# Vaultfish: the full text > 22 guides, the price study, 28 buyer profiles and 248 short answers on getting company data ready to license to AI labs, as markdown, in that order. Index of everything published: https://vaultfish.com/llms.txt Each guide also lives at https://vaultfish.com/guides/ and each answer at https://vaultfish.com/answers/, each with a markdown twin at the same URL plus ".md". Buyer profiles live at https://vaultfish.com/buyers/. Cite the canonical URL each document names, never this file. Nothing here is legal advice. The fit check, a discovery call, tools, guides and introductions are free to your company. Managed readiness is optional, scoped and quoted in writing before you pay. micro1 may pay us a referral fee if a company we introduce goes ahead with it. We never take a percentage of your deal, and we do not negotiate for you. https://vaultfish.com/disclosure explains how we are paid. --- # How much is your company data worth to AI? > No price list exists for company data. What moves its value, what public deals and buyer calculators show, and a ten-minute check to run on your own records. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-much-is-your-business-data-worth-to-ai Published: 2026-10-07 Updated: 2026-10-14 Nobody can give you a reliable price for company data today. The public record holds a handful of deals and a few buyer calculators that disagree widely. It also holds a short list of things that move the number. > **Data licensing means a company gets to use your records for a while, under rules. You keep ownership.** Think of the attic. You can't price the boxes until you know what is in them, how old they are and whose they are. A ten-minute look at your own records will tell you more than any estimate form. The check is at the bottom. The full process is in the [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies). ## Why is there no rate card for what company data is worth? [Troveo](/buyers/troveo) says there is [no public price list](https://www.troveo.ai/resources/sell-data-to-ai-companies), and no public per-record, per-token or per-workflow-hour rate for business data exists yet. [micro1](/buyers/micro1) states deal tiers. It also says [compensation depends](https://www.micro1.ai/data-partnerships) on dataset size, workflow complexity, data quality and domain expertise. Part of the reason is that the buyer side shares little detail. Marketplaces name buyers in generic terms. Epoch AI's review of RL environments describes app replicas and lab partnerships with product companies, and does not discuss real company archives ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). So every number below is a deal, a bid or a company's own claim. None is a rate you can multiply by your headcount. ## What moves the value? **History.** Buyer calculators take headcount and years of history as inputs. Count the period your records actually cover, not the company's age. **Volume.** The Spirit archive was described in counts: about 100 million emails, 500 million Teams chats and about 30 million lines of code ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). Counts are the language of the conversation. **Context.** This one is our read, and no published price proves it yet. micro1's CFO and Troveo's guide both point to records of real work: a problem, the steps and the result. Whole threads that show that arc should be worth more than loose fragments. **Rights.** A record you have no right to license has no value to a buyer, so rights set the ceiling. Counsel's list covers third-party confidentiality, trade secrets, privilege and employee talk the US labor law protects ([counsel's list](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). **Buyer demand.** Bids on Spirit rose from $7.5M to $12.5M. That points to demand. Supply is rising too. More than 350 companies have listed assets on SimpleClosure's hub since April ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). **Exclusivity.** Epoch's interviews put exclusive deals at roughly 4x to 5x the non-exclusive price for RL environments. Troveo says its exclusivity is time-limited and has to be earned. ## What do the public deals show? | Evidence | Figure | Read it as | |---|---|---| | Google, Spirit Airlines archive, August 2026 | $10M winning bid, still contested | One airline's archive, sale awaiting court approval | | micro1, Spirit, September 2026 | $12.5M later offer | Same archive, a related offer and not a separate deal | | SimpleClosure, 2026 | $10,000 to $100,000 per shut-down startup, nearly 100 deals | Small startups ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)) | | Cielo24, a shut-down captioning company's Slack messages, email and Jira tickets | "Hundreds of thousands of dollars" | One reported case, from Forbes via [Slashdot](https://yro.slashdot.org/story/26/04/18/014244/shuttered-startups-are-selling-old-slack-chats-emails-to-ai-companies) | | Mercor, shuttered startups | Offers reported up to $300,000 per startup | [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) | | micro1 | Tiers of $100K+, $500K+ and $1M+, and $100K-$2M+ for approved data packages | Self-reported, from [its page](https://www.micro1.ai/data-partnerships) and its [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) | | Troveo | Full-company deals "start at six figures" | Self-reported ([Troveo](https://www.troveo.ai/business-data)) | | Epoch's RL environment review | About $20,000 for a website clone, figures around $300,000 for a Slack-grade clone, $200 to $2,000 per task | What labs pay to build environments, a different product from your archive | **$10,000 to $100,000** What shut-down startups got per company, across nearly 100 deals ([source](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)) The Spirit sale is still before the bankruptcy court, with no sale order. The flight attendants' and pilots' unions objected. EPIC filed a brief on 2 Oct 2026 ([EPIC](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/)). On 5 Oct 2026 the court-appointed privacy ombudsman recommended approval from a privacy view. Her report says she did not examine risks to employees or third parties ([ombudsman report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf), [Bloomberg Law](https://news.bloomberglaw.com/ip-law/spirit-data-sale-to-google-passes-muster-privacy-ombudsman-says)). The hearing was moved from 14 Oct to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. The [deals tracker](/deals) follows each public figure. ## Why do calculators disagree on what business data is worth? Each calculator runs on its own assumptions, so the same company gets very different answers. Troveo's calculator shows $800K to $1M by default, with employee tiers from 20 to 1,000+ ([Troveo](https://www.troveo.ai/business-data)). Other estimate forms I tested gave ranges far from that for similar inputs, and some showed a number before I entered anything. These tools run on headcount, founding year and sometimes revenue. micro1 says pay depends on dataset size, workflow complexity, data quality and domain expertise ([micro1](https://www.micro1.ai/data-partnerships)). A headcount form asks for none of those. Most calculators sit in front of a lead form that collects your name, email, phone and website, then books a call. That is how the buyer finds its next deal. Use a calculator to start a conversation. Treat the number as a hint about the buyer's pitch. _A calculator that gives you a number before it asks what you have is guessing. Politely._ ## Run the ten-minute readiness check Set a timer and open a blank doc. Write one block per system, using the template below. 1. **Systems.** List every tool where work gets recorded: email, chat, CRM, helpdesk, project boards, docs, call recordings, code. Note who can export each one. 2. **Years.** Write the date of the oldest record you still hold in each system, and any gaps. 3. **Counts and size.** Estimate the number of items per system, such as tickets, threads, deals and messages. Add the storage each system uses. micro1's pages state no data-size threshold, but a storage count helps you describe your records. Screenshot wherever the tool shows a total, with the date visible. Then you can show evidence, not a recollection. 4. **Rights.** Write whose words are in each system: staff, customers, partners, contractors. Note which contracts mention confidentiality or data use. Note whether your tool's terms restrict export or AI use. 5. **Exclusions.** Mark what stays out: anything under NDA, trade secrets, privileged conversations and employee talk the US labor law protects. Mark personal data about customers too. Removing names from it is harder than it sounds. ```text System: [tool name] Oldest record: [date] Approximate count: [number and unit] Whose words: [staff / customers / partners / contractors] Restrictions: [contracts, tool terms, privacy policy] Exclude: [what stays out] Screenshot saved: [yes / no] ``` Don't change your privacy policy or customer terms to cover this after the fact. The FTC calls quiet retroactive changes for AI training potentially unfair or deceptive ([FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive)). Ask a lawyer how to handle your own terms. ## What to do with the sheet Bring it to a lawyer first, because rights decide what is on the table at all. Then bring it to a buyer or data program. The stated thresholds differ. micro1's pages say 30 or more employees, with mature operations. Handshake AI's referral page says 20 or more full-time employees, and Troveo states no minimum. Check yours. The free [fit check](/business) is the next step. The [buyer directory](/buyers) lists the buyers side by side. If your business runs a community, a course library or a podcast, the people in that content hold rights too. The [guide to licensing your business's content to AI](/guides/license-your-business-content-to-ai) covers members, clients and guests. The pillar guide has the [contract checklist and red flags](/guides/how-to-sell-company-data-to-ai-companies) to read before any call. If a buyer quotes you a number, ask what it is built from. ## Do this safely Run the [rights check](/rights-check) before any buyer sees your sheet. It asks seven questions about whose words sit in your systems and what your contracts say. The [risk map](/risks) covers the legal and security failure points for data owners. Keep raw exports in your own systems until a signed agreement says who receives them. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [no public price list](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [compensation depends](https://www.micro1.ai/data-partnerships) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [counsel's list](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Slashdot](https://yro.slashdot.org/story/26/04/18/014244/shuttered-startups-are-selling-old-slack-chats-emails-to-ai-companies) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [Troveo](https://www.troveo.ai/business-data) - [EPIC](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/) - [ombudsman report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Bloomberg Law](https://news.bloomberglaw.com/ip-law/spirit-data-sale-to-google-passes-muster-privacy-ombudsman-says) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) - [FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) --- # How to license your company's data to AI companies > Searching how to sell your company's data to AI? You license it. Shut-down startups got $10,000 to $100,000. Who pays, what qualifies and the rights checks. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-to-sell-company-data-to-ai-companies Published: 2026-10-07 Updated: 2026-10-14 Yes, some AI companies pay for company records, but the public proof is thin. The one repeat price is $10,000 to $100,000 per shut-down startup, per [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916). People search for how to sell company data. In practice you license it. A working company has no public price yet. Most deals run through a marketplace, after you confirm you hold the rights. **$10,000 to $100,000** What SimpleClosure's nearly 100 deals paid per shut-down startup ([source](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)) That range is for a company closing its doors. No raw data leaves your building until a contract says so. The buyer numbers are self-reported, and this guide leans on public reporting, court filings and buyer pages. Check anything you plan to rely on. ## What do AI companies want from a business? Troveo, micro1 and Mercor list records of real work. A support ticket shows a problem, the steps taken and the result. A deal in your CRM (the system that tracks customers) shows the same arc. Labs and agent builders use records like these to build practice workplaces for AI agents, sometimes called RL gyms. The agent works through real Slack threads, tickets and email ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), [Futurism](https://futurism.com/artificial-intelligence/employer-selling-emails-train-ai)). Most marketplace pages keep buyers generic, as in "frontier AI lab." For the limits of this market, see [what can go wrong](/what-can-go-wrong). ## What qualifies, and what stays out? The companies list the same core material: - [micro1](https://www.micro1.ai/data-partnerships): written procedures, knowledge bases, CRM data and project histories. - [Troveo](https://www.troveo.ai/business-data): chat, email, documents, tickets, CRM and finance systems. Size and history matter too. micro1 asks for 30 or more employees, Handshake AI for 20 or more full-time employees and 3 or more years in operation, and Troveo states no minimum. The table shows where each says so: | Company | Stated minimum | Where it says so | |---|---|---| | micro1 | 30 or more employees, mature operations, primarily English documentation, US prioritized | [Data partnerships page](https://www.micro1.ai/data-partnerships) and its company referral page | | Handshake AI | 20 or more full-time employees and 3 or more years in operation | [Referral page](https://joinhandshake.com/ai/data-partnerships/referral) | | Troveo | No minimum stated | [Troveo](https://www.troveo.ai/business-data) | Acceptance at micro1 depends on its review and current demand. Confirm exceptions directly with micro1. What stays out is anything you lack the right to license. Your email and chat hold other companies' information, often under NDAs (confidentiality agreements). Counsel also flags trade secrets, waived privilege and employee talk protected by US labor law ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Your tools have terms too. Salesforce's 2025 Slack API terms bar bulk export and AI use of data pulled through its API (the connection other tools use) ([Hunton](https://www.hunton.com/insights/legal/salesforce-locks-down-slack-data-time-to-review-your-slack-api-terms)). Ask whether an admin's own export is treated differently. ## How does a deal work? Steps vary by buyer. This is the common shape. 