What is a trade secret, under the law?
Your company responds to tenders, security questionnaires, due diligence questionnaires (the DDQ a customer sends before awarding you a contract). Over the years, these answers form a library: your organization, your methods, your prices and how you build them, your customer references, your systems architecture, your contractual commitments. This library is what lets you respond fast and accurately. It is also, very likely, a trade secret under the law.
Trade secret law protects information that meets three cumulative conditions in most jurisdictions, a test that traces back to the international standard set by Article 39 of the TRIPS Agreement. Expressed in materially similar terms across jurisdictions, it reads:
> "Information is protected as a trade secret when it meets the following criteria: > 1. It is not, in itself or in the precise configuration and assembly of its components, generally known or readily accessible to persons within the circles that normally deal with that kind of information; > 2. It has commercial value, actual or potential, because it is secret; > 3. Its legitimate holder has taken reasonable steps, given the circumstances, to keep it secret."
The legitimate holder is the one who lawfully controls the information. Jurisdictions define trade secrets similarly, often following the same three-part logic, but with their own wording, burden of proof, and remedies: in the United States, the Defend Trade Secrets Act; in the United Kingdom, the Trade Secrets (Enforcement, etc.) Regulations 2018. The trade secret law applicable in your market should be verified.
This site does not give legal advice. It asks the question your own counsel should answer, and it asks it because that question is rarely raised at the moment it matters: when a tool is chosen.
Why does a library of answers meet the first two conditions?
First condition: the information is not generally known. Taken piece by piece, part of your library is public: your certifications, your headcount, your address. But the standard also covers "the precise configuration and assembly" of elements. How you describe your method, how you build a price, how you answer a security question about your architecture, is known to no one but you. That is exactly why a competitor would want to read it.
Second condition: commercial value because it is secret. The value of your library comes from your competitors not having it. A price list known to everyone is no longer an advantage. An answer to a security questionnaire that describes your controls and your weak points has value to you, and a different kind of value to someone who would want to attack you. A detailed customer reference, a deployment method, a service-level commitment: each is worth something because of what others do not know.
These two conditions are met by the very nature of the library. No one has to decide anything for them to be met.
The third condition is the one that depends on you
"Reasonable steps, given the circumstances." This is the condition a company meets, or does not meet, through its own actions. And it is the one the choice of an AI tool puts at stake.
Feeding your library of answers into a tool means entrusting it to that tool. The question is not whether the tool is useful; it is. The question is whether the circumstances of that trust still amount to a reasonable protective measure. Four points determine this, and each is found in the tool's contract terms, not its brochure.
| Protective measure | What it protects | The question to ask the vendor, contract in hand |
|---|---|---|
| Location of processing | The legal perimeter within which your answers exist | Where are your documents processed, not just stored, and under what law? |
| Use of the data | The exclusivity of your knowledge | Do your documents or answers serve to improve a model shared with other customers, even in aggregated form? |
| Reversibility | Control over time | At the end of the contract, is your data handed back in a reusable format, with everything derived from it (indexes, representations, logs, backups) deleted and certified? |
| Traceability | Proof that you took the measures | Can you establish, for every answer submitted, where it came from and who accessed it? |
A company that can answer these four questions precisely has taken protective measures, and can prove it. A company that cannot may have unknowingly weakened the third condition, and with it the protection of the whole.
On the Optivalue.ai platform, which publishes this site, the instance is private per customer and never shared across organizations; it is deployed in shared mode, on a private cloud, or on-premises, with hosting available in more than 80 countries, in the jurisdiction of your choice; and reversibility is contractual: handover in a reusable format, dated deletion covering derivatives, backups, and subcontractors, an auditable certificate, and a ban on using your data, even aggregated, for the benefit of other customers. Your documents stay with you, and you can prove it.
The concession that clarifies everything
Not all the data you feed into AI is a trade secret. Rephrasing an email, summarizing a public article, cleaning up meeting notes with no sensitive content: generic AI does this very well, and the question raised by trade secret law does not arise, because the first condition is not met.
The question arises at the precise moment you feed in the library itself: the accumulated answers, the prices, the methods, the descriptions of your systems. That is where the tool stops being a drafting assistant and becomes the custodian of what sets you apart. A draft commits no one. Your library does.
Three questions that draw the line
Before feeding your answers into a tool, three questions to ask your legal counsel and the vendor, in this order:
- What exactly does what we are feeding in contain? Make the list: prices and how they are built, methods, named references, security architecture, contractual commitments. If the list contains any of these, the first and second conditions of trade secret law are likely met.
- Do the vendor's terms let us claim we have taken reasonable measures? Location of processing, use of data, reversibility, traceability: the four rows in the table above, with the clause that covers each.
- Could we prove it in court or to an auditor? The third condition does not just call for measures; it calls for being able to establish that they were taken. A contract, an access log, a deletion certificate are evidence. A brochure is not.
Frequently asked questions
Is consumer-grade generic AI necessarily incompatible with trade secret protection? No. It all depends on the terms of use you agree to and what you feed into it. The question is not about the tool itself, but about the protective measures taken, given the circumstances. It is the contract terms and the content entrusted that answer this, not the tool's brand.
Does losing trade secret protection have concrete consequences? Trade secret law generally provides remedies against the unlawful acquisition, use, or disclosure of a secret (in the United States, under the Defend Trade Secrets Act; in the United Kingdom, under the Trade Secrets (Enforcement, etc.) Regulations 2018). If the third condition is no longer met, those remedies become uncertain. Your legal counsel is the right person to assess what that means for your situation.
Are our answers to security questionnaires affected? They particularly are. An answer to a security questionnaire describes your controls, your architecture, and often your gaps. Its commercial value comes from being secret, and its disclosure would also have a security consequence.
What is a clause worth that promises not to train a model on our data? It is worth what it covers. Check whether it extends to aggregated data, to derivatives (indexes, vector representations), to subcontractors, and to what happens after the contract ends. A clause covering all four is a protective measure; a clause covering only one leaves three doors open.
Does a private instance alone meet the third condition? It contributes to it, through location of processing, reversibility, and traceability. It does not remove the need for internal measures: access rights, logging, team awareness. The law refers to measures taken "given the circumstances": it is the whole picture that counts.
See a private instance handle your own documents, without them ever leaving
Bring a real tender, a security questionnaire, or a DDQ. You will see the extraction coverage, the sources cited to the page, and the gap analysis on your document, in an instance dedicated to you, not a prepared demo.
Sources cited
- Trade secret law (in the United States, the Defend Trade Secrets Act of 2016; in the United Kingdom, the Trade Secrets (Enforcement, etc.) Regulations 2018); the applicable rule in each market should be verified.
- Directive (EU) 2016/943 of 8 June 2016 on the protection of undisclosed know-how and business information against unlawful acquisition, use, and disclosure: EU law.