This article is the third installment in our four-part Trade Secrets at Risk: A Business Owner’s Guide series. Read Part One, Part Two, and Part Three.
Remote work is here to stay, overseas vendors are commonly called upon, and AI tools are everywhere and then some.
Each one creates a distinct trade secret risk that your standard policies have likely not caught up with.
Remote Work and Trade Secret Protection: What North Carolina Businesses Need to Know
Like it or not, remote work is not going away. While this modern workforce commonplace provides great convenience for workers, those privileges come with risks. The risk it creates is not primarily that employees will deliberately steal information, but ratherthat the remote work environment removes the physical and digital controls that once made trade secret misappropriation difficult and visible.
When an employee works from home, company information moves across personal Wi-Fi networks, onto personal devices, and into personal cloud accounts. Each of those transfers is a potential exposure point: the file saved to a personal Google Drive for convenience, the work email forwarded to a personal account to read later, or the document downloaded to a personal laptop because the VPN was slow. Most of these are innocent, or seemingly appear as such, but any of them can result in confidential information sitting in an environment you cannot audit, monitor, or wipe when the employee leaves.
Your company should have minimum requirements for a remote work trade secret policy that holds up to legal scrutiny. These requirements include no company information on personal email accounts, no storage in personal cloud services, no use of personal devices for work files unless enrolled in company mobile device management, VPN required for all access to company systems, and no use of personal USB drives or external storage. These should be written rules, communicated at hiring, reinforced in periodic training, and enforced without carve-outs for convenience. If you allow exceptions, expect to see them cited against you in litigation.
Mobile device management matters more than most companies realize. If an employee uses a personal phone to access company email or company systems, you need the contractual and technical ability to remotely wipe company data from that device when they leave. You do not want to discover, after a departure, that eighteen months of confidential communications are sitting on a personal phone you have no way to reach. Put plainly, if an employee leaves a company phone at the bar in an airport, you need to be able to delete the data on it before anyone else finds it.
Foreign Vendors and the Trade Secret Enforcement Gap
Many companies use overseas vendors for software development, manufacturing, or technical services. The legal risk is specific: if a foreign vendor misappropriates your trade secrets, enforcing your rights against them may be practically impossible.
The DTSA has worldwide reach in theory. If an act in furtherance of misappropriation occurred in the United States, federal courts can exercise jurisdiction over the full scheme, including conduct abroad. However, a vendor in a country with no U.S. operations and no U.S. assets presents serious practical enforcement problems. Getting into a foreign court system on a trade secret claim is slow, expensive, and uncertain, and in some jurisdictions, unrealistic.
The time to manage this risk is before you share your information. Vendor agreements with foreign companies should include a consent to U.S. jurisdiction for any trade secret dispute. Without that consent, you may have a valid legal claim and no practical path to pursue it. Agreements should also specify audit rights: if a vendor has access to your proprietary software, manufacturing specifications, or technical documentation, you need the contractual right to audit their handling of that information and require certified destruction or return when the relationship ends.
Before engaging a foreign vendor for anything that involves your proprietary information, three questions are worth answering: Is there a domestic alternative that could perform this work? If the vendor misappropriates my information, can I reach them in a U.S. court under the existing contract? Does the agreement give me audit rights and require certified deletion at the end of the engagement? If any answer is no, the arrangement deserves closer review before it proceeds.
AI Tools and Trade Secret Waiver: What North Carolina Courts Are Seeing
Like remote work, AI tools have become standard in the daily work of many employees, whether companies formally allow it or not. Legal teams use them to draft documents. Sales teams use them to prepare client materials. Engineers use them to write and review code. Most of this happens on personal accounts and free consumer tiers of platforms operating under terms of service that permit the platform to use submitted data for model training.
When an employee enters confidential business information into a public AI platform, several things may happen at once: the platform may use that data to improve its models, other users may eventually encounter outputs shaped by your proprietary information, and if litigation ever arises, opposing counsel can seek discovery of those interactions. Courts have held that conversations with public AI chatbots are not protected by attorney-client privilege: those inputs are discoverable. If an employee used a public chatbot to process information they were misappropriating, every session is available to the other side. That cuts both ways because if your own employees fed your trade secrets into a public platform, that exposure exists regardless of who is suing whom.
Your AI and trade secret policy needs to be specific. Employees should be prohibited from entering confidential company information, including customer data, pricing, formulas, software code, and proprietary processes, into any public AI platform. If AI tools are used for work, they should be enterprise versions with documented data handling agreements that include data isolation and prohibit use of company data for model training. This is not a technology governance question. It is a trade secret protection question, and it belongs in the same policy, the same training, and the same periodic reminders as the rest of your confidentiality program.
What Federal Law Covers and Where Its Limits Are
For businesses operating across state lines or internationally, it is worth knowing what the Defend Trade Secrets Act covers and where its practical limits are.
The DTSA applies nationwide and extends to international conduct when part of the misappropriation occurred in the United States. Federal courts can award injunctive relief, actual damages, unjust enrichment damages, and, in cases of willful and malicious misappropriation, exemplary damages up to two times the compensatory award, plus attorneys’ fees. Trade secrets under the DTSA do not expire. As long as the information remains secret and commercially valuable, protection continues. A well-maintained trade secret program is more durable than a patent.
The practical limits show up in enforcement against overseas actors without U.S. presence and in cases where the company failed to maintain documented protection measures. A company that cannot demonstrate reasonable steps to keep its information secret will have difficulty prevailing on the merits, regardless of how clear the theft was. The protection is conditional on the effort.
Where to Start: A Trade Secret Audit for Your North Carolina Business
A trade secret audit does not require outside counsel to begin, though having a North Carolina trade secret attorney walk through it with you is useful. It starts with three questions: What information do we have that would damage us competitively if a competitor obtained it? What specific steps have we taken to keep it secret, and can we document those steps? Where are the gaps?
Most businesses find, when they sit down with those questions honestly, that the documentation is thinner than they believed. Policies exist on paper but have not been updated in years. Confidentiality agreements with contractors are missing or unsigned. Remote work practices evolved without a corresponding update to written policy. AI tools are in daily use with no policy guidance at all.
None of those gaps are fatal, and they can all be addressed. The cost of addressing them is substantially lower than the cost of trade secret litigation. Ward and Smith’s intellectual property and litigation teams in Raleigh handle trade secret matters at every stage, from initial policy review and confidentiality agreement drafting through preservation letters, cease and desist demands, and federal court litigation when it is necessary. If you have seen warning signs, or if you want to understand where your current program stands, contact the authors or your general counsel.
Trade Secrets at Risk: A Business Owner’s Guide