1. **Assessment** List your tools, years of records and rough counts. 2. **Scope** Agree in writing which systems and dates are in or out. 3. **Preparation** Someone extracts the records and removes names. 4. **Contract and transfer** Sign first. Then the data moves. 5. **Payment** Assessment usually starts from counts and dates, not raw records. [Troveo](/buyers/troveo) says it needs no OAuth into your systems and no platform to install ([Troveo](https://www.troveo.ai/business-data)). Many buyers also run a short estimate form, then a call. Preparation differs a lot. Troveo says it scrubs names, contact details and client identities, and needs no sign-in access to your systems. Others connect read-only to the tools you approve. [micro1](/buyers/micro1)'s CFO said in an undated recorded forum talk that its engineers help your IT people with the transfer, about 10 hours of work over a week or two from one or two of your IT people. micro1's David Revland, who works on human data, said micro1 verifies the data before it pays. Revland also said micro1 swaps each name for a consistent stand-in, so roles and cross-tool trails survive. Its page says personal information "is removed when relevant." Ask each buyer which approach it uses and what it means for your people. Payment comes in four models: - **One-off transfer.** [SimpleClosure](/buyers/simpleclosure), whose terms give the buyer all right and title. - **Direct partnership.** micro1's corpus track covers a full archive of company records, paid under the agreed partnership. micro1 says companies keep ownership of their underlying data. - **Revenue share.** Troveo pays a cut of repeat deals. The split is unpublished. - **Deal revenue share.** Protege pays a revenue share when your content enters qualified deals ([Protege](https://withprotege.ai/data-provider/video)). Exclusivity changes the price. Epoch AI's interviews put exclusive deals at roughly 4x to 5x the non-exclusive price. [Troveo](https://www.troveo.ai/business-data) says its exclusivity is time-limited. ## What do the public figures show? There is no public price list, and [Troveo's own guide says so](https://www.troveo.ai/resources/sell-data-to-ai-companies). What exists is a short list of deals. - **Spirit Airlines archive.** Google's $10M bid won the 14 Aug 2026 auction, and court approval is pending. The archive held about 100 million emails, 500 million Teams chats and 30 million lines of code. [Mercor](/buyers/mercor) was the alternate at $7.5M ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). micro1 later offered $12.5M ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). - **SimpleClosure.** Nearly 100 deals in a year at $10,000 to $100,000 per shut-down startup ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)). - **Mercor.** Offers to shuttered startups reported at up to $300,000 each ([BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). - **micro1 and Troveo.** micro1 lists $100K+, $500K+ and $1M+ tiers. Troveo says full-company deals typically start at six figures. **The biggest number is still a bid:** The court has not approved the Spirit sale. Unions objected, saying stand-in names could let someone rebuild identities. EPIC filed a brief on 2 Oct 2026 ([EPIC](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/)). The court-appointed privacy ombudsman said on 5 Oct 2026 that approval would be appropriate from a privacy view. Her report says she did not reach any conclusion on risks to employees or third parties ([ombudsman report, Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf), [Bloomberg Law](https://news.bloomberglaw.com/ip-law/spirit-data-sale-to-google-passes-muster-privacy-ombudsman-says)). The debtors' notice ([Doc 1663](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1663.0.pdf)) first set the hearing for 14 Oct 2026, and it was later moved to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. Every public deal above is a distressed company selling a whole archive. None shows what a working company would get. The [value guide](/guides/how-much-is-your-business-data-worth-to-ai) covers what moves the number, and the [deals tracker](/deals) follows the public figures. ## Which companies take company data? Troveo is a marketplace that pays a revenue share. micro1 and Mercor deal with companies directly. SimpleClosure serves shutdowns. The [buyer directory](/buyers) covers each player neutrally, for all of them and more. Some companies in this market also pay people who introduce a business. Ask any comparison, this one included, whether its author gets paid when you sign up. Ours may be, and the [disclosure page](/disclosure) says how. ## Do you have the right to license your company's records? The largest risk sits in the archive. Your customers and employees wrote those messages, and your contracts may not let you license them. Removing names is harder than it sounds. The UK data regulator says pseudonymised data is still personal data for anyone who holds the extra information ([ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/)). A label like "Person 14" keeps the links between records. Law differs by place. The EU's [EDPB Opinion 28/2024](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf) requires anonymity claims to survive a test of "all the means reasonably likely to be used." The FTC calls quiet retroactive changes to terms for AI training potentially unfair or deceptive ([FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive)). Whether you need consent from employees and customers depends on your contracts and your state. That question comes before any buyer call. ## How do you do this safely? Three steps before any call, in this order: 1. **Run the [rights check](/rights-check).** Seven questions on whose words sit in your systems and what your contracts say. 2. **Read the [risk map](/risks).** It maps the legal and security failure points for data owners. 3. **Hold your raw data.** Keep exports in your own systems until a signed agreement says who receives them and when they are deleted. Check each buyer's security record too. Mercor says a supply chain attack in March 2026 exposed sensitive information for a very limited subset of its experts ([Mercor](https://www.mercor.com/blog/update-on-mercor-security-incident/)). ## What contract questions go to a lawyer? We are not lawyers, so read this as a list to bring to one. 1. **Scope.** Which systems and dates, and what is excluded. 2. **Payment.** One-off, revenue share or royalty, with the trigger in writing. 3. **Exclusivity.** How long, for which buyers, at what premium. 4. **Removing names.** Who does it, to what standard, and whether links survive. 5. **Raw data.** When it moves, over what access, and when it is deleted. 6. **Liability.** Who pays if a record leaks or a rights claim lands. 7. **Rights promises.** What you warrant about ownership and consent. 8. **Buyer limits.** What the buyer may do with the data, and whether it can resell. 9. **Term and exit.** How long the license runs and how it ends. 10. **Referral fees.** Whether anyone between you and the buyer takes a cut. ## What are the red flags? - **A payout clock.** A promise to pay within days usually starts once your data passes review, not at the first call. Ask what starts the clock. - **Headline ranges.** A headline range can sit far above what the same site's calculator returns. Ask what the range is built from. - **Urgency.** Posts saying owners who wait will get less cite no source. More than 350 companies have listed on SimpleClosure's hub since April, so supply is rising too ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). - **No terms or privacy policy.** If a buyer's terms or privacy page returns "not found," ask for the contract. Do not give any buyer read access before you have read it. ## Where do you start this week? Run the ten-minute check in [how much your business data is worth to AI](/guides/how-much-is-your-business-data-worth-to-ai). It gives you the counts every buyer will ask for. Then the free [fit check](/business) is the next step. If your business runs a community, a course library or a podcast, read [the guide to licensing your business's content to AI](/guides/license-your-business-content-to-ai) first. Members and guests hold rights the business may not. Then put the contract questions above in front of a lawyer before any buyer call. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Futurism](https://futurism.com/artificial-intelligence/employer-selling-emails-train-ai) - [micro1](https://www.micro1.ai/data-partnerships) - [Troveo](https://www.troveo.ai/business-data) - [Referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Hunton](https://www.hunton.com/insights/legal/salesforce-locks-down-slack-data-time-to-review-your-slack-api-terms) - [Protege](https://withprotege.ai/data-provider/video) - [Troveo's own guide says so](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [EPIC](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/) - [ombudsman report, Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Bloomberg Law](https://news.bloomberglaw.com/ip-law/spirit-data-sale-to-google-passes-muster-privacy-ombudsman-says) - [Doc 1663](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1663.0.pdf) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [EDPB Opinion 28/2024](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf) - [FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) - [Mercor](https://www.mercor.com/blog/update-on-mercor-security-incident/) --- # AI training data: where labs get it > AI training data is what models learn from and are tuned and tested on. Where labs get it, why public text is limited, and what company records add. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/ai-training-data Published: 2026-10-01 Updated: 2026-10-14 AI training data is the text, images, audio, video, code and records that a model learns from. Labs also use it to tune and test the model. Labs get it from six places: scraped web data, open datasets, platform and user data, made-up data, direct licensing deals and licensed data providers. Company records are the newest source. They add something public text lacks, a record of real work from start to finish. > **AI labs have read most of what is public.** Think of a library. The shelves are nearly read. Now the labs want to borrow how real work gets done. This guide covers the sources, the limits on public text and what a company's own archive adds. The licensing process lives in the [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) ## What counts as AI training data? Three jobs use it. Pre-training teaches a model from very large amounts of data. Post-training and fine-tuning shape its behavior with smaller, curated sets. Evaluations test it. Protege's pages describe its datasets as for "pre-training, post-training, fine-tuning and evals." Human work sits inside the second and third jobs. Experts write model answers, grade output and flag errors. Platforms such as Mercor, Surge AI, Scale AI and Turing pay people to do it. That is labor sold to a lab. Your existing records are a different product. ## Where do labs get their data? [Troveo](/buyers/troveo)'s guide lists six sources: scraped web data, open datasets, platform and user data, synthetic (made-up) data, direct licensing deals and licensed data providers ([Troveo](https://www.troveo.ai/resources/where-ai-labs-source-training-data)). Troveo sells licensed data, so read its ranking with that in mind. The same guide says made-up data fills gaps but "inherits the ceiling of the models that generate it." Labs use it as a supplement. On platforms, labs with their own user content use it. Labs without it pay for someone else's. Reuters reported in February 2024 that Google pays Reddit about $60M a year ([The Decoder](https://the-decoder.com/reddit-signs-60-million-annual-training-data-deal-with-google/)). Shutterstock's CEO said its AI licensing made $104M in 2023 ([Bloomberg Law](https://news.bloomberglaw.com/artificial-intelligence/shutterstocks-ai-licensing-business-generated-104-million)). ## Is public training text running out? Epoch AI estimated that the supply of good public human text could be fully used between 2026 and 2032, an 80% interval ([Epoch](https://epoch.ai/publications/will-we-run-out-of-data-limits-of-llm-scaling-based-on-human-generated-data)). It put the supply near 300 trillion tokens. It said heavier training on the same data could pull the date earlier. The range is wide, so treat the dates as a bracket. The count covers public text only. Licensed libraries and private company records sit outside it. That is why private data gets attention. ## What does company data add? It adds a record of how a real problem got solved. Who asked, which tools were used, what approvals came and what the result was. micro1's CFO described the prize in an undated recorded forum talk as the chain from a communication to a deliverable. David Revland, who works on human data at micro1, gave the example of a Slack message asking for a finance report, then the report in a spreadsheet. Fortune calls the recorded steps a trajectory ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). Labs and vendors use such records to build RL environments. These are simulated workplaces where an agent practices a job ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)). Google bid $10M for the Spirit Airlines archive. It held about 100 million emails, 500 million Teams chats and about 30 million lines of code ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). The sale was still before the bankruptcy court. ## What does the demand look like? Epoch interviewed RL environment vendors. A website-clone environment cost near $20,000. A Slack-grade clone cost near $300,000. Tasks ran $200 to $2,000. Exclusive deals ran roughly 4x to 5x the non-exclusive price ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). Those prices pay for environments and tasks that someone built. That differs from paying for an existing archive. Epoch's review does not discuss real company archives. That is the gap in the demand case. Marketplace copy rarely names a buyer. **Figure: A practice Slack costs about fifteen practice websites to build.