# How Mercor uses your company data > How Mercor uses your company data: the connectors it asks for, the automated name removal, who it says sees it, pay, and the March 2026 breach. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-mercor-uses-your-company-data Published: 2026-08-28 Updated: 2026-10-14 [Mercor](/buyers/mercor) says it connects to your work accounts and pulls out the data. It says an automated pipeline removes names and details. Then Mercor licenses the result to AI labs. It says no lab or outside vendor sees your raw data. It pays by wire after the anonymized dataset is delivered. > **Data licensing means a company gets to use your records for a while, under rules. You keep ownership.** Think of renting a room you never use. The guest stays under house rules, and you keep the house. All of that comes from [Mercor's own data page](https://www.mercor.com/data/). Mercor also had a security incident in March 2026 that exposed contractor data. We cover it below. For the pricing and offers around the program, see [Mercor data licensing](/answers/mercor-data-licensing). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) ## What data does Mercor ask for? Workflow data from the tools a company uses daily. [Mercor's data page](https://www.mercor.com/data/) names Slack, Microsoft Teams, Gmail, Confluence, Salesforce, Outlook, GitHub, Google Drive and Notion. It says it supports 100+ tools. It also lists target industries with example records: - Legal contracts and case files - Healthcare records - Financial statements - Manufacturing logs - Real estate documents - Supply chain manifests Read that list twice. Healthcare records, case files and financial statements carry privacy and confidentiality duties of their own. Those are a question for your lawyer, not Mercor. ## How does Mercor collect it? Through connected accounts. The page describes four stages: scope, connect, process and payout. In the first, you choose what moves. The page says no data leaves your systems until you approve it. Then you link accounts. The page says credentials are held per session and never shared between connections. Connecting accounts means your platforms' own API terms apply. An API is a connection between two systems. The buyer can read whatever the connection scope allows. That is a different risk from handing over an export file. Troveo says it doesn't connect to your systems at all. See [the Mercor breach page](/answers/mercor-data-breach) for why the difference matters. ## What does Mercor say it does to the data? [Its page](https://www.mercor.com/data/) says the platform "extracts and de-identifies" your data into an asset. It says the extraction and anonymization are fully automated. It doesn't say what that means in practice. It names no standard, no method and no sampling. Whether names are removed or swapped is not stated. Neither is whether free text is checked. Ask for the specification in writing. A swap that keeps each person's stand-in consistent behaves differently from removal when someone tries to re-identify the records. ## Who receives it? The page says the dataset goes to "frontier AI" labs and names none. It says no AI lab buyer and no third-party vendor ever sees your raw data. Mercor's engineering team oversees the pipeline but does not manually review your data. All access is logged under strict internal controls. The only named buyer-side facts are bids on one archive. Mercor bid $7.5 million for Spirit Airlines' archive, and Google won the auction at $10 million, pending court approval, per [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) ([the Spirit sale timeline](/answers/spirit-airlines-data-sale)). Mercor also reportedly offered up to $300,000 to shuttered startups for chat, drive and email archives, per [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d). ## Does Mercor license your data or take it outright? [The page](https://www.mercor.com/data/) says "We license it, package it, and pay you for it." It publishes no contract. So it says nothing on exclusivity, term or what the license lets a lab do with derived data. It names no retention period and no deletion process. On the points that matter after signing, Mercor doesn't say. Figure: steps You connect accounts -> Mercor says it removes names -> Wire after delivery. Mercor says its pipeline runs without a person reading your raw data. ## What security does Mercor claim? Four things, per [its data page](https://www.mercor.com/data/): SOC 2 Type II, encryption in transit, encryption keys managed in AWS KMS, and an audit log of every access. We could not verify the audit's scope, the auditor or the test period. Then the incident. [Mercor said](https://www.mercor.com/blog/update-on-mercor-security-incident/) a poisoned release of the open-source LiteLLM library, live for a short window in March 2026, affected it. Mercor said the same release affected a significant number of other companies. [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) reported more than 40,000 current and former contractors and customers and about 4 TB of material. That included source code, a user database, video interviews and identity documents. [Mercor says](https://www.mercor.com/blog/update-on-mercor-security-incident/) the impact on customer information was very limited. A class action, *Ananthula v. Mercor.io Corp.*, was filed on 21 April 2026 in the Northern District of California. Its claims are allegations. No company-archive data was reported exposed. A buyer that holds many companies' records in one pipeline is a target. Its certificate is a claim to check. Ask for the SOC 2 report itself, read the scope and the dates, and ask who the auditor was. _A badge on a website is a nice start. The report behind it is the real thing._ ## How does Mercor pay? Mercor says pay depends on data volume, the tools you connect and the depth of the data. Connecting more tools generally pays more. [Its data page](https://www.mercor.com/data/) says payment is a wire "typically within 2-4 weeks" of the signed agreement, issued on delivery of the dataset to the buyer. It says it covers extraction, anonymization and transfer costs and takes no setup fee or deduction. No price list is published. Nothing here promises you a payout. ## What should you ask Mercor? - What connection scope do you need for each tool, and can it be read-only? - What does the name removal do to names, emails and free text? - How long is raw and processed data kept, and who deletes it? - Which labs can receive the dataset, and can they resell it? - Where is the SOC 2 report, and what does it cover? - If a breach touches my records, who notifies and who pays? See [who is liable if the buyer is hacked](/answers/who-is-liable-if-the-data-buyer-is-hacked). The evidence on the company is in [is Mercor legit](/answers/is-mercor-legit). The [rights check](/rights-check) comes before any account connects. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's own data page](https://www.mercor.com/data/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Mercor said](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [CourtListener docket, Deboni v. Mercor.io Corp.](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/)