplate gets scrolled past, which weakens the very record you are creating.
2. Require the reader to identify themselves. An acceptance with no name against it is not a record of anything. Name and email before the terms, or send each person their own named link so you already know who they are.
3. Show the terms before the first page. Not in a footer, not after. Access has to be the thing that follows acceptance.
4. Record it. Who, which email, and the exact moment — stored against that open, and exportable alongside the rest of your log.

What makes the record worth having

An audit trail is only useful if it survives the day you need it. Four things to check:

• It names a person, not a country. Anonymous acceptance is worthless.
• It has a timestamp you did not type. Server-recorded, at the moment of acceptance.
• It is exportable. A record trapped inside somebody's dashboard is a record you will not have when you need it. A CSV you keep is a record you will.
• It ties to what they then did. Which pages they read after accepting, and whether they took a copy, are part of the same story.

Pair it with controls that actually restrict access

An NDA is a promise. The controls around it are what reduce how often the promise has to be relied on:

• A password, so the document opens only for the person you told.
• An expiry date, so access ends when the conversation does.
• Downloads off, so there is no file to forward — the reader reads it in the browser and there is nothing to attach to an email.
• A watermark carrying the reader's own email, stamped across their copy. Stated honestly: this does not prevent a screenshot. It makes a screenshot traceable to the person who took it, which is the part that changes how people behave with a document.
• A named link per person, so if material does leak, you know whose copy it was, and you can revoke that one person without disturbing anyone else.

There is more on the mechanics of these in how to send a proposal securely.

The test that tells you whether "revoke" is real

Before you rely on any of this, run one check. Share a document with yourself, open it, then pause it and reload the page you already had open. If the pages still appear, the tool is serving them from a public file address and your "revoke" does nothing — the NDA is the only thing standing between the document and the world, which is not what you signed up for.

	Signature platform	Click-through terms on the link
Setup time	A signing round per recipient	Paste the terms once
Reader effort	Open, review, sign, return	One tick, then reading
Record produced	Executed agreement	Named acceptance, timestamped
Right for	The deal itself	Information shared on the way
Access control	Separate from the file	The same link that carries the terms

Frequently asked questions

Is a click-through NDA legally binding? Click-through acceptance is widely used and generally enforceable when the terms were clearly presented before access and the person affirmatively agreed — which is exactly the flow described here. Enforceability depends on your jurisdiction and what the terms say, so take advice for anything high-stakes.

Should the NDA be long? No. A short notice that gets read produces a stronger record than a long one that gets scrolled past. Say what is confidential, what they may not do with it, and for how long.

Can I see who accepted and when? Yes — that is the point. Each acceptance is stored against the person's open, with their name, email and the time, and exports with the rest of the log.

What if they refuse to accept? Then they do not see the document, which is the correct outcome. You will see the open recorded without an acceptance, which is itself useful information.

Put the terms where the document is

The overhead of a separate signing round is why so many confidential documents get sent with no protection at all. Putting the terms on the link removes the excuse. Add an NDA to your next tracked document and keep the record without slowing anything down.

Read next: how to send a proposal securely and how to update a PDF after you have already sent it.