Sending Drawings to China: How NDAs and IP Protection Actually Work

Key Takeaways

Almost every drawing leak traces to three skipped steps: no NDA, files posted to a public RFQ board, or unclear terms after the job ends. Volume of exposure, not exotic hacking, is the real risk.
A one-page mutual NDA is enough if it nails six clauses: definition of confidential information, purpose limitation, no third party disclosure, term, return or destruction, and ownership.
Send only what the quote needs: a 2D PDF with tolerances and a 3D STEP model, marked Confidential. Keep a simple record of file name, version, date and who received it.
Designs, CAD files and fixtures stay yours when the NDA and the purchase order both say so. Confirm fixture ownership and release terms before the first order, not after a problem.
Our intake rules are on the RFQ page: quote within 24 hours, NDA available on request, and quote files deleted 365 days after upload if no order follows.
Inside the factory the drawing moves through eight logged steps, from intake to CMM inspection, and only two nodes hold full 3D geometry, both read only. Access runs on four levels, so sales, the shop floor and the inspection station each see only what their step needs.
Deletion is a system event, not a promise. Expiry tags, T-30, T-7 and T-1 reminders, a DoD 5220.22-M secure erase and a SHA-256 destruction certificate mean a 365 day clause can be proven on request.

Sending drawings to a CNC shop in China is a normal, low-risk step when the process around it is right. Sign a short NDA before the RFQ, send only what the quote needs, keep design and tooling ownership in writing, and work with a supplier whose business runs on repeat custom parts. Most IP losses trace back to skipped steps: no NDA, files posted to a public RFQ board, or unclear terms after the job ends. This article explains how the paperwork and the file handling work on a professional floor, and what to check before you press send.

What Actually Puts a Drawing at Risk?

Three failure patterns cause almost every leak in this industry. The first is volume: the same RFQ blasted to ten shops, or to a public board where any registered trader can forward it, multiplies the number of people who hold your file. The second is casual internal handling: a file emailed to a friend supplier for a quick look, or passed to a subcontractor for one process without your consent. The third is reuse, where a supplier shops your design to someone else in your market. That last one gets the headlines, but in custom parts machining it is the rarest, because a serious shop earns from repeat orders and process control, not from reselling designs. The economics are different from hiring a factory to develop a consumer product for you.

A quote package is small: a 2D PDF, a STEP model, a material callout. The format carries little risk on its own. What matters is how many hands touch the file and what each of them is allowed to do with it. Get those two things under control and sending drawings overseas becomes about as routine as sending them to the shop across town.

What Should an NDA With a CNC Machining Supplier Cover?

Short and specific beats long and vague. A one-page mutual NDA is enough if it nails six clauses:

Clause	What it does
Definition of confidential information	Covers drawings, 3D models, specifications, quantities and prices
Purpose limitation	Files are used to quote and, if ordered, to make your parts, nothing else
No third party disclosure	Nothing goes to a partner factory without your written consent
Term	3 to 5 years is common, long enough to cover a product cycle
Return or destruction	You can ask for files back, or deleted, when the job ends
Ownership	Designs, CAD and tooling stay yours

Two things to watch. First, one-way NDAs that restrict only you while the supplier keeps full freedom to reuse what you send: walk away. Second, a twenty-page template that needs a week of legal ping pong before anyone can open your file. That usually signals a shop that rarely handles confidential work. We publish a one-page NDA covering the six clauses above; download it, sign it and attach it to your first RFQ. If your legal team wants changes, send the redlines with the RFQ and they get reviewed the same day.

How Should You Handle Files Before and During an RFQ?

Send what the quote needs, nothing more. For a component quote that means a 2D PDF with tolerances and key callouts plus a 3D STEP model. If the drawing carries features unrelated to the quote, block them out or crop the sheet; a supplier does not need your full assembly to price one bracket. Mark the drawing Confidential even though the NDA already covers it, because the label sets expectations for everyone downstream, including the intern who prints a copy. Skip public RFQ boards entirely. Aggregators collect your file, forward it to several factories and take a margin, so you lose track of who holds the drawing and rarely get the most useful technical answer back.

