Non-Compete Violation Investigation & Evidence

Proving a non-compete or non-solicitation violation requires lawfully gathered, admissible evidence, not suspicion. Licensed investigators combine public-records research, digital-footprint and open-source analysis, forensic examination of company-owned devices, and, where warranted, discreet surveillance to document where a former employee now works, what they took, and whom they are soliciting. Assembled correctly, that record survives a courtroom challenge and supports injunctive relief such as a temporary restraining order.

A restrictive covenant is only as strong as the proof that it was broken. General counsel and business owners routinely learn that a key salesperson has decamped to a rival, or that a departing engineer is quietly standing up a competing venture, and their instinct is to reach for the signed agreement. But courts do not enjoin conduct on the strength of a contract and a hunch. They require a factual showing — who is doing what, where, with which customers, and using whose confidential information — developed through evidence that was obtained legally and can be authenticated. This guide is written for the general counsel, business owner, or litigation team that suspects a breach and needs to understand exactly what a disciplined, defensible investigation looks like in the window that matters.

Why does enforcement now turn on evidence, not just contract language?

The evidentiary burden has grown heavier as the enforceability of non-competes has become contested terrain. Judges scrutinize these agreements closely, and a plaintiff who arrives with a thin record — or worse, with evidence gathered through hacking, illegal surveillance, or pretext — can lose the case and inherit counterclaims. The discipline described below is how elite investigative firms convert a suspicion of breach into a litigation-ready file: lawful collection, rigorous documentation, and a chain of custody built for a courtroom from the first hour.

The order of operations matters as much as the tools. A serious inquiry resolves the legal theory first, exhausts clean open-source and public-records channels before anything intrusive, and preserves company-owned digital evidence early, because that evidence decays and is destroyed by routine IT offboarding. Speed and discipline in that window are what separate a provable claim from an unenforceable accusation.

Are non-competes even enforceable anymore? The shifting legal landscape

The enforceability question is the first thing a competent investigation resolves, because it dictates what is worth proving. In April 2024 the Federal Trade Commission issued a rule that would have banned most employee non-competes nationwide. That rule never took effect: a federal court in Texas set it aside on a nationwide basis in August 2024, and the Commission subsequently stepped back from it. The practical result is that non-competes remain governed almost entirely by state law, which varies dramatically from one jurisdiction to the next. The FTC’s own non-compete rulemaking record remains a useful reference for the policy debate, but it is not enforceable law.

A handful of states void most employee non-competes outright. Others permit them only above an income threshold or with specific notice. The majority still enforce them where the restriction is reasonable in scope, geography, and duration and protects a legitimate business interest. Crucially, even in states that ban non-competes, non-solicitation, confidentiality, and trade-secret obligations usually survive — so a violation investigation often pivots from “where is she working” to “what did she take and whom is she soliciting.”

Jurisdictional posture	Representative states	What it means for the investigation
Broad ban on employee non-competes	California, North Dakota, Oklahoma, Minnesota (agreements after July 1, 2023)	Focus shifts to trade-secret theft, non-solicitation, and confidentiality breaches, which generally remain actionable.
Enforceable above an income / notice threshold	Washington, Oregon, Illinois, Colorado, Maine, Virginia	Confirm compensation level and notice compliance before investing in a full breach investigation.
Enforceable if reasonable (traditional standard)	Florida, Texas, Georgia, most other states	Build a record on scope, geography, duration, and the legitimate interest protected.
Federal layer	FTC rule vacated in 2024; no federal ban in force	Rely on state law and federal trade-secret statutes such as the Defend Trade Secrets Act.

Because the landscape keeps moving, an investigation should be scoped in coordination with counsel who can confirm the current rule in the governing jurisdiction. The Defend Trade Secrets Act of 2016 added a powerful federal civil cause of action for trade-secret misappropriation that runs in parallel with state law — often the stronger claim when a non-compete’s enforceability is doubtful. The Uniform Trade Secrets Act, adopted in some form by nearly every state, supplies the parallel state-law claim.

What does a violation actually look like?

Before mobilizing surveillance or forensics, an investigator maps the specific conduct the agreement prohibits and looks for observable indicators. The most common breach patterns include:

• Direct competition. The former employee has joined, or quietly formed, a competing company — sometimes concealed behind a spouse’s name, a shell LLC, or a “consulting” arrangement.
• Customer and client solicitation. Former accounts migrate to the new employer within weeks; clients report being contacted with insider knowledge of pricing or renewal dates.
• Employee poaching. A coordinated departure of a team, or recruiting messages sent to current staff.
• Trade-secret and data misappropriation. Mass downloads before resignation, USB transfers, forwarding files to personal email, or cloud-sync exfiltration of customer lists, pricing models, and source code.
• Concealment. A deliberately vague professional profile, use of an intermediary, or false statements at the exit interview about future plans.

