A secret you cannot prove is not a secret

Many startups I meet own something worth more than the patents they never filed: know-how. How they train a model, the list of the right suppliers, the parameters of a process, the terms they negotiated with a client. Almost none of them really protect it.

Not because they do not know it exists. Because they think keeping it confidential is enough.

What the law says

Directive (EU) 2016/943 treats information as a trade secret when it has three features: it is secret, it has commercial value because it is secret, and it has been subject to reasonable steps to keep it secret. In Italy the rules sit in Article 98 of the Industrial Property Code, updated in 2018 to implement the directive.

The third requirement is where cases are lost. It is not enough for the information to be confidential in practice. You must be able to prove you protected it, with measures suited to the circumstances.

The same pattern exists in the US, where the Defend Trade Secrets Act of 2016 requires "reasonable measures", and in the UK, which implemented the directive in 2018 and kept those rules after Brexit. If you operate across markets, you at least get this advantage: the logic is the same.

Where it breaks

In practice, secrets are lost at predictable moments. A key employee leaves. A pitch to an investor with no NDA, or with a generic NDA that does not say what is confidential. A shared folder whose access rights nobody has ever reviewed. A supplier receiving technical specs without proper clauses.

In each case, before a judge, the question is not "was it a secret?". The question is "what did you do to protect it, and can you prove it?". If the answer is a policy written three years ago and never applied, the case is uphill.

Protection is a process

That is why I think trade secrets should also be treated as compliance that runs, not as a document. Three things are needed.

An inventory: knowing which information is truly strategic. Not everything is secret, and treating everything as secret amounts to protecting nothing.

Proportionate, tracked measures: access, agreements, training, with dates and owners.

Proof on hand: the ability to reconstruct, within a day, who had access to what and under which constraints.

This is the problem Trade Secret OS was built for. But the point holds even without software: if you cannot list your secrets, you cannot expect a court to recognise them.

For a startup there is also negotiating value. In due diligence, a well-kept inventory of protected know-how is an asset. A vague "we trust our people" is a risk the investor will take off the price.