** Two rows of squares for the price of one RL environment in Epoch AI's vendor interviews, each square worth $20,000. A practice website clone near $20,000 is one square. A practice Slack-grade clone near $300,000 is fifteen highlighted squares. Source: [Epoch AI vendor interviews](https://epoch.ai/gradient-updates/state-of-rl-envs). ## What happens when rights are unclear? Content has already produced large claims. Anthropic agreed in September 2025 to pay at least $1.5B to settle an authors' lawsuit. The suit covered about 500,000 books that the plaintiffs said came from piracy sites. That works out to roughly $3,000 per book ([NBC News](https://www.nbcnews.com/tech/tech-news/anthropic-settlement-lawsuit-authors-rcna229422)). That case is about books, and company records are a different kind of material. It shows why buyers and data owners both care where data came from and who agreed to its use. For company archives, the live dispute is the Spirit sale. The flight attendants' union and EPIC objected on privacy grounds ([EPIC](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/)). ## What is the owner's part? Rights come first. Your archive holds customers' and employees' words. Counsel flags third-party confidentiality, trade secrets, legal privilege and employee talk that US labor law protects ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Run the [rights check](/rights-check) and read the [risk map](/risks). Count your systems and years of records using the sheet in [how much your business data is worth to AI](/guides/how-much-is-your-business-data-worth-to-ai). Then take the free [fit check](/business). The [AI data licensing guide](/guides/ai-data-licensing) explains outright transfer versus license. [AI data companies](/answers/ai-data-companies) sorts the players. _Your old Slack has years of real work in it. The library has never seen it. Check the rights first._ Talk to a privacy or commercial lawyer in your state before you sign. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/resources/where-ai-labs-source-training-data) - [The Decoder](https://the-decoder.com/reddit-signs-60-million-annual-training-data-deal-with-google/) - [Bloomberg Law](https://news.bloomberglaw.com/artificial-intelligence/shutterstocks-ai-licensing-business-generated-104-million) - [Epoch](https://epoch.ai/publications/will-we-run-out-of-data-limits-of-llm-scaling-based-on-human-generated-data) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [NBC News](https://www.nbcnews.com/tech/tech-news/anthropic-settlement-lawsuit-authors-rcna229422) - [EPIC](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # How AI labs use company data > How AI labs use company data: what arrives, how names get swapped, what labs build with it, what you keep and what you can't take back. Buyer by buyer. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-ai-labs-use-company-data Published: 2026-09-30 Updated: 2026-10-14 AI labs use company data to train and test software agents. Your Slack threads, email chains, tickets and documents show how a real task moved from request to finished deliverable. Public text can't show a lab that path. The data usually arrives as an export or a connected account. A buyer swaps the names. A lab then builds practice tasks and scoring tests from it. > **Data licensing means a lab gets to use your records for a while, under rules.** Think of a library. The lab borrows real work to learn how work gets done. You keep the originals. You can't get a trained model back out of a lab. Most questions below trace to that. The public record on what happens inside a lab is thin. Buyers describe their own pipelines on their own pages, so those claims are self-reported. Where a buyer says nothing, we say so. ## What data actually arrives? Three collection methods show up across the buyers we read. [Mercor](/buyers/mercor) connects to your accounts. [Its page](https://www.mercor.com/data/) lists 100+ supported tools and says no data leaves your systems until you approve it. [Troveo](https://www.troveo.ai/business-data) asks for an export and says it needs no OAuth (a login link) into your systems. [micro1](/buyers/micro1) starts with a form that lists your tools and rough sizes. Its engineers then help your IT people with the transfer. The content is workplace records. [micro1 lists](https://www.micro1.ai/data-partnerships) SOPs, knowledge bases, CRM data, project histories and QA processes. [Troveo](/buyers/troveo) lists chat, email, documents, work tools, CRM and support, finance, and code on its business data page. micro1's CFO says labs want the chain: a request in chat, the spreadsheet that answered it, and the approval that followed. The CFO used a marketing budget request as the example in an undated recorded forum talk. Each buyer has its own guide, linked at the bottom. Start with [how micro1 handles it](/guides/how-micro1-uses-your-company-data) or [how Mercor handles it](/guides/how-mercor-uses-your-company-data). ## How do the companies change the data before a lab sees it? Every buyer says it removes or swaps personal details. The methods differ, and so does what is left behind. Troveo shows the cleanest example on its [business data page](https://www.troveo.ai/business-data). A sentence naming a customer and an email address becomes a sentence with PERSON-014 and EMAIL-019 in their place. micro1's David Revland, who works on human data, describes a similar swap in an undated recorded forum talk. A name becomes the same stand-in on every platform, so the role and the cross-tool trail survive. [micro1's page](https://www.micro1.ai/data-partnerships) says some datasets get synthetic rewrites. micro1 staff said in the same talk that companies can't clean the data first, because blanking names destroys the trail it needs. [Mercor](https://www.mercor.com/data/) says its extraction and anonymization is automated. [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) says it applies a structured process to remove direct and indirect identifiers. A swapped name can still point to a person. The [UK Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) says pseudonymised data is personal data in the hands of anyone who holds the extra information. [Handshake AI](/buyers/handshake-ai) says on its own page that no process of removing names eliminates re-identification risk entirely. The detail is in [micro1's name transformation](/answers/micro1-pii-transformation) and [pseudonymization versus anonymization](/answers/pseudonymization-vs-anonymization). Figure: steps Export or connect -> Lab trains or tests -> Model keeps what it learned. Settle what the model may keep before you export. ## What do labs build with it? Public reporting names three uses: reinforcement learning environments, agent training and evaluations. An [RL environment](/answers/what-is-an-rl-environment) is a practice space. A model attempts a task and an automated grader scores it. Time tied Google's Spirit Airlines bid to environments like that. Google told Time only that the data "can be helpful in improving our products and AI models." Fortune, reporting on micro1's offer for Spirit's records, wrote that an agent needs to learn how to choose actions, use tools and recover from mistakes. The record of those steps is a [trajectory](/answers/what-is-a-trajectory-in-ai). The third use is evaluation. micro1's workflows track has employees grade a general-purpose agent on their real daily work. micro1 receives the grade plus the agent's trajectory. The gap: no lab has published how it used a specific purchase. We have buyers describing plans. The longer read is [what AI labs do with company data](/answers/what-do-ai-labs-do-with-company-data). ## What do you keep? The companies split on this in their own words. Figure: comparison of What each company says about your data rights: micro1 (You retain ownership), Troveo (Ownership never transfers), SimpleClosure (emphasized: Perpetual and irrevocable, Perpetual license). Two say you keep ownership. A perpetual license never ends, so check the contract. [micro1's page](https://www.micro1.ai/data-partnerships) says companies retain ownership of their underlying data. [Troveo's licensing guide](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) says a license is permission and you keep ownership. [SimpleClosure's terms](https://simpleclosure.com/tos/) take a non-exclusive, transferable, sub-licensable, perpetual and irrevocable license to the assets you submit. Owning your files and the rights a buyer holds over its copy are separate questions. Read the contract for the second one. Our page on [what reps and warranties a buyer asks for](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) shows what you will be asked to promise. ## What can't you take back? Deleted files don't un-train a model. [Troveo's guide to licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) says models already trained survive the license ending. A [law firm checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) from Frankfurt Kurnit Klein and Selz says data that has trained a model cannot practically be pulled back out. A regulator can reach further than a contract can. In February 2024 the [FTC's order against Avast](https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over) required deletion of the browsing data sent to Jumpshot and of the algorithms derived from it. That was a consumer privacy case and not a company-archive deal. It still shows that a model is not always safe from an order. What a buyer will delete is a contract term. micro1 says data is retained only for a limited period under agreed retention policies, with deletion on request. Mercor's page says nothing on retention or deletion. [Deleting after training](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it) covers the three separate questions inside this one. _Deleting a file is easy. Un-teaching a model is a different job, and nobody has the button._ ## Where can it leak? Four places, in the order we would worry about them. 1. **The buyer's own security.** [Mercor said](https://www.mercor.com/blog/update-on-mercor-security-incident/) a malicious release of the open-source LiteLLM library in March affected it, and that the impact on customer information was very limited. [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) reported about 4 TB exposed, including source code, a user database and interview recordings. I found no report of company-archive data exposed. The facts are on [the Mercor data breach page](/answers/mercor-data-breach). 2. **Re-identification.** Swapped names plus context can point back to a person. 3. **Rights you did not hold.** Your customers' and employees' messages are inside the archive. You promise the buyer you had the right to share them. 4. **The people who can see files before the swap.** Ask who that is, in writing. Who pays if a buyer is hacked is usually a contract term. See [who is liable if the data buyer is hacked](/answers/who-is-liable-if-the-data-buyer-is-hacked). ## Which companies explain their handling? Six publish enough to read. Each guide covers what the company asks for, how it collects, what it says it does to the data and who gets it. It also covers ownership, retention, security, how it pays and what to ask. - [How micro1 uses your company data](/guides/how-micro1-uses-your-company-data) - [How Mercor uses your company data](/guides/how-mercor-uses-your-company-data) - [How Troveo uses your company data](/guides/how-troveo-uses-your-company-data) - [How Handshake AI uses your company data](/guides/how-handshake-ai-uses-your-company-data) - [How SimpleClosure uses your company data](/guides/how-simpleclosure-uses-your-company-data) - [How Defined.ai uses your company data](/guides/how-defined-ai-uses-your-company-data) The [buyers directory](/buyers) lines them up side by side. Before any call, run the [rights check](/rights-check) and read the [risk map](/risks). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Its page](https://www.mercor.com/data/) - [Troveo](https://www.troveo.ai/business-data) - [micro1 lists](https://www.micro1.ai/data-partnerships) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [UK Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [Troveo's licensing guide](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - [SimpleClosure's terms](https://simpleclosure.com/tos/) - [Troveo's guide to licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) - [law firm checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [FTC's order against Avast](https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over) - [Mercor said](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) --- # AI data licensing, and who actually pays for it > AI data licensing lets AI companies use your data on set terms. Outright transfer vs license, four kinds of data, who pays, and what an owner needs first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/ai-data-licensing Published: 2026-09-29 Updated: 2026-10-14 AI data licensing is a deal that lets an AI company use data you hold. In return you get a fee, a share of sales or a royalty. > **Licensing means a company gets to use your records for a while, under rules.