The Problem Most Tech Companies Discover Too Late

A competitor starts selling a product that looks remarkably like yours. Or a former engineer takes your source code to a startup across town. You call an attorney, describe what happened, and expect to hear "let's file."

What you actually hear is harder: "Can you prove it was a secret? Can you prove you treated it like one?"

That is the moment most California tech companies learn their trade secret program has a fatal gap. Not because the theft didn't happen. It probably did. But because the legal standard for a misappropriation claim requires two things that many companies never built: documented proof that the information had independent economic value, and documented proof that the company took reasonable measures to keep it confidential.

Both. Before the lawsuit. Not assembled after the fact.

This post walks through what courts actually look for, what you need to build now, and where the gaps most commonly destroy otherwise valid claims.

---

What Counts as a Trade Secret Under California Law

California's trade secret framework comes from the California Uniform Trade Secrets Act (CUTSA). The statute sets a two-part test, and both parts must be met at the time of misappropriation, not at the time of filing.

Part one: independent economic value from secrecy. The information must derive value precisely because it is not generally known and not readily ascertainable by someone in the industry using normal means. A customer list with pricing history, margin data, and renewal patterns qualifies. A general list of names that any salesperson could find on LinkedIn does not.

Part two: reasonable measures to maintain secrecy. The company must have actually done something to protect the information. Courts look at concrete steps. NDAs, access controls, password protection, physical security, confidentiality markings, and documented employee training all count. Hoping people would keep secrets does not.

What commonly fails the test:

• General "know-how" that any competent engineer in the field would develop independently
• Business strategies discussed openly in pitch decks or investor calls
• Pricing information shared without any confidentiality wrapper
• Source code that anyone with a subscription to the right developer tool could reproduce

Industries the firm serves, software, telecommunications, pharmaceuticals, oil and gas, all have legitimate trade secrets. But what is protectable in each industry looks very different. A pharmaceutical compound formula is not the same analytical exercise as a telecom network optimization algorithm. The category matters; so does the specificity of what you are claiming.

---

The Documentation Standard Courts Actually Apply

This is where strong cases collapse most often. California courts require a plaintiff to identify its trade secrets with "reasonable particularity" before discovery begins. That requirement comes from California Code of Civil Procedure section 2019.210, and it is enforced strictly.

What does "reasonable particularity" mean in practice? It means you cannot walk into court and say "our entire software platform is a trade secret." You must describe the specific algorithms, specific data structures, specific processes, and specific combinations that constitute the secret. General descriptions get struck. Cases get stayed or dismissed.

A defensible trade secret log, something a company should maintain before any dispute arises, includes:

• A clear description of each trade secret, specific enough that an engineer in the same field could understand what is and is not included
• The date the secret was created or first fixed in a tangible form
• Who has access, and under what authorization
• The protective measures in place for that specific asset
• The estimated economic value or competitive advantage the secret provides

One entry per secret. Not one entry for "all proprietary technology." Courts have seen that move before.

If you have never done this exercise and a dispute is already brewing, it is not too late to start. But building a log under litigation pressure is harder, more expensive, and less credible than one built during the normal course of business. Courts notice when documentation appears to have been assembled for trial.

---

Reasonable Measures: The Element Companies Most Often Blow

The reasonable measures requirement sounds easy. It is not.

Courts look at the totality of what the company did, calibrated to the value of the secret and the size of the business. A 15-person startup is not held to the same standard as a 500-person enterprise. But "we had everyone sign an NDA at hire" is rarely enough by itself.

What courts have found insufficient in California misappropriation cases:

• NDAs that were signed but never enforced, with no follow-up training or acknowledgment
• Access controls that gave broad system access to nearly every employee
• No offboarding procedure: departed employees kept their credentials active for weeks
• Source code stored in shared repositories with no permission tiering
• Confidential documents emailed to personal accounts with no policy prohibiting it

What courts credit as reasonable:

• Role-based access controls with documented authorization levels
• Annual confidentiality training with signed acknowledgment
• Structured offboarding that includes device return, credential revocation, and an exit interview covering confidentiality obligations
• Contractor and vendor agreements with specific confidentiality provisions, not just a generic exhibit
• Marking documents "Confidential" or "Proprietary" consistently, not selectively

None of this requires a Fortune 500 security budget. A $10 million software company can implement most of this with reasonable effort. The failure is usually organizational, not financial.

