# Is it safe to license company data to AI?

> Asking whether it's safe to sell company data to AI? In a license, risk sits partly with whoever handles raw data. Mercor's March 2026 breach is the test case.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-it-safe-to-sell-company-data-to-ai  
Published: 2026-07-03  
Updated: 2026-10-14

## The short answer

The published evidence says the risk is real. Many buyers handle raw data before de-identification. In March 2026 a supply-chain attack hit data buyer Mercor and exposed about four terabytes, including SSNs of over 40,000 contractors. Ask any buyer where raw data sits and who deletes it.

"Safe" is a fair question with no single answer. So here is what is on the record, with dates. You can use it to ask any buyer better questions.

## What happened at Mercor?

[The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) reported that tainted releases of the LiteLLM library were available for roughly 40 minutes. The Next Web reported that thousands of companies were affected, and [Mercor](/buyers/mercor) confirmed it was one of them. The outlet reports about four terabytes exposed. That included the names and Social Security numbers of more than 40,000 contractors and customers.

[Hausfeld](https://www.hausfeld.com/what-we-do/current-claims/mercor-data-breach), a plaintiffs' firm, dates the intrusion to on or about 24 March 2026. The [Business and Human Rights Resource Centre](https://www.business-humanrights.org/en/latest-news/usa-ai-startup-mercor-sued-over-hiring-practices-and-contractors-data-handling/) lists claims about the breach. It also lists claims about how Mercor handled applicant and contractor data. Mercor said it strongly disputes the claims. These are allegations, and no court has ruled.

## How do the companies move the data?

Each buyer describes its own method, and these are self-reported.

| Company | How it says data moves |
| --- | --- |
| micro1 | Its forward-deployed engineering team helps run the transfer with your IT people. Its CFO said this takes about 10 hours of one or two IT people over a week or two (undated recorded forum talk) |
| Mercor | [100+ integrations](https://www.mercor.com/data/) pull the data. Extraction and anonymization are automated |
| Troveo | No OAuth into your systems. The owner exports |

Mercor's page says no AI lab buyer or third-party vendor ever sees your raw data. That is a claim, and the buyer's own pipeline still handles it.

Models differ by buyer. [Polyshares](/buyers/polyshares) says a specialist partner de-identifies the data. Its data handling page says two Polyshares people can see an unmasked record ([page](https://polyshares.com/data-handling)). Ask each buyer which model it uses. See [how fast de-identification should finish](/answers/data-deidentification-timeline-after-extraction).

## What does a micro1 referral partner say about safety?

In a [micro1](/buyers/micro1) video, a micro1 referral partner said anonymization plus the licensing agreement let almost any company take part and "sleep good at night" (self-reported, about 13:46). She added that no company has had a privacy or data-security issue, which I can't verify. She earns from referrals.

The video describes no contract term. Ask for the anonymization method and the agreement text before you rely on either.

## What do law firms advise?

[Frankfurt Kurnit Klein and Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) gave this advice:

- Limit access to raw data before de-identification.
- Keep buyers out of your systems.
- Require certification of the de-identification to your satisfaction.

## What can I check before I agree?

Ask who touches the raw data, where it sits, how long it stays, and who deletes it. Ask what certifications exist and what they cover. The [SOC 2 page](/answers/do-i-need-soc-2-to-sell-data-to-ai) explains them.

The [buyers page](/buyers) compares what each buyer publishes. The [rights check](/rights-check) lists what to settle before a call. Our [managed readiness service](/managed-readiness) walks through your export method and access logging. We never take your data.

Figure: comparison of Three transfer routes buyers describe: Owner export (Buyer moves it), Buyer connector (Buyer pulls it), Direct delivery (emphasized: Raw data skips the buyer, Owner to buyer). Only direct delivery keeps the raw data out of the buyer's hands, by the buyers' own descriptions.

Talk to a privacy or commercial lawyer in your state before you sign.

[Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships)

_Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk)
- [Hausfeld](https://www.hausfeld.com/what-we-do/current-claims/mercor-data-breach)
- [Business and Human Rights Resource Centre](https://www.business-humanrights.org/en/latest-news/usa-ai-startup-mercor-sued-over-hiring-practices-and-contractors-data-handling/)
- [100+ integrations](https://www.mercor.com/data/)
- [polyshares.com](https://polyshares.com/data-handling)
- [Frankfurt Kurnit Klein and Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)