Most software companies approach trade secret protection by checking two boxes: an NDA with contractors and a standard IP assignment clause in employment agreements. Both are necessary. Neither is sufficient on its own. Companies that have learned this the hard way, through litigation under the Defend Trade Secrets Act or a state equivalent, consistently discover the same gaps: their confidentiality agreements were not tailored to the information that actually needed protecting, their access controls did not support the “reasonable measures” standard that trade secret law requires, and their offboarding procedures were informal enough that a departing engineer could walk out with source code and claim they did not realize it was confidential.
Trade secret protection is not a document problem. It is a legal framework problem, and the documents are only as strong as the practices behind them. This article covers what the Defend Trade Secrets Act requires, where NDAs and IP assignment clauses leave gaps, and what a properly structured trade secret protection program looks like for a software company that wants to enforce its rights if something goes wrong.
1. What Qualifies as a Trade Secret Under the DTSA
The Defend Trade Secrets Act (18 U.S.C. § 1836) is the federal framework for trade secret protection. It defines a “trade secret” as information, including formulas, patterns, compilations, programs, devices, methods, techniques, or processes that: derives independent economic value from not being generally known or readily ascertainable by others who could obtain economic value from it, and for which the owner has taken reasonable measures to keep it secret.
For software companies, trade secrets can include: proprietary algorithms and their implementation details, training data sets and model weights for AI systems, source code for unreleased features or internal tools, database schemas and architecture documentation, customer lists with purchase history and behavioral data, pricing models and cost structures, and product roadmaps and competitive strategy documents. Not everything in your company is a trade secret, but the information that gives you a competitive advantage over competitors who do not have it, if that information is not publicly known, qualifies if you have taken reasonable steps to protect it.
The “reasonable measures” requirement is where most trade secret claims fail or succeed. A company that labels everything “confidential” but leaves source code repositories open to all employees, contractors, and vendors without access controls has not taken reasonable measures. Courts look at the totality of what you did to protect the information, not just whether you had a signed NDA.
2. What NDAs Protect and What They Don’t
A non-disclosure agreement creates a contractual obligation on the signing party not to disclose confidential information. What it does not do is protect you under trade secret law if the information becomes publicly available through other means, establish the existence or scope of trade secret protection for purposes of a misappropriation claim, create any remedies against third parties who receive misappropriated information but were not party to the agreement, or substitute for the “reasonable measures” requirement that trade secret law imposes independently of any contract.
NDAs that software companies routinely execute have several common deficiencies when evaluated for actual trade secret protection:
Overly broad definitions of confidential information. An NDA that defines “confidential information” as “all information disclosed by Company to Recipient” covers too much and protects too little. Courts apply a reasonableness standard: if the information is genuinely public or could be independently developed, the NDA’s broad label does not help you. Worse, a litigation opponent can challenge the breadth of your definition and argue that you cannot identify what specific information you actually considered confidential.
No specific identification of the information being protected. Trade secret misappropriation claims require you to identify the trade secrets at issue with particularity. An NDA that covers everything generically does not help you establish with specificity what was taken. The better approach is to supplement a general NDA with a schedule or exhibit that specifically identifies categories of highly sensitive information the recipient is accessing, so the record is clear from the start of the relationship.
No access controls that support the contractual restrictions. An NDA restricts disclosure by the signing party. It does not substitute for technical controls that prevent access. If your contractor can download your entire source code repository and take it to a competitor, the NDA gives you a breach of contract claim. It does not give you the more powerful misappropriation remedies under the DTSA, which include injunctive relief and exemplary damages, unless you can also establish that you took reasonable measures to prevent unauthorized access.
3. The IP Assignment Gap: What Standard Clauses Miss
IP assignment clauses in employment agreements and contractor agreements transfer ownership of work product to the company. They are essential. They are also frequently drafted in ways that create disputes about what they actually cover.
Common gaps in standard IP assignment clauses:
Failure to address prior inventions. Employees and contractors often bring existing IP to the relationship, and a well-drafted IP assignment clause should include a process for documenting prior inventions that the employee or contractor is not transferring to the company. Without this, you risk a dispute later about whether an invention was developed before or after the relationship began, which is a fact-intensive and expensive argument to have after the person has left.
