CNC machining China NDA and IP protection is a file-handling system, not a PDF you never read. Sign a mutual NDA (or the shop’s) before you send STEP solids of unreleased 6061 housings or 304 shafts. Limit who at the mill can open the zip. Put part number and Rev C on every file so an old pocket is not cut from a leftover model. Ban unmarked photos of your part on WeChat. Ask when the shop deletes superseded STEPs. This is practical control: NDA, access list, revision, and packing. It is not a claim of ITAR registration, and it is not a lawyer telling you the NDA will win in court. If the part is export-controlled, stop and talk to your own counsel before any China RFQ.
US and EU teams worry about copies. Chinese mills worry about being blamed for a leak they did not cause. Both sides do better with boring rules: who gets the file, which revision is live, and what happens to samples. YXT can discuss confidentiality before detailed files are shared. Nothing here is legal advice.
This guide is shop practice for a drawing-driven RFQ. It is not a substitute for your counsel, your export-control owner, or a patent strategy. YXT CNC is not described here as ITAR registered. A machining quote is not an export license.
Key takeaways
- NDA first, STEP second, for unreleased geometry.
- Access lists beat “the company signed it.”
- Revision control is IP control. Old files are leaky files.
- Photos, samples, and subcontractors are the usual leak paths.
- Export-controlled work needs your counsel, not a machining blog.
Where an NDA helps, and where it does not
An NDA tells the mill the files are confidential and not for other customers’ quotes. It can cover drawings, STEP, process notes, and photos. It does not replace patents, and it does not make a dishonest actor honest. It does give you a written hook if files show up in someone else’s brochure.
Have your counsel review any NDA you did not draft. Jurisdiction, language, and file return at project end are lawyer questions. A factory can sign. A factory cannot tell you the clause is “enough.”
Do not send the full product tree. Send the machined piece. Extra assemblies are extra IP with no machining value.
If you are still choosing a mill, read how a Dongguan factory describes drawing control and ask them to match that with an access rule, not only a stamp.
If your company has tagged the file as export-controlled or ITAR, this page is not your process. Talk to your export-control owner and counsel. Do not send the file to a China mill while you “figure it out later.”
NDA timing is a file-control rule. The sequence is: NDA (or a written “legacy, NDA not required”) then zip. Do not attach the STEP “so they can start” while legal still has the NDA. The mill that already imported the solid cannot unread it. If you only need a ROM number, send a stripped envelope with no unique geometry, or wait.
What an NDA does not do: it does not stop a screenshot. It does not delete a WeChat forward. It does not replace an access list. Treat the NDA as the permission layer. Treat folders, revisions, photo bans, and sample returns as the actual protection you will run on a Tuesday night shift.
Do not ask the mill to interpret US or EU export rules for you. They can confirm they received your statement (“commercial, not tagged” or “do not send, tagged”). They cannot be your counsel. This article will not tell you a jurisdiction where your NDA “wins.”
CNC machining China NDA and IP protection: file access
CNC machining China NDA and IP protection fails when the zip is forwarded to three “partners” the NDA never named. Write the rule: no subcontract of programming or cutting without your written OK. If a trader is in the loop, the mill name still belongs on the access list.
Ask for these mill controls:
- One project folder named with your part number, not a shared “RFQ” desktop.
- STEP and PDF only on the programmer’s PC and the machine net you agree, not on a public WeChat group.
- No posting of in-process photos without your OK.
- Samples packed so a passerby cannot read the customer name off a lobby tag.
NIST’s manufacturing and cybersecurity publications treat access control as part of making things. Start at NIST (NIST Cybersecurity Framework 2.0, 2024, is the access-control way of thinking). You can ask a shop whether they use passwords on shares. You cannot assume they run a federal program.
Contact the shop before the detailed pack if you need the NDA sequence first, then the files.
Name people, not departments. “Engineering” is not an access list. “Programmer A and estimator B, no WeChat group” is an access list. If the mill uses a trader as the English face, the trader is a recipient. Put them on the list or take them off the thread.
Channel control is access control. Prefer a dated zip on email or a portal over a live cloud folder you are still editing. A live link is a moving STEP. It is also a link that can be forwarded without your NDA covering the next inbox. If IT requires a password on the zip, send the password on a second channel and make sure the night estimator can open it. An unreadable pack causes people to ask a colleague to forward an older, unlocked copy. That older copy is how Rev A leaks.
Do not watermark as your only trick. Marking a PDF with recipient and date helps you see whose sheet hit a brochure. STEP watermarks are weak. Limit who gets the solid.
For custom CNC machining, the access list belongs next to material and quantity on the first RFQ, not in a legal appendix nobody opens.
