CIIAA for Founders: Protect Your IP from Inside Threats

Guest author: Carter Chojnacki, Associate Attorney at Michael Best

Founders ask us all the time: “When do I need an NDA? I want to pitch my business idea, but I am afraid investors, customers, or fellow entrepreneurs might steal it.” Most founders want a quick, clear answer about confidentiality agreements. Unfortunately, patent law, trade secrets, industry norms, and fact-specific nuances make a straightforward answer difficult. However, there is a twist. While founders often worry about outsiders, most overlook a far greater threat: the people already inside the company. One essential agreement protects against insider risk: the Confidential Information and Invention Assignment Agreement, or “CIIAA.”

What Is a CIIAA (Confidential Information and Invention Assignment Agreement)?

A CIIAA does two things. First, a CIIAA requires anyone who works for your company, let’s call them a “service provider,” (e.g., executives, employees, consultants, contractors, advisors, etc.) to keep company information confidential. Second, a CIIAA ensures that anything the service provider invents or creates while working for the company belongs to the company, not to them personally. Without a written agreement, a service provider may retain ownership of key company inventions and information. Also known as an IP protection agreement or employee invention agreement, a CIIAA is one of the most critical startup documents you'll oversee.

Why It Matters

Consider the difference between what outsiders see and what insiders know:

What Outsiders See	What Insiders Know
A fellow entrepreneur in your accelerator cohort hears your general business idea.	Your software developer knows exactly how your product is made down to a single line of code.
At a pitch event, you tell the audience how big your market is.	Your head of sales has access to your detailed customer and prospect lists.
At a tradeshow, you display a one-page poster.	Your executive assistant has access to thousands of sensitive company files.
A new vendor might hear that you have big growth plans.	Your advisor sees your actual strategic plans and deal pipeline for the next three months.
A customer might see you have a growing team.	Your operations executive knows the company only has six months of cash to make payroll.
A prospective investor sees your impressive résumé of inventions.	You, as the solo inventor, know whether you created the invention in connection with your start-up and whether the company even owns it.

CIIAA in Action: Real World Examples

Apple v. OpenAI. In July 2026, Apple sued OpenAI, alleging that former Apple employees misappropriated trade secrets after joining OpenAI. Central to the case is Apple’s Intellectual Property Agreement (IPA), which all Apple employees must sign as a condition of employment. The IPA serves as the legal equivalent of a CIIAA, and it prohibits employees from using or disclosing Apple’s proprietary information during or after employment and requires the return of all confidential materials upon departure. Apple alleges that former employees violated these obligations by retaining unauthorized access to Apple’s systems, downloading confidential engineering files, and sharing proprietary information with OpenAI while developing competing hardware products. The lesson: A signed CIIAA creates enforceable contractual obligations that provide the legal foundation to pursue claims for misappropriation of trade secrets and breach of contract against insiders who misuse confidential information, even after they leave the company.

The Facebook Origin Story. If you think disputes like Apple’s only happen to established companies, think again. Made famous by the hit movie The Social Network, Cameron Winklevoss, Tyler Winklevoss, and Divya Narendra claimed that Mark Zuckerberg stole the idea for Facebook while they were all students at Harvard. They alleged that Zuckerberg was brought in to help program their competing social networking site, ConnectU, sharing code and confidential business plans. Zuckerberg and Facebook, in turn, counter-sued for other claims. After contentious litigation across multiple courts over several years, the parties eventually signed a settlement agreement, with the Winklevosses receiving cash and Facebook stock in exchange. The lesson: Insider risks arise at the earliest stages of company formation, and proper agreements, such as CIIAAs, create predictability about ownership and confidentiality from the outset, potentially avoiding years of costly litigation.

The Core Components of a CIIAA

A well-drafted CIIAA typically covers several essentials:

• Confidentiality. Obligates the service provider to protect company information during and after the engagement.

• Invention Assignment. Ensures that inventions and creative works made in connection with the engagement belong to the company.

• Disclosure of Prior Inventions. Requires service providers to list any inventions they created before joining that they want to exclude. This protects both the service provider’s pre-existing work and the company from later disputes.

• Return of Property. Requires that all files, devices, and materials go back to the company at departure.

Additional provisions may include non-competes, non-solicits, arbitration clauses, and injunctive relief provisions. However, the enforceability and legal requirements of these provisions vary by state, so an attorney should review them.

A well-drafted CIIAA protects your startup's most valuable intellectual property and prevents costly founder disputes down the road.

Common Mistakes Founders Make

The most common mistake is not using a CIIAA at all. The second is using one only for certain service providers, such as full-time employees, while contractors, advisors, and co-founders sign nothing. The third is relying on an outdated template that does not reflect current law, which may render the CIIAA unenforceable. CIIAA coverage is also a routine due diligence item in venture financings and exit sales, and missing signatures can delay or derail a deal.

Your Actionable Checklist

• Confirm every current and former service provider (including employees, contractors, consultants, and advisors) has signed a CIIAA.

• Confirm your templates comply with current law in the states where each service provider resides and where the company operates.

• Confirm your invention assignment language is legally sufficient to transfer property rights.

• Maintain contact information for all current and former service providers to track down any missing CIIAAs.

• Consider making other onboarding agreements (offer letters, stock option grants, etc.) contingent on the service provider signing the CIIAA.

When to Call a Lawyer

The best time to call a lawyer is during the initial setup of the company, before you onboard co-founders and early team members. An attorney can help you get onboarding documents right from the beginning. If you are already further along, it is never too late to audit your existing agreements and close any gaps.

Have a question or topic for Carter to cover? Send it to Beth at beth@startingblockmadison.org

The views expressed in this post are those of Carter Chojnacki and Beth Ott as individuals and are not meant to represent the views of their respective organizations, Michael Best & Friedrich LLP and StartingBlock Inc. Nothing in this blog post should be construed as specific legal advice. Please consult an attorney for advice specific to your situation.