Inadequate scope for AI-assisted development. If your developers use AI coding tools, the IP status of AI-assisted work product is a live legal issue that standard IP assignment clauses written five years ago do not address. Your agreements need to address how AI-generated output is treated, your company’s policies on which AI tools can be used, and whether the use of AI tools creates any issues with your IP ownership claims under applicable law.
Missing assignment of derivative rights. An assignment that covers “inventions and developments” may not clearly cover derivative works, improvements, or enhancements to existing company IP that the employee or contractor creates. Your clause should specifically cover work that builds on or improves the company’s existing intellectual property.
Failure to include work-for-hire language as a backup. Under copyright law, a work created by an employee within the scope of employment is a work for hire and belongs to the employer. For independent contractors, work-for-hire status only applies to certain categories defined by statute, and software generally does not qualify. Your contractor agreement should include both a work-for-hire designation (where applicable) and an assignment as a backup to ensure copyright transfers regardless of how a court classifies the relationship.
4. The “Reasonable Measures” Standard: What Courts Actually Look At
To win a trade secret misappropriation claim, you must prove you took “reasonable measures” to maintain the secrecy of your trade secrets. Courts evaluate this by looking at the totality of your information security practices, not just your contractual documentation.
Courts look for evidence of: access controls that limit access to sensitive information on a need-to-know basis, logging and monitoring of access to sensitive systems, clear policies about what information is confidential and how it must be handled, consistent enforcement of those policies (you cannot protect a trade secret selectively), employee training on confidentiality obligations, physical security measures appropriate to the nature of the information, and offboarding procedures that actually recover access credentials and devices.
If your source code repository is accessible to all employees with no access logging, if your confidential business documents are shared in an unrestricted company-wide Slack channel, or if your departing employees routinely retain access to company systems for weeks after they leave, you have a reasonable measures problem that an NDA cannot fix retroactively.
5. Contractor Agreements: The Highest-Risk Relationship
Software companies frequently engage contractors, offshore development teams, and freelancers who have access to proprietary code, system architecture, and business logic. The NDA and IP assignment clauses in these relationships often receive less attention than employment agreements, but the risk profile is typically higher because contractors often work with less supervision, may work for competitors simultaneously, and may not be subject to the same cultural norms around confidentiality that employees develop over time.
Your contractor agreements should include: an NDA that specifically identifies the categories of information the contractor will access, an IP assignment with the gaps addressed above, specific restrictions on the contractor’s use of company systems and data (including prohibition on downloading beyond what is necessary for the current project), a certification of return or destruction of all company materials at project completion, and a non-solicitation provision covering employees and clients for an appropriate post-engagement period.
If you use offshore development teams, your agreements should also address jurisdiction and governing law, since enforcing a US trade secret claim against a defendant in another country requires navigating international enforcement, which is expensive and uncertain. The better approach is structural: limit offshore team access to the specific systems and code they need, use separate repositories for sensitive components, and require that work product be committed to company-controlled repositories rather than stored on contractor devices.
6. Offboarding: Where Trade Secret Leaks Actually Happen
The most common vector for trade secret misappropriation by employees and contractors is not a sophisticated exfiltration scheme. It is the period immediately before and after departure, when someone is wrapping up a project, cleaning up their work environment, and transferring files they intend to reference later. Without a formal offboarding process, this behavior is often invisible until the person shows up at a competitor with your code or business strategy.
A formal offboarding process should include: return of all company devices and equipment on or before the last day, revocation of all access credentials (email, code repositories, cloud infrastructure, internal tools) immediately upon departure, a certification by the departing employee that they have not retained company confidential information and have deleted any copies of company data from personal devices, an exit interview that includes a reminder of ongoing confidentiality obligations, and a forensic review of departing employee system activity in the period before departure for high-risk departures (especially those going to known competitors).
