An easy-to-follow one-page trade secret policy for your startup
In January 2026, a federal court dismissed a trade secret claim because the owner workshopped her trade secrets inside consumer ChatGPT. Disclosing a secret to an organization under no obligation to protect it, the court said, extinguishes the trade secret forever. While this kind of fact pattern may be recent, the rule is not: it is a rule the Supreme Court articulated in 1984, applied to the realities of modern technology.¹
If your company does not have a trade secret policy, it needs one. And it needs to be a policy that you and your employees can actually follow.
If you are looking for the template, here it is:
One Page
Trade Secret Policy (one Page) Strain Pllc (PDF, 118KB)
Multi Page
Trade Secret Policy Strain Pllc (PDF, 139KB)
Otherwise, read on!
What is a trade secret policy for?
To constitute a trade secret, information needs to satisfy two things:
(A) the owner thereof has taken reasonable measures to keep such information secret; and
(B) the information derives independent economic value… from not being generally known….²
Chances are, if you care about the trade secret, element (B) is satisfied. A trade secret policy exists to make sure you can demonstrate element (A) does, too.
What “reasonable” means in (A) depends on who you are. You do not need to be perfect: “reasonable steps for a two or three person shop may be different from reasonable steps for a larger company.”³
For a relatively new or small company, your trade secret policy does not need to focus on word count. It needs to answer four questions a court will ask, and all four can be answered on a single page.
Why many trade secret policies fail
Protecting trade secrets works differently from other types of intellectual property, like patents, trademarks, and copyrights. Procuring these latter forms of intellectual property typically involves delegating filing or prosecution work to counsel for drafting and execution. And once obtained, these IP assets require comparatively little ongoing effort to maintain.
Trade secrets work differently. For a trade secret to have value, the company must continuously and vigilantly protect its secrecy. Company employees, contractors, and/or vendors must often use the trade secret, so efforts to preserve its secrecy require much greater coordination between counsel and non-legal staff, who often have no training in preserving trade secrets.
In short, the company must take real ownership of the trade secret policy. Here are the ways that effort commonly fails:
The policy is too broad or vague: Not everything your company does or makes is a trade secret. If your definition of trade secret is “everything we do,” then nothing you do is a trade secret and your claim will fail at the pleading stage.⁴ And if your trade secret policy does not “define, delineate, or specify” what information is considered confidential, a court is unlikely to find that you have any.⁵
The policy does not restrict access: Recalling the wording of the statute above, the owner must take reasonable measures to keep the trade secret actually secret. Sharing trade secrets with vendors, partners, suppliers, or other third parties can be okay, but access must include enforceable bounds. A single recipient who owes you no duty of confidentiality can be enough to destroy your trade secret protection.⁶
The policy is not followed: An unfollowed trade secret policy is just words on a page. Too many startups and small companies treat the policy as the end product, but it is critical that the company follow the policy for it to have legal effect. A policy a company ignores is evidence showing your information is not a trade secret.⁷
The four questions your policy needs to address
For a trade secret to have business value, it must be enforceable in court. To help a court rule in your favor, your trade secret policy should work much like a map, pointing to the parts of your business where your trade secret program actually lives.
The policy is not the program, but it helps the court answer these four critical questions:
Did the company say what is secret? Your policy should point to a trade secret register, with someone in your company named as the owner of the register.
Does everyone with access owe you confidentiality? Your policy should require no access without a signed agreement and should specify the location where those agreements reside.
Did you limit access in proportion to your size? Your policy should require that trade secrets be shared only on a “need-to-know” basis, and the register should list who you have determined meets that requirement. Your policy should also mark the secret so that it is conspicuously identifiable within your documents.
Did you close the loop when people leave? Your policy should provide for access termination when employees, vendors, etc. leave, and the register should indicate return or deletion certifications.
Walking the template, clause by clause
I linked the one page template at the beginning of this article, and here it is again:
One Page
Trade Secret Policy (one Page) Strain Pllc (PDF, 118KB)
Multi Page
Trade Secret Policy Strain Pllc (PDF, 139KB)
Let us look at each clause in the one page template in turn.
Scope
The policy applies to all of your personnel. It is not practical to entirely delegate trade secret protection to counsel. The company must own trade secret protection.
Definition
A reminder of the statutory definition of a trade secret. The company should adapt the “Examples” to include types of information the company typically possesses that not only meet the statutory definition but also produce enough business value to justify the cost associated with trade secret protection. Overseeing a trade secret program involves cost; the value of the trade secret should exceed its incremental cost.
