A large company in our space says they want to acquire my startup and wants to do diligence on us. This company has a reputation for not closing deals and stealing IP from startups. I am worried they just want some free intelligence on our business which they can use to compete against us.

Your concern is a real issue and I have even lived through a situation where a larger company used the cover of an acquisition as part of a scheme to steal my startup’s technology (allegedly), which resulted in years of litigation. Yet, no buyer will purchase you without understanding your business thoroughly.

Let me address legal remedies first. You can pretty much forget any criminal remedies. State and federal authorities are overwhelmed, unqualified, easy to fool, indifferent, and almost entirely useless in protecting startups in cases of industrial espionage, so you will need to create your own protections here. (As a taxpayer and someone who still clings stubbornly to the idea of justice, I hope one day to be proven wrong in what I just wrote.)

You should have a special non-disclosure agreement and process when dealing with potential acquirers who may be fishing for your secrets. There are more aggressive terms which can be inserted in NDAs to address likely trade secret theft claims, including jurisdiction, choice of law, specialized arbitration, and even waivers of certain legal barriers (such as California’s Code of Civil Procedure § 2019.210, which is an industrial espionage felon’s best friend). You should also ensure your NDA addresses all proper parties, including subsidiaries and foreign affiliates of the buyer.

Your NDA should prohibit the buyer from hiring your employees. From a process standpoint, never let key talent meet with the potential buyer alone and never provide compensation information about your talent in identifiable format, at least at the early stages. (In the story I mentioned above, it was our refusal to permit the buyer to meet our engineers alone which caused the buyer to go around us to our engineers directly, so these contractual prohibitions are only as good as the ethical standards of everyone involved.) Depending on what your company does, you should also prohibit the buyer from using any of your contractors and manufacturing facilities, especially if you make things in places with weaker IP laws, like China.

You can consider adding an enhanced non-use provision, which can, for example, restrict the buyer from reverse engineering your technology or developing competitive products and IP for a period of time, although almost all buyers will balk at any such restrictions. You should certainly “gate” the revelation of any significant IP and other sensitive information until further into the process, once you have established the seriousness of the buyer. If you have the leverage, you might insist on a breakup fee if a deal fails to close, but such terms are rare for startups to get.

In situations where my companies dealt with notorious IP thieves, we also proactively created thickets of provisional patent applications to (a) address the combinations of our technology with the buyer’s potential product strategy, and (b) block all significant ways the potential buyer might commercialize technology in our space.

You can restrict what information the buyer is able to have in its possession, or even whether the buyer has to use a reputable third party for certain issues so it never receives some information itself. You can also insist on strong protections to ensure the destruction of information if the sales process terminates.

In the end, legal remedies are only partially effective, as a company motivated to steal will not be deterred and will have the legal resources to bury you in any litigation. If you are at the point where you are considering the steps I outlined above, query whether you even want to be doing business with this company. After all, in a successful acquisition, you and your key talent will likely be working there for some time. The sad truth is there are many companies with dubious ethics, and many parts of the world where respect for intellectual capital is spotty at best. Life is too short to work for any of them, in my view.

See also: 2.103: Driving Innovation Through IP Strategy