This article is the third installment in our four-part Trade Secrets at Risk: A Business Owner’s Guide series. Read Part One and Part Two.
Courts do not require perfection; they require effort.
If you are doing nothing to protect your trade secrets, a court will likely conclude you did not think the information was worth protecting in the first place.
The Legal Standard: What Counts as Reasonable Protection
Federal law and North Carolina’s Trade Secrets Protection Act both require that you take reasonable measures to maintain secrecy as a condition of trade secret protection. What counts as reasonable depends on the size and nature of your business. A ten-person manufacturing company in Wilmington and a five-hundred-person technology firm in Raleigh will have different security architectures, and courts recognize that. The question is whether you treated your confidential information differently from your non-confidential information and whether you documented that distinction.
Every practice described below is something courts examine when deciding whether protection should apply. None is individually sufficient, but together, they build the record that makes protection enforceable.
Written Confidentiality Policies and Employee Agreements
For starters, a confidentiality policy buried in an employee handbook that no one has read since onboarding is weak evidence in a North Carolina trade secret case. Courts want to see that employees were regularly reminded of their obligations. Showing effort by way of quarterly communications, annual training, acknowledgment signatures when policies are updated, references in onboarding materials for new hires, to name a few, are measures that go a long ways when protecting your trade secrets and winning over a judge. The goal is a documented paper trail showing that everyone with access to sensitive information knew it was sensitive and knew what they could not do with it.
Confidentiality agreements should cover employees, contractors, and business partners. If you are sharing sensitive information with any outside party, a signed agreement should be in place before the information changes hands. A well-drafted North Carolina NDA is often easier to enforce in court than a trade secret misappropriation claim, because you do not need to meet all the statutory elements. You just need to show a signed agreement and a breach.
Access Controls: Limiting Who Can See What
Limiting who can access sensitive information is one of the strongest signals that you treat it as confidential. Password-protected databases, role-based access permissions, and documented access logs all serve as evidence. North Carolina courts have upheld trade secret protection on databases that were not explicitly labeled confidential because access was restricted and required authentication. The restriction itself communicates the confidential nature of the information.
Moreover, despite the digital era we exist in, physical security still matters. Visitor logs, restricted access zones, and controlled areas for sensitive work are real safeguards that also produce records. Digital security for remote workers requires separate attention: VPNs should be mandatory for all remote access, and company information should stay on company-controlled systems. Employees should not store work files on personal cloud accounts or personal devices. These rules need to be written down, communicated clearly, and enforced without exception.
Make Clear What Is Confidential
If a document is confidential, label it. This sounds basic, but it comes up in trade secret litigation more often than you would expect. Attorneys defending against North Carolina trade secret claims routinely argue that the employee had no reason to know the information was secret because nothing was marked. A measure as simple as a confidential header or footer on sensitive documents removes that argument. For digital files, folder organization and restricted permissions serve the same function.
Verbal reminders are fine, but you need written, demonstrable communication that is objective in the eyes of the judge. Having a policy exist, and a record showing it was communicated, quarterly, annually, or at onboarding will leave you in a much better starting position that otherwise.
Exit Procedures for Departing Employees
The highest-risk point in the trade secret lifecycle is when an employee departs your company. A documented exit procedure should require device return, immediate access revocation, and a written reminder of ongoing confidentiality obligations. That written reminder should reference the specific agreements the employee signed and be acknowledged in writing by the departing employee.
For employees leaving to join a competitor, that written acknowledgment at departure establishes a record. If trade secret misappropriation is discovered later, the fact that the employee received a written reminder of their obligations shortly before leaving is useful evidence in court.
Regular Security Audits
Security measures degrade over time, employees leave and permissions go unrevoked, and access logs go unreviewed. Regular audits of who has access to what, combined with periodic review of those logs for unusual activity, catch problems early. Audits also demonstrate to courts that your trade secret protection program was active and not merely nominal. A proactive security audit is always a welcome tool in the toolbox when it comes to protecting your trade secrets.
Your AI Policy: The Gap Most North Carolina Companies Have Not Closed
Whether companies allow it or not, employees are using AI tools at work. ChatGPT, Claude, and other publicly accessible platforms are part of the daily workflow for many knowledge workers across the world. The trade secret risk is direct: putting confidential business information into a public AI tool can constitute a waiver of trade secret protection. While courts continue to catch up on the real-world implications of AI usage in the context of the law, recent rulings have found that inputs into AI are discoverable in litigation, and there is no reason to believe that this trend won’t continue. Simply put, inputs to public AI platforms are not private, and when secrecy is a core element of what defines a trade secret, it is imperative that your employees are on notice.
Your written policies need to address this explicitly. Employees should be told in specific terms that they may not enter confidential company information into any public AI platform. If AI tools are approved for internal use, they should be enterprise versions with data isolation agreements, not personal consumer accounts. This belongs in onboarding, in periodic reminders, and in your written record of the trade secret protection program.
Building a Culture of Protection
While specific measures are important, individual IT professionals and isolated security audits will only get you so far. As with most things, the best results come from a culture of intention and a company-wide buy-in to the idea that a culture of protection benefits everyone. The checklists and policies are the floor, not the ceiling. The goal is employees who genuinely understand what your trade secrets are, why they matter commercially, and why protecting them is part of their professional responsibility.
Role-specific training makes that concrete. Engineers need to understand that their technical documentation is sensitive, while sales teams need to understand that customer databases, including buying history, contact preferences, pricing arrangements, and buying cycles, are among the company’s most valuable assets. Transition points are especially important: promotions, new project assignments, and departures are moments when employees encounter new information or are about to leave with information they have accumulated. A brief, documented acknowledgment at each of those points reinforces obligations precisely when they are most likely to be tested.
The North Carolina companies that avoid trade secret litigation are not always the ones with the most sophisticated security systems. They are the ones whose employees understood the value of what they had access to and treated it accordingly. Prevention is substantially cheaper than litigation. The cost of building and maintaining a genuine protection program is a fraction of what it costs to chase information down in federal court after it is already gone.
Trade Secrets at Risk: A Business Owner’s Guide