Identification, Marking, and Storage
The company should designate one or more individuals to oversee the trade secret program. If your company decides to use a committee, I recommend limiting membership. Large committees that spread accountability too broadly increase the risk of neglect. Neglecting to execute the trade secret policy will undermine or destroy your trade secrets.
The policy should also designate where the trade secret register will be stored, to promote centralization and easy review of records. The register itself should include (1) a brief description of the trade secret as well as (2) an identification of the owner, (3) storage location, and (4) authorized access list for each secret.
Need-to-Know Access
A company must control its trade secrets, otherwise they are not secret. The requirements listed here are the minimum restrictions courts will look to when determining whether element (A) of the trade secret test has been established.
Onboarding / Offboarding
Before sharing trade secrets with new employees or contractors, the company should ensure the individual has executed an agreement containing nondisclosure obligations and IP assignment provisions sufficient to protect company IP, including trade secrets. Typically, a PIIAA contains these terms.
The company should also ideally conduct a formal training on IP, including trade secrets.
On employee departure, the company must ensure the employee returns or destroys all copies of trade secrets; if this is not possible, the company should discuss with IP counsel.
Suspected Misappropriation or Loss
Trade secret remedies are usually time sensitive. Once information becomes generally known, it ceases being a trade secret, regardless of fault. The best way to salvage a leak is to contain it as quickly as possible, either by revoking credentials, remotely wiping lost devices, sending a demand letter, or formally requesting a court-issued injunction.
Any delay in seeking remedies risks loss of the trade secret forever.
The multi-page template expands on these ideas and offers more robust context, at the expense of brevity. The longer the policy, the higher the risk a new organization may overlook a key detail. If a multi-page trade secret policy does not work for your organization at the outset, start with the one page template and grow into a longer policy, adjusting the language and adding new wording to fit your company’s circumstances. I encourage you to work with an attorney on this task when you are ready.
What the template deliberately leaves out
Trade secret information necessarily will interact with other parts of your business, and those parts can impact trade secret protection. The following are beyond the scope of this article, but should be considered as part of an overarching trade secret strategy.
IT and security standards. Part of your “reasonable” measures to keep information safe must include securing your IT and files.
AI usage policy. Using off-premises artificial intelligence (Claude, ChatGPT, Harvey, etc.) means transmitting information to systems outside of your control. Trade secrets should never be sent to these systems unless legal has approved it.
The patent vs. trade secret decision. For further reading: What Goes in the Patent, and What Stays in the Building.
Related Reading
If you made it this far, I owe you a beer.
Grab one with me in Washington, DC.
Author Note
Stephen G. Nagy is a patent attorney and engineer at Strain PLLC. This article is for general informational and educational purposes only, is not legal advice, and does not create an attorney-client relationship. It reflects the author’s views, not necessarily those of Strain PLLC. Legal authorities change; verify currency before relying on anything here. For advice on your specific situation, consult qualified counsel.
This article is my own work:
Notes
1. Trinidad v. OpenAI, Inc., No. 4:25-cv-06328-JST, slip op. at 6–7 (N.D. Cal. Jan. 5, 2026), ECF No. 74 (dismissing with prejudice) (quoting Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1002 (1984)), appeal dismissed, No. 26-721 (9th Cir. Apr. 7, 2026).
2. 18 U.S.C. § 1839(3).
3. Learning Curve Toys, Inc. v. PlayWood Toys, Inc., 342 F.3d 714 (7th Cir. 2003) (quoting Elmer Miller, Inc. v. Landis, 625 N.E.2d 338, 342 (Ill. App. Ct. 1993)).
4. Sysco Mach. Corp. v. DCS USA Corp., 143 F.4th 222 (4th Cir. 2025) (affirming Rule 12(b)(6) dismissal where the complaint’s three definitions of the trade secrets, taken together, “suggest that nearly Sysco’s entire business is a trade secret”).
5. Abrasic 90 Inc. v. Weldcote Metals, Inc., 364 F. Supp. 3d 888, 899 (N.D. Ill. 2019) (denying preliminary injunction; the company’s only confidentiality guidance was a “vague, generalized admonition” that “did not define, delineate, or specify which information was considered confidential”).
6. Turret Labs USA, Inc. v. CargoSprint, LLC, No. 21-952, 2022 WL 701161 (2d Cir. Mar. 9, 2022) (summary order) (affirming dismissal where the complaint did not allege that the software licensee or its users were “required to keep Turret Labs’ information confidential”).
7. See Abrasic 90, 364 F. Supp. 3d at 899 (employee-handbook confidentiality clause was “too broad and vague to confer meaningful protection,” and the company “did nothing to train or instruct employees” on it).