Revision control as IP control
ASME Y14.5-2018 drawings identify the part and the revision. The ASME Y14.5 system is also an IP system: Rev C is the only solid that should be on the machine. ISO 2768-1 (1989) does not cover revision letters, but a complete PDF still reduces an unofficial second model. See ISO 2768-1.
Rules that work:
- One live revision in filenames (
PN-REV-C.step/.pdf). - Email subject includes the revision when you supersede.
- Shop confirms they archived Rev B toolpaths before cutting Rev C.
- First article tied to that revision. A new revision is a new article.
A common leak is leaving Rev A STEP in a shared folder “for reference.” Someone loads it on Saturday. You get the old pocket.
For production repeats, small-batch CNC machining should pull the released pack, not a salesperson’s old zip.
Revision leaks are IP leaks because the old geometry is still your geometry, plus it may be the version you already showed at a trade show. Mixed revisions also create a false “copy” story: a part hits the market with last quarter’s pocket and you assume a stolen STEP when you actually left two STEPs alive.
Write kill language when you bump: “Supersede PN Rev B. Do not quote, cut, or photograph Rev B. Archive the folder. Echo Rev C before you recut the number.” If they already programmed Rev B, they should say so. Paying to reprogram is cheaper than two geometries in one carton, and cheaper than Rev B photos in a capability album.
Do not increment with final2.step while the title block still says Rev C. Programmers search letters. They do not search your adjectives.
Keep a local dated folder: RFQ-2026-05-01-PN-REV-C. That folder is what you sent. If a dispute appears, you can show the pack. IP arguments that start from “I think we sent the new hole” are already lost as file control, whatever the NDA says.
Photos, samples, and leftover parts
IP also walks out in cardboard. Mark samples as customer property. Say whether the mill may keep a witness piece. Default is no capability-album photos and no WeChat “workshop life” posts of your geometry.
Packing lists should use your part number, not a stealth product nickname. Failed parts in a scrap bin with your logo are a photo leak. Ask for scrap to be unrecognizable or returned if the shape is the secret.
Photo rules belong in the RFQ, not after a viral clip. Write: “No photos of this part on social, WeChat Moments, or catalogs unless we approve a crop in writing.” If the mill needs an in-process photo for your DFM thread, require it in the email thread, not in a public group. A DFM screenshot of a pocket can be OK. A beauty shot of the full housing on a table with your logo is not.
Samples: state return, destroy, or mill-keeps-one. If you allow a witness piece, require it in a locked cabinet, not on a lobby shelf. If you require destroy, ask how (machine again, chip, or return). You will not get a legal certificate of destruction from this blog. You can get a one-line email: “Rev C leftovers chipped on [date].” Save that with the zip.
Shipments: hide product names that reveal the launch. PN-440 Rev C is enough. “NEW DRONE GIMBAL PROTO” on a carton is a brief for a photographer at the freight dock. This is not paranoia theater. It is labeling.
If a trader is in the chain, samples can sit in a second office. Put sample handling on the access list. The mill NDA does not automatically cover a trader’s showroom.
CNC machining China NDA and IP protection: RFQ checklist
CNC machining China NDA and IP protection should show up as a paste-able list on the first RFQ for a new product.
- NDA status (signed / not needed for this legacy part)
- File channel (email / form, not a public link with the whole catalog)
- People allowed to hold STEP
- Revision in filenames
- Subcontract ban unless approved
- Photo ban
- Sample return or destroy
- Export-control statement from you: commercial / tagged / do not send
If a line is empty, the mill will fill it with convenience.
| Control | What you do | What the mill does | Best for | Watch-out |
|---|---|---|---|---|
| NDA | Send / review before STEP | Sign, file, brief staff | Unreleased products | Unsigned “we are careful” |
| Access list | Name who may receive files | Limit folder, no extra forwards | Traders in the chain | WeChat group dumps |
| Revision | One live STEP plus PDF | Echo Rev, archive old | Every CNC job | Rev A left on the controller |
| Photos | Ban or approve | No public posts | Stealth hardware | “Workshop life” videos |
| Samples | Return / destroy rules | Tag as customer property | Shows, leftover PCNs | Lobby display boards |
| Export tag | Your counsel’s call | Receive or refuse the pack | Tagged files | Sending while “figuring it out” |
Bottom line: pick the row you will actually enforce. An NDA with unlimited forwarding is theater.
The export line is yours. If the file is tagged, do not send it to a China mill, factory direct or trader, while you wait for advice. This page will not claim a registration, a license, or a safe harbor. If the file is ordinary commercial hardware your company has not tagged, say that so the mill is not guessing.
Paste the checklist under the zip the same way you paste material and qty. IP that lives only in a legal shared drive does not reach the programmer.
Worked RFQ: NDA, then one zip, then an echo
A worked file-control RFQ for an unreleased 6061 housing:
Day 0: counsel (yours) sends or reviews NDA. Mill signs. You record names of mill signatory, estimator, and programmer. You still send no STEP.