The forensic review is the component most software companies skip because it feels aggressive. Courts regularly admit evidence of pre-departure downloading activity as circumstantial evidence of misappropriation, and this evidence is only available if you have the monitoring in place to capture it. Your intellectual property counsel can advise on what monitoring is legally permissible in your jurisdiction and how to use it consistently enough to support a trade secret claim.
7. The DTSA Whistleblower Immunity Notice Requirement
One technical requirement that many companies miss: the DTSA requires that employers include a “whistleblower immunity” notice in any NDA or confidentiality agreement with employees or contractors. The notice must inform signatories that they may not be held liable for disclosing trade secrets to government officials or attorneys in connection with reporting a suspected legal violation. Agreements that do not include this notice do not provide the company with the statutory remedies (exemplary damages and attorney’s fees) available under the DTSA, even if they otherwise would qualify. This is a one-paragraph addition that your employment and contractor agreements must include going forward and retroactively in any updated agreements.
8. When to Call a Technology Lawyer
Trade secret protection disputes are expensive and fact-intensive. The companies that win them are the ones that can demonstrate, through documentation and consistent practice, that they treated the information as confidential before the dispute arose. A technology attorney can help you audit your existing agreements and operational practices, identify gaps in your reasonable measures program, draft agreements that are specifically tailored to the information you actually need to protect, and structure your access controls and offboarding procedures so they support a misappropriation claim if one becomes necessary.
The cost of getting this right is a small fraction of the cost of a trade secret litigation, where legal fees routinely run into seven figures before trial.
Frequently Asked Questions
Does the Defend Trade Secrets Act apply to my company even if we are a small startup?
Yes. The DTSA applies to any company whose trade secrets are related to a product or service used in interstate or foreign commerce, which effectively covers any software company doing business in the US. The DTSA provides federal court jurisdiction and remedies including injunctive relief, damages, and exemplary damages for willful misappropriation. Small company size does not affect applicability.
Can a departing employee take their code contributions with them if they wrote them independently?
If you have a properly executed IP assignment agreement that covers inventions created within the scope of employment, no. The employee’s contribution to company code belongs to the company. However, if the IP assignment clause has gaps (missing prior invention carve-out, unclear scope, missing signatures), disputes can arise. Employees who developed specialized skills in connection with company projects can legitimately take those skills to a new employer; they cannot take the company’s specific code or trade secret information.
We have NDAs with all our contractors. Is that sufficient for trade secret protection?
NDAs are necessary but not sufficient. Trade secret protection under the DTSA also requires “reasonable measures” to maintain secrecy. Courts evaluate your access controls, monitoring practices, marking of confidential information, and offboarding procedures alongside your contractual documentation. An NDA with no supporting operational practices is unlikely to satisfy the reasonable measures standard for a serious trade secret claim.
What is the DTSA whistleblower immunity notice, and must I include it?
Under 18 U.S.C. § 1833(b), you must notify employees and contractors in any confidentiality agreement that they are immune from trade secret liability for disclosures to attorneys or government officials when reporting a suspected legal violation. If you fail to include this notice, you lose the ability to recover exemplary damages and attorney’s fees under the DTSA, even if you prevail on your misappropriation claim.
How do we identify which information qualifies as a trade secret?
Start with information that provides a competitive advantage your competitors do not have: proprietary algorithms, source code for core features, customer data with behavioral patterns, pricing models, or AI training data. Ask whether a competitor could obtain the same information without significant effort or investment if they acquired it. The information must also be the subject of reasonable protection measures. Working with a technology lawyer, conduct a trade secret audit that identifies and documents what you have and establishes consistent protection practices across each category.
Build a Trade Secret Program That Actually Protects You
NDAs and IP assignment clauses are the starting point, not the finish line. A trade secret protection program for a software company requires tailored agreements, operational security practices, consistent enforcement, and properly structured offboarding procedures. If you cannot demonstrate all of these in litigation, your agreements are less effective than they should be.
Contact Hansen Tong at TOSLawyer.com to get a trade secret protection audit and properly structured NDA, IP assignment, and contractor agreements that hold up when it matters.