Keep a simple record instead: file name, version, date, who received it. When three quotes come back and one price looks strange, you will want to know exactly which revision that shop priced. On our side the intake rules are printed on the RFQ page: quote within 24 hours for complete 2D and 3D files, NDA available on request, and quote files deleted 365 days after upload if no order follows. No order, no archive.

NDA protected 3D CAD model of a machined aluminum housing on a tablet next to the finished part — Fig. 1: A 3D CAD model and the finished part side by side. The model you send, the part you get, and the file that stays under NDA in between.

How Does a Serious Shop Control Files Inside the Factory?

Files should land in a controlled intake tied to a quote or job number, not in a general inbox. Access stays with the estimator and the engineer who plans the job. Production gets setup sheets and process sheets, not the full customer drawing set, unless a feature on the drawing is needed at the bench. Anything that leaves the building, such as heat treatment or plating, goes out only with your written consent, and the partner receives the minimum geometry that process needs. Document control here is not a courtesy; it is an audited requirement. ISO 9001:2015 and AS9100D both examine how drawings are identified, stored, retrieved and disposed of, and an auditor will ask to see it. Our machining, heat treatment coordination, surface treatment and final inspection sit under one quality system in a 6,000+ m² facility with 100+ employees, so the file does not bounce between companies you have never heard of.

What Does Confidential File Handling Look Like in Practice?

The rules above are easy to write down. What follows is the real path a customer drawing takes through our shop, because that path is where an NDA either holds or does not. Every detail below comes from a live aerospace program and the standing procedure behind it.

1. The NDA Comes Before the Drawing

In the second quarter of 2024 a purchasing manager at a top-tier European aerospace propulsion group sent an email that contained a single line:

"Before sharing any drawing, please sign and return the attached NDA. We will then upload files to our secure portal."

That message landed before any drawing did. We countersigned and returned the scan within four hours, and opened a controlled entry in our foreign document register at the same time:

Customer code F-2024-047, built from country, year and a running number
Five year NDA term, including a no reverse engineering clause and one covering staff who leave
Intake restricted to the customer's own SFTP, with WeChat and personal email transfers not permitted
First drawing batch of 3D STEP and 2D PDF, 12 parts, 86 MB in total

Most shops answer a new drawing with two questions: can we make it, and what does it cost. The buyer on the other side is watching something else. They are checking whether your handling of their file is good enough for the file.

2. The Path From Quote to Machine

The 12-part set then follows a fixed route. Each step is logged, and that log is what we open during an audit or a customer visit.

Step	Owner	What they see	System action	Logged at
1 Intake	Export sales	Thumbnail and file name, no dimensions	Upload to PDM, watermark applied with recipient name and date	T+0
2 Engineering review	Process engineer	Full 3D and 2D, read only	DFM analysis, feasibility report generated	T+4h
3 Quote	Sales manager	Routing and cycle time estimate, no full geometry	Quote stripped of key feature dimensions	T+24h
4 Order confirmation	Project manager	Full drawing, version locked	Revision frozen, Rev A becomes Rev A-Locked, any change goes through an ECO	T+48h
5 Programming room	CNC programmer	Full 3D, exported to a CAM only format that cannot be re-saved	Mastercam local cache cleared on exit	T+72h
6 Production prep	Shop supervisor	Process drawing and workholding sketch, no full dimension chain	Printout stamped Controlled, valid for the day only	T+96h
7 Machine operation	CNC operator	Single operation drawing with that operation's dimensions, the rest masked	Held on a magnetic board at the machine, collected at shift change	T+120h
8 Quality inspection	CMM inspector	Inspection point 3D model and tolerance band, not the full product drawing	ZEISS CALYPSO program stored separately, drawing never lands on the inspection station	T+144h

Three control points carry most of the weight. Full 3D geometry is visible at two nodes only, engineering review and the programming room, and both are read only. The shop floor never holds the complete part drawing; an operator sees the dimensions their own operation needs, which is a physical barrier rather than a sentence in a policy. Every printout carries a QR code in the lower right corner that traces back to who printed it, when, on which printer, and against which electronic revision.