Each pattern points to a different evidence source. Concealed employment is often exposed through public records and surveillance; data theft is proven through digital forensics; solicitation is corroborated by customers and communications. A serious inquiry pursues several tracks in parallel and lets them converge on a single, documented narrative.

How do investigators lawfully gather the proof?

Elite firms follow a repeatable sequence that prioritizes legally clean, low-visibility sources first and escalates to intrusive methods only when justified and lawful. The order matters: moving to surveillance before the paper trail is exhausted wastes budget and risks tipping off the subject.

1. Fix the legal theory with counsel. Confirm which covenant applies, whether it is enforceable in the governing state, and exactly what facts would satisfy the elements. This defines the evidence you actually need and keeps the work proportionate.
2. Public records and corporate intelligence. Secretary-of-state business filings, DBA and LLC registrations, fictitious-name statements, professional licenses, court dockets, property records, and vendor registrations frequently reveal a competing entity the subject tried to hide. This is fully lawful, open-source, and often decisive.
3. Digital footprint and open-source research. Analysis of public professional profiles, company websites, press releases, job postings, archived web pages, business directories, and social media documents the new role, the pitch to customers, and the timeline — captured with metadata and timestamps for authentication.
4. Forensic examination of company-owned assets. With proper authorization, examiners image the former employee’s company laptop, phone, and email and analyze USB-insertion artifacts, cloud-sync logs, mass-download events, and deleted files to prove what data left the building and when. This is the backbone of a trade-secret claim.
5. Discreet physical surveillance where warranted. Licensed investigators can observe activity in public — confirming the subject reporting to a competitor’s office, meeting known clients, or working a trade show — documenting it with time-stamped, unaltered footage and detailed logs.
6. Witness and customer corroboration. Structured, lawful interviews of remaining employees and cooperating customers turn circumstantial patterns into direct testimony about solicitation.
7. Documentation and chain of custody. Every artifact is logged, hashed where digital, and preserved so it can be authenticated and, if needed, defended under a Daubert challenge by a qualified expert.

Where are the legal lines on admissibility and pitfalls?

The fastest way to lose a non-compete case is to gather evidence illegally. Unlawful collection can render proof inadmissible, expose the client and the investigator to civil and criminal liability, and hand the defendant a sympathetic counterclaim. The following boundaries separate a professional investigation from an amateur — or reckless — one:

• No unauthorized computer access. Logging into the subject’s personal email, cloud account, or social media without authorization can violate the federal Computer Fraud and Abuse Act and the Stored Communications Act. Investigators work only company-owned systems the client is entitled to access, and only public online sources otherwise.
• Recording and wiretap law. Many states require all-party consent to record conversations. Intercepting calls, messages, or voicemail is prohibited. Surveillance is limited to observing what is visible in public.
• GPS tracking restrictions. A number of states criminalize placing a tracking device on a vehicle the client does not own. Location is established through lawful physical surveillance, not covert trackers, unless a statute and ownership clearly permit it.
• No pretexting for protected data. Obtaining financial or phone records through deception is unlawful; the Gramm-Leach-Bliley Act specifically bars pretexting for financial information. Investigators do not impersonate the subject to extract private records.
• No trespass or intrusion on privacy. Surveillance stops at the property line and at any reasonable expectation of privacy; there is no photographing through windows or entering non-public areas.
• Proper licensing and forensic soundness. Physical investigation and surveillance require a licensed investigator in the jurisdiction, and digital evidence must be collected using validated tools and documented methods so it authenticates and withstands expert cross-examination.

Handled correctly, these constraints are not obstacles — they are what makes the resulting evidence usable. A judge weighing a request to enjoin someone’s livelihood pays close attention to how the proof was obtained. Clean provenance is persuasive; tainted provenance is fatal.

How is the file built to support litigation and injunctive relief?

Non-compete and trade-secret disputes are usually won or lost in the first weeks, when the plaintiff seeks a temporary restraining order or preliminary injunction to halt the conduct before customers and secrets are permanently lost. That posture demands speed and a tightly evidenced showing of likely success and irreparable harm. A well-run investigation is engineered to feed that motion directly:

• A declaration-ready timeline. Findings are organized chronologically — resignation, data movement, new employment, first solicitation — so counsel can drop them into a sworn declaration.
• Authenticated exhibits. Screenshots, filings, and surveillance footage are captured with metadata and custody records so each can be admitted without a foundation fight.
• Forensic reporting that anticipates Daubert. Data-exfiltration findings are documented by an examiner who can testify to methodology, tools, and error rates.
• Support for expedited discovery. The investigation identifies the specific devices, accounts, and custodians worth targeting, making early discovery requests precise rather than a fishing expedition.
• Damages foundation. Documented customer migration and misappropriated assets underpin later claims for lost profits, unjust enrichment, or — under the Defend Trade Secrets Act — exemplary damages and fees in appropriate cases.

