Ultimate Guide to Archviz & CGI Vendor Compliance: NDA Templates & Security Checklists

Last updated: November 7, 2026
Author: Oak3D team

Note: This guide is intended as a practical procurement and project-management resource, not as legal advice. NDA language and contractual controls should be reviewed by your legal team and adapted to the applicable jurisdiction and project.

Architectural visualization vendors often receive much more than a design brief. They may work with CAD drawings, BIM models, floor plans, façade systems, unreleased project concepts, pricing-sensitive launch materials, 3D scenes, marketing assets, and internal design revisions.

That makes vendor compliance more than an NDA-signing exercise. A practical archviz vendor compliance package combines contractual protection, access rules, secure file handling, software and asset controls, procurement checks, and clear restrictions on how project materials can be used or published.

The goal is simple: the right people should be able to work with the files they need, while unreleased project information remains controlled throughout production.

Industry workflows increasingly rely on shared drives, cloud tools, render infrastructure, plug-ins, remote access, and external assets. Each of these creates another point where information may be copied, exposed, lost, or accessed by the wrong person.

For developers, architectural firms, design managers and procurement teams, the question should therefore be not only “Has the vendor signed an NDA?” but also “Can this vendor actually work with sensitive project files in a controlled way?”

A standard non-disclosure agreement is a useful starting point, but architectural visualization projects often require additional detail because the vendor does not work with one static document.

The production chain can include:

• CAD drawings and BIM models
• architectural plans and elevations
• unreleased design concepts
• preliminary and final renderings
• animation frames and source footage
• 3D models and project scenes
• textures, custom assets and material libraries
• internal comments and design revisions
• location information
• launch dates and marketing plans.

Outsourced visualization workflows routinely involve clients transferring drawings, references and other source materials to an external production team, so confidentiality needs to cover the production process, not only the final image.

Definition of Confidential Materials
Confidential Materials may include all non-public architectural, technical, commercial and visual information provided to or created by the vendor in connection with the project, including drawings, CAD files, BIM models, reference materials, drafts, renderings, animations, 3D scenes and derivative project assets.

Purpose Limitation
The vendor may use the Confidential Materials solely for the purpose of delivering the agreed visualization services.

Need-to-Know Access
Access should be limited to personnel who require the information to perform the project and who are bound by equivalent confidentiality obligations.

Subcontractor Control
The contract should state whether subcontractors are permitted and, if so, under what conditions.

Portfolio Embargo
No image, draft, animation, model, project name or related information may be published in the vendor's portfolio, social media, awards submissions or promotional materials without prior written approval.

Derivative Materials
Working scenes, reconstructed geometry, draft renderings and other assets produced from confidential client information should remain subject to the confidentiality requirements.

Incident Notification
The vendor should have a defined obligation to notify the client if confidential materials are lost, exposed or accessed without authorization.

Retention and Deletion
The parties should agree how long project data may be stored after delivery and what happens to archives and backups.

A project-specific NDA can include wording covering the following areas:

At minimum, the agreement should make clear:

What is confidential
Do not limit the definition to “documents”. Include drawings, CAD and BIM data, 3D scenes, renders, drafts, comments, reference files, design information, project names and any other non-public materials shared or created during the engagement.

What counts as a derivative asset
A CGI vendor may create new 3D models, scenes, textures or working files from the client's drawings. Their confidentiality status should not become ambiguous simply because they were generated during production.

Who may access it
Define whether the vendor may share files internally with artists, project managers, freelancers, render-farm providers or subcontractors.

Whether the project may be published
The agreement should explicitly address websites, Behance, ArtStation, social media, awards, showreels, sales presentations and internal vendor marketing.

How long restrictions apply
Some projects need confidentiality until a public launch. Others require confidentiality for a defined period or indefinitely for specific technical or commercial information.

What happens when the project ends
Agree whether files must be archived, returned or deleted and whether the vendor may retain any backup copies.

These are example control areas, not universal legal clauses. Exact wording should be agreed with counsel based on jurisdiction, project sensitivity and the client's procurement policies.

A leaked final render is obvious. A leaked production file may be more complicated. CAD drawings or BIM models can reveal building layouts, façade solutions, engineering decisions or architectural information long before a development is publicly launched. 

Draft renders may reveal a project even when they were never intended for external use.
Shared folders may contain project names, file structures or metadata that make confidential information visible beyond the image itself.

Industry discussions of digital risk in architectural visualization specifically identify unauthorized shared-drive access, unsecured file synchronization, outdated software or plug-ins, human error and exposure of visuals still covered by NDA as common risk areas.

The solution is not to stop outsourcing. It is to define the rules before files enter the vendor's workflow.

A corporate NDA is normally written to prevent disclosure of confidential information. The problem is that CGI production generates new visual assets from that confidential information.

A vendor may receive a Revit or CAD model and then produce:

• simplified 3D geometry
• textured architectural scenes
• test compositions
• clay renders
• draft images
• post-production files
• animation sequences
• AI-assisted variations
• marketing-ready final imagery.

A generic NDA may protect the files that were originally transferred while saying very little about these derivative materials. That creates avoidable uncertainty.