** It is like renting out a room you never use. You keep the house. An outright transfer hands the data over once. A license pays each time the data is used, in [Troveo](/buyers/troveo)'s words. Before any of that, expect a buyer to ask for proof of your rights in every record. The market holds four kinds of data, and only one is company records. Most prices for that kind come from the buyers themselves. The full licensing process is in the [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies). ## What does AI data licensing cover? Four kinds of data change hands. Each has its own buyers and its own price evidence. **Content libraries.** News, images, forum posts and video. Reuters reported in February 2024 that Google pays Reddit about $60M a year for its data ([The Decoder](https://the-decoder.com/reddit-signs-60-million-annual-training-data-deal-with-google/)). Shutterstock's CEO said its AI licensing business made $104M in 2023 ([Bloomberg Law](https://news.bloomberglaw.com/artificial-intelligence/shutterstocks-ai-licensing-business-generated-104-million)). Yahoo Finance reported that Reddit's "other revenue," mainly data licensing, was $43M in the second quarter of 2026 ([Yahoo Finance](https://finance.yahoo.com/media-advertising/articles/reddits-data-licensing-revenue-grew-125000998.html)). **Expert work.** Platforms such as [Mercor](/buyers/mercor) and Scale AI hire people to write, grade and correct model output. That is paid labor, so no company records change hands. **Business content.** Video, audio and courses a company owns, such as a producer's archive, a training company's course library or a company podcast. Troveo and [Protege](/buyers/protege) license video, and Bloomberg reported buyers pay about $1 to $4 a minute for it ([Bloomberg via The Star](https://www.thestar.com.my/tech/tech-news/2025/01/13/youtubers-are-selling-their-unused-video-footage-to-ai-companies)). Our [guide to licensing your business's content](/guides/license-your-business-content-to-ai) covers consent from members, clients and guests. **Company records.** Email, chat, tickets, CRM history and code. This is the newest kind, and public prices are few. ## How is a license different from an outright transfer? Troveo puts it in one line: "A sale pays once. A license pays every time the data is used, and you keep ownership" ([Troveo](https://www.troveo.ai/resources/data-monetization-examples)). micro1, Troveo and Protege use the words loosely. [micro1](/buyers/micro1) pays under an agreed data partnership and says companies keep ownership of their underlying data. Troveo describes a revenue share on every deal, and it has not published the split. Protege describes revenue-share payments on qualified deals ([Protege](https://withprotege.ai/data-provider/video)). [Pricing models](/answers/data-monetization-pricing) shows the figures for each. [License company data to AI](/answers/license-company-data-to-ai) lists what to settle in the contract. ## What does Epoch AI say about the supply of public text for AI? Public text is a limited supply. Epoch AI estimated that the supply of good public human text could run out between 2026 and 2032 (80% interval) ([Epoch](https://epoch.ai/publications/will-we-run-out-of-data-limits-of-llm-scaling-based-on-human-generated-data)). For company records, the draw is a record of real work. micro1's CFO said in an undated recorded forum talk that the prize is the chain from a request to a finished deliverable. One example, from micro1's David Revland, is a Slack message asking for a report, plus the report itself. The demand case has one gap. Epoch's review of RL environments describes app replicas and lab partnerships with product companies, and does not discuss real company archives ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). ## Who takes company records, and on what terms? Direct programs include micro1, [Handshake AI](/buyers/handshake-ai) and Mercor's data arm. Troveo runs a marketplace. Google's $10M winning bid for Spirit Airlines' archive is pending court approval. [AI data companies](/answers/ai-data-companies) sorts the players by lane. [Who buys company data for AI](/buyers) compares the buyers. Stated figures come from the companies themselves. micro1's Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. Handshake AI says $100K to $4M+. SimpleClosure reported nearly 100 shutdown deals at $10,000 to $100,000. ## What does an owner need first? Three things, in order. 1. **A count.** List the systems you run, the years of records in each and the rough number of items. The ten-minute sheet is in [how much your business data is worth to AI](/guides/how-much-is-your-business-data-worth-to-ai). 2. **Rights.** Your email and chat hold other people's words, often under NDAs. Counsel flags trade secrets, legal privilege and employee talk that US labor law protects ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Run the [rights check](/rights-check). 3. **A plan to remove names.** [Removing names from data](/answers/data-de-identification) covers what each law test asks and who does the work in a deal. Then take the free [fit check](/business). If you want help preparing the records, see the [managed readiness service](/managed-readiness). Figure: comparison of Three kinds of data AI companies license: Content libraries (Many public deals), Video archives (Priced by the minute), Company records (emphasized: Newest kind, few public prices, Few public prices). So a price for company records is mostly the buyer's own claim. ## How should you read a company's own licensing claim? As a claim. Troveo's [business-data page](https://www.troveo.ai/business-data) shows "$20M+" paid to licensors and "4x" average sales per dataset. Troveo's number covers more than 7,000 rights holders across video, audio and other data. So it says little about business-data licensors ([Troveo press release](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html)). The same page counts 40+ active buyers. Calculators differ too, since each runs on its own assumptions about headcount and years of history. Ask what each number is built from, and who gets paid when you sign. ## What can go wrong? Removing names is the weak joint. A label like "Person 14" keeps the links between records. The flight attendants' union in the Spirit case objected to a requirement to preserve "referential integrity" ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). The [risk map](/risks) lists the other failure points for data owners. Check the buyer too. The [buyer directory](/buyers) and the [deals tracker](/deals) follow each player and each public figure. Talk to a privacy or commercial lawyer in your state before you sign. Their view on rights counts for more than any buyer's estimate. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [The Decoder](https://the-decoder.com/reddit-signs-60-million-annual-training-data-deal-with-google/) - [Bloomberg Law](https://news.bloomberglaw.com/artificial-intelligence/shutterstocks-ai-licensing-business-generated-104-million) - [Yahoo Finance](https://finance.yahoo.com/media-advertising/articles/reddits-data-licensing-revenue-grew-125000998.html) - [Bloomberg via The Star](https://www.thestar.com.my/tech/tech-news/2025/01/13/youtubers-are-selling-their-unused-video-footage-to-ai-companies) - [Troveo](https://www.troveo.ai/resources/data-monetization-examples) - [Protege](https://withprotege.ai/data-provider/video) - [Epoch](https://epoch.ai/publications/will-we-run-out-of-data-limits-of-llm-scaling-based-on-human-generated-data) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [business-data page](https://www.troveo.ai/business-data) - [Troveo press release](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) --- # How Defined.ai uses your company data > How Defined.ai handles supplier data: the consent proof it asks for, the license to share samples, the confidentiality terms, and what it doesn't say. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-defined-ai-uses-your-company-data Published: 2026-09-22 Updated: 2026-10-14 [Defined.ai](/buyers/defined-ai) runs a marketplace where a business lists datasets that AI developers can license. It asks suppliers to prove consent and the right to license the data. It takes a license to share data samples with prospective customers. It publishes its [supplier terms](https://defined.ai/supplier-program). We found no program built for a company's internal Slack and email archive. This guide reads differently from the others. Defined.ai handles packaged datasets that a supplier has already cleared. The handling terms live in its supplier agreement more than in marketing copy. Every claim below comes from Defined.ai's own pages, so treat it as self-reported. The product overview is in [the Defined AI data marketplace](/answers/defined-ai-data-marketplace). > **Data licensing means a company gets to use your records for a while, under rules.** Defined.ai is the library's front desk. You hand in books that are already cleared, and it lends them out. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) ## What data does Defined.ai ask for? Its [data partner page](https://defined.ai/partnerships) says any business that generates or aggregates data can apply. It takes audio, video, image, text or mixed data. Its [supplier terms](https://defined.ai/supplier-program) name four service types: data collection, crowd-as-a-service, evaluation of experience and reinforcement learning from human feedback. Its partnerships page says it wants content such as cinematic video, anime-style imagery, code and STEM material. It does not list workplace chat, email or CRM records. A company archive holds your employees' and customers' words. That raises the consent question the marketplace is built around. ## How does Defined.ai collect it? Suppliers apply and upload. The [partner page](https://defined.ai/partnerships) lists four reviews: account creation, a market review, a data quality review, and an ethics and compliance check. The compliance step asks for proof that the data is ethically sourced. That means proper consent, paperwork and the right to license it for AI training. There are no connectors and no exports run by Defined.ai. You package the data and you upload it. Figure: steps Account and market review -> Consent and quality checks -> Dataset listed. Defined.ai checks consent proof before a dataset goes live on the marketplace. ## What does Defined.ai say it does to the data? On supplier data, the pages we read don't say. The partnership page and the supplier terms don't mention anonymization or removing names and emails. Its ethics page covers the company's own contributor programs. It says Defined.ai uses data minimization, pseudonymization, encryption and access controls throughout processing. That describes data it collects from contributors. It is not a promise about a business's dataset. So the burden sits with the supplier. If your dataset has people in it, you must show consent. ## Who receives it? Customers. The [partner page](https://defined.ai/partnerships) says the marketplace serves startups and international AI heavyweights and names no one. The ethics page mentions clients in automotive, financial services, healthcare, gaming, robotics and retail. One term deserves attention before you list. The [supplier terms](https://defined.ai/supplier-program) grant Defined.ai a worldwide, free, non-exclusive and unencumbered license to share data samples with customers so they can judge interest. Samples leave before any customer licenses the dataset. ## Does Defined.ai license your data or take it outright? You license it. [The terms](https://defined.ai/supplier-program) describe the supplier relationship as non-exclusive, with no minimum commitment for business on either side. The partner page says usage follows defined licensing terms and agreed use cases. It doesn't say who holds derived models or whether a customer can resell. We found no mention of exclusivity pricing. ## What about retention and deletion? The pages don't set a retention period for datasets or a deletion process. The terms do set confidentiality. It runs for three years after the relationship ends. Materials go back within ten calendar days after termination. That binds both sides on confidential information. It is not a promise to delete your dataset from customers' hands. ## What security does Defined.ai claim? More than most buyers here. Its ethics page claims ISO/IEC 27001 and 27701 certification and an ISO/IEC 42001 certificate for AI management systems. Its [partner page](https://defined.ai/partnerships) says suppliers go through legal, compliance and cybersecurity checks. We did not verify the certificate scopes. The terms also require suppliers to follow Defined.ai's data protection policies as a non-negotiable condition. They let Defined.ai audit a supplier. ## Where does the risk sit? On the supplier. Under [the terms](https://defined.ai/supplier-program), you agree to defend, indemnify and hold harmless Defined.ai and its affiliates against third-party claims. In plain words, you protect them from lawsuits. Your liability under that clause is capped at two times the total value of the business conducted. The terms set no matching cap for Defined.ai and leave its side to a separate data license agreement. Read [reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) to see how these clauses work. ## How does Defined.ai pay? Defined.ai pays through licensing fees from marketplace deals. The commission is not published, and the terms state no revenue split. Defined.ai [reports](https://defined.ai/press-room/defined-ai-reports-sixty-five-percent-revenue-growth) 65% revenue growth in 2025. That is the company's own growth. Its [partnership page](https://defined.ai/partnerships) also quotes partner revenue, undated and unaudited. I leave those figures out, because they predict nothing for what your company would receive. _Someone else's revenue is a bad number to plan a budget around._ ## What should you ask Defined.ai? - What is the commission, and when am I paid? - Which data samples go to customers, and can I limit them? - What happens to my dataset when I delist it? - Are customers allowed to resell or build derived products? - What consent evidence is enough for my kind of data? - What does the 3-year confidentiality cover? Run the [rights check](/rights-check) first, and see the other buyers in the [buyers directory](/buyers). Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [supplier terms](https://defined.ai/supplier-program) - [data partner page](https://defined.ai/partnerships) - [reports](https://defined.ai/press-room/defined-ai-reports-sixty-five-percent-revenue-growth) --- # How Troveo uses your company data > How Troveo uses your company data: export-only collection, a documented scrubbing standard, confidential buyers, a license that keeps ownership, pay per deal. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-troveo-uses-your-company-data Published: 2026-09-21 Updated: 2026-10-14 [Troveo](/buyers/troveo) says you export your company data with its guidance. It scrubs names and identifiers to one documented standard, then licenses the result to AI buyers for you. Per its page, ownership never transfers, and you share in the revenue on every deal. Of the six buyers we read, Troveo asks for the least access to your systems. It also leaves the most open, because the standard is unpublished and the buyers are unnamed. Everything below is Troveo describing itself. For the program overview, see [Troveo business data](/answers/troveo-business-data). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) ## What data does Troveo ask for? Troveo started with video and audio and added company data in 2026. Its [business-data page](https://www.troveo.ai/business-data) lists system groups with named examples: - Chat and meetings, such as Slack, Teams, Google Chat and Zoom. - Email and calendar, such as Gmail and Outlook. - Storage, such as Google Drive, OneDrive, SharePoint and Dropbox. - Work tools, such as Jira, Linear, Asana, Notion and Figma. - Business systems, such as Salesforce, HubSpot, Zendesk, QuickBooks, Stripe, GitHub and Snowflake. The page says buyers pay a premium for work they can follow across channels. It says more systems and more years of history raise the value. ## How does Troveo collect it? By export. [The page](https://www.troveo.ai/business-data) says there is no OAuth into your systems and no platform to install. Troveo guides you through the export. Its stated process has four steps: 1. **Answer a few questions** You get an estimate. 2. **Agree standard terms** 3. **Names scrubbed, data packaged** 4. **Get paid** You hold the files until you send them. That keeps your platforms' connection (API) terms out of the picture. It also leaves you responsible for what you put in the export. ## What does Troveo say it does to the data? [It says](https://www.troveo.ai/business-data) it scrubs people's names, contact details, credentials and client identities under one documented standard. That happens before the data is put to work. Its page shows a before and after. A sentence naming a customer and an email address becomes one with PERSON-014 and EMAIL-019 in their place. The stand-ins in that example are consistent labels. That is pseudonymisation, and it keeps the trail across records. The same example also shows a file path replaced with a code. The page does not show the standard itself. Nobody outside Troveo can check it. Ask for the written standard before you sign. Ask whether the mapping from labels to real names is kept or destroyed. See [pseudonymization versus anonymization](/answers/pseudonymization-vs-anonymization). ## Who receives it? Unnamed buyers. [The page](https://www.troveo.ai/business-data) says your company is never named publicly. Buyers are introduced confidentially only after an agreement is signed. It mentions 40+ active buyers and describes them as a frontier AI lab, an AI startup and a Mag 7 company, without names. That protects your privacy. It also means you cannot judge a buyer before you commit. Ask whether you get a veto over a named buyer, or at least a category list. ## Does Troveo license your data or take it outright? It licenses. [The page's](https://www.troveo.ai/business-data) answer to who owns the data is "You do." Troveo licenses it on your behalf under terms you sign off on. > **Data licensing means a company gets to use your records for a while, under rules.** It's like renting out a room you never use. You keep the house. The page describes exclusivity as time-limited and something that has to be earned, with exit terms in the agreement. The license terms themselves are not published. Figure: comparison of What Troveo says about your data: Ownership (Stays with you), Buyers (Unnamed until signing), Scrubbing (emphasized: Ask for it in writing, Standard unpublished). Ask for the buyer names and the scrubbing standard in writing. ## What does Troveo say about retention and deletion? Troveo's business-data page does not address deletion. Troveo's [licensing guide](https://www.troveo.ai/resources/ai-data-licensing-deals) lists deletion at expiry among the terms to settle. It also says models already trained survive a license ending, because nothing can be untrained. That is Troveo describing the industry in general. What your agreement says is the only answer that counts. The wider picture is in [deleting after training](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it). ## What security does Troveo claim? Little. The page describes privacy design. It publishes no certification, no encryption statement and no breach process. The footer links a privacy policy and a support hub, and no security or terms page. We found no incident report. Ask for the security documentation you would expect from any vendor holding your records. ## How does Troveo pay? [The page](https://www.troveo.ai/business-data) says you share in the revenue on every deal, the first and later ones, and that companies pay no fees. The split is not published. It says typical full-company deals start at six figures. It shows an illustrative dataset licensed to several buyers, which is an example and not a real deal. Troveo says it has paid more than $20 million to licensors. That figure covers all its licensing, not only business data, and it predicts nothing about what your company would receive. See [Troveo revenue share](/answers/troveo-revenue-share). The page describes a repeat deal as a possibility. It promises you nothing. ## What should you ask Troveo? - Can I read the scrubbing standard, and does it cover free text and file paths? - Is the label-to-name mapping kept? - Can I see buyer categories or veto a named buyer before a deal? - What does the license let a buyer do with derived or enriched datasets? - What is deleted at expiry, and what is not? - What is the revenue split, and how often is it reported? Run the [rights check](/rights-check) first, and see [is Troveo legit](/answers/is-troveo-legit) for the evidence on the company. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [business-data page](https://www.troveo.ai/business-data) - [licensing guide](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Troveo: how much is company data worth](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [Troveo content owners](https://www.troveo.ai/content-owners) --- # Business data licensing, and who buys it > Business data licensing means letting AI buyers use your records, such as email, chat and tickets. What they look like, who buys and how a deal runs. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/business-data-licensing Published: 2026-09-16 Updated: 2026-10-14 Business data licensing means letting a buyer, now mostly an AI company, use your company's operating records. Those records are email, chat, documents, tickets, CRM history, finance records and code. > **Data licensing means a company gets to use your records for a while, under rules.** It's like renting out a room you never use. You keep the house. [micro1](/buyers/micro1) runs a data partnership program. Its CFO said in an undated recorded forum talk that it looks for the chain of work from a request to a deliverable across tools. Other companies named in public sources include [Handshake AI](/buyers/handshake-ai), [Mercor](/buyers/mercor) and Google. This guide is the company version of the topic. It covers what operating data looks like, who buys it, what a deal involves and what rules a business out. The full licensing process is in the [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies). Most payout figures below are self-reported. ## What counts as business data? The companies list the same kinds of systems. [Troveo](/buyers/troveo)'s page names these groups: chat and messaging, email and calendar, documents and files, work and knowledge tools, CRM, sales and support, business platforms, finance and operations, and data and code. It says internal custom systems can matter too ([Troveo](https://www.troveo.ai/business-data)). micro1 names SOPs (written work procedures), knowledge bases, CRM data and project histories ([micro1](https://www.micro1.ai/data-partnerships)). Buyers care most about the record of work. A single message matters less. Your tools hold that record in pieces, so the value sits in the trail across them. ## What does a valuable business record look like? micro1's CFO gave one example in an undated recorded forum talk. A team member asks for a marketing budget. The record shows the request, the analysis in a spreadsheet, the back-and-forth and the approval across Slack, email and Google Workspace. The CFO said the value is the path from request to approval across tools. The names and vendor line items matter less (self-reported). Fortune calls such a recorded sequence of steps a trajectory ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). A support ticket works the same way. It holds a problem, the steps and the resolution. _A trajectory is a paper trail with a fancier name._ ## Who buys it? - **Google** placed the $10M winning bid for Spirit Airlines' archive, pending court approval. The archive holds about 100 million emails, 500 million Teams chats and 30 million lines of code. The sale was still before the bankruptcy court ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). - **Handshake AI** says partnerships range from $100K to $4M+. - **Mercor** has a data arm with connectors to tools like Slack and Gmail. It has approached shuttered startups with offers reported up to $300,000 ([BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). - **Troveo** is a marketplace that licenses to buyers it rarely names. [Who buys company data for AI](/buyers) has the sources. [AI data companies](/answers/ai-data-companies) sorts the players by lane. ## Where does micro1 fit? [micro1](/buyers/micro1) runs company-data partnerships for AI development, with compensation under the agreed data partnership. Its Enterprise Data Partnership listing says $100K-$2M+ for approved data packages (self-reported). ## What does a deal involve? David Revland, who works on human data at micro1, walked through its corpus process in an undated recorded forum talk (self-reported). It starts with an introduction, a first call and a data manifest form. The form asks which services you use and rough sizes per tool. Then come a payment proposal, contract language, a transfer micro1's engineers help run, and payment after micro1 verifies the data. The CFO estimated, in an undated talk, about 10 hours over a week or two from one or two of your IT people. Other buyers differ. Troveo says it needs no OAuth access (login permission) to your systems. Mercor says its platform pulls data through connectors and removes names. Figure: steps Intro and first call -> Manifest form and contract -> Transfer, check, payment. micro1 pays only after it has checked the data. ## What does a business need to qualify? The stated minimums differ by company. micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. Handshake AI's referral page says 20 or more full-time employees and 3 or more years in operation. Firms whose records are mostly client files, such as law, accounting and healthcare practices, face the hardest rights questions. Much of what they hold is client material, and counsel decides what the firm can license. ## What can stop a deal? Rights come first. Your email and chat hold other companies' information, often under NDAs. Counsel also flags trade secrets, privilege and employee talk that US labor law protects ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Your tools have terms too. Salesforce's 2025 terms for the Slack connection tools use to pull data bar bulk export, persistent archives and use of that data in AI language models ([Hunton](https://www.hunton.com/insights/legal/salesforce-locks-down-slack-data-time-to-review-your-slack-api-terms)). Removing names is the other weak joint. In an undated recorded forum talk, Revland said micro1 swaps names for consistent stand-ins, and micro1 staff said companies cannot scrub first. [Data de-identification](/answers/data-de-identification) covers what the legal tests ask. ## Where does the money question stand? No public price list exists. Every public deal is a distressed company or a buyer headline. [Pricing models](/answers/data-monetization-pricing) shows the figures. [How much your business data is worth to AI](/guides/how-much-is-your-business-data-worth-to-ai) covers what moves a number. ## Where to start this week Write one block per system: the tool, the oldest record, the approximate count, whose words are in it and any restrictions. Run the [rights check](/rights-check), then take the free [fit check](/business). The [buyer directory](/buyers) and the [deals tracker](/deals) cover the players and the public figures. If you want help preparing the records, see the [managed readiness service](/managed-readiness). