What IP documentation do EU investors require from startups?

EU investors conducting due diligence typically require: (1) IP ownership proof: evidence that the company, not individual founders, owns the core technology, designs, and content; (2) IP assignment agreements: signed and dated agreements from all founders and key contributors who created IP before or during employment; (3) IP creation timeline: version-controlled development records, qualified electronic timestamps on key milestones, or patent priority dates establishing when IP was created; (4) Trademark and patent registrations: filings in EU markets; (5) Non-disclosure and non-compete agreements with all parties who had access to proprietary IP. Qualified electronic timestamps from an eIDAS QTSP are increasingly used to satisfy the IP creation timeline requirement at low cost.

How do EU data protection rules (GDPR) affect startup IP protection?

GDPR (EU Regulation 2016/679) intersects with IP protection when the IP involves personal data: user data, customer databases, AI training datasets containing personal information, or research data. Under GDPR Art. 5, personal data must be processed lawfully, fairly, and for specified purposes. If a startup's IP consists of or relies on personal data, the legal basis for that data processing must be documented and maintained. Qualified electronic timestamps on data processing agreements, consent records, and GDPR documentation establish a clear legal timeline for IP built on personal data. This is critical for due diligence by EU investors who face joint liability for portfolio companies' GDPR compliance.

Should startups file patents or use trade secrets to protect technology in the EU?

The choice depends on: (1) Reverse-engineerability: if competitors can replicate your technology from the product alone, a patent is more protective (patents make it illegal to independently recreate the invention); if the technology can be kept secret, trade secret protection may last longer (patents expire in 20 years); (2) Cost and timeline: EU patents (via EPO) cost €10,000 to €50,000+ including translations and maintenance, take 3 to 5 years, and require public disclosure; trade secrets have no upfront cost but require active confidentiality measures; (3) Market strategy: for deep-tech where you plan to license technology to large companies, patents are essential; for B2B SaaS where the moat is execution and data, trade secrets may suffice. Qualified electronic timestamps serve both strategies: they establish creation date evidence before a patent is filed and document trade secret existence.

What is the EU Trade Secrets Directive and how does it help startups?

The EU Trade Secrets Directive (2016/943/EU), implemented in all EU member states, provides a harmonised framework for protecting trade secrets, including startup algorithms, processes, and know-how. It defines a trade secret as information that: is secret, has commercial value because it is secret, and is subject to reasonable steps to maintain its secrecy. The Directive gives holders of trade secrets the right to prevent misappropriation and seek civil remedies across all EU jurisdictions. For startups, the key requirement is proving that secrecy measures were in place. Qualified electronic timestamps on confidential documentation, combined with access logs and NDAs, provide the evidential basis to claim trade secret protection under the Directive.

How should a startup assign IP from founders to the company before raising EU investment?

IP assignment should happen before external investment closes. The process: (1) Identify all IP created by founders (code, designs, content, algorithms, brand assets) from before and during their work for the company; (2) Draft an IP assignment agreement specifying what is transferred, from whom, for what consideration (often nominal consideration is sufficient if founders receive equity); (3) Sign the agreement with qualified electronic signatures, which creates a legally binding contract and establishes the transfer date; (4) Apply a qualified electronic timestamp to the executed agreement, which proves the assignment date for future disputes; (5) Update the company's IP register. EU investors will review this documentation; gaps, missing signatures, or unclear ownership chains are common reasons for investment delays or reduced valuations.

Digital IP Protection for EU Startups Raising Funding

What investors actually check in IP due diligence, why a Google Drive timestamp will not hold up in court, and how ZertES and eIDAS certificates give your startup legally admissible proof of creation.

In April 2025, an Amsterdam-based fintech startup reached term-sheet stage with a Munich-based VC. The deal was EUR 4 million at a EUR 20 million pre-money valuation. The VC's legal team opened due diligence and asked one question first: can you prove when your core algorithm was created and that it belongs to the company, not the founding engineer personally? The CTO produced a GitHub repository, a shared Google Drive folder, and a Slack export. The lawyers spent three weeks reviewing the materials, then recommended the VC reduce the valuation by 30% to reflect unquantified IP risk. The deal closed at EUR 14 million pre-money. The cost of missing qualified IP documentation: EUR 1.8 million in implied valuation.

IP is the most valuable asset a startup carries into a funding round. It is also the most commonly underprepared. Founding teams spend months on the deck and the financial model, then discover in due diligence that their ownership evidence does not meet the legal standard investors and their lawyers require. This guide covers what that standard is, why informal evidence fails it, and how ZertES and eIDAS qualified certificates solve the problem in under two minutes.

What Investors Actually Check in IP Due Diligence

When a VC or corporate investor reviews IP in due diligence, their legal team looks for three specific things:

1. Chain of custody. Who created the IP, and have they properly assigned it to the company? A common failure point: a solo founder who built the MVP before incorporating never formally assigned the code to the entity. The IP technically belongs to them as an individual, not the startup.

2. Creation dates. When was the IP created, and can that date be verified by an independent third party? A founding date claim that rests solely on a GitHub commit history or a file's "last modified" metadata is not legally credible. Metadata is editable by anyone with filesystem access.

3. Ownership proof. Is there any document that definitively links the IP to the legal entity now seeking funding? A verbal agreement between co-founders is not a document. Neither is a Notion page or a Trello board.

Investors have seen all of these failure modes. The average EU IP infringement case costs between EUR 250,000 and EUR 1.2 million (EUIPO, 2023). Investors price that risk into valuations before a dispute ever starts. CHF 5 per document sealed with a qualified timestamp is the cost of removing that discount.

