Skip to main content ホーム クリエイター thomasmoreai legal-skills-open confidentiality-security-agreement
confidentiality-security-agreement Drafts enforceable U.S. Employee Confidentiality and Security Agreements protecting proprietary information, trade secrets, and digital assets, with layered confidential-information definitions, security and acceptable-use obligations, incident reporting protocols, termination property-return procedures, and post-employment restrictive covenants. Incorporates state-specific enforceability standards, DTSA whistleblower immunity notice, and NLRA Section 7 savings clauses. Use when onboarding employees, updating confidentiality policies, or drafting NDA-style employment agreements (trigger keywords: confidentiality agreement, employee NDA, security agreement, trade secret, acceptable use, incident reporting, post-employment restrictions).
インストールへ移動 Skills Marketplace コミュニティが作成したAIスキルを発見・探索
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill confidentiality-security-agreementコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Zipをダウンロード ダウンロード中... このリポジトリの他の Skills fetching-arbitration-rules Use when retrieving arbitration institutional rules (ICC, LCIA, SCC, SIAC, HKIAC, VIAC, МКАС/МАК при ТПП України, UNCITRAL) — fetching current version, verifying redaction applicable to the date of arbitration agreement, constructing URLs for official rule texts
determining-pl-request-regime Use when choosing the Polish legal regime for letters, requests, applications, complaints, petitions, public-information requests, KPA filings, PPSA complaints, RODO access requests, registry extracts, court-file access, tax/ZUS/cudzoziemcy/USC procedures, or professional lawyer letters. Prevents mixing UDIP, KPA, PPSA, RODO, registry, special-procedure, and advocate/radca letter regimes.
applying-new-york-convention Use when preparing applications for recognition and enforcement of foreign arbitral awards in Poland, applications for setting aside arbitral awards under KPC art. 1205–1211, or opposing such applications — mapping Article V of the 1958 New York Convention to art. 1214–1215 of the Polish KPC, identifying grounds for refusal, structuring public policy arguments
name confidentiality-security-agreement title Employee Confidentiality and Security Agreement description Drafts enforceable U.S. Employee Confidentiality and Security Agreements protecting proprietary information, trade secrets, and digital assets, with layered confidential-information definitions, security and acceptable-use obligations, incident reporting protocols, termination property-return procedures, and post-employment restrictive covenants. Incorporates state-specific enforceability standards, DTSA whistleblower immunity notice, and NLRA Section 7 savings clauses. Use when onboarding employees, updating confidentiality policies, or drafting NDA-style employment agreements (trigger keywords: confidentiality agreement, employee NDA, security agreement, trade secret, acceptable use, incident reporting, post-employment restrictions). author CaseMark author_url https://github.com/CaseMark/skills/tree/main/skills/legal/confidentiality-security-agreement license Apache-2.0 version 0.1.0 execution_mode open jurisdiction us practice employment language en tags ["agreement","drafting","regulatory"]
Employee Confidentiality and Security Agreement
Drafts an execution-ready agreement protecting company proprietary information, trade secrets, and digital assets while establishing employee security obligations and post-employment restrictions.
Checkpoint A: Pre-Draft Intake (Mandatory)
Ask every time unless user says "use defaults." Gather:
Governing jurisdiction — state law for restrictive covenants, trade secret protections, consideration requirementsCompany documents — existing confidentiality agreements, handbooks, security policiesEmployee role — position, access level, exposure to sensitive systems/dataIndustry context — regulated industries (healthcare, finance, defense) need sector-specific provisionsExisting restrictive covenants — prior agreements that must be harmonized
If user doesn't respond , apply and label defaults: at-will employment state; general staff access level; 3-year non-trade-secret duration; 1-year non-solicitation; governing law per company's home state.
Intake Table
Item Details Company (legal name/entity/state) Employee (name/title/department) Governing jurisdiction Access level (general / elevated / executive) Regulated industry? (specify) Existing agreements to harmonize Post-hire execution? (additional consideration needed)
Pre-Drafting Research
Area Key Items State enforceability Restrictive covenant standards, blue-pencil vs. reformation, consideration requirements Trade secret law UTSA adoption, state statutes, DTSA federal protections Employee mobility Non-compete bans/restrictions, NLRA § 7 protections, whistleblower statutes Data protection State privacy acts, HIPAA, GLBA, CMMC (if defense) Recent case law Reasonableness standards for scope/duration in governing jurisdiction
Step 1: Draft Confidential Information Provisions
Definition — Layered Category Approach Category Examples Technical/Proprietary Trade secrets, source code, algorithms, R&D, manufacturing processes Business Strategy Business plans, pricing, margins, financial projections, M&A targets Customer/Relationship Customer lists, supplier networks, contract terms, referral sources Financial/Operational Financial statements, budgets, compensation structures, performance metrics Intellectual Property Inventions, patents, copyrights, trademarks, proprietary methodologies
Cover all formats: written, oral, electronic, visual
Include derivative works (analyses, compilations, summaries)
Protection applies regardless of whether marked "confidential"
Standard Exceptions Employee bears burden of proof (clear and convincing evidence):
Already public at disclosure (not through employee's breach)
Lawfully in employee's possession pre-disclosure (documented)
Received from third party without restriction
Independently developed without reference to Confidential Information (contemporaneous documentation required)
Obligations
Non-disclosure without prior written authorization from authorized officer
Duration: indefinite for trade secrets; [3–5] years for other Confidential Information
Use limited to assigned duties within employment scope
Standard of care: at least reasonable care, no less than employee's own
Need-to-know restriction; internal sharing only to authorized personnel under equivalent obligations
Secure storage: encryption (electronic), locked storage (physical), secure disposal
Immediate incident notification to security officer/legal
Compelled Disclosure Carve-Out Immediate notice to legal on receipt of subpoena/court order → cooperate with protective order efforts → disclose only what is legally required.