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [micro1](https://www.micro1.ai/data-partnerships) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Hunton](https://www.hunton.com/insights/legal/salesforce-locks-down-slack-data-time-to-review-your-slack-api-terms) --- # How do you monetize company data? > How to monetize company data: improve your work, wrap it into products or package it. Ranked by evidence, with dated AI-buyer prices and rights checks. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/monetize-company-data Published: 2026-09-15 Updated: 2026-10-14 You can monetize company data in three ways. Use it to improve how you work, wrap it into your products, or package information built from it as a product. MIT research found that on average 51% of the returns came from improving work, 31% from wrapping and 18% from selling ([MIT Sloan](https://mitsloan.mit.edu/press/data-everybodys-business-fundamentals-data-monetization)). Licensing records to an AI buyer is one of the newest kinds of data monetization. Its public prices are thin and mostly self-reported. Whichever route you pick, ask first: do you have the right to use the records that way? ## What does it mean to earn from company data? It means turning data you already hold into money or savings. The MIT researchers call the three ways improving, wrapping and selling. Improving is a stocked shelf or a faster ticket queue. Wrapping is a recommendation that helps a customer buy. In their terms, selling is information that solves someone else's problem. Those figures are averages across the firms studied, not a forecast for yours. They do show where to look first. > **Data licensing is one way to earn from records. A company gets to use them for a while, under rules.** Think of renting out a room you never use. You collect rent and keep the house. ## Which routes can earn from data you already hold? Here are five routes, ranked by how much public evidence supports each. The ranking is about evidence. It says nothing about payout. 1. **Improve your own work.** The best-evidenced route here, at 51% of returns in the MIT study. It needs your data and your team and no buyer. It is the least glamorous finding on this page and the best supported. 2. **Wrap data into your product.** 31% of returns in the same study. Think recommendations, benchmarks or alerts inside the products you already offer. 3. **Package information products.** 18% of returns. The MIT authors describe selling insights that solve problems, which goes beyond raw datasets. 4. **License records through a marketplace.** [Troveo](/buyers/troveo) says it matches you with buyers and removes names from the data to a documented standard. It pays a revenue share on every deal, with no platform fee for companies. It publishes no split ([Troveo](https://www.troveo.ai/business-data)). 5. **Join a direct data program.** [micro1](/buyers/micro1) and Mercor run direct programs. The evidence is the thinnest of the five. The labs at the end go unnamed, and the figures come from the programs themselves. _The dullest route has the best evidence. The glamorous one has the best press._ ## What do the public figures show? There is no rate card. Troveo says so itself, and micro1 sets payment deal by deal. These are the public figures, each with its source type. | Evidence | Figure | Source type | |---|---|---| | Google, Spirit Airlines archive, auction | $10M winning bid | Reported ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)) | | micro1, Spirit Airlines offer | $12.5M | Reported ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)) | | SimpleClosure, shut-down startups, about 100 deals in a year | $10,000 to $100,000 each | Reported ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)) | | micro1, stated tiers | $100K+, $500K+, $1M+ | Self-reported ([micro1](https://www.micro1.ai/data-partnerships)) | | micro1, approved data packages | $100K-$2M+ | Self-reported ([micro1's Enterprise Data Partnership listing](https://www.micro1.ai/company-referral)) | The Spirit sale is one bankruptcy sale of one company's data, and the court has not approved it. Read the [Spirit Airlines page](/answers/spirit-airlines-data-sale) for the status. Our guide on [what your data is worth](/guides/how-much-is-your-business-data-worth-to-ai) shows why none of these is a rate you can multiply by your headcount. Epoch AI's review of RL environments describes app replicas and lab partnerships with product companies, and does not discuss real company archives ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). Demand is plausible. Public prices don't document it yet. ## What can stop a data license? Rights. Daniel Goldberg, a partner at Frankfurt Kurnit, lists these risks: competing ownership claims, privilege waiver, privacy-policy promises, California sale rules, protected employee communications and data permanence. It says to leave out privileged material, HR files, payroll, health data and union communications entirely ([FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). California defines a sale of personal information as a transfer to a third party for "monetary or other valuable consideration" ([Civ. Code 1798.140(ad)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). On my reading, a revenue share fits that text, so ask counsel whether your deal is a sale. Customer contracts can bar the use outright. Run our [rights check](/rights-check) before a buyer call. Read the [risk map](/risks) for where objections have come from. Talk to a privacy or commercial lawyer in your state before you sign. ## What does a micro1 corpus deal look like? David Revland, who works on human data at micro1, described a corpus deal in an undated recorded forum talk, from introduction to payment. We group it into three stages. micro1's CFO estimated in the same talk that the data transfer takes about 10 hours over a week or two from one or two IT people. The CFO also described a recurring workflows track, where employees grade an AI agent on real daily work, and said a company can do both. Figure: steps Intro and first call -> Manifest form and contract -> Transfer, check, payment. Expect a call before paperwork, and paperwork before any data moves. The manifest form asks which tools you use and rough sizes per tool. Revland said micro1 then checks the delivered data before it pays, and that a possible top-up about six months later covers data created since the first transfer. ## How do you start? Start with a readiness picture. A buyer call can wait. The free [fit check](/business) scores your records and shows what would move the score, with no upload. The [data readiness checklist](/answers/data-readiness-checklist) lists the same inputs as a list. Read the [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies) for the full process. Read [what goes in a data licensing agreement](/guides/data-licensing-agreement) before you see a contract. If you want help preparing the file, see [managed readiness](/managed-readiness). Information products are one route of three. If your own team can use the records to run the business better, that route carries the most public evidence. The [data monetization glossary entry](/answers/what-is-data-monetization) has the short version. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [MIT Sloan](https://mitsloan.mit.edu/press/data-everybodys-business-fundamentals-data-monetization) - [Troveo](https://www.troveo.ai/business-data) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [micro1](https://www.micro1.ai/data-partnerships) - [micro1's Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Civ. Code 1798.140(ad)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) --- # micro1 data partnership: how the program works > The micro1 data partnership program, walked through: three ways in, the process from first call to payment, eligibility, personal info and pay. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/micro1-data-partnership Published: 2026-09-07 Updated: 2026-10-14 A [micro1](/buyers/micro1) data partnership is a deal where micro1 pays a company under an agreed data partnership for use of its workplace records, or for employees' graded work with an AI agent. Its [data partnerships page](https://www.micro1.ai/data-partnerships) lists tiers from $100K+ to $1M+. It describes three ways in: a corpus deal, a workflows track and a referral. > **Data licensing means a company gets to use your records for a while, under rules.** Picture an attic full of old boxes. micro1 wants to read through them, and it pays you under a partnership agreement. Every number in this guide comes from micro1 describing itself, on its pages or in an undated recorded forum talk. Read each as a claim, not a measured result. We read micro1's pages and worked from the recording of a forum talk by its CFO and team, the third Company Data Partnerships session. The recording has no date and its captions are automatic, so a few figures carry a "verify" flag below. ## What does micro1 say it is? In an undated recorded forum talk, micro1's team called the company a data lab. It trains and improves AI models and agents by supplying data in formats models learn from. Its company data page says it helps organisations turn operational data into revenue. For the company profile and funding figures, see [what is micro1](/answers/what-is-micro1). The pitch for company data is simple. Hired experts build synthetic training environments that imitate the real world. micro1's CFO said the best training environment is the real world itself. A real marketing budget request shows who asked, which tools they used, which spreadsheets changed and who approved it. That chain from request to deliverable is the product. The names and vendor line items matter less. ## What are the three ways in? **1. Corpus deal.** This is the Enterprise Data Partnerships track, a partnership covering a company's data corpus. micro1 says companies keep ownership of their underlying data. Confirm licensed uses, duration, exclusivity and payment structure in the proposed agreement. micro1's page lists $100K+, $500K+ and $1M+ tiers set per deal, and its Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. Its CFO said in an undated recorded forum talk that deals near $2 million are real. In the same talk, David Revland, who works on human data at micro1, said it may come back about six months later for a top-up covering data created since the first transfer. **2. Workflows track.** Employees use a general-purpose AI agent on their real daily work and grade how it did. They also say how it should have done the task. micro1 receives the evaluation and the agent's trajectory. In the undated talk, the CFO described pay per completed task in the high hundreds of dollars for a couple of hours of work. We could not confirm that figure word for word in the captions (verify). The company chooses how many employees take part and how often. A company can run both tracks. **3. Referral.** micro1 also pays people who introduce a company. If someone introduced you, ask them in writing whether micro1 pays them. Figure: comparison of Three ways into micro1's data program: Corpus deal (emphasized: One transfer, no repeats, One transfer), Workflows (Repeats by task), Referral (An introduction). Most companies start with the corpus deal, and workflows can run alongside it. ## What is the process for a corpus deal? micro1's David Revland described seven steps in the undated recorded forum talk. 1. A referral, a peer introduction or organic contact starts it. 2. A first call with a data partnership manager. 3. A data manifest form on micro1's data platform, as described in the undated talk. It asks which services you use (Google Workspace, Slack, project management tools, GitHub and so on) and rough sizes per tool. micro1 supplies instructions for finding sizes, for example in Google Drive. 4. micro1 sends a payment proposal. 5. Contract language. 6. The transfer, with micro1's forward-deployed engineering team helping your IT people. In the undated talk, the CFO estimated about 10 hours of work from one or two of your IT people over a week or two. [How long a transfer takes](/answers/how-long-does-a-data-transfer-take) has the detail. 7. micro1 verifies the delivered data and then pays. Figure: steps Intro and first call -> Manifest form and contract -> Transfer, check, payment. Scope and contract come before any data leaves your systems. The page version is shorter. It lists four stages: a simple assessment, an evaluation, a discovery and privacy discussion, and a partnership agreement. The talk's seven steps are the same path in more detail. ## Who qualifies? micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. Confirm exceptions directly with micro1. - **Employees.** The data partnerships page and the referral page say 30 or more. - **Operations.** Mature operations with established documentation, knowledge bases, CRM metadata and project histories. - **Language.** Primarily English. The pages give no percentage. - **Place.** US companies first, then other Western markets. - **Volume.