Trade Secrets in the Age of Vector Databases

Trade secret protection depends on reasonable steps to keep information secret. Embedding that information into a vector index creates a derived copy that most confidentiality programmes were not written to cover.

What an embedding is, legally speaking

A numerical representation of a passage, generated so that similar meanings sit close together in a high-dimensional space. It is not the text, and it is not readable by a person. It is also not a one-way function in any strong sense: inversion research has repeatedly shown that substantial portions of source text can be reconstructed from embeddings, particularly with knowledge of the embedding model.

The practical conclusion: treat an embedding of confidential material as confidential material. The alternative — treating it as anonymised derived data — is a position that has not been tested and would be uncomfortable to argue.

Where the exposure appears

• Vector stores hosted in a different environment, or by a different vendor, from the primary document store, frequently with weaker access controls.
• Indices that are not deleted when the source document is deleted — the most common gap we find in technical reviews.
• Shared indices across tenants or business units, where retrieval can surface a passage to someone with no right to the underlying document.
• Third-party embedding APIs, where the text is transmitted to the provider and retention terms are set by their standard agreement.

Reasonable steps, updated

Access controls that apply to retrieval results, not only to documents: if a user cannot open the document, retrieval must not return its passages. Deletion that cascades to the index. Encryption of the vector store with keys under your control. Contractual terms with embedding providers covering retention, training use and deletion. And an inventory that records where confidential material has been embedded, which most organisations do not have.

Contract drafting

Definitions of Confidential Information should expressly cover derivatives, representations and other machine-readable transformations. Return-and-destroy obligations should reference derived artefacts explicitly. Neither is difficult to draft; both are absent from the majority of NDAs currently in circulation.