Is it safe to license company data to AI?
The short answer
The published evidence says the risk is real. Many buyers handle raw data before de-identification. In March 2026 a supply-chain attack hit data buyer Mercor and exposed about four terabytes, including SSNs of over 40,000 contractors. Ask any buyer where raw data sits and who deletes it.
"Safe" is a fair question with no single answer. So here is what is on the record, with dates. You can use it to ask any buyer better questions.
What happened at Mercor?
The Next Web reported that tainted releases of the LiteLLM library were available for roughly 40 minutes. The Next Web reported that thousands of companies were affected, and Mercor confirmed it was one of them. The outlet reports about four terabytes exposed. That included the names and Social Security numbers of more than 40,000 contractors and customers.
Hausfeld, a plaintiffs' firm, dates the intrusion to on or about 24 March 2026. The Business and Human Rights Resource Centre lists claims about the breach. It also lists claims about how Mercor handled applicant and contractor data. Mercor said it strongly disputes the claims. These are allegations, and no court has ruled.
How do the companies move the data?
Each buyer describes its own method, and these are self-reported.
| Company | How it says data moves |
|---|---|
| micro1 | Its forward-deployed engineering team helps run the transfer with your IT people. Its CFO said this takes about 10 hours of one or two IT people over a week or two (undated recorded forum talk) |
| Mercor | 100+ integrations pull the data. Extraction and anonymization are automated |
| Troveo | No OAuth into your systems. The owner exports |
Mercor's page says no AI lab buyer or third-party vendor ever sees your raw data. That is a claim, and the buyer's own pipeline still handles it.
Models differ by buyer. Polyshares says a specialist partner de-identifies the data. Its data handling page says two Polyshares people can see an unmasked record (page). Ask each buyer which model it uses. See how fast de-identification should finish.
What does a micro1 referral partner say about safety?
In a micro1 video, a micro1 referral partner said anonymization plus the licensing agreement let almost any company take part and "sleep good at night" (self-reported, about 13:46). She added that no company has had a privacy or data-security issue, which I can't verify. She earns from referrals.
The video describes no contract term. Ask for the anonymization method and the agreement text before you rely on either.
What do law firms advise?
Frankfurt Kurnit Klein and Selz gave this advice:
- Limit access to raw data before de-identification.
- Keep buyers out of your systems.
- Require certification of the de-identification to your satisfaction.
What can I check before I agree?
Ask who touches the raw data, where it sits, how long it stays, and who deletes it. Ask what certifications exist and what they cover. The SOC 2 page explains them.
The buyers page compares what each buyer publishes. The rights check lists what to settle before a call. Our managed readiness service walks through your export method and access logging. We never take your data.
Talk to a privacy or commercial lawyer in your state before you sign.
Apply to micro1's data partnership (paid link)micro1's own data-partnerships pagePaid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