3. Who Is Allowed to See the Full Drawing

Drawing access runs on four levels, sized to what each role actually needs:

Level	Roles	Visible scope	Where it lives
L1, outline	Sales, admin, finance	Part thumbnail plus material and quantity, no tolerances	ERP preview
L2, process	Process engineers, project managers, quality manager	Full 3D and 2D with tolerances and surface requirements	PDM, read only, screenshot watermark
L3, manufacturing	Programmers, shop supervisors	CAM format and process drawings	Local cache cleared on exit, plus printed controlled copies
L4, station	Operators, inspectors	Dimensions and inspection points for one operation	Paper process card, returned the same day

The logic behind the split is easy to explain. Sales does not need to know how a bearing bore is held to ±0.005 mm on an H7 fit; they need to confirm that we can. An operator does not need the next operation on the sheet; they need to know this one drills four Ø8.5 holes to a depth of 12 mm at Ra 1.6. Fewer people holding the complete drawing means less surface to lose it from, which is the practical reading of AS9100D clause 7.5.3 on the control of documented information.

4. Executing the 365 Day Deletion Clause

The same customer did not leave deletion to a promise. Their NDA carried this clause:

"All drawings, models, and derivative data shall be permanently deleted within 365 days after the last shipment or project termination, whichever is earlier. A deletion certificate with file hash values must be provided upon request."

A clause like that only means something when a system enforces it, so ours does:

Task	How it is done	How it is verified
Expiry tagging	PDM tags each customer folder with a due date of last shipment plus 365 days	Dashboard refreshed daily
Reminders	Automatic email 30, 7 and 1 day before the due date, to the IT administrator and the project manager	Email records archived
Deletion	On the due date the IT administrator runs a secure erase to the DoD 5220.22-M standard, three overwrite passes, not a file delete	Erasure report generated
Hash certificate	SHA-256 values computed before deletion, then a data destruction certificate listing the file list, the hashes, the erase time and the operator's signature	PDF certificate archived
Backup cleanup	The matching version chain is deleted from NAS incremental backups, with a 30 day recycle bin before a second erase	Backup logs compared

One real record, with the customer reduced to the code we use internally:

Project F-2024-047
Last shipment 2025-03-15
Deletion due 2026-03-14
Files erased: 12 3D STEP, 12 2D PDF, 8 CAM files, 12 CMM programs and 12 process cards
Certificate issued: KGL-DEL-F2024047-001, six pages, every SHA-256 value listed

5. Why File Control Earns a Premium

None of this is a cost center. It is part of why we can hold price.

When file control is written into a standing procedure, ours is SOP-IT-003, and the evidence goes on the table during a customer audit, the conversation changes. We show the NDA register for the last 12 months, 47 agreements all countersigned inside four hours, the PDM access audit log with no unauthorized access recorded, and three data destruction certificates, each executed on time. The buyer stops asking whether this factory might leak the design and starts asking why their other suppliers are not this careful.

If your drawing is worth more than USD 100,000, the choice is between a shop that can produce a destruction certificate on request and a shop that says relax, we will not leak it. Only one of those answers survives an audit.

Controlled process card in a magnetic holder on a CNC machine, returned at shift change under NDA file control — Fig. 3: A controlled process card at the machine. It carries one operation and goes back at shift change, so the full drawing never sits on the shop floor.

Who Owns the Design, the CAD and the Tooling?