A finished render may be attractive enough for a studio to want to publish it. That does not mean publication should be assumed. For unreleased developments, the contract should state clearly that portfolio use requires written client approval.

The restriction should cover more than the final hero images. It may also need to include:

• work-in-progress material
• animations
• close-ups
• cropped images
• development names
• behind-the-scenes content
• social posts
• award submissions.

“Confidential until launch” sounds clear until different teams have different definitions of launch. Is the release date:

• the public website launch?
• first media announcement?
• sales launch?
• planning approval?
• client email confirmation?

The safest approach is usually to make publication subject to explicit written approval rather than an assumed date.

If a vendor rebuilds part of a BIM model, develops landscaping from a masterplan or produces a new 3D scene from architectural drawings, confidentiality should continue to apply to that work. Otherwise, the contract protects the input but leaves the production output open to interpretation.

Confidentiality and intellectual property are related but different questions. An NDA answers:
Who may disclose or use this information?

The main services agreement should also answer:
Who owns or may reuse the deliverables, source files, custom models and third-party assets?

That distinction matters especially when stock libraries, plug-ins, licensed models or third-party textures are involved.

When working with external visualization teams, several points deserve explicit treatment.

For larger developers, architectural groups and corporate clients, CGI vendor onboarding may involve more than a creative review.

The procurement process can include legal, financial, information-security and operational checks.

NIST's current supply-chain guidance frames due diligence as a pre-acquisition process for understanding supplier risk before entering into an agreement. CISA vendor-risk templates similarly cover governance, information security, supply-chain controls and third-party practices.

For visualization vendors, the same logic can be scaled to the actual project risk.

The depth of the process should be proportional to the project. A five-image marketing assignment for an already public property does not necessarily need the same compliance package as a confidential masterplan or an unreleased flagship development.

Boutique CGI studios do not always look like large enterprise suppliers. A highly capable specialist studio may have a relatively small headcount and lean corporate structure. That means procurement teams should separate legal qualification from financial qualification.

Legal vetting asks:

• Is the contracting entity identifiable?
• Can it enter into the required agreement?
• Can it sign the NDA?
• Are IP and confidentiality responsibilities clear?
• Is subcontracting controlled?
• Are relevant jurisdictions and governing law addressed?

Financial vetting asks:

• Is the supplier financially capable of delivering the contract?
• Does the payment structure create unnecessary exposure?
• Is the studio dependent on an unusually high upfront payment?
• Does the contract size materially exceed its normal operating scale?
• Is insurance required for this project?

A small agency should not automatically fail because it does not resemble a multinational supplier. The check should establish whether its structure is appropriate to the risk and value of the engagement.

Security is not only about passwords. Visualization production relies on software, plug-ins, render engines, asset libraries and external services. A procurement review should therefore ask what enters the production environment.

Software compliance

Ask whether the studio maintains authorized commercial or otherwise properly licensed software for the tools used on the project.

Typical environments may include 3ds Max, Maya, Cinema 4D, Blender, V-Ray, Corona, Unreal Engine and numerous plug-ins.

The concern is not the brand of software itself. It is whether the studio can account for the tools used to create client work.

Unauthorized or poorly controlled software can create:

• operational risk
• malware exposure
• licensing disputes
• unstable production environments
• problems reproducing or handing over source files.

CISA supply-chain guidance emphasizes that third-party components and software should be assessed against defined security requirements rather than treated as implicitly trusted.

Third-party assets

Ask where models, textures, HDRIs, fonts and other creative assets come from.

The vendor should have a process for distinguishing:

• internally produced assets
• commercial libraries
• client-provided assets
• open-license assets
• project-specific custom assets.

This becomes particularly important if the client expects editable source files rather than only final renders.

Access permissions

Not everyone in the studio needs access to every client folder. For confidential projects, access should follow the need-to-know principle.

A senior artist working on the exterior may need the architectural model. A freelancer creating vegetation may not need the full confidential data room.

A security questionnaire does not have to be 100 pages long. For most archviz engagements, procurement and IT teams need clear answers to a smaller set of practical questions.

CISA's vendor supply-chain risk templates similarly assess security policies, cybersecurity frameworks, supplier controls and incident procedures.

Core questions to ask an archviz vendor

• Who will have access to our project files?
• Do you use subcontractors or freelance artists, and how are they bound by confidentiality requirements?
• Where will project files be stored?
• Are user accounts individual or shared?
• Is multi-factor authentication used for project storage and core work systems?
• Can access be revoked when a person leaves the project?
• Which file-transfer methods do you use for confidential projects?
• How are backups handled?
• How long are project files retained after delivery?
• Can files be deleted on request?
• What is your process if a security incident occurs?
• Do you maintain policies for software, plug-ins and third-party assets?
• Can project materials be uploaded to AI tools or external platforms? If yes, under what rules?
• Do you log or otherwise control access to sensitive project repositories?
• Can you work inside a client-provided environment if required?

A mature vendor does not necessarily need to answer every question with the most enterprise-heavy solution. What matters is whether the answer is clear, controlled and appropriate to the risk.

