A trade secret is any business information that has value because it isn’t generally known, and that you take reasonable steps to keep secret. For startups, that often means source code, algorithms, models, training data, pricing and customer lists. Trade secrets are protected by state law and the federal Defend Trade Secrets Act for as long as they stay secret, with no registration and no filing fee, but the protection exists only if you can show you actually protected the information.
Key takeaways
- If you don’t take reasonable steps to keep information secret, it isn’t a trade secret at all.
- The federal Defend Trade Secrets Act lets you sue in federal court anywhere in the US, alongside state law.
- Employee and contractor agreements should include the whistleblower immunity notice the federal law requires.
- What employees paste into AI tools is now one of the easiest ways to lose a trade secret.
- Most trade secret losses happen when someone leaves. Have an exit routine.
What counts as a trade secret?
Almost any information can qualify if it meets two tests: it gets its value from not being generally known or easy to figure out, and the company makes reasonable efforts to keep it secret. Common examples at startups are source code that never leaves your servers, proprietary algorithms and model weights, training data sets, formulas and manufacturing processes, customer and prospect lists with real detail behind them, pricing models, and product roadmaps.
Reasonable secrecy is not just something you prove when you sue. It is part of the definition. If a startup shares its algorithm freely, never asks anyone to sign an NDA, and lets everyone access everything, a court may find it never had a trade secret to protect.
What laws protect trade secrets?
Two layers. Every state protects trade secrets, and 48 states plus Washington, D.C. have adopted a version of the Uniform Trade Secrets Act. New York relies on court-made law, and North Carolina has its own statute. In 2016, Congress added the Defend Trade Secrets Act (DTSA), which gives trade secret owners a federal claim in federal court. The remedies under both include court orders stopping use or disclosure, damages for actual losses or the other side’s unjust gains, and, for willful and malicious theft, up to double damages and attorney’s fees. In extreme cases, the DTSA also allows a court to order seizure of property without notice to prevent the secret from spreading.
One detail matters for your paperwork. The DTSA gives employees and contractors immunity for disclosing trade secrets confidentially to the government or an attorney to report a suspected violation of law, or in a sealed court filing. Companies must give notice of this immunity in any agreement that governs confidential information, such as a CIIAA or NDA, entered into or updated after May 11, 2016. If the notice is missing, the company can’t recover double damages or attorney’s fees against that person under the DTSA. Check that your CIIAA, contractor agreement and NDA templates include it.
Trade secret or patent?
A simple test: if competitors can figure out the invention by examining your product, a patent may be the only real protection, because a trade secret ends once someone reverse-engineers it legally. If the value lives on your servers or in your process and can’t be seen from outside, a trade secret can protect it indefinitely, at no filing cost and without publishing it in a patent. Trade secrets don’t protect you against someone who develops the same thing independently. Patents do. See Startup Patents: Are They Worth It?
What are reasonable measures in 2026?
“Reasonable” depends on how valuable the information is and what a company your size can do, but courts look for a consistent pattern. The core of it is contracts and access. Start at hiring. When you bring someone on, especially from a competitor, tell them in writing not to bring or use any confidential information from a former employer. That protects you from their old employer’s claims as much as it protects your own secrets. Everyone who works with confidential information, including founders, employees, contractors and advisors, should sign a CIIAA, and outsiders such as potential partners or vendors should sign an NDA before you share anything sensitive. Inside the company, give access on a need-to-know basis through role-based permissions, keep access logs for your most sensitive repositories and data, and mark important documents as confidential.
AI tools have added a new item to the list. When employees paste source code, customer data or internal documents into a consumer AI chatbot, that information may be stored by the provider or used to train its models, and a court could treat it as disclosed. In 2023, Samsung engineers made headlines by pasting proprietary source code into a public chatbot. Today, reasonable measures should include a short written AI-use policy that says which tools are approved and what may not be put into them, plus business or enterprise accounts whose terms say your data is not used for training.
Non-competes are not a reliable substitute. There is no federal ban, since the FTC’s rule was set aside and withdrawn, but several states, including California, ban most of them, and Westaway does not recommend non-competes for employees. Confidentiality and invention assignment agreements do the real work. See Non-Compete Clauses.
How do I protect algorithms and data so they hold up in diligence?
Investors and acquirers will ask how you protect your core technology. A diligence-ready startup can show a short register of its key trade secrets (what they are, where they’re stored and who has access), signed CIIAAs and NDAs from everyone who has had access, access controls and logs on the systems that hold them, a written AI-use policy, an exit procedure for departing employees, and written license terms for any third-party data used to build its products or train its models. Describe the register as a list of key examples, not a complete catalog, and don’t adopt a rule you won’t follow every time, such as marking every confidential document. If your policy says everything confidential gets marked, an unmarked document becomes the other side’s best evidence that the information wasn’t secret. This doesn’t have to be elaborate. A one-page register and a folder of signed agreements go a long way. See Startup Due Diligence.
What should I do when an employee leaves?
Most trade secret theft happens around a departure, so have a routine and follow it every time. Shut off access to systems, code repositories and shared drives on the last day. Collect company laptops and devices, and ask the person to confirm in writing that they have returned or deleted all company information and kept no copies. Remind them, in a short exit letter, of their continuing confidentiality obligations under their CIIAA. For a sensitive departure, especially someone going to a competitor, check access logs for unusual downloads in the weeks before they left. And before you wipe a departing employee’s laptop and reissue it, have it forensically imaged if there is any chance of a dispute. Once the device is wiped, the evidence is usually gone. See What Do I Need to Do When an Employee Quits?
What happens if a trade secret is stolen?
Act quickly. Preserve evidence such as logs, emails and device images, and talk to a lawyer about a demand letter or a request for a court order stopping use. Courts can issue temporary orders fast when the risk is real. The strength of your case will turn on the measures described above: what the information was, why it was valuable, and how you protected it. The startups that win these cases are the ones that can show signed agreements and real access controls.
For more on the basics, see Trademark vs Copyright vs Patent and Who Owns Startup IP? If you’d like help protecting your startup’s trade secrets, contact us.
