Over the course of my two years with my current employer, I've collected a small but not insignificant amount of company data on my personal machine(s). Most of these are in the form of old config files I keep as a back up or emails with information I like to reference. SOME files contain more potentially dangerous information from user ids to private VPN configurations. I know that most of this information resides elsewhere, I keep it there now for easy access.

I'm leaving in roughly a month (my boss already knows), what I suspect he doesn't know, or chooses to ignore, is that some of the things both he and a client told me to do are, while not illegal, wrong. By this I mean that there has been a continuous pattern of choosing speed or cost over system reliability, security, etc. I anticipate a lawsuit one day, and being the only person in the company who actually dealt with these things, I don't see how I could not be at least contacted by either party.

My question: I've been obsessive about documenting everything: who wanted what done when, why, what phase the moon was in, and the color of my underwear. The documentation will live on without me, but I have a personal paper trail of config file snippets, emails, and other records. I'd like to hold onto this personal documentation. Do I open myself up to any ethical or legal implications in doing so? The information is certainly confidential, but doesn't contain things like passwords or user logs.

  • Really you anticipate a lawsuit because someone chose speed or cost over reliability and you could be contacted by either party. To facilitate this you wonder if you should take a copy of confidential information.
    – paparazzo
    Apr 20 '16 at 13:26
  • I don't think business strategy decisions are likely to generate a lawsuit, especially since both parties are actively involved. Just because you think these things were wrong from a developer perspective, doesn't mean that both sides didn't evaluate the pros/cons and agree to take in the technical debt.
    – cdkMoose
    Apr 20 '16 at 16:55

Short answer: Don't.

Make sure you do a good handover, ensure they know where the information is, and enjoy your new job. It's not your problem any more. Unless they are going to pay you for the privilege, it's there prerogative to make sure all the information in your head is available.


The original question asked "Should I take confidential data with me once I leave a company to make it easier to help them when called?". The last edit changed the question to "How can I keep a confidential paper trail when leaving a company in case of potential legal action?" The below answer addresses the new question, while the above the original question

I would strongly encourage you to talk to a lawyer before you leave the organisation. That way if they recommend keeping information that may protect you, then you still have access to it. But only a lawyer can give you the legalities of doing so. The "how" then becomes simple.

  • As a point of clarification: my replacement as Lead Systems Engineer is still not placed (and I doubt will be), so the 'handover' I've been trying to make happen seems unlikely. I obviously plan to purge 'sensitive' info like passwords, TLS certs etc. I'm more worried about emails I'd like to retain in anticipation of a law suit one day. Perhaps a better question would be 'How do I maintain a paper trail after leaving a company'? Apr 20 '16 at 3:44
  • so the 'handover' I've been trying to make happen seems unlikely. Not your problem. The other, however, may be a different question to ask.
    – Jane S
    Apr 20 '16 at 3:45
  • I edited the question's title and content to better reflect what I'm asking and concerned with. Thanks Apr 20 '16 at 3:56
  • 1
    Hmm, thus totally invalidating my answer :) I will edit.
    – Jane S
    Apr 20 '16 at 3:57
  • Sorry. It's late here. Have an upvote C= Apr 20 '16 at 3:59

In theory you should hand over everything related belonging to the company, to the company. In reality that doesn't always work out.

But, if you were to hold on to such information because in your opinion it might save you some grief, here's some advice. Don't go on the internet and advertise the fact.

An example would be a series of emails covering your back if anyone tried to implicate you for doing something that shouldn't have been done. Because the emails clearly show you refusing to get involved, things like that.


Generally speaking - when exiting a company you are to turn over all property that belongs to them. In the case of emails, etc, those belong to the company and it's up to them to retain them (given applicable laws). By extension, once handed over, you should remove any, and all, company emails, source code, config files, passwords, etc from your devices.

If the company is sued that is their problem; not yours. Well, not yours unless you engaged in illegal behavior. If you did engage in illegal behavior I highly doubt you'd want a record of that anyway. So absolutely get rid of it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .