Payroll software is supposed to turn human mess into orderly records: names, salaries, permissions, devices, approvals. In the fight between Rippling and Deel, the records have escaped the product demo and entered federal court. Slack searches, channel views, bank transfers and sworn statements now form the anatomy of a rivalry that became an allegation of corporate espionage. The spectacle is tempting. The useful story is quieter. Two companies that sell administrative trust are discovering how precisely software can measure its collapse.
Rippling filed its original complaint in California on March 17, 2025. It alleged that Deel recruited Keith O'Brien, then a Rippling global payroll employee in Dublin, to gather confidential intelligence. According to Rippling, O'Brien searched internal systems for references to Deel, viewed sales and customer channels, downloaded material and relayed it outside the company from roughly November 2024 through March 2025. Deel denies commissioning espionage and contests Rippling's larger narrative.
The verbs matter. Rippling alleges. Deel denies. A payment is acknowledged, but motive is disputed. In February 2026, U.S. District Judge Charles R. Breyer allowed Rippling's federal RICO, RICO-conspiracy and trade-secret claims to survive dismissal. He dismissed three overlapping state-law claims. That decision means the federal allegations were sufficiently pleaded when viewed in Rippling's favor. It does not mean a court found them true.
The employee account at the center
The public record begins with access that looked legitimate. O'Brien worked inside Rippling and had credentials. Rippling's complaint says its forensic review found more than 1,300 views or downloads involving prospective-customer channels during the alleged window, plus hundreds of interactions with material about current customers and retention risks. The company says a recurring search for “deel” helped O'Brien locate pricing discussions, sales strategy, churn concerns and competitive training.
Rippling's allegationViews or downloads involving prospective-customer Slack channels between November 2024 and March 2025, according to the original complaint. The figure remains an allegation, not a judicial finding.
This distinction is the first operational lesson. Insider risk rarely announces itself with a failed login. A valid user can become risky when the shape of access stops matching the shape of the job. A payroll employee repeatedly opening sales-pipeline channels may pass every authentication check while failing a more basic test: why does this person need this information now?
Rippling says it turned that question into a trap. Its complaint describes a decoy Slack channel named “#d-defectors.” Knowledge of the channel was tightly held. Rippling's lawyers then sent a letter to a small group of Deel leaders that mentioned it. Rippling alleges O'Brien soon searched for and accessed the channel, which the company treated as evidence that information had traveled from Deel back to its employee. Deel disputes the inferences and has attacked the credibility and conduct behind Rippling's case.
How the alleged information loop worked
The payment both sides explain differently
Money gives the dispute a firmer object but not a settled meaning. A November 2025 federal order concerning confidentiality described Revolut records showing a payment from Lets Deel Ltd, a Deel affiliate, to Alba Basha, the wife of Deel operating executive Dan Westgarth, followed by a corresponding payment from Basha to O'Brien. Later filings put the amount at approximately $6,000.
Deel has acknowledged the one-time transfer. Its account, reported from a March 2026 filing, is that O'Brien requested temporary help with living expenses while preparing to leave Rippling and explore work or business ideas with Deel. Deel says there was no agreement to buy confidential material, no continuing payment arrangement and no acceptance of a later request for more money. It says the indirect route reflected O'Brien's concern that Rippling might monitor his finances.
Rippling gives those same details a darker interpretation. It alleges the transfer was the opening payment in compensation for intelligence and that routing it through a spouse's personal account was concealment. O'Brien's April 2025 affidavit, opened in Ireland's High Court, said he passed confidential information to Deel after its chief executive suggested he become a “spy” for a reward. Deel challenges O'Brien's reliability and says Rippling later paid him under a cooperation agreement.
A transaction record can prove that money moved. It cannot, by itself, decide which story moved with it.YesPress analysis of the competing filings
Rippling's account
The transfer was part of compensation for an insider who gathered sales, customer and competitive intelligence at Deel's direction.
Deel's account
The transfer was one-time personal assistance during a possible job transition, with no bargain for confidential information.
This is why the confirmation of payment is significant without being conclusive. It narrows the factual disagreement. The parties no longer argue over whether that first transfer happened. They argue about purpose, surrounding communications and credibility. Discovery exists to test those accounts against messages, metadata, bank records and testimony.