You do, and the paperwork should say so twice: once in the NDA, once in the purchase order. Drawings, 3D models and specifications remain your property. The shop gains the right to use them for one purpose, making your parts, and no right to quote or make the same part for anyone else. Fixtures and special tooling built for your job are yours too. Ask before the first order, not after a problem: are the fixtures customer property, where are they stored, and what happens if I move production? A straight answer, they are returned or handed over on request, should appear in writing. What the shop keeps is process knowledge: cutting parameters, fixturing tricks, the inspection method. That is fair, and it is how your next batch comes out faster. The line is simple. Your design and your tooling go home with you. Our process stays with us and never works for a competitor of yours.

How Do You Vet a Supplier Before You Send Anything?

Start with verifiable identity. A real factory can give you its D-U-N-S number, ours is 54-443-4542, its business license and its certificates. ISO 9001:2015 is the baseline. AS9100D for aerospace and ISO 13485:2016 for medical matter more, because both audits go deep into document control, traceability and how confidential technical data is handled. Then ask four direct questions: who sees my files, do you pass RFQs to partner factories, what is your retention policy if we never order, and can the NDA be signed this week. The answers should be specific and a little boring. A video walk-through helps too: ask to see the inspection lab and the machines that would run your part, then compare what appears on camera with the equipment list on the website.

Finally, apply the repeat business test. We hold 177 customer records in our CRM across 19+ countries, and most of them reorder, which is the number we actually watch. A shop that lives on repeat custom parts gains nothing from leaking one drawing and risks everything. For the opposite picture, read our piece on the red flags of an unreliable CNC machining supplier and our guide to the key factors when you evaluate a supplier.

Bridge CMM first article inspection probing an aluminum machined part on a granite table — Fig. 2: Bridge CMM first article inspection on a granite table. Inspection records stay tied to the job number under the same document control as your drawing.

What Should Your First RFQ Package Contain?

Six items get you a fast, quotable answer under NDA. The 2D drawing with tolerances and the 3D model in STEP. The material spec and delivery condition, for example 6061-T6 or 316L. Quantity for the first order and the expected annual volume, because batch size changes the process decision. Surface treatment requirements, whether that is anodizing, passivation or plating. Inspection expectations, including whether you need a first article inspection with a CMM report in the box. And the delivery address with a target date, so the quote reflects real logistics. Add the signed NDA and any redlines if your legal team has them. With a complete package, quotes come back within 24 hours, sampling runs on a scheduled window, and there is no minimum order, so a single test part is a normal way to start. Send the package through our RFQ page and keep the drawing marked Confidential. From there it should feel like working with the shop across town, just with more machines behind the door.

Frequently Asked Questions

Do I need an NDA just to get a quote?

If the drawing carries real design value, yes. We offer a one-page NDA on request and can sign it before any file moves. If your part is a standard bracket with no proprietary geometry, an NDA is still good practice, but the deletion policy matters more: quote files get deleted 365 days after upload when no order follows. How we treat your data in general is described in our privacy policy.

Will my drawing be shared with other factories?

Not here. Files stay inside our factory and go to a subcontractor only with your written consent, for a single process such as plating, and only the minimum geometry that process needs. Watch out for quote aggregators, because forwarding your RFQ to several shops is their business model.

What happens to my files if we never place an order?

They are deleted. Our RFQ page states the policy plainly: drawings uploaded for a quote are used only to prepare that quote, and if no order follows, they are deleted 365 days after upload. We do not pass files to third parties.

Who owns the tooling if I move production later?

You do, when the paperwork says so. Confirm in the NDA and the purchase order that fixtures and special tooling are customer property, and ask how release works before the first order, not after.

Is it safe to send drawings to China at all?

For custom machined parts, with an NDA, a vetted supplier and controlled channels, the risk is manageable and comparable to domestic sourcing. The horror stories mostly come from product development ODM work or from files posted on public RFQ boards, not from a signed NDA between a buyer and an audited machine shop.

This article is for informational purposes only. Tolerance capability, material recommendations and lead times depend on part geometry, material condition and batch size. Content reflects general machining practice at KGL and public engineering references; it is not a substitute for a project specific review. Send your drawing for a binding assessment.