do you have any insight on what you HAVE to reveal during this process?
There is no cut and dry answer to that in entirety...but there certainly are some "Shall"s in the
APQP and PPAP processes, as well as IATF.
Read the documents...word by word...learn for yourself what MUST be, and what is optional. If it doesn't say MUST...it's optional.
"Have to" to comply with PPAP and IATF, "Have to" in order to land the business, and "Have to" to be true to your company's policies and integrity are three different things (with much overlap)...but all three lines are in different places.
At the end of the day, the customer will have minimum requirements of disclosure in order to buy from you...you don't get to know what they are.
At the end of the day, it is in your company's best interest to reveal as little about sources and methods as possible to protect your IP...
It is in the customer's best interest to know everything about what you do so they can pressure your price down by a variety of methods.
Your company and the customer will dance around each other for a while to find if there is a middle ground where you disclose a little more than you had wished, and they have learned a little less than they had wished.
In my experience, engineering and quality from the customer side will demand that full disclosure is required (basically a lie), and if you fall for it you're basically toast. Management on your side will hold the line "reveal nothing", which will totally kill the relationship. And your Sales and their Engineering and Purchasing will either find a middle ground or they wont. The lower your price is, the more the customer will be willing to back off.
Your initial post sounds like you and your boss want to jump into the toaster thinking its a good idea (it isn't). Based on that, I suggest you lean heavily on whomever is the primary relationship manager and salesperson on your side and follow their lead...and learn from them how these things actually work. Beyond the plain requirements of {your customer's definition of} PPAP and the plain requirements of IATF...there is no real right or wrong left. Again, read the written requirements for yourself and look at the "shalls" and "musts"...there are a few, but not many at all in the area we're discussing.