The investigator’s job is not to render legal conclusions; it is to hand counsel a clean, corroborated, admissible factual record fast enough to matter. Federal and state courts publish their procedural rules and dockets openly through resources such as the U.S. Courts system, and coordinating collection to those procedural realities is part of doing the work at an elite level. The same forensic discipline that proves exfiltration in a departing-employee data-theft investigation underpins the digital half of a non-compete matter.

What separates a world-class investigation from a mediocre one?

Any licensed investigator can follow a car. The differences appear when the file is tested in court:

• Legal-theory discipline. World-class teams scope to the elements counsel must prove in the specific jurisdiction, rather than gathering an expensive pile of irrelevant activity.
• Multi-source convergence. Public records, digital forensics, open-source research, and surveillance are triangulated so no single point of failure sinks the case.
• In-house forensic and intelligence capability. Digital forensics, cybersecurity, financial investigations, and background intelligence under one command — as they are at Honeybadger Solutions, remote-by-design and available nationwide and internationally — means the data question is answered by the same team that framed the case.
• Lawfulness as a feature. Elite firms treat statutory boundaries as the guarantee of admissibility, not red tape, and document their methods accordingly.
• Discretion. The subject is not tipped, the client’s business relationships are protected, and the matter is handled quietly and professionally from first contact to final report.

What drives the cost of a non-compete investigation?

Cost scales with scope and urgency rather than drama. The primary drivers are the volume of surveillance hours required to confirm concealed employment or client contact, the number of devices and accounts subject to forensic examination, the breadth of public-records and open-source research across jurisdictions, the number of witnesses to interview, and — above all — the compression when a TRO deadline is live and everything must be assembled in days. The false economy is a thin, cheap inquiry that fails to support the injunction; the value of doing it right is measured in secrets protected, customers retained, and a covenant actually enforced.

How does Honeybadger investigate a non-compete violation?

Honeybadger Solutions supports employers, general counsel, and litigation teams across Arizona, nationwide, and internationally. Our digital forensics, cybersecurity, financial investigations, and background intelligence functions are handled in-house and delivered remotely by design, so a data-exfiltration or corporate-intelligence question can be answered wherever the conduct occurred. Field investigation and surveillance are conducted by licensed investigators — our own in-house agents in Arizona, and a vetted field-partner network beyond it, with established theaters in California, Texas, and Florida and Arizona as home command. Whether the matter is a single departing salesperson or a coordinated team lift-out, the standard and the discretion are the same.

Because the forensic, investigative, and intelligence work sits under a single accountable chain of command, a suspected breach never fragments across disconnected vendors: the team that images the endpoint and reconstructs the data trail is the same one that runs the public-records and open-source track, coordinates lawful surveillance, and assembles the declaration-ready file counsel needs to move for relief. That is the discipline our corporate investigations practice is built to sustain, and it is anchored from our Arizona base across the Casa Grande headquarters and the Phoenix and Oro Valley offices.

Frequently asked questions

Is it legal to hire a private investigator to prove a non-compete violation?

Yes. Using a licensed investigator to gather evidence through lawful means — public records, open-source research, authorized forensic examination of company-owned devices, and surveillance of activity visible in public — is entirely legal and routine. What is not legal is hacking personal accounts, illegal recording, covert GPS tracking where prohibited, or pretexting for protected records. A professional firm stays within those lines precisely so the evidence remains admissible.

Can we still act if our state bans non-competes?

Often, yes. Even where employee non-competes are void — as in California, Minnesota, North Dakota, and Oklahoma — non-solicitation clauses, confidentiality agreements, and trade-secret protections generally remain enforceable. The investigation simply shifts its focus to what the former employee took and whom they are soliciting, frequently under the federal Defend Trade Secrets Act as well as state law.

How quickly can an investigation support a restraining order?

When speed is critical, a focused effort can produce a declaration-ready evidence package within days by running public-records, digital-forensic, and surveillance tracks in parallel. The earlier a firm is engaged — ideally at the first sign of a suspicious departure — the stronger the forensic record, because company devices can be preserved before evidence is lost.

What evidence is most persuasive to a judge?

Convergent, authenticated evidence from independent sources: forensic proof that confidential data was copied before departure, public filings or surveillance confirming competing employment, and testimony or communications showing direct client solicitation. A clean chain of custody and lawful collection make that evidence not just persuasive but usable, which is what ultimately decides the motion.