The classic SME owner's nightmare: after eight years, your best salesperson hands in a notice, says they're "moving to a competitor for slightly better terms" — and over the next six months, coincidentally, your customers keep drifting the same way. There is a non-compete in the contract, but written by a lawyer in 2016. The database is "kind of" secured. And you know something leaked.
This isn't a piece about building enterprise DLP for half a million. It's about what a 15-person company can do on a Friday afternoon so this risk stops being an open wound. None of it gives you 100% protection. Together, it makes a huge difference.
Start with the most important thing: you will not stop a determined person who knows your customers by name. A salesperson who's been drinking coffee with them for five years does not need to pull an Excel file — it's all in their head. Everything else in this article is about them not additionally walking out with the full documentation of your business as a CSV.
A contract with actual teeth
A surprising number of companies have contracts where "non-compete" is three sentences with no consequences. Somebody once copied a template from the internet, ran it past a lawyer for 300 zł, and forgot about it. That's paper without teeth.
Things that actually work in the Polish reality:
- A post-employment non-compete clause with actual compensation (Polish labour code requires paying compensation — without it, the clause is simply invalid). A realistic period is 6–12 months; nobody will sign a longer one.
- A non-solicitation clause — separate from non-compete, specifically about contacting customers from your list.
- The "customer database" defined as a trade secret under the unfair competition act. Without this it's hard to enforce anything in court — because formally "every salesperson knows their customers".
- Contractual penalties written as concrete numbers. A court can still reduce them, but a written figure of 30–100k zł works psychologically very differently from "we'll pursue civil claims".
Take a look at the contracts you currently have. If it's been 5+ years since the last review and the clause is one paragraph — it isn't a contract, it's decoration.
The technical minimum you can put in place in a week
Without enterprise DLP, without investing in a SIEM, a 15-person company can close 80% of the typical leak paths in a week. Based on a typical stack (Comarch Optima or enova365, Microsoft 365, some CRM):
- Restrict Excel exports from ERP/CRM. In Comarch Optima, every operator can usually export whole tables. Set permissions so that exporting the full contractor list requires its own privilege — not the default for every salesperson. A salesperson should see their scope, not the whole book.
- Cap mass exports from your CRM. Most CRMs (HubSpot, Pipedrive, and the CRM module in Optima) have API limits and export logs. Turn them on. It won't stop one export, but the next 40 downloads in a week will leave a trail.
- Disable automatic sync of Outlook/Teams contacts to personal phones. People forget about this. Contacts from the company mailbox end up on personal iCloud and nobody knows when.
- Block automatic email forwarding outside your domain. In Microsoft 365 this is one Exchange option, one transport rule, five minutes. The result: nobody sets up "forward everything from client@ to myprivate@gmail".
- Define which SharePoint/OneDrive folders are "critical" and enable mass-download alerts on them (Microsoft 365 has this in E3/Business Premium). "Mass" meaning e.g. >100 files per hour.
At one of our clients — an 18-person packaging company, Comarch Optima plus an in-house CRM — the key salesperson exported 4,200 contacts from Optima over three weeks before leaving, in batches of ~150 records at a time, so it wouldn't stand out. Nobody noticed. Only four months later, when the new employer started inviting exactly the same people to meetings, did the client ask us to review the logs. It was all there. Together with the client we estimated the lost revenue in the following six months at around 340,000 zł. Had export alerts been on from the start, they'd likely have known in week 2, not month 4.
Warning signs worth watching
This isn't about surveillance. It's about a handful of patterns that in practice almost always precede a walk-out with the database:
- A sudden spike in exports from CRM/ERP — especially "list of all customers", "all quotes from the last 12 months", "price list".
- A personal USB stick or external drive plugged in (endpoint protection logs this).
- Copying SharePoint folders to the local machine in volumes that don't match the previous usage pattern.
- Emails sent to oneself with attachments, to a private mailbox (SPF/DMARC and Exchange logs see this).
- A sudden drop in sales activity (no new quotes, no meetings) alongside "normal" presence at work — the classic "already mentally out".
None of these signals mean anything on their own. But when three of them coincide in time for the same employee — that's a signal to talk to a lawyer, not to panic in the open plan.
The last day — a boring, hard procedure
The last day of work cannot be improvised. A standard procedure worth having written down:
- Revoke access at the same hour the statement is signed. Not "on Monday when they return the key". M365 account, VPN, ERP, CRM, SharePoint — all of it in one 30-minute window.
- Return of laptop and phone before leaving the office, not "we'll courier it". Check that the device hasn't been factory-reset.
- Archive the mailbox and forward to another person for 90 days (to catch trailing threads and to see who reaches out).
- An activity-log export for the last 3 months — saved, in case a lawyer needs to see it in two months.
- A short email from management to that person's customers: "X no longer works with us; your new contact is Y". A single sentence, but it closes off disputes like "X told me…".
This sounds impersonal. It's meant to. The procedure protects both sides — the employee too, because there are no disputes about "what they took".
What to do when it's already happened
Assume it's too late. They left, customers are "coincidentally" remembering another supplier. What you can actually do:
- Secure the evidence. ERP, CRM, Exchange and endpoint logs — pull them immediately and save them in a separate place. Default retention is 30–90 days; miss that and you can't prove anything.
- Use a lawyer who's done this before. Not the same one who writes lease agreements. Specifically: unfair competition act cases (art. 11 and 12). Ask for a warning letter to the former employee and the new employer — the letter alone often settles 60% of cases.
- Do not contact customers with grievances. It's the worst idea. A customer doesn't leave because they don't like you — they leave because they have a relationship with a specific person. Repairing the relationship is a separate topic, but it starts with being professional, not entitled.
- Turn this into a lesson. Don't fire IT for "not blocking it". Fire the procedure that wasn't there. Add the right clauses to the onboarding of every new salesperson, tidy up permissions, turn on alerts. In a year you'll be in a different position.
None of this recovers lost revenue. But together it turns "we were robbed" into "we have a policy and we enforce it". Those are two completely different positions — in court, and in front of the next salesperson who walks into an interview.
If you want a quick review of your current controls — book a free 30-minute call. We'll walk your actual configuration with you, show where the biggest gaps are, and what can be closed this week.
You will not stop a person who knows your customers by name. But you can make sure they don't additionally walk out with the full documentation of your business as an Excel file.