Research record: Protecting trade secrets with dated records

Protecting Trade Secrets With Dated Records

A dated record can support trade-secret protection, but it is not trade-secret protection by itself. The useful question is not simply, “Can I put a file on a blockchain?” It is, “Can I show what confidential information I controlled, when a particular version existed, and what reasonable steps I took to keep it secret?”

A timestamped fingerprint helps with one part of that record. It can support the existence and integrity of a specific digital file at or before a recorded time. The rest of the case still depends on confidentiality practices, access records, contracts, and the facts of the dispute.

What trade-secret protection actually requires

The details differ across legal systems, but the core idea is consistent. WIPO describes a trade secret as information that is commercially valuable because it is secret, known only to a limited group, and subject to reasonable steps to keep it secret . The EU Trade Secrets Directive uses a similar three-part definition: the information must not be generally known or readily accessible, it must have commercial value because it is secret, and the lawful controller must have taken reasonable steps to keep it secret .

That can include a formula, manufacturing process, source code, product design, supplier list, pricing model, research result, or combination of information. The label alone is not enough. A document marked “confidential” may help communicate expectations, but the organisation also needs practices that match the sensitivity of the information.

Common measures include:

• limiting access to people who need the information for their work;

• using confidentiality agreements with employees, contractors, suppliers, customers, and potential partners where appropriate;

• marking files and folders as confidential;

• applying technical access controls and keeping useful access records;

• training people on how confidential information must be handled; and

• reviewing access when an employee, contractor, or business relationship ends.

Where dated records fit

A trade-secret programme usually has two different evidence questions.

The first is a confidentiality question: what steps did the organisation take to restrict access and communicate the obligation not to disclose or misuse the information?

The second is a content-and-time question: what exactly did the confidential material contain at a particular point in time, and had that version changed later?

A dated cryptographic fingerprint mainly addresses the second question. A cryptographic hash is a fixed-length value calculated from a file’s contents. If the file changes, the hash changes. Comparing the file later with the preserved reference can therefore show whether the file is the same byte-for-byte version that was recorded.

WIPO explains that digital timestamping can help establish the existence, integrity, and possession of digital content at a specific point in time . It also describes blockchain timestamping as recording a document’s cryptographic hash with a timestamp, without placing the underlying document on the public ledger. That distinction matters for confidential information: the record can refer to a file without publishing the file’s contents.

This is evidence of a particular state of a file. It is not a public disclosure of the secret, and it is not a substitute for protecting the file itself.

The USPTO describes these measures as examples rather than a universal checklist. What is reasonable is assessed in context, including the nature and value of the secret and the organisation’s circumstances.

A practical workflow for confidential files

1. Identify what needs protection

Start with an inventory of information that gives the business an advantage because it is not generally known. Separate genuine trade-secret candidates from ordinary business records. Record a short internal description, the business owner, sensitivity level, and the people or teams who need access.

This step creates context that a standalone timestamp cannot provide. It can also help the organisation apply stronger controls to the most valuable material instead of treating every file identically.

2. Prepare the file without exposing it unnecessarily

Create a stable version of the material that you intend to preserve. For example, this might be a signed-off technical specification, a source-code archive, a research result, or a version of a process document prepared before a partner meeting.

Keep the original in a controlled location. Avoid editing the file after recording it. If the material is a collection of files, use an agreed archive format and retain the archive exactly as recorded. Keep any version number or internal reference in a separate record as well, because a hash does not explain the business context of the file.

3. Create a dated fingerprint

A service such as Certelo can calculate a SHA-256 fingerprint locally in the browser. The original file is not uploaded merely to create the proof; the resulting fingerprint is anchored to the Electra Protocol blockchain .

The practical privacy benefit is narrow but important: the service can receive the fingerprint rather than the underlying confidential file. The hash does not function as a replacement for encryption, access control, or secure storage. It is a way to create a reference for the exact file contents.

Record the certificate or transaction information with the internal matter, project, or version identifier. Keep enough surrounding documentation for another person to understand which file was recorded and why.

4. Preserve the evidence bundle

Keep the following together under an appropriate retention policy:

• the untouched original file;

• the certificate, hash, or blockchain reference;

• the internal description and version identifier;

• the list of authorised users or relevant access records;

• applicable confidentiality agreements and disclosure approvals; and

• communications showing when, why, and to whom the material was shared.

The bundle is stronger than any single item. The timestamp can support the timeline, while the surrounding records help connect the file to a project, organisation, custodian, and controlled disclosure.

5. Share only under controlled conditions

Before sending the material to a prospective partner, investor, supplier, employee, or contractor, confirm that the recipient should receive it and that the confidentiality terms are appropriate. Use the least detailed version that allows the business discussion to proceed. Keep a record of what was shared, when it was shared, under which agreement, and through which channel.

A dated record should normally be created before disclosure, not after a disagreement begins. It cannot undo a public disclosure or repair a weak access-control process.

6. Verify the version if a question arises

If the file later needs to be reviewed, calculate its SHA-256 fingerprint again and compare it with the recorded value. Certelo’s verification page says verification can use the original file or its hash and can check the result against the blockchain record.

A matching result supports the proposition that the supplied file is the same version associated with the recorded time. A mismatch shows that the supplied bytes do not match the reference. It does not, by itself, explain whether the file was deliberately edited, converted by software, corrupted, renamed incorrectly, or replaced with another version.

What Certelo can and cannot add

Certelo is relevant when the problem is preserving a dated reference without uploading the confidential document. Its current product description says that hashing occurs locally in the browser using SHA-256, that the original file remains on the user’s device, and that the fingerprint is anchored to the Electra Protocol blockchain . The resulting record can be checked using the relevant file, hash, or certificate information .

That can support an evidence trail for a technical specification, source-code archive, formula document, research file, or other digital artefact. It can be especially useful before a controlled disclosure, when the organisation wants a contemporaneous record of the version it held.

Certelo does not establish who created the file, who owns the underlying rights, whether the information is original, or whether the information qualifies as a trade secret under a particular law. It does not prove that no other person had the same idea or developed similar information independently. Certelo’s own compliance guidance also says that the proof is evidence, not legal representation, and that evidentiary treatment varies by jurisdiction.

A pre-disclosure checklist

Before sharing a confidential digital file, ask:

1. Have we identified why this information is commercially valuable and confidential?

2. Have we limited access to people who need it?

3. Are the relevant confidentiality obligations in place?

4. Is this the exact version we intend to preserve and share?

5. Have we retained the original in a controlled location?

6. Would a dated fingerprint help us distinguish this version from later versions?

7. Have we recorded the certificate or blockchain reference with the internal file record?

8. Have we documented what will be shared, with whom, when, and under what terms?

9. Can we later explain who controlled the file and how it was handled?

10. Do we need advice from counsel in the relevant jurisdiction before disclosure or enforcement?

The central principle is simple: protect the secret first, then document it. A dated, independently checkable fingerprint can strengthen the timeline and integrity portion of that documentation without putting the original file on a public blockchain. It works best as one layer in a broader trade-secret programme, not as a promise that a dispute will be easy or that a legal right exists automatically.

If you need a privacy-first dated reference for a specific digital version, Certelo can create a SHA-256-based blockchain proof while the original remains on your device. Preserve the original and the surrounding confidentiality records, and obtain jurisdiction-specific legal advice when the commercial or legal stakes justify it.