# Who owns company emails?

> Who owns company emails? Owning the mailbox, owning what is inside it and having the right to license it are three separate questions with different answers.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/who-owns-company-emails  
Published: 2026-09-30  
Updated: 2026-10-14

## The short answer

Who owns company emails depends on which of three questions you mean. Who controls the mailbox is a contract and employment question. Who owns the contents is mixed: a mailbox mixes company writing with clients' and vendors' records. The right to license is separate. A lawyer can sort them.

People type this query before licensing, a shutdown or an employee dispute. The honest answer has layers.

## Who owns the mailbox?

Start with the provider's terms. The [Google Workspace terms](https://workspace.google.com/terms/premier_terms/) say "Customer retains all Intellectual Property Rights in Customer Data". [Slack's privacy principles](https://slack.com/trust/data-management/privacy-principles) say customers own their Customer Data.

Those lines settle the relationship between you and the provider. Between you and your employees, the answer sits in employment agreements and handbooks. A lawyer reads those.

## Who owns what is inside?

Several parties can have a claim to one thread. [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) says email and chat contain other companies' confidential information, often under NDAs.

The Spirit Airlines sale shows the pattern. A software vendor, [Springshot](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google), argued that part of the archive was data generated by its software under its contract. An engine maker, International Aero Engines, pointed to confidentiality agreements.

## How do you sort out who owns what?

Start by sorting the data into three groups:

- **First-party data** is what your company wrote.
- **Held-for-others data** is what you process for customers.
- **Third-party data** is content from partners, guests and shared channels.

[Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data), a law firm, says a data provider should offer representations that it has sufficient rights to license the dataset. It adds that the provider should offer indemnification for third-party claims. A mailbox that mixes the three groups makes that representation hard to give.

## Does owning it mean I can license it?

Not by itself. Ownership and the right to license are separate questions. [California's CCPA](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) treats disclosing personal information for "monetary or other valuable consideration" as a sale, whoever owns the mailbox.

Work through [your NDAs](/answers/does-my-nda-let-me-sell-data-to-ai), [employee privacy](/answers/can-i-sell-employee-emails-to-ai) and [privileged material](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) before any offer.

Our [rights check](/rights-check) asks whether a policy says the company owns work communications. If you are weighing a license of the archive itself, [licensing company emails to AI](/answers/sell-company-emails-to-ai) covers buyers, exclusions and a sample mailbox inventory.

Talk to a privacy or commercial lawyer in your state before you sign.

Figure: comparison of Three questions that sound like one: Own the mailbox (Contract, employment), Own the contents (Split among parties), Right to license (emphasized: Separate from mailbox ownership, Its own question). The right to license is its own question, separate from who owns the mailbox.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [Google Workspace terms](https://workspace.google.com/terms/premier_terms/)
- [Slack's privacy principles](https://slack.com/trust/data-management/privacy-principles)
- [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)
- [Springshot](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google)
- [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data)
- [California's CCPA](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)