How to safeguard confidential information about your company

By Huifen Zheng, legal counsel. All views expressed here are strictly in her personal capacity.

A company’s confidential information forms part of its assets. Such information includes the client base, corporate setup, and most importantly — ideas.

Most startups begin with one bright spark of an idea that the team works to translate to a viable business model. But there is nothing to stop key employees or co-founders from jumping ship and trying to take confidential information with them to a new setup.

How can such ideas be protected?

Resorting to legal action is never cost effective and most startups simply lack the cash to pay lawyers’ fees. Here are sensible ways for managing the flow of confidential information within the company. I’ll also briefly discuss intellectual property protection at the end.

1. Ensure all founders and employees sign non-disclosure/confidentiality and assignment agreements.

A non-disclosure or a confidentiality agreement is a document in which one or both parties agree to keep certain information confidential. In the case of a co-founder or an employee, the agreement to keep secrets will be one-way, i.e. that the co-founder or employee will not disclose any confidential information that they have access to while working for the company.

This applies even after that person leaves the company. This restriction can be for a few years after leaving, or perpetually. It depends on how strict the company wishes to be.

Separately, an assignment agreement will state that whatever work product generated by the co-founder or employee while working for the company, will be fully assigned to the company.

Taken together, these two documents will mean that the company owns the work generated, and that the co-founder/ employee is required to keep such information confidential.

2. Keep information on a “need to know” basis.

Even after the documents in point 1 above have been signed, sensitive information should still be carefully guarded. Employees should be able to access enough information to do their work well, but no more. For example, do not save your product’s source code without encryption in a public shared drive, or leave client lists lying in plain sight.

You can’t leak what you don’t know.

3. Be vigilant about transiting and former employees.