Why Google Drive, Email Trails, and Git Commits Are Not Enough

Google Drive / Dropbox "created on" dates. These timestamps reflect when a file was uploaded to the platform, not when it was written. They are stored in Google's proprietary database, controlled entirely by Google. They are trivially altered by re-uploading a file. No court in Switzerland, Germany, France, or the Netherlands will treat a Google Drive timestamp as legally conclusive without corroborating evidence.

Email chains. An email thread showing co-founders discussing a design at a given date establishes that a conversation happened. It does not establish the content of the attachment they referenced, because attachments can be swapped. It also does not establish that the email has not been modified post-hoc.

Git commits. Git is the closest of the three to credible evidence. A signed git commit with a cryptographic hash does lock in content. But git commit timestamps can be rewritten with git commit --amend --reset-author and a manual date argument. Without a trusted external anchor, git history is self-referential. It is only as trustworthy as the person who controls the repository.

The core problem: all three evidence types are custodian-dependent. You control them. An adversary in a dispute will argue that you altered them. Without an independent, qualified third party to anchor the timestamp, the evidence is challengeable.

What ZertES and eIDAS Qualified Timestamps Actually Prove Legally

A qualified electronic timestamp under ZertES (Switzerland) or eIDAS (EU) is fundamentally different from a platform-generated date. It is issued by an accredited Trust Service Provider regulated and audited by a national supervisory body.

Here is what a qualified timestamp legally proves:

Existence: The specific cryptographic hash of your file existed at the recorded moment. If the file has changed by even a single byte since sealing, the hash will not match, and the certificate will flag it.
Integrity: The file has not been altered since the timestamp was anchored. This is mathematically guaranteed by SHA-256.
Non-repudiability: The timestamp was issued by a regulated entity accountable to the Swiss Federal Chancellery (for ZertES) or the EU member state supervisory body (for eIDAS). You cannot have issued it yourself.

Under eIDAS Article 41, a qualified timestamp carries a legal presumption of accuracy of the time and integrity of the data across all 27 EU member states. The burden is reversed: a party disputing your timestamp must prove it is wrong, not the other way around.

Under ZertES Art. 11 and OR Art. 14 para. 2bis (SR 220), a qualified electronic signature and timestamp from a Swiss-accredited QTSP has full legal standing in Swiss courts. Swisscom Trust Services, Switzerland's leading QTSP, provides the anchoring infrastructure behind Swiss Trust Layer.

Why eIDAS QES Matters for CH and EU Startups

Swisscom Trust Services holds both ZertES accreditation (Swiss BAKOM) and eIDAS qualified status on the EU Trusted List independently. A seal issued through Swiss Trust Layer therefore carries legal presumption under both frameworks. This means a single seal created on Swiss Trust Layer is valid evidence in:

Swiss courts (ZertES Art. 11 and OR Art. 14 para. 2bis (SR 220))
All 27 EU member states (eIDAS Art. 41)
181 Berne Convention member countries for copyright purposes
UAE courts via UAE Pass integration

This matters for funding because investors doing cross-border due diligence need evidence valid in their legal system, not just the founder's home jurisdiction. A qualified Swiss/EU timestamp satisfies both. See the full compliance overview for a jurisdiction-by-jurisdiction breakdown. Swiss startups should also read the ZertES compliance guide for Swiss companies for a step-by-step breakdown of obligations under SR 943.03.

What Would Have Happened Differently

If the Amsterdam CTO had sealed the core algorithm with a qualified timestamp at the time of first commit, the outcome of due diligence would have been different from day one. The VC's lawyers would have received a World Court Proof certificate anchored to Swisscom Trust Services, showing the SHA-256 hash of the codebase dated to four months before the company was incorporated, with a formal IP assignment agreement countersigned on incorporation day. Chain of custody: clear. Creation date: independently verified. Ownership proof: on file. The conversation about IP risk would not have happened. The EUR 1.8 million valuation discount would not have happened either.

How to Protect Your IP Before Your First Investor Meeting: 3-Step Workflow

Step 1: Compile a full IP archive. Do not seal individual files. Create a ZIP archive containing everything that constitutes your IP: source code, design files, written specifications, business logic documents, algorithms, marketing copy, and any other original work. Include a text file listing each founder and their contribution. Seal it whole. A single seal on the ZIP proves that all of this content existed together, in this form, at this moment.

Step 2: Upload and seal on Swiss Trust Layer. Go to hello.swisstrustlayer.com. Upload your ZIP. The platform generates a SHA-256 hash client-side. Your files do not travel over the network. The hash is submitted to Swisscom Trust Services and anchored with a ZertES/eIDAS-qualified timestamp. You receive a World Court Proof e-Seal certificate: a PDF containing the hash, the timestamp, and the full Swisscom QTSP certificate chain. Download it. Store it alongside the original ZIP.

Step 3: Seal at every significant milestone. Every material change to your IP deserves a new seal. A new algorithm, a new design, a new product version. Each seal adds a node to your audit trail. By the time an investor's lawyer asks for IP provenance, you will have a cryptographically anchored timeline of your product's development, something no competitor can produce after the fact.

The Amsterdam CTO now seals every significant commit before the end of the sprint. The process takes under two minutes per document and costs CHF 5. The EUR 1.8 million valuation gap in their last round is the number they show new engineers during onboarding. That is what missing a CHF 5 seal costs at the wrong moment.

Start protecting your startup's IP on Swiss Trust Layer, from CHF 5 per document.