** The pages state no data-size threshold. A storage count still helps you describe your records. The undated recorded talk gave earlier, different figures: at least 20 full-time employees, about 1 TB across the corpus and about 80% English. It also named any industry, a US and Canadian preference and no cap on the number of companies. Those figures are history, and they do not decide who qualifies now. Every company goes through micro1's evaluation. The referral page says a referral does not guarantee acceptance. ## What happens to personal information? Personal information here means names, emails and phone numbers. micro1's CFO said in the undated talk that it does not want any. In the same undated talk the CFO said every corpus goes through a scrubbing step, which it samples at several points before use. The page says personal information "is removed when relevant." Revland said micro1 swaps names instead of blacking them out. A name is replaced with a consistent stand-in across every platform. The same person keeps the same stand-in in Slack and in Google Workspace, so the role and cross-tool trail survive. For that reason micro1 staff said in the undated talk that companies cannot pre-scrub. The same talk said removing names first would destroy the trail micro1 needs. micro1 refers to its own data trust principles. Counsel and regulators treat swapped names with caution. The [UK ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) says pseudonymised data is still personal data for anyone who holds the extra information. The union objection in the Spirit Airlines sale turned on the same worry (Time). Ask micro1 who holds the mapping between real and stand-in names, and how long it keeps it. The page also says data is held in isolated pipelines. It is kept for agreed periods and deleted on request or at the end of the engagement, in line with the contract. We found no security certification published by micro1. ## What should you ask before the first call? - Which of my systems does the manifest cover, and which stay out? - Who sees the data besides micro1, and does the contract name the AI labs that receive it? - Who holds the real-to-stand-in name mapping, and for how long? - What does the contract say about my warranties, the promise to protect micro1 from lawsuits (the indemnity) and any cap on micro1's liability? [Reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) shows the published pattern. - If micro1 is breached, who pays and who notifies? See [who is liable after a breach](/answers/who-is-liable-if-the-data-buyer-is-hacked). - Is the payout one-time, and is a top-up possible? Before any call, run the [rights check](/rights-check) on the systems you plan to include. Customer contracts, employee conversations and tool terms such as Slack's API terms all sit between you and a clean deal. The [risks page](/risks) lists what the companies publish about security and removing names. Want a person to organise the facts? [Managed readiness](/managed-readiness) is the service we run. We never take custody of your data. ## What does micro1's own video add? A micro1 referral partner spoke in a micro1 video. The publish date is not stated, the video is promotional, and she earns from referrals. Her statements differ from the undated recorded talk in places, so both are printed here. - **Payout clock.** Payouts typically arrive about 60 days after the company engages with micro1, with "engaged" undefined. The undated recorded talk and micro1's pages give no day count (about 2:54). - **Form and payment proposal.** The form takes under 10 minutes and a payment proposal follows within a few days (about 2:20 and 2:34). - **License or sale.** She calls it a license in which the company keeps full access. In the earlier, undated talk the CFO called the corpus track a one-time sale (about 12:29). micro1's current page says companies keep ownership of their underlying data. - **Removing names.** She says it removes names, emails and phone numbers. Revland described a consistent stand-in swap (about 13:27). - **IT effort.** She says no IT team is needed. In the undated talk the CFO said about 10 hours from one or two IT people (about 12:12). _Two tellings of one program. The signed contract is the one that counts._ ## What does micro1 say you gain? Two things. First, a new revenue stream from data you already store. Second, for the workflows track, a team that works with AI agents more fluently, "more AI native" in micro1's phrase. micro1 reports a large business, and its pages name no lab clients. Weigh both claims with that in mind. Compare it with the other published routes in the [buyers directory](/buyers) and the [deals tracker](/deals). Read [how to license company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies) for the whole market. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [UK ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # How Mercor uses your company data > How Mercor uses your company data: the connectors it asks for, the automated name removal, who it says sees it, pay, and the March 2026 breach. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-mercor-uses-your-company-data Published: 2026-08-28 Updated: 2026-10-14 [Mercor](/buyers/mercor) says it connects to your work accounts and pulls out the data. It says an automated pipeline removes names and details. Then Mercor licenses the result to AI labs. It says no lab or outside vendor sees your raw data. It pays by wire after the anonymized dataset is delivered. > **Data licensing means a company gets to use your records for a while, under rules. You keep ownership.** Think of renting a room you never use. The guest stays under house rules, and you keep the house. All of that comes from [Mercor's own data page](https://www.mercor.com/data/). Mercor also had a security incident in March 2026 that exposed contractor data. We cover it below. For the pricing and offers around the program, see [Mercor data licensing](/answers/mercor-data-licensing). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) ## What data does Mercor ask for? Workflow data from the tools a company uses daily. [Mercor's data page](https://www.mercor.com/data/) names Slack, Microsoft Teams, Gmail, Confluence, Salesforce, Outlook, GitHub, Google Drive and Notion. It says it supports 100+ tools. It also lists target industries with example records: - Legal contracts and case files - Healthcare records - Financial statements - Manufacturing logs - Real estate documents - Supply chain manifests Read that list twice. Healthcare records, case files and financial statements carry privacy and confidentiality duties of their own. Those are a question for your lawyer, not Mercor. ## How does Mercor collect it? Through connected accounts. The page describes four stages: scope, connect, process and payout. In the first, you choose what moves. The page says no data leaves your systems until you approve it. Then you link accounts. The page says credentials are held per session and never shared between connections. Connecting accounts means your platforms' own API terms apply. An API is a connection between two systems. The buyer can read whatever the connection scope allows. That is a different risk from handing over an export file. Troveo says it doesn't connect to your systems at all. See [the Mercor breach page](/answers/mercor-data-breach) for why the difference matters. ## What does Mercor say it does to the data? [Its page](https://www.mercor.com/data/) says the platform "extracts and de-identifies" your data into an asset. It says the extraction and anonymization are fully automated. It doesn't say what that means in practice. It names no standard, no method and no sampling. Whether names are removed or swapped is not stated. Neither is whether free text is checked. Ask for the specification in writing. A swap that keeps each person's stand-in consistent behaves differently from removal when someone tries to re-identify the records. ## Who receives it? The page says the dataset goes to "frontier AI" labs and names none. It says no AI lab buyer and no third-party vendor ever sees your raw data. Mercor's engineering team oversees the pipeline but does not manually review your data. All access is logged under strict internal controls. The only named buyer-side facts are bids on one archive. Mercor bid $7.5 million for Spirit Airlines' archive, and Google won the auction at $10 million, pending court approval, per [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) ([the Spirit sale timeline](/answers/spirit-airlines-data-sale)). Mercor also reportedly offered up to $300,000 to shuttered startups for chat, drive and email archives, per [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d). ## Does Mercor license your data or take it outright? [The page](https://www.mercor.com/data/) says "We license it, package it, and pay you for it." It publishes no contract. So it says nothing on exclusivity, term or what the license lets a lab do with derived data. It names no retention period and no deletion process. On the points that matter after signing, Mercor doesn't say. Figure: steps You connect accounts -> Mercor says it removes names -> Wire after delivery. Mercor says its pipeline runs without a person reading your raw data. ## What security does Mercor claim? Four things, per [its data page](https://www.mercor.com/data/): SOC 2 Type II, encryption in transit, encryption keys managed in AWS KMS, and an audit log of every access. We could not verify the audit's scope, the auditor or the test period. Then the incident. [Mercor said](https://www.mercor.com/blog/update-on-mercor-security-incident/) a poisoned release of the open-source LiteLLM library, live for a short window in March 2026, affected it. Mercor said the same release affected a significant number of other companies. [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) reported more than 40,000 current and former contractors and customers and about 4 TB of material. That included source code, a user database, video interviews and identity documents. [Mercor says](https://www.mercor.com/blog/update-on-mercor-security-incident/) the impact on customer information was very limited. A class action, *Ananthula v. Mercor.io Corp.*, was filed on 21 April 2026 in the Northern District of California. Its claims are allegations. No company-archive data was reported exposed. A buyer that holds many companies' records in one pipeline is a target. Its certificate is a claim to check. Ask for the SOC 2 report itself, read the scope and the dates, and ask who the auditor was. _A badge on a website is a nice start. The report behind it is the real thing._ ## How does Mercor pay? Mercor says pay depends on data volume, the tools you connect and the depth of the data. Connecting more tools generally pays more. [Its data page](https://www.mercor.com/data/) says payment is a wire "typically within 2-4 weeks" of the signed agreement, issued on delivery of the dataset to the buyer. It says it covers extraction, anonymization and transfer costs and takes no setup fee or deduction. No price list is published. Nothing here promises you a payout. ## What should you ask Mercor? - What connection scope do you need for each tool, and can it be read-only? - What does the name removal do to names, emails and free text? - How long is raw and processed data kept, and who deletes it? - Which labs can receive the dataset, and can they resell it? - Where is the SOC 2 report, and what does it cover? - If a breach touches my records, who notifies and who pays? See [who is liable if the buyer is hacked](/answers/who-is-liable-if-the-data-buyer-is-hacked). The evidence on the company is in [is Mercor legit](/answers/is-mercor-legit). The [rights check](/rights-check) comes before any account connects. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's own data page](https://www.mercor.com/data/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Mercor said](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [CourtListener docket, Deboni v. Mercor.io Corp.](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) --- # How to choose an AI data broker > How to choose an AI data broker: eight checks on entity, terms, numbers, buyers, fees, data handling and contract, with dated examples from public buyer pages. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-to-choose-an-ai-data-broker Published: 2026-08-28 Updated: 2026-10-14 Pick the buyer that lets you check the most. Seven checks cover most of it before you send a single record, and each takes minutes. In order: 1. A named legal entity 2. Live terms and privacy pages 3. Numbers that agree with each other 4. Named buyers 5. A published fee 6. A clear rule for when your data moves 7. A contract that sets liability Each check below uses examples from public buyer pages. Nobody has outside proof of what any buyer paid a business for its data. So these checks test whether a firm's story hangs together and how much it shows. You make the call on each firm. The firms report their own figures, and none is a promise of what you would receive. > **Data licensing means a company gets to use your records for a while, under rules. You keep ownership.