How can proprietary code be protected when collaborating with an external company?

Question

Imagine I have a code base and I'm obsessively concerned about the protection and privacy of that code. If I were to hire a freelancer to work on that code base, I'd probably have the freelancer sign a nondisclosure agreement and hopefully I'd build up a relationship with him/her over time and gain some confidence that he/she can be trusted.

However, if I wanted to collaborate with an external company, company X, what steps can I take to protect my code? I assume a nondisclosure agreement would offer some protection in the case that company X steals my code, but what could I do to protect against the code being stolen from a rogue company X employee with access to the code base? Should I require that all employees at company X sign a nondisclosure agreement?

In general, what steps can be taken by a company like company X to encourage a trusting collaboration with their clients? How can company X assure me that the code they have access to won't be stolen? Are such collaborations even possible?

Postscript:

I'm not really confident in the protective power of most non-disclosure agreements. In general, I believe that all I can do is work with people that I trust and hope for the best. However, for the purposes of this question I'm interested in hearing if any form of protection is available even if it isn't particularly robust.

Answer 1

You may be better served asking this on OnStartups than on Programmers...

An NDA and appropriate contractual penalties with an external company is generally rather good protection depending, of course, on the legal environment and the external company. If both companies are in the same country so that you could sue in the event of a breech without worrying about worrying about jurisdictional issues or issues of international law, that obviously makes contractual penalties more useful. If the other companies have enough assets to ensure that they don't just fold if their is a suit, contractual penalties are more useful.

On the technical side, do you have to share the entire code base with the external company? Or could you package the most sensitive pieces of code in a way that the external company could use it without having access to the code. For example, could you package the most sensitive components as web services that the external company could call? Or at least as a library of some sort that would be more difficult to reverse engineer?