Sending CAD Data to a Machine Shop: What to Control

A CAD file for a machined part is small, portable and almost perfectly copyable. It contains the geometry a competitor would need to make the same part, and it can leave your building as an email attachment with no unusual behaviour at all.

Most companies handle this with an NDA and a reasonable amount of trust. That is often thinner than the risk. What follows is what to control, what to ask, and which answers are meaningful — written from the supplier's side of the table.

What is actually at risk

Two distinct things, with different consequences.

The geometry itself. A STEP file of an assembly gives away dimensions, hole patterns and interfaces. For a proprietary mechanism that is the design; for a commodity bracket it is worth much less than companies assume.

The production data. CAM programs, fixture designs, tool lists and setup sheets that a shop creates are derivative IP. They are not yours to demand by default, and they are not the shop's to reuse freely either. This is a contract point most NDAs miss.

Decide which matters for each project. Treat a generic enclosure more lightly than a novel mechanism; making every RFQ a state secret slows quoting until engineers route around the process.

NDA scope: the clauses that decide whether it works

A one-page mutual NDA signed by a procurement clerk is better than nothing. If you want it to hold, check five things.

1. Definition of confidential information. "All information disclosed" is broad but sometimes unenforceable in narrower jurisdictions. A written definition plus a marking convention — confidential by default for technical data — is more workable.
2. Permitted recipients. Named individuals or roles, not "employees who need to know". In a 40-person shop, that is a short list: the programmer, the estimator, the QA lead.
3. Subcontractor flow-down. This is the gap that matters most. A shop that mills the part may send it to an anodizer, a heat treater or a laser-marking vendor. Unless the NDA requires equivalent terms with those parties, your drawing has just left the perimeter.
4. Term and survival. Three to five years after the relationship ends is typical. Trade secrets may need indefinite protection, which is a separate clause.
5. Return or destruction. An obligation plus a certificate, with a stated timeframe — 30 days is common — and an exception for records you are legally required to keep.

If you are in a regulated industry, check whether your obligations to your customer flow through to your supplier. The NDA you sign upstream often requires specific terms downstream, and generic language may not satisfy it. Confirm with your legal team rather than adopting a template.

See also: CBAM and Machined Metal Parts: The Supplier View and Supplier ESG Questionnaires: How a Small Machine Shop Answers.

Transfer, access and storage

Email is the weakest common channel and the most common: it leaves copies in two mailboxes, two spam filters, a phone and an archive nobody can enumerate.

Two rows deserve scrutiny. Endpoint control is where small shops are weakest: the model sits on a programmer's PC, and that PC has a USB port. Cloud hosting is where the answer is often "local server", which is fine provided the backup is properly controlled.

Retention and deletion, including the conflict nobody flags

Shops keep files longer than customers expect, for good reasons: repeat orders, traceability, warranty claims, replacement parts.

That collides with a deletion obligation. If your NDA says "delete within 30 days of project end" and your quality requirement says "retain production records for seven years", the shop has to choose which clause to breach. Resolve it in the contract: data needed for traceability stays, locked and access-restricted; CAD geometry that is not needed for the record set is destroyed on a schedule.

Terms that hold up:

• Active project data: production period plus 12 months.
• Geometry and CAM files: deleted 90 days after final shipment unless a repeat order is open, confirmed in writing.
• Quality records with dimensions: retained per your quality agreement, typically 3-7 years, access-restricted.
• Backups: rotation stated, with a 90-day tail acknowledged rather than pretended away.

Ask for the confirmation in writing. A shop that says "yes, we delete it" and cannot produce a date is describing an intention, not a control.

Twelve questions that produce useful answers

Ask these by email once and keep the reply on file.

1. Where are CAD files stored — local server, NAS, or cloud? Which country?
2. Who has read access to customer CAD data, by role?
3. Is multi-factor authentication enforced on email and remote access?
4. How do you transfer files in and out — portal, SFTP, email?
5. Do you have a written USB and removable-media policy?
6. Which subcontractors receive customer drawings, and what is your flow-down clause?
7. How long do you keep CAD files after the last shipment, and what triggers deletion?
8. Can you issue a deletion confirmation on request?
9. Who is notified, and how fast, if a device holding customer data is lost or compromised?
10. Do you carry cyber liability insurance, and what is the notification window?
11. Has any customer data been lost or leaked in the last three years?
12. Who owns the CAM programs and fixture designs created for our part?

Question 12 starts the most useful conversation. Shops want to reuse fixture concepts and machining strategies across customers, which is reasonable, while not transferring your specific geometry to anyone else. Say so in the contract and the argument disappears.

Our own position is straightforward and written down: NDA on request before any file is exchanged, project folders separated by customer, and files accepted up to 50 MB. Details are on how we work, and the contact page is the right place to start an NDA before you send anything.

Frequently asked questions

Is an NDA enough to protect CAD data sent to a supplier?

It is necessary but not sufficient. An NDA gives you a remedy after a leak, not prevention. Pair it with a transfer channel you control, a short recipient list, a subcontractor clause and a verifiable deletion schedule. For high-value designs, send only the part files needed to quote.

Should I refuse to work with a shop that uses email for files?

Judge the whole picture. A password-protected link or an encrypted archive over email is meaningfully better than a raw STEP attachment. What matters is whether access is controlled and logged and whether the recipient list is known. Blanket bans on email get bypassed under time pressure, which is worse than a documented exception.

Does sending files to a supplier in China create a specific legal exposure?

The obligations are contractual and depend on your jurisdiction, the data type and what your own customer requires. Some export control regimes also restrict releasing technical data to foreign nationals regardless of location, which is separate from commercial confidentiality. Take advice on your own facts rather than a rule of thumb.

What should happen when the relationship ends?

Return or destroy the CAD files, confirm in writing, and keep only what quality or legal obligations require. The confirmation should name the date and the systems covered, including backups and local copies. If a repeat order is plausible, agree a restricted archived copy instead of pretending the data is gone.

Related reading

• Conflict Minerals in Machined Parts: 3TG, Cobalt and the Forms2026-11-04
• RoHS and REACH Declarations for Machined Metal and Plastic Parts2026-11-03
• Robot End Effector Machining: Where Gripper Accuracy Actually Lives2026-09-19