UiPath, Inc. v. Shanghai Yunkuo Information Technology Co. was a proceeding in the United States District Court for the Southern District of New York in which the robotic process automation (RPA) vendor UiPath asked the court to confirm and enforce an arbitral award against Shanghai Yunkuo Information Technology Co., Ltd., which does business as ENCOO Tech. The arbitrator had found that the respondent misappropriated UiPath’s source code and breached a settlement agreement. The respondent took part in the arbitration but did not appear in court, and on 2024-06-04 Judge Lorna G. Schofield granted the unopposed petition.[1] Judgment for USD 71,692,756.43 was entered on 2024-06-10.[2]
The case is not about customer licensing. It concerns the protection of a software publisher’s own source code against a competitor, which is the background against which RPA vendors write the confidentiality, reverse-engineering and benchmarking restrictions in their licence agreements.
Background
UiPath is described in the opinion as “a public U.S. company in the field of robotic process automation”; the respondent is a company organized under the laws of the People’s Republic of China.[1] On 2020-07-14 the parties signed a settlement agreement “related to Respondent’s misappropriation of Petitioner’s trade secrets, specifically, Petitioner’s source code”. The agreement required the respondent to submit its source code for third-party review within fourteen days of UiPath naming a reviewer. It also provided for arbitration in New York City before a single arbitrator and for New York law.[1]
The dispute
The respondent did not submit its source code by the deadline, even after UiPath extended it. On 2020-11-11 UiPath filed a demand for arbitration with the International Centre for Dispute Resolution, claiming breach of the agreement and the original misappropriation. The respondent argued that the arbitration clause covered only disputes about the agreement itself; on 2021-10-26 the arbitrator ruled in a Partial Award on Scope that the misappropriation claims were within the clause.[1]
After two years and a multi-day evidentiary hearing, the Partial Award on the Merits of 2023-05-10 found for UiPath on both claims. It ordered USD 70,000,000 in compensatory damages, enjoined further use of UiPath’s trade secrets, ordered the respondent to remove all similarities between its code and UiPath’s source code, and required it to make the source code of all its RPA products available for review by a third-party expert twice a year for five years. The Final Award added USD 1,411,243.93 in attorney’s fees and costs and USD 281,512.50 in administrative fees and expenses.[1]
UiPath petitioned the court on 2023-09-05 to confirm the Final Award under the New York Convention and the Federal Arbitration Act.[2] Serving a company in China took several months. In December 2023 the court denied UiPath’s first request for alternative service without prejudice and asked for more evidence; it later set a briefing schedule, and the opinion records that the relevant filings “were served on Respondent via alternative service methods approved by the Court”. The respondent filed no opposition.[1][2]
Decision or outcome
The court treated the unopposed petition as an unopposed motion for summary judgment and applied the “extremely deferential” standard of review for arbitral awards, under which only “a barely colorable justification” is needed.[1] It held that the award fell under the New York Convention because the agreement was written, both the United States and China are signatories, the subject matter was commercial, and the respondent was a foreign company.[1]
On the merits, the court noted that the arbitrator found UiPath’s source code to be a trade secret because “it is not publicly available; it is valuable to both Petitioner and competitors; it required over a decade to develop and Petitioner took strong measures to protect this information both internally and externally”. Liability rested on the large compensation package the respondent paid a former UiPath employee “despite his lack of experience with RPA”, on expert evidence that the respondent copied UiPath’s code, and on “several implausible ‘coincidences’”. The breach finding rested on the missed source code review deadline, with the arbitrator observing that the respondent “acted in bad faith in connection with the source code review”.[1]
The court confirmed the Final Award with post-award interest at New York’s nine percent rate and post-judgment interest under 28 U.S.C. § 1961.[1] The judgment of 2024-06-10 entered USD 71,692,756.43 for UiPath, enjoined the respondent from “further using, disclosing, or exploiting Petitioner’s trade secrets”, ordered it to remove all similarities between its code and UiPath’s, and ordered it to make its RPA source code available for third-party review twice a year for five years on 30 days’ notice. The case was then closed.[2][3]
Significance for software licensing and SAM practice
The ruling is about trade secrets in source code, not about copyright infringement or licence counting, and it confirms an arbitration award rather than deciding the merits afresh. It shows three things relevant to software licensing. First, a publisher’s protection of its code depends partly on the measures it takes to keep the code confidential, which is one reason why UiPath’s own agreements forbid reverse engineering, benchmarking and building competing programs (see UiPath MSSA, Community and evaluation terms). Second, a settlement can create an ongoing audit-like right: here, a right to have a competitor’s code reviewed by a third party, confirmed by the court for five years. Third, a broadly worded arbitration clause in a settlement agreement can bring the underlying claims into the arbitration.[1] For other software cases see software licensing litigation.
Lessons learned
- Confidentiality measures matter. The arbitrator’s finding that the code was a trade secret relied on it being non-public, valuable and protected by “strong measures” internally and externally.[1] Organizations that hold source code under licence or escrow should apply the protections their agreements require.
- Review rights need deadlines. The settlement fixed a fourteen-day period to submit code for review after a reviewer was named; missing it was a breach in itself.[1]
- Arbitration scope follows the wording. A clause covering “all disputes arising under this agreement” was held by the arbitrator to include the original misappropriation claims.[1]
- Hiring and similar code are evidence. Pay offered to a former employee and code similarities supported liability.[1] Software teams that hire from competitors should be able to show independent development.