# How to prepare company data for AI licensing

> How to prepare company data for AI licensing: a five-item packet, what intake forms ask first, who does the scrubbing, and the rights step.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-to-prepare-company-data-for-ai-licensing  
Published: 2026-08-13  
Updated: 2026-10-14

Build a one-page packet before any first call, and leave the scrubbing to the company you license to. The packet lists:

- The systems you run
- The oldest record and a rough size in each
- Whose words sit in them
- What stays out
- Who can run the exports

Why not scrub first? [micro1](/buyers/micro1) staff said in an undated recorded forum talk that companies can't pre-scrub. micro1's method swaps names for matching stand-ins across tools and needs the original links intact.

Preparing here means gathering facts and checking rights. It does not mean data engineering. This guide covers the packet, what intake forms ask first, the scrubbing question and the rights step.

Your counsel owns the rights step. Most facts below come from micro1, Troveo, Mercor and Handshake AI themselves.

> **Data licensing means a company gets to use your records for a while, under rules. The contract says who keeps ownership.** Think of clearing out an attic before a guest stays. You list what's up there and what stays locked. The guest does the dusting.

## Which five items go in the packet?

1. **Systems and owners.** List every tool where work gets recorded. That means email, chat, CRM, helpdesk, project boards, documents, call recordings and code. Next to each, write the name of the person who runs it and can pull an export.
2. **Dates.** Note the oldest record you still hold in each system, and any gaps.
3. **Rough size per tool.** micro1's data manifest form, as micro1's David Revland described it in an undated recorded forum talk, asks which services you use and a rough size for each.

   The talk gives steps for finding sizes, for example in Google Drive. Our page on [checking your Google Drive size](/answers/micro1-google-drive-data) shows where. Screenshot any total with the date visible.
4. **Whose words.** Staff, customers, partners, contractors and guests in shared channels. Note any contract, NDA or tool term that mentions secrecy, data use or AI.
5. **Exclusions.** List the categories that stay out of any deal. Your counsel signs off on them.

The [ten-minute check in the worth guide](/guides/how-much-is-your-business-data-worth-to-ai) has a template for the first four items. The [readiness checklist](/answers/data-readiness-checklist) lists the thresholds each program publishes.

Figure: steps List your systems -> Mark exclusions -> Counsel review. Your counsel signs off on what stays out.

## What do intake forms ask first?

Each company opens with a different slice of the packet.

| Company or marketplace | First ask | Source |
|---|---|---|
| micro1 | Which services you use and rough sizes per tool, on a data manifest form | Recorded forum talk, date not stated |
| Troveo | Data estimate details, with no access to your systems | [Business data page](https://www.troveo.ai/business-data) |
| Mercor | Which tools to share, from 100+ supported connectors | [Data page](https://www.mercor.com/data/) |

[Mercor](/buyers/mercor) connects to the tools you choose. [Troveo](/buyers/troveo) says you need no access to start. Keep raw data in your own systems until a signed agreement says who receives it.

Our page on [the data manifest form](/answers/what-is-a-data-manifest-form) explains micro1's version.

## Should you scrub the data first?

The companies say the cleaning is their job.

Revland said in an undated recorded forum talk that micro1 swaps each person for the same stand-in in Slack and in Google Workspace. That way the role and the trail across tools survive.

micro1 staff said in the same talk that redacting first destroys that trail. [Mercor](https://www.mercor.com/data/) says extraction and anonymization are automated and it covers the cost.

[Handshake AI](https://joinhandshake.com/ai/data-partnerships/) says it removes direct and indirect identifiers before delivery. The partner stays responsible for the legal side of its transfer.

[Troveo](https://www.troveo.ai/business-data) says it scrubs names, contact details, credentials and client identities under one documented standard.

Removing names from emails and chats is hard. Counsel warns that text with the names removed can still reveal sensitive details about people or small groups ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Our pages on [removing names from data](/answers/data-de-identification) and [micro1's name swapping](/answers/micro1-pii-transformation) go further. The [anonymization guide](/guides/data-anonymization) covers the legal tests.

What you can do early is decide what stays out of scope. Leaving something out costs less than scrubbing it.

## What does the rights step involve?

Your counsel owns this step. We judge no contract. Daniel Goldberg, a partner at [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), listed what a company reviews before a data deal:

- Whether you own or control the data. Email and chat hold third-party information, often under NDAs.
- Trade secrets and privileged messages.
- Your privacy policy and employee handbook, and [the FTC's view](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) of quiet retroactive changes.
- Privacy laws such as the CCPA, and sector rules for health or financial records.
- Section 7 of the [National Labor Relations Act](https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/interfering-with-employee-rights-section-7-8a1). It can protect employee talk about pay and conditions.
- The limits of removing names.

His process advice has four parts. Gather legal, privacy, security, HR and communications people. List the sources. Confirm ownership through vendor contracts. Define exclusions and write down the review.

Your packet is the raw material for that review. The [rights check](/rights-check) asks seven questions on the same ground. [What data you can't license to AI](/answers/what-data-can-i-not-sell-to-ai) lists the categories that usually come out. The [risk map](/risks) shows where deals break.

_A packet with a clear "no" column beats a packet that says yes to everything. Lawyers like it, too._

## Who needs to be involved on your side?

You need one person with admin rights per system. Add whoever speaks for legal and HR. micro1's CFO estimated, in an undated talk, the transfer at about 10 hours of work over a week or two, from one or two IT people (self-reported).

Name your export owner early and the wait gets shorter. See [how long it takes to license company data](/answers/how-long-does-it-take-to-sell-company-data).

## Where does the packet go?

Counsel first. Then the free [fit check](/business) and the [buyer directory](/buyers), which lists each buyer's published terms.

Want the packet built as a dated, sourced file? [Managed readiness](/managed-readiness) does that as an optional paid service.

It turns descriptions and counts into a buyer one-pager, a systems inventory, questions for your counsel, a buyer shortlist and a term-question checklist in 2 to 3 weeks, and hands every legal call to your counsel. It can end in a no.

The [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies) covers the full process. Talk to a privacy or commercial lawyer in your state before you sign.

micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure)

[Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships)

_Paid link. [How we are paid](https://vaultfish.com/disclosure)_

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [Business data page](https://www.troveo.ai/business-data)
- [Data page](https://www.mercor.com/data/)
- [Handshake AI](https://joinhandshake.com/ai/data-partnerships/)
- [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)
- [the FTC's view](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive)
- [National Labor Relations Act](https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/interfering-with-employee-rights-section-7-8a1)