# Data licensing audit: what it covers and who runs it

> A data licensing audit reviews your records before licensing: inventory, rights, sensitive data, thresholds and buyer fit. No standard exists. Sources compared.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-licensing-audit  
Published: 2026-09-09  
Updated: 2026-10-14

## The short answer

An audit reviews records before an AI license. No industry standard exists. Five parts: inventory of systems, rights check, sensitive records list, buyer threshold test and buyer match. Thresholds are self-reported. Rights questions go to counsel.

The five parts below are my own structure. Each draws on a dated source, and the table says which.

## What do the companies check at intake?

Each buyer runs its own light version of an audit.

- **[micro1](/buyers/micro1).** micro1's David Revland, who works on human data, said in an undated recorded forum talk that a data manifest form asks which services you use and a rough size for each.

  He said micro1 supplies instructions for finding sizes (self-reported, talk date not stated). See [what a data manifest form is](/answers/what-is-a-data-manifest-form).
- **[Handshake AI](/buyers/handshake-ai).** Its [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) runs an estimator that asks for headcount, years in operation and country, then describes a scoping call on data parameters, de-identification, terms and timeline.
- **Troveo.** Its first step is [Scope](https://www.troveo.ai/business-data), which it describes as deciding what is in and what is out. Anonymizing follows, documented in a manifest.

## What does Frankfurt Kurnit say to check?

[Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) lists the review steps. Involve legal, privacy, security, HR and communications people. Inventory systems, record types, volume and timeframes.

Review customer, partner, vendor and platform terms. Exclude categories such as privileged material, HR files, payroll, health information, union communications and customer confidential data. Document the review.

## What are the five parts of an audit?

| Part | What it checks | Source behind it |
|---|---|---|
| Inventory | Systems, plan tier, who administers it, size, years covered | Revland (micro1), undated forum talk, FKKS |
| Rights | Contracts, notices and third-party content that touch the records | FKKS |
| Sensitivity | Categories to exclude before any transfer | FKKS |
| Thresholds | Headcount, volume, years, language, location | Buyer pages above |
| Buyer fit | Which buyer's published terms match the records | Buyer pages, our [buyer directory](/buyers) |

The table rows for rights and sensitivity are fact-gathering. Whether a record may be licensed is a decision for counsel. The [rights check](/rights-check) asks seven questions on it.

## Where do the numbers come from?

My [1 TB page](/answers/does-my-company-have-1-tb-of-data) and [inventory template](/answers/company-data-inventory-template) show the columns to fill in. The [readiness checklist](/answers/data-readiness-checklist) lists the published thresholds.

## Who runs the audit?

You can. Start with the inventory and the thresholds, then hand the rights and sensitivity rows to counsel. Or use [managed readiness](/managed-readiness), our optional paid service.

It builds a buyer one-pager, a systems inventory, questions for your counsel, a buyer shortlist with each buyer's current criteria and a term-question checklist from descriptions and counts, never records.

It takes 2 to 3 weeks with two rounds of revisions, and every legal question goes to your lawyer in writing.

The audit can end in a no. A company may fall outside every buyer's thresholds, and nothing here promises a buyer or a price. Talk to a privacy or commercial lawyer in your state before you sign.

micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure)

Figure: steps Inventory and rights -> Mark records, test thresholds -> Match buyers. Our data licensing audit runs from an inventory of systems to a match with buyers.

[Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships)

_Paid link. [How we are paid](https://vaultfish.com/disclosure)_

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [data partnerships page](https://joinhandshake.com/ai/data-partnerships/)
- [Scope](https://www.troveo.ai/business-data)
- [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)