Can I scrub data before licensing it? Who cleans it
The short answer
No. micro1 staff said in an undated recorded forum talk that companies cannot pre-scrub because it would break the cross-tool trail. Troveo and Handshake AI both say they handle cleaning themselves. Control scope instead by agreeing which systems to include before anything moves.
Scrubbing sounds like the responsible first move. In this market the company you license to, or its partner, usually owns that step, and the company's job is to say what goes in.
Why does micro1 say companies cannot pre-scrub?
In an undated recorded forum talk, micro1's David Revland, who works on human data, described transformation, which is a different operation from redaction.
A name becomes a consistent stand-in across every tool, so a request in Slack can still be matched to the report in Google Workspace. Blanking names first would break that match. My PII transformation page has the detail and the caveats.
Who cleans the data at other companies?
| Company or marketplace | Who does the cleaning, in its own words |
|---|---|
| micro1 | Its staff said micro1 transforms the data. Its page says companies can review representative samples before use. |
| Troveo | Troveo handles anonymization and packaging, to a documented standard it does not publish. |
| Handshake AI | Handshake AI says it de-identifies and cleans the data on its side before delivery to labs. |
All of it is self-reported. A name swap alone leaves risk behind, and the UK ICO still treats pseudonymised data as personal data for anyone who holds the extra information.
What does the company control instead?
Scope. You choose which records to include and exclude, and you agree the permitted uses before any records move. Handshake AI says the company keeps control of its data-sharing decisions.
micro1 says every partnership defines an approved data scope and clear boundaries. The data manifest form is where you list tools and rough sizes, so the form page is a good first read.
What can you prepare before the first call?
A list comes first. Write down which tools hold which kinds of records and which categories a lawyer would want kept out. Frankfurt Kurnit's checklist names privilege, payroll, health files and union communications as categories to exclude.
The rights check asks whether privileged material, health records or NDAs are in play, and the managed readiness service builds the list with you and never touches your data.
Should you delete anything first?
The sources I read don't address deleting records before a licensing deal. I'd ask your lawyer before you delete anything.
Talk to a privacy or commercial lawyer in your state before you sign.
micro1 may pay us a referral fee if a company we introduce goes ahead with it. How we are paid
Apply to micro1's data partnership (paid link)micro1's own data-partnerships pagePaid link. How we are paid
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