Day 1: zip HSG-NEW-REV-A.step + HSG-NEW-REV-A.pdf. Email subject: RFQ HSG-NEW Rev A, NDA on file, no photos, no subcontract. Body:
- NDA: signed [date], mill legal name
- Access: estimator, programmer; no WeChat group; no trader
- Material: 6061-T6, qty 6
- Finish: as machined, Ra 3.2, no album photos
- Criticals: pocket L/D, two dowel bores
- Sample: return all, no witness piece
- Export statement: your company has not tagged this file as export-controlled (if that is true; otherwise do not send)
- Please echo Rev A and the access rules before quoting
Day 1 mill echo you require: “NDA on file. Quoting HSG-NEW Rev A. Access limited to [names]. No subcontract. No photos. Samples returned.”
If they echo only a price, you have not finished CNC machining China NDA and IP protection. Write back once. Do not start a second mill with the same zip until the first mill’s access echo exists, or you just doubled the copy count.
Day 8: sample returns in your packaging, packing list shows Rev A, no leftover on their shelf (you asked). You bump to Rev B for a hole change, kill Rev A in the subject, and require a new echo. Old toolpaths archived. That is IP control that a factory can follow.
Second table for leak paths vs RFQ lines:
| Leak path | RFQ line that addresses it | Proof you can ask for |
|---|---|---|
| Extra mill | No subcontract unless approved | Mill name on quote |
| WeChat dump | Named access, no group | Echo of names |
| Old STEP | One live revision, kill language | Echo of Rev letter |
| Catalog photo | Photo ban | Written no-album |
| Lobby sample | Return / destroy | Packing list + email |
| Full assembly | Send machined piece only | Zip contents |
Bottom line: the NDA is the first row. The rest is how files actually move.
If you later want a Dongguan mill to run this sequence, use YXT CNC contact and state NDA status before you attach the detailed STEP.
FAQ
Do I need an NDA for every China CNC quote?
No. Legacy hardware that is already in catalogs often does not need a new NDA. Unreleased geometry should have an NDA before the STEP goes out. Write the status on the RFQ so the mill does not guess. “NDA not required, catalog part PN-12” is a file-control statement. Silence is not. If you are unsure whether the geometry is still secret, treat it as unreleased until your counsel or product owner says otherwise. This page will not make that call for you.
Is a China NDA enforceable?
That is a counsel question for your jurisdiction and the shop’s. This page does not tell you a clause will win. Use the NDA plus access and revision controls anyway. Enforceability is a lawyer’s job. Stopping a WeChat forward is a folder job. You want both. A mill can sign. A mill cannot advise you that the governing law clause is “enough.” If the NDA is only in English and the shop staff work in Chinese, ask your counsel whether a bilingual set is worth it. That is still legal work, not CAM.
Can I watermark CAD files?
You can mark PDFs with recipient and date. STEP watermarks are weaker. Still limit who gets the solid. Do not rely on a watermark as the only control. A marked PDF helps you see whose sheet leaked. It does not stop a screenshot of the model in CAM. Access lists, no-subcontract language, and kill-old-revision rules do more on a shop floor than a faint logo in the title block. Use the watermark as a trace, not as a lock.
Should I split the part so no shop sees the whole product?
Sometimes, for high-secrecy assemblies. You pay in fit-up risk and extra RFQs. For most housings and shafts, one mill plus an NDA is the practical path. Split only when the assembly is the secret and each piece is meaningless alone. Then you run two NDAs, two access lists, and two revision systems. Fit is your problem at home. Do not split a single housing across mills just to feel safer. You will create two copies and a datum fight.
What if the mill wants to use my part in their capability album?
Say no unless you approve a cropped, non-identifying photo in writing. Default is no album, no WeChat, no trade-show part on a table. If you do approve a crop, specify which faces, whether your logo is gone, and whether the filename can appear. Keep that approval with the zip. A verbal “sure, just don’t show the logo” will not reach the marketing intern. Album use is a revision of the photo ban, not a friendly extra. Treat it like a drawing change: written, dated, limited.
What should I do if the file might be export-controlled?
Stop the send. Talk to your export-control owner and counsel before any China RFQ. Do not ask a mill to decide. Do not treat a machining blog as a license. YXT CNC is not described here as ITAR registered. If your company has not tagged the file, say so on the RFQ as your statement, not as the mill’s legal opinion. If it is tagged, do not attach the STEP while you wait. File control includes not creating copies you are not allowed to create.
Treat CNC machining China NDA and IP protection as NDA timing, named file access, and revision control, then send only the machined-piece pack. For a Dongguan factory review after those rules are set, use YXT CNC contact and state NDA status, revision, and whether photos or samples may be kept.
