How a Media Buying Team Can Protect Itself from Information Leaks

The media spotlight on the affiliate market has triggered not only a wave of fresh talent, but also a surge in corporate espionage. Stories have been circulating publicly about newcomers attempting to join teams in order to learn the "secrets" of running traffic and other valuable information. 

In this piece, we break down how to protect confidential information about traffic campaigns within a team and what tools are available for that purpose. We invited experts from Traffic Squad, Trident Media, and Space Profit Team to share their experience. 

What Data Teams Need to Protect

Traffic arbitrage is often associated with a "money button," and in recent years the space has attracted new people trying to figure out how to earn enough for a Panamera — ideally within the first month. Some newcomers dream of getting access to an evergreen funnel to make money on autopilot. 

HR managers and security teams at media buying companies are forced to screen out suspicious candidates in order to protect the team's infrastructure. This puts pressure on the team and requires periodic updates to security protocols. 

What data typically falls into the "not for disclosure" category:

• traffic campaign specifics;
• salary figures;
• company financial metrics;
• headcount, department structure, etc.;
• advertiser lists, offers, and payout rates;
• proprietary company software.

Any information whose leak could negatively impact a company's financial performance or reputation requires protection. Safeguarding trade secrets is especially critical for high-profile media brands.

Tools for Protecting Sensitive Information

From an outside perspective, it may seem like teams don't have many options for protecting confidential information — and there are doubts about their effectiveness, since no software or protocol is foolproof. 

For example, there have already been cases on the market where team leads and team owners were scammed out of money through a fake consumables store scheme. Protecting against this kind of fraud is extremely difficult, and even experienced professionals have fallen for scammers. 

Below we cover the basic tools for preventing information leaks, with invited experts providing more detail on each.

Security Department

Large teams typically have a dedicated security department within their structure, responsible for ensuring that confidential data doesn't leave the office. Every company runs it differently, but the value it provides is undeniable. 

Security staff thoroughly vet new hires using OSINT tools and their own sources. Once an employee joins the team, their activity is monitored for any signs of suspicious behavior.

Lie Detector

Polygraph testing has long become standard practice for both new and existing employees at affiliate teams. From interviews, we know that even CEOs of some companies periodically visit polygraph examiners. 

The lie detector has its limitations, but overall it's a powerful psychological tool that can deter corporate spies. In Ukraine, polygraph services became especially popular in parallel with the boom in affiliate and IT companies.

NDA

A Non-Disclosure Agreement is a document that an employee signs before gaining access to confidential data. The agreement outlines rights, obligations, potential penalties, and the method for resolving disputes between a team member and the company. 

There is a view that NDAs carry little legal weight within the Ukrainian jurisdiction, but it's situational. If the document is well-drafted and the company has in-house or outsourced legal counsel, the liability for breaching the agreement can serve as a psychological deterrent. 

Corporate Secured Devices

Some IT companies operate under very strict security protocols and issue employees specialized laptops that are protected against data extraction. Whether this is practical in a media buying business remains an open question. 

Q&A with Media Buying Teams

What is your company's approach to protecting confidential information?

At TS, everything is set up pretty simply but effectively. We separate access rights, grant permissions only to the necessary services, and implement a password management system. Once someone leaves — we revoke their access.

---

Artem Lashko

COO Traffic Squad

Even though NDAs in the industry are often treated as routine paperwork rather than something to be taken seriously, ours is drafted strictly — and if a violation is uncovered, the consequences are severe.

The second layer is the team's common sense. We emphasize that certain information is strictly for internal use and regularly remind everyone of the rules around handling it.

---

Mykyta Kosheliuk

COO Trident Media

What data is critical for a media buying team to protect? Connections, financial metrics? 

Early on, we dreamed of collaborating with the FBI to track down whoever was leaking our connections — but it turned out they're powerless against spies. These days, we protect our financial reports, data about our partners, and the team's morale.

---

Artem Lashko

COO Traffic Squad

There are 3 major layers here:
1. The company's financial standing: revenue, financial performance by vertical and by employee. The full picture is accessible to a minimal number of people, which is the primary safeguard for that information.

2. Information about partners and deal terms. Which offers, products, and advertisers are generating revenue, what the payouts, caps, and traffic volumes look like. Both NDAs and the buyers' own common sense apply here — they have a vested interest in keeping things private.

3. Team information: contacts, roles, and employment terms. We try not to make life easier for recruiters at other companies, rarely making personal information about team members publicly available. This doesn't apply to bizdev roles, app managers, the brand unit, or C-level positions.

---

Mykyta Kosheliuk

COO Trident Media

Do you have a security department? If not, why?

The FBI collaboration never panned out, so we handle all disputes through legitimate channels. Even when tricky situations do arise — everything can be resolved reasonably within the legal framework.

---

Artem Lashko

COO Traffic Squad

The concept of a "security department" is quite broad. It can include people who physically guard the office, as well as those who provide legal support. We're not ready to go into specifics, but the security function is in place. 

---

Mykyta Kosheliuk

COO Trident Media

Do you use a polygraph? For what purposes?

Yes, we do conduct polygraph sessions. Of course, all the questions are light-touch and relate exclusively to professional experience. There are 2 key points for us: that the person isn't working for competitors and that they share the company's values.

---

Artem Lashko

COO Traffic Squad

Yes, we introduced the polygraph at the end of last year. The main reason was rapid team growth and, as a result, the need for objective verification tools. On top of that, we had suspicions of NDA violations. The primary goal of pre-hire screening is to validate the experience listed on a résumé and check for connections with other market players. For current employees, the polygraph is used to verify NDA compliance and honesty in their relationship with the company.

---

Mykyta Kosheliuk

COO Trident Media

Do you have an NDA? How strict is it? 

Yes, we sign an NDA at the start of any collaboration. But it's important to understand that it's designed to protect the business, not to restrict our employees' rights — there are no bans on working in the industry or fines with multiple zeros attached.

---

Artem Lashko

COO Traffic Squad

Yes, of course. The Non-Disclosure Agreement protects the company from the disclosure of the information outlined in the second clause.

The strictness of the agreement comes down to two factors: 
— the penalty amount for breaching confidentiality;
— the number of clauses that must not be disclosed.

So, to put it simply: if you breach the agreement — the terms will be tough; if you don't — you can sleep easy.

---

Mykyta Kosheliuk

COO Trident Media

What about corporate secured devices? Is that going too far, or is it standard practice?

We clearly understand that our job as a business that cares about people is to create all the conditions for comfortable work. So yes, we have corporate Macs connected to a shared workspace, and in critical situations we have a clear action protocol and designated people who can shut down equipment and critical services.

---

Artem Lashko

COO Traffic Squad

We issue corporate secured devices to teammates who have access to the company's most sensitive information.  

---

Mykyta Kosheliuk

COO Trident Media

Have you ever had cases of corporate espionage? Did any newcomers come in looking to leak something? 

Our biggest spy is Vitalik Sitovsky — his sociability and ability to know everything about everyone actually inspires us, which is exactly why we haven't fired him.

---

Artem Lashko

COO Traffic Squad

No, fortunately we've managed without that so far. Suspicious candidates usually drop off at the interview stage.

After introducing a lie detector, we parted ways with two teammates. Now the polygraph comes before the job offer, which significantly reduces the chances of potential bad actors making it into the company.

---

Mykyta Kosheliuk

COO Trident Media

Security is clearly taken seriously in the media buying business. So joining a team for the sake of connections or financial data simply doesn't make sense. It's better to focus on building genuine expertise and networking within the team itself. 

And for alternative takes on security from Yevhen, Head of PR at Space Profit Team — check our Instagram.