---

Building the Paper Trail Before Litigation Begins

If a misappropriation claim ever reaches court, you will need to show the measures were in place before the theft, not implemented in response to it. That is a backward-looking evidentiary exercise, and the paper trail either exists or it does not.

Employment agreements. Every employee who touches anything sensitive should have a written agreement covering confidentiality, assignment of inventions, and post-employment obligations. "Sensitive" means anyone who touches customer data, product architecture, pricing, or vendor relationships. That is most of your company.

Contractor and vendor agreements. Outside contractors are a common vector for trade secret exposure. A standard services agreement with a confidentiality exhibit is not optional. It is foundational.

Exit procedures. This is where companies most frequently create their own problems. When an employee resigns or is terminated, the clock starts immediately. A documented exit process, covering device return, account revocation, exit interview, and written reminder of continuing confidentiality obligations, creates the record you will need if that employee shows up at a competitor six months later. For more on what happens when that moment arrives, what to do when a former employee takes your trade secrets covers the immediate response steps in detail.

Digital preservation. If you suspect misappropriation has already occurred, do not touch the systems. Call an attorney first. Forensic evidence, login records, file access logs, email headers, USB transfer records, is fragile. Employee instinct to "check what happened" often destroys the evidence needed to prove what happened. The same principle applies to any significant business dispute: how breach of contract litigation over software access actually unfolds shows how digital evidence becomes central to the case timeline.

---

When a Former Employee or Competitor Crosses the Line

Misappropriation rarely announces itself. The signals are usually indirect:

• A former employee recruits three of your clients within 60 days of departure
• A competitor releases a product with architecture that mirrors yours too closely to be coincidence
• An employee downloads an unusually large volume of files in the two weeks before resigning
• A customer tells you a competitor quoted pricing that could only have come from your internal data

Any one of these warrants immediate legal attention. Not because filing a lawsuit is always the right answer. Because the timing of your response affects what remedies are available. Injunctive relief, a court order stopping the misappropriation from continuing, is time-sensitive. Courts look at how quickly the plaintiff acted. A company that waits eight months before calling a lawyer has a harder time arguing urgency.

The same urgency applies to preserving your own records. Insurance policies, IT access logs, and email servers have retention limits. Once data is gone, it is gone.

---

Fee Structures That Make Litigation Possible for Mid-Market Companies

Trade secret litigation is expensive. A contested case through trial in California federal court can run well into seven figures in legal fees. That number stops most $5 million to $50 million companies before they even pick up the phone.

The attorneys at Thomas Whitelaw & Kolegraff LLP structure fees differently. For strong claims, we offer success fees and contingency arrangements where we share the risk with the client. For defendants, fixed monthly fees give a predictable litigation budget instead of open-ended hourly billing. In some matters, we combine structures: fixed fees through discovery, with a success component for trial and recovery.

The firm took over the defense of a $10 million patent infringement case, Whitewater West Industries, Ltd. v. Pacific Surf Designs, Inc. (S.D. Cal. No. 3:17-cv-01118), approximately 30 days before trial. The jury found no infringement, and the court entered judgment that the defendants owe no damages. In a separate matter, the firm secured a $33 million judgment for a shopping center owner whose parking was taken through a governmental extension. Prior results do not guarantee a similar outcome; every case depends on its own facts.

The same approach applies to IP claims. For companies with valid trade secret claims who cannot sustain years of open-ended billing, alternative fee arrangements are worth a direct conversation. The same logic applies to companies facing patent claims, as patent litigation attorneys who work with fixed-fee structures explains in the context of Orange County manufacturers.

---

Start the Work Before You Need It

Trade secret protection for California tech companies is not a document you file. It is a program you run. Courts reward companies that built their protections systematically and penalize those who assembled their case after the fact.

The audit is straightforward: review your employment agreements, contractor NDAs, access controls, offboarding process, and your trade secret log. If any of those do not exist or have not been updated in the last two years, the gap is real.

Thomas Whitelaw & Kolegraff LLP, 18101 Von Karman Avenue, Suite 230, Irvine, CA 92612. (949) 679-6400. info@thomas-whitelaw.com. This post is for general information only and is not legal advice.

The firm's partners have between 15 and 35 years of litigation experience. We take cases at any stage, including close to trial, and we run them ourselves. If your trade secret program needs review, or if a dispute is already developing, we are available to talk through what you are facing.