Archviz projects create unusually large files. BIM models, textures, 3D scenes, animations and layered production files can easily exceed what is practical to transfer by email.

Convenience, however, should not turn into uncontrolled sharing.

For sensitive projects, agree the transfer method before production begins.

Possible options include:

• client-controlled corporate storage
• managed cloud storage with named users
• private object storage such as controlled S3 environments
• secure managed-transfer platforms
• FTPS/SFTP or enterprise transfer systems where required by the client.

The key distinction is not simply Google Drive vs another platform. It is controlled corporate access vs uncontrolled sharing.

A properly administered enterprise cloud environment with individual permissions, MFA and restricted links can be entirely different from sending an open public URL from a personal account.

Recommended controls include:

Named users
Avoid anonymous access where the project sensitivity requires accountability.

Time-limited access
Remove access when the project or role ends.

No open public links
Restrict links where confidential materials are involved.

Clear folder ownership
Define whether the client or vendor owns and administers the repository.

Version discipline
Make it clear which model or drawing revision is current.

Defined retention
Agree what stays after handover.

Role-based permissions, MFA and better control over shared creative assets are also among the risk-reduction practices identified specifically for architectural visualization workflows.

File security does not end in the cloud. Once a model has been downloaded, it may exist on an artist's workstation, a local server, a render node or a backup system.

For high-sensitivity projects, ask how the studio controls that environment.

Relevant questions include:

• Are company devices or personal devices used?
• Are operating systems and production tools kept updated?
• Is endpoint protection in place?
• Is MFA required for remote-access systems?
• Are guest and production networks separated where appropriate?
• Can project data be copied to personal storage?
• How is access removed when a team member leaves?
• Where are local and server backups located?
• What happens to local project copies after completion?
• Who can physically access on-premise storage or render infrastructure?

The point is not to turn every CGI engagement into a banking-security audit. The point is to know where the files actually go after you send them.

Not every project needs the same controls. A simple approach is to classify the job before onboarding the vendor.

Standard Risk
Suitable for projects already in the public domain and containing limited sensitive design information. 

Typical controls: 
NDA where required, named client contact, approved file-sharing channel, basic portfolio rules.

Elevated Risk
Suitable for unreleased sales launches, confidential interior concepts, new architectural schemes or projects with valuable client data.

Typical controls:
project-specific NDA, restricted access, portfolio embargo, approved storage, subcontractor controls, retention rules and a basic security questionnaire.

High Risk
Suitable for flagship developments, confidential masterplans, government or infrastructure work, projects subject to strict corporate policies or highly sensitive pre-launch information.

Typical controls may include:
client-controlled storage, detailed access matrix, security assessment, incident reporting obligations, restricted subcontracting, formal offboarding and additional IT/security review.

This is where compliance becomes useful rather than bureaucratic: the controls follow the actual exposure.

This helps you avoid choosing only by the lowest price.

There is no universal period. The embargo should reflect the project's launch and confidentiality requirements. For sensitive developments, publication is often safest when tied to written client authorization rather than an assumed date. The agreement should also clarify whether drafts, project names and behind-the-scenes materials are covered.

The consequences depend on the contract and applicable law. The agreement may define notification duties, corrective actions, confidentiality remedies, liability or termination rights. For critical projects, the more important step is to agree to an incident-response procedure before work starts rather than deciding what to do only after a breach occurs.

At minimum, define who may access the files, where they may be stored, which transfer methods are approved, whether subcontractors are involved, whether public links are permitted, how backups are handled, how long files are retained, and what happens to project data after completion.

Before giving a CGI vendor access to a confidential project, confirm:

• scope and team are defined
• NDA is signed
• confidential materials are clearly defined
• portfolio publication rules are agreed
• subcontracting rules are known
• IP and derivative asset terms are clear
• file-transfer method is approved
• access is limited to required team members
• retention and deletion rules are agreed
• software and third-party asset policies are understood
• security questionnaire is complete where required
• incident notification process is clear
• commercial and legal onboarding is complete
• final offboarding responsibilities are assigned.

This reflects the broader vendor-risk principle that supplier due diligence should happen before the procurement decision and should examine more than one dimension of supplier risk.

The objective of vendor compliance is not to surround visualization work with paperwork. It is to remove uncertainty.

When access rules are known from day one:

• artists know where to find the correct files
• project managers know who may see them
• clients know when materials may be published
• procurement knows who is responsible
• IT knows how information enters and leaves the vendor environment.

That creates a more predictable production process.

Professional CGI outsourcing already relies on structured briefings, controlled feedback stages, quality checks and defined communication between client and studio. Adding sensible confidentiality and access controls is a continuation of that same production discipline, not a separate bureaucratic layer.

If your CGI project involves confidential drawings, unreleased designs or sensitive launch materials, it is worth defining the working rules before production begins.

Oak3D can align the project setup with your team's requirements for NDA, file access, secure sharing, participant roles and approval workflow, so that the CGI production process is clear from the start.

Planning a confidential visualization project? Send us your brief and requirements, and we can discuss the right setup for your team.