To judge whether a small-molecule API CDMO is credible and unbiased on IP protection and confidentiality, look for evidence in documents, behavior, controls, and incentives—not just assurances.

1) Check the legal and contractual baseline

A serious CDMO should be willing to sign:

• Mutual NDA with clear scope
• Project-specific confidentiality clauses
• IP ownership language stating:
  • your pre-existing IP stays yours
  • all project-generated inventions, data, methods, and know-how are assigned or licensed as agreed
  • no right to use your compounds/processes for other clients
• Non-use / non-disclosure / non-circumvention provisions where appropriate
• Subcontractor flow-down obligations
• Data return / destruction terms at project end

Red flags:

• They resist project-specific IP language
• They use vague “industry standard” wording instead of explicit terms
• They try to reserve rights to “background know-how” in a way that could swallow your project IP

2) Examine their governance and ownership structure

Credibility and neutrality are strongly affected by incentives.

Ask:

• Are they independent, or owned by a competitor, distributor, broker, or downstream manufacturer?
• Do they have any affiliations with companies that could benefit from your chemistry?
• Do key staff hold side roles, consulting relationships, or equity interests in client-competing businesses?
• Do they have a formal conflict-of-interest policy?

Better signs:

• Clear conflict disclosure process
• Separate governance for BD, tech, and manufacturing
• No obvious competing business lines

Red flags:

• Shared ownership with a CMO, distributor, or API trader
• “We work with everyone” but no conflict policy
• Sales-led culture with weak technical segregation

3) Assess their confidentiality controls, not just their promises

Ask to see how they operationalize confidentiality:

People controls

• Role-based access to client data
• Need-to-know restrictions
• Background checks where relevant
• Confidentiality training for employees and contractors
• Offboarding controls for departing staff

Digital controls

• Access logging
• MFA/SSO
• Segregated client folders/projects
• Encryption at rest and in transit
• Data retention/deletion policy
• Restrictions on external sharing and personal devices

Physical controls

• Controlled lab access
• Visitor sign-in and escort policies
• Secure sample storage
• Paper record handling and shredding

Process controls

• Separate project teams
• Client-specific sample labeling
• No shared notebooks or uncontrolled screenshots/photos
• Formal document approval and distribution rules

Red flags:

• “We keep everything in shared drives”
• No audit trail
• No formal training or access review
• Casual lab culture with open discussions across projects

4) Ask how they handle chemistry know-how and route sensitivity

For small molecules, confidentiality risk is often not only the structure of the API but:

• route details
• intermediates
• impurity profiles
• process parameters
• analytical methods
• crystallization/polymorph information
• scale-up learnings

Good CDMOs should explain:

• what information is ring-fenced
• who can see synthetic route details
• how they prevent knowledge transfer to other programs
• how they protect process optimization data and batch records

Red flags:

• They treat process know-how as generic “manufacturing experience”
• They mention cross-project “learnings” without strong boundaries
• They want broad rights to use your process data for internal templates or future clients

5) Evaluate whether they have ever litigated, been accused, or breached trust

Do some due diligence:

• Search for IP disputes, trade secret claims, regulatory misconduct, fraud, or breach of contract
• Ask for client references, ideally from companies similar to yours
• Look for evidence of long-term repeat business from sophisticated clients

Useful questions:

• Have you had any confidentiality breaches in the last 5 years?
• How were they handled?
• Were clients notified?
• What corrective actions were taken?

A credible CDMO won’t pretend incidents never happen; they’ll show mature remediation.

6) Look for technical and QMS maturity

Confidentiality and IP protection usually correlate with operational maturity.

Evidence to request:

• ISO 9001 / 14001 / 45001 if applicable
• GMP certifications or inspection history
• Data integrity procedures
• Computer system validation practices
• Document control SOPs
• CAPA system
• Vendor qualification and subcontractor oversight

Important: certifications help, but they are not proof of confidentiality. They’re just supportive evidence.

7) Probe their culture through the questions they ask you

A good CDMO should ask disciplined questions about:

• what exactly is confidential
• what can be shared with subcontractors
• permitted use of data
• publication restrictions
• inventor identification and assignment
• background IP vs foreground IP

If they ask thoughtful, precise questions, that’s a good sign.

If they are sloppy about “we’ll figure it out later,” that’s a concern.

8) Test responsiveness and consistency

Before giving them sensitive information, observe:

• whether they respond consistently across BD, legal, and technical teams
• whether they can explain their confidentiality policies without improvising
• whether they honor document-marking instructions
• whether they stop discussion when you ask for a controlled session

Inconsistency often predicts weak controls.

9) Use a staged disclosure approach

Don’t start with your most sensitive material.

A practical sequence:

1. Share only high-level project description
2. Sign NDA
3. Share noncritical technical package
4. Evaluate handling and professionalism
5. Then disclose route-sensitive or structure-sensitive details

If they mishandle small items, don’t escalate.

10) Include IP/confidentiality in the commercial evaluation

A CDMO can be excellent technically but still not acceptable if:

• they insist on broad license-back rights
• they want publication rights
• they push for ownership of process inventions
• they refuse to identify subcontractors
• they will not commit to data deletion or return

Sometimes the most important criterion is not cost or speed, but whether their business model creates a structural conflict.

---

Practical scorecard

You can score them 1–5 on each:

• Contract strength
• Conflict-of-interest transparency
• Confidentiality SOPs
• IT/security controls
• Physical security
• Data/IP ownership clarity
• Incident history and remediation
• Client references
• Cultural discipline
• Subcontractor control

A CDMO that scores low in any of the first six should be treated cautiously.

---

Short list of direct questions to ask

1. Who owns the company, and do any owners have competing businesses?
2. What is your standard position on foreground IP and process inventions?
3. Do you ever reuse process learnings, methods, or analytical approaches across clients?
4. How do you segregate client data and project teams?
5. Who can access my project’s batch records, routes, and impurity data?
6. Do you use subcontractors, and how are they bound?
7. Have you had any confidentiality or trade secret incidents in the past 5 years?
8. Can you provide sample confidentiality, IP assignment, and data return language?
9. Can you provide references from clients with sensitive chemistry?
10. What happens to my data and samples when the project ends?

---

Bottom line

A credible and unbiased CDMO will be transparent, specific, and contractually willing to protect your IP—while demonstrating real operational controls and no hidden incentive to reuse your chemistry. If they are vague, defensive, or ask for broad reuse rights, treat that as a major warning sign.

If you want, I can turn this into:

• a due diligence checklist
• an RFP questionnaire
• or a model risk-scoring matrix for CDMO evaluation.