What the judge decided, and what he did not
Judge Breyer's February 23, 2026 order is easy to overread. On a motion to dismiss, a judge generally asks whether a complaint states a legally plausible claim, assuming well-pleaded allegations are true. Breyer found Rippling had plausibly alleged a RICO enterprise, a pattern of racketeering and injury. He said the pleaded predicate acts included obstruction, wire fraud and trade-secret theft. He also found the trade-secret claim should not be resolved before evidence develops.
Federal RICO, RICO conspiracy and Defend Trade Secrets Act claims.
Three California state-law claims found preempted by the state's trade-secret statute.
The order was not a liability verdict, nor a factual endorsement of every allegation. It did keep the core case alive, including claims against Deel and individual executives. The litigation then widened. Deel filed federal counterclaims in March 2026 against Rippling, CEO Parker Conrad and O'Brien. Deel alleges, among other things, that Rippling used a fake customer identity to access proprietary employer-of-record materials and misappropriated its work. Rippling disputes Deel's characterization. The rival narratives now face each other in the same federal action, alongside related Irish proceedings and a separate Delaware history.
There is a business reason for the intensity. Rippling and Deel overlap in payroll, HR and global workforce management. Their products sit near hiring decisions, compensation, worker identity and compliance. Sales cycles expose which customers are unhappy, what prices they will accept and which features might make them switch. A competitor who sees that context does not merely gain a lead list. It gains timing.
What operators can steal from the case
The litigation will determine legal responsibility. Companies do not need to wait for that result to inspect their own controls. The practical question is not whether every employee is trustworthy. It is whether a company can notice, contain and reconstruct access when trust changes.
- Match permissions to work. Sales strategy, renewal risk and executive escalations should not be broadly searchable simply because the collaboration tool makes broad search convenient.
- Alert on behavior, not only authentication. Repeated searches for a competitor, bulk channel previews and unusual mobile downloads can matter even when the login is valid.
- Preserve logs before confrontation. Access histories, device events and relevant messages can disappear through retention policies or reactive deletion. Evidence preservation needs an owner and a rehearsed sequence.
- Write competitive-intelligence rules. Employees need a plain boundary between public research, legitimate customer feedback and material that should never be solicited or accepted.
- Treat indirect payments as a control event. Payments through personal intermediaries invite questions even when there is an innocent explanation. Document purpose, authorization and counterparties before funds move.
The awkward point is that collaboration software rewards openness. Searchable channels and unified data help employees move faster. Rippling itself sells a single source of truth across departments. Deel promises one platform for a global workforce. The same architecture that makes work legible also makes sensitive context easy to traverse. Least privilege feels like friction until an access log becomes an exhibit.
For customers choosing between the platforms, the lawsuit does not supply a product verdict. Buyers should ask narrower questions: How are privileged searches monitored? Can access be scoped by role, geography and customer? What logs can an administrator export? How long are they retained? How does the vendor investigate an insider alert? A courtroom story becomes useful when it improves a procurement checklist.
The durable record
Startup fights are often narrated through personality. This one resists that simplification because the record keeps growing. The complaint contains one version. Deel's motions and counterclaims contain another. O'Brien's affidavit adds a witness account that Deel attacks. Payment data establishes a transfer but leaves purpose for proof. The federal order tells us which claims can proceed, not who will win them.
What remains is unusually modern: two companies built to organize employee data are now organized by the data their employees and systems produced. Each search has a timestamp. Each transfer has counterparties. Each legal claim has an answer. Trust, once broken, becomes less a feeling than a sequence that lawyers can paginate.
That may be the most reusable insight. A company cannot guarantee loyalty, and it cannot predict every competitive maneuver. It can decide how much any one account can see, which behaviors create a signal and whether its evidence will survive the first chaotic hours of an investigation. The Rippling-Deel case is unresolved. Its operating lesson is already available.
Questions people ask
What does Rippling accuse Deel of doing?
Rippling alleges Deel and several executives recruited and paid a Rippling employee to obtain confidential sales, customer, pricing and competitive information. Deel denies commissioning espionage.
Did Deel admit paying the Rippling employee?
Deel acknowledged a one-time transfer of about $6,000 but says it was assistance with living expenses, not payment for confidential material. Rippling disputes that purpose.
Has a court found Deel liable?
No. The February 2026 order allowed core federal claims to proceed past dismissal. It did not determine that Rippling's allegations are true.
What is Deel alleging against Rippling?
Deel alleges Rippling used deceptive competitive-intelligence practices, including access to Deel materials through a purported customer account. Rippling disputes the account.
Why does the case matter to operators?
It illustrates how employee permissions, collaboration tools, payment trails and evidence retention can become business and legal risk.