Protected Activity Savings Clause (REQUIRED)
DTSA immunity for disclosures to attorneys/government officials in confidence
Whistleblower cooperation protections
NLRA § 7 rights preserved (wages, working conditions)
Step 2: Draft Security Responsibilities
Password and Access Control
Personal credentials; never shared
Minimum: 12+ characters, mixed case/numbers/symbols, unique per system
No plaintext storage; company-approved password managers only
MFA required on all available systems
Lock workstations when unattended; log out of sessions
Report compromised credentials immediately
All access terminates upon separation
Acceptable Use Permitted Prohibited Primary business use of company systems Unauthorized software/extension installation Limited personal use (non-interfering) Circumventing security controls or monitoring Professional communications via company tools Unauthorized devices on company networks Illegal, explicit, or infringing content Competitive activities on company systems Company data on unapproved personal cloud
BYOD (if applicable): company MDM required, remote wipe consent, security software mandatory
Remote access: approved VPN only; adequate privacy at remote locations
No expectation of privacy on company systems — monitoring may occur without notice
Incident Reporting Protocol Reportable: data breaches, unauthorized access, malware, phishing, lost/stolen devices, inadvertent disclosure, suspicious behavior, physical security breaches.
Report to IT security + direct supervisor within [2–4] hours of discovery
Preserve all evidence — no deletion, alteration, or destruction
Document: what happened, when discovered, systems/data affected, actions taken
Maintain incident confidentiality; share only with authorized personnel
Follow incident response team instructions
Non-retaliation: Good faith reporting carries no negative consequences, even if incident resulted from employee's error.
Step 3: Draft Termination and Post-Employment Provisions
Return of Property (immediately upon termination or earlier upon request) Company rights: inspect workspace/devices, remotely wipe MDM-enrolled devices, pursue legal remedies.
Survival of Obligations Obligation Duration Trade secret confidentiality Indefinite (while information qualifies) Other Confidential Information [3–5] years post-termination Employee non-solicitation [1–2] years (jurisdiction-dependent) Customer non-solicitation [1–2] years, material-contact customers only
Non-solicitation = active solicitation only; does not bar accepting competitor employment or responding to unsolicited inquiries
Employee must notify prospective employers of continuing obligations
Employee must notify company of new employment (employer, general responsibilities)
Cooperation: respond to legal process, assist with litigation/investigations, provide truthful testimony (reasonable compensation for time)
Step 4: Draft Legal Framework
Acknowledgments (employee confirms)
Read and understood; opportunity to consult counsel
Voluntary execution without duress
Restrictions reasonable in scope, duration, and geography
Confidential Information is valuable; unauthorized disclosure = irreparable harm
Adequate consideration received
For post-hire execution: specify additional consideration (promotion, raise, bonus, or continued employment per jurisdiction) [VERIFY]
Protected Rights Acknowledgment (REQUIRED)
DTSA immunity per 18 U.S.C. § 1833(b) [VERIFY]
Whistleblower protections: unrestricted government agency reporting
NLRA § 7: right to discuss wages and working conditions
Enforcement Provisions
Governing law: [state], no conflicts-of-law principles
Exclusive venue: state and federal courts in [county/state]
Equitable relief available without bond or proof of actual damages
Prevailing party: reasonable attorneys' fees, costs, expert fees
Severability with reformation to minimum enforceable scope
Integration clause; supersedes prior understandings on subject matter
Amendment: written, signed by both parties; no oral modifications
Assignment: company may assign (merger/acquisition/sale); employee may not
Supplements (does not replace) other confidentiality/IP agreements — most protective provision controls
Signature Block Employee signature, printed name, date; authorized company representative signature, title, date. Separate acknowledgment page optional.
Step 5: Assemble Agreement in Section Order
Parties, Recitals, and Effective Date
Confidential Information — definitions, categories, exceptions, obligations, compelled disclosure carve-out, protected activity savings clauseSecurity Responsibilities — access control, acceptable use, incident reporting, non-retaliationTermination and Post-Employment — property return, survival of obligations, non-solicitation, cooperationLegal Framework — acknowledgments, protected rights, enforcement, severability, integrationSignatures
Checkpoint B: Post-Draft Alignment (Mandatory) After delivering the initial draft, ask:
Are the confidential information categories appropriate for this employee's role and access level?
Are the non-solicitation durations acceptable given the governing jurisdiction?
Is additional consideration needed for post-hire execution?
Should BYOD or remote-work provisions be included or expanded?
If user doesn't answer, recommend confirming non-solicitation scope and post-hire consideration (highest-risk decisions) and proceed if authorized.
Quality Audit Before finalizing, verify:
Guidelines
Jurisdiction calibration is critical — non-compete/non-solicitation enforceability varies by state; CA, CO, MN, OK, ND broadly restrict or ban non-competes [VERIFY current status]Consideration requirement — many jurisdictions require independent consideration beyond continued employment for post-hire agreements [VERIFY]Blue-pencil vs. reformation — know whether the jurisdiction modifies overbroad restrictions or voids them entirelyDTSA notice — employers must provide DTSA whistleblower immunity notice in any trade secret agreement (18 U.S.C. § 1833(b)) [VERIFY]NLRA compliance — confidentiality provisions must not chill Section 7 rightsRole-based customization — adjust categories, security requirements, and restriction durations to employee access level and seniorityDo NOT include non-compete provisions unless specifically requested and confirmed enforceable
Do not fabricate statutory citations, case law, or enforceability standards
All outputs require attorney review in the governing jurisdiction 