** Think of renting a room. Before you hand over a key, you check who the landlord is, what the lease says and what it costs. Figure: steps Check the entity -> Test the numbers -> Read the contract. Run all three before you sign anything. People search for "data broker" when they mean an AI data company. Legally, a data broker resells consumer data and must register in some states. This site calls AI data companies buyers. ## Check 1: does the buyer name a legal entity? Look at the footer and the terms. A named company gives you someone to hold to an agreement. [SimpleClosure](/buyers/simpleclosure)'s terms name "Simple Closure Inc." Some referral sites give only a trading name, or an operator with no address or registration. [Troveo](/buyers/troveo)'s business-data page footer shows "Troveo 2026" and no legal entity. Ask any of them for the contracting entity before a call. ## Check 2: are the terms and privacy pages live? Open both pages and check the date. SimpleClosure's terms cover its Asset Hub. Troveo's `/terms` and `/privacy` paths returned 404. A missing page can be a site fault. Ask for the supplier agreement in writing. ## Check 3: does the headline match the calculator? Most buyers show an estimator. Test its top end against the headline. [Handshake AI](/buyers/handshake-ai)'s calculator example (100 employees, 10 years) gives $383,083 to $896,969. Its headline says $100K to $4M+. It calls the example "indicative only." When a calculator tops out far below the headline, ask which companies reach the headline. ## Check 4: do the buyer's own pages agree? Compare totals across its pages. Troveo shows $20M+ paid on its business-data page. Its content-owners page shows "$50M+" with no date. Handshake AI shows $250M paid to partners on Handshake AI's [company referral page](https://joinhandshake.com/ai/data-partnerships/referral) and $500M+ in payouts on its fellowship page. These are company-wide totals, and none of them predicts what your company would receive. Each pair may cover different groups. The pages don't say. Ask which group each number counts. ## Check 5: does it name who gets the data? Marketplaces describe their buyers as a "frontier AI lab" or a "selected partner." Troveo's page uses "Mag 7 company." The Spirit Airlines bids from Google, [Mercor](/buyers/mercor) and [micro1](/buyers/micro1) were public only because a bankruptcy court ran the auction ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). Ask which kinds of buyer will see your data, and under what contract. A micro1 referral partner made two points in a micro1 video (about 17:00 and 22:31). Owners are right to check that the company is reputable and that other companies are signing. And the first question is who micro1 is. Ask who else is signing, and which lab ends up with the data. ## Check 6: are the fees and splits published? Troveo shares revenue "on every sale" and charges companies no fees. It doesn't publish its split. An advisor paid on success should state its percentage before you sign. SimpleClosure's terms point to fees in a separate order form, and its AssetHub page says it takes an unpublished percentage on a completed deal. micro1 and Handshake AI publish tiers or ranges for what they pay. That gives you a figure to test. But a price range doesn't show what a middleman keeps. Get the percentage in writing. ## Check 7: when does your data move, and how is it prepared? The companies differ here. - [Troveo](https://www.troveo.ai/business-data) says it needs no OAuth access to your systems and no platform to install. - Mercor connects to your tools and pulls the data through connectors. micro1 staff said in an undated recorded forum talk that companies can't scrub first and micro1 must change the data itself. micro1's CFO said its engineers help your IT people with the transfer. Mercor says no lab buyer or vendor sees raw data. Its own March 2026 incident update says a supply chain attack on LiteLLM affected it. Whatever the answer, ask who holds the data, for how long and where it is deleted. ## Check 8: what does the contract say? Daniel Goldberg, a partner at Frankfurt Kurnit, advises that a purchase agreement should "restrict how the buyer can use the data, allocate privacy risk, and address what happens if something goes wrong" ([Goldberg](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Ask about four things: the promises you must give, who pays if the buyer is breached, deletion on request, and exclusivity. Epoch's interviews put exclusive RL-environment deals at roughly 4x to 5x the non-exclusive price. Exclusivity changes value ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). ## What about domain age and reviews? Domain age is a weak signal. A domain registered this year leaves no track record to read. Mercor's domain, though, predates the company by two decades. Treat age as a cue to ask for references. Reviews mostly describe worker platforms. We found none from companies that licensed business data. Ask each buyer whether a past licensor will talk to you. A micro1 referral partner said in a micro1 video that she connects hesitant owners with owners who finished (about 19:34). Ask a reference four things: - Who ran the export? - How long did it take? - What was removed? - When did payment arrive? _Domain age is a weak clue. A brand-new site can be honest, and an old one can still say "TBD" about fees._ ## What should you do next? Run the [rights check](/rights-check) and read the [risk map](/risks). Then bring the answers to a first call. The [buyer directory](/buyers) and [best AI data brokers](/guides/best-ai-data-brokers) list each firm's public terms. [AI data broker red flags](/answers/ai-data-broker-red-flags) ranks the patterns above. For help getting your records and rights ready before any buyer sees them, see [managed readiness](/managed-readiness). We work from descriptions and counts, never your records. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [company referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Troveo](https://www.troveo.ai/business-data) - [Goldberg](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # How SimpleClosure uses your company data > How SimpleClosure uses your company data through Asset Hub: what it takes, the perpetual license in its terms, the consent duty on you, and what it skips. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-simpleclosure-uses-your-company-data Published: 2026-08-17 Updated: 2026-10-14 [SimpleClosure](/buyers/simpleclosure)'s Asset Hub sells code and workspace data from shutting-down startups to AI buyers. [Its terms](https://simpleclosure.com/tos/) take a perpetual, irrevocable license to what you submit and make you hold consents from the people in it. [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), citing Forbes, nearly 100 deals at $10,000 to $100,000 per company. SimpleClosure says it handles collection, strips personal details and sends the data to the buyer. Its terms are published in full, so it is the easiest buyer here to check. It was built for a company that is closing. Its [AssetHub page](https://simpleclosure.com/product/assethub/) now says operating companies can license too. The [buyers directory](/buyers) lists other options. For the product itself, see [SimpleClosure Asset Hub](/answers/simpleclosure-asset-hub). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) > **Data licensing means a company gets to use your records under rules. You still own them.** Think of renting a room. Most renters get a lease with an end date. This lease has none, and you can't cancel it. ## What data does SimpleClosure ask for? SimpleClosure's [terms](https://simpleclosure.com/tos/) call what you submit "digital assets." That covers software codebases, source code repositories and technical documentation. It also covers workplace data exports, such as emails, messaging exports and project management records. The [launch release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) sorts these into three groups: - Code is live. - Workspace data, such as email, Slack, Notion and Google Drive, is in beta. - Domains, patents, trademarks and equipment are in development. ## How does SimpleClosure collect it? Through its services. The release says SimpleClosure manages the deal end to end, including data collection. The terms say you submit assets through the services. For code, intake starts with a connection to GitHub. SimpleClosure shares no more detail on how it pulls workspace data. Ask whether you run an export or it runs a connection. ## What does SimpleClosure say it does to the data? The [launch release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) says SimpleClosure removes personal information before transfer. It means names, emails and other details that point to a person. [The terms](https://simpleclosure.com/tos/) matter more here. You promise that you have all required consents from the people in the assets. That includes employees, contractors, customers, investors and vendors. The terms name the CCPA, CPRA and GDPR. You must also disclose open-source parts in the assets. So the process says SimpleClosure scrubs. The contract says you promised the data was fine to share. Both can be true. If the second turns out false, you answer for it. The terms promise no scrubbing. They say only that its evaluation may include an assessment of embedded personal information. ## Who receives it? The terms list three groups: SimpleClosure, its affiliates and subsidiaries, and third-party buyers it introduces. The release names the buyer types as AI labs, reinforcement learning researchers and enterprise AI companies. It names no buyers. [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), citing Forbes, nearly 100 deals at $10,000 to $100,000 per company. ## Does SimpleClosure license your data or take it outright? You license it. The [license](https://simpleclosure.com/tos/) is the broadest on our list. It is non-exclusive, transferable, sub-licensable, royalty-free, fully paid up, perpetual, irrevocable and worldwide. It lets SimpleClosure use, copy, change, share, license or sell the assets for any lawful purpose. That includes licensing or selling them to third parties. You are owed no further consent or pay, except what a separate asset assignment or purchase agreement says. Figure: comparison of SimpleClosure's license on your assets: Term (Perpetual), Revocation (emphasized: You cannot take it back, Irrevocable), Resale (Sub-licensable). Once granted, this license stays with SimpleClosure and its buyers. The terms state no revenue share and no fee. Payment sits in a separate agreement. The price of the license is whatever that agreement says. Its [AssetHub page](https://simpleclosure.com/product/assethub/) adds that there is no upfront cost and SimpleClosure takes a percentage only on a completed deal. The percentage is not published. ## What about retention and deletion? The terms set no automatic deletion. After the contract ends, [the terms](https://simpleclosure.com/tos/) say SimpleClosure provides your data on request for 30 days. That returns your copy. It says nothing about deleting what a buyer holds, and the license can't be revoked. See [deleting after training](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it). ## What security does SimpleClosure claim? The terms don't cover it. We found no certification or encryption statement in the material we read. A closing company's email archive is sensitive. Raise this gap first. ## Where does the risk sit? [The terms](https://simpleclosure.com/tos/) make you defend and protect SimpleClosure from lawsuits over four things: - Breaches of your promises - IP claims - Privacy violations - Open-source non-compliance SimpleClosure caps its own liability at the greater of what you paid in the prior six months or $100. That is a lopsided pair. You can owe a lot. It likely owes $100 at most. [Reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) explains what such promises cost. ## How does SimpleClosure pay? It doesn't publish the fee or the split. The only figure is the reported range of $10,000 to $100,000 per company. That figure is second-hand and promises you nothing. See [how much SimpleClosure costs](/answers/how-much-does-simpleclosure-cost). _An irrevocable license is the only lease where the landlord never has to give the key back._ ## What should you ask SimpleClosure? - What is the fee, and is it taken before or after I'm paid? - Can I leave out messages from people who haven't agreed to share them? - Who removes the personal details, and with what method? - Can the irrevocable license cover training uses only? - What happens to my data if the buyer resells it? - Which promises can I limit? Start with the [rights check](/rights-check). Then read [is SimpleClosure legit](/answers/is-simpleclosure-legit). Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Its terms](https://simpleclosure.com/tos/) - [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [AssetHub page](https://simpleclosure.com/product/assethub/) - [launch release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) - [SimpleClosure Asset Hub announcement](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [SimpleClosure CEO post](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) --- # How to prepare company data for AI licensing > How to prepare company data for AI licensing: a five-item packet, what intake forms ask first, who does the scrubbing, and the rights step. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-to-prepare-company-data-for-ai-licensing Published: 2026-08-13 Updated: 2026-10-14 Build a one-page packet before any first call, and leave the scrubbing to the company you license to. The packet lists: - The systems you run - The oldest record and a rough size in each - Whose words sit in them - What stays out - Who can run the exports Why not scrub first? [micro1](/buyers/micro1) staff said in an undated recorded forum talk that companies can't pre-scrub. micro1's method swaps names for matching stand-ins across tools and needs the original links intact. Preparing here means gathering facts and checking rights. It does not mean data engineering. This guide covers the packet, what intake forms ask first, the scrubbing question and the rights step. Your counsel owns the rights step. Most facts below come from micro1, Troveo, Mercor and Handshake AI themselves. > **Data licensing means a company gets to use your records for a while, under rules. The contract says who keeps ownership.** Think of clearing out an attic before a guest stays. You list what's up there and what stays locked. The guest does the dusting. ## Which five items go in the packet? 1. **Systems and owners.** List every tool where work gets recorded. That means email, chat, CRM, helpdesk, project boards, documents, call recordings and code. Next to each, write the name of the person who runs it and can pull an export. 2. **Dates.** Note the oldest record you still hold in each system, and any gaps. 3. **Rough size per tool.** micro1's data manifest form, as micro1's David Revland described it in an undated recorded forum talk, asks which services you use and a rough size for each. The talk gives steps for finding sizes, for example in Google Drive. Our page on [checking your Google Drive size](/answers/micro1-google-drive-data) shows where. Screenshot any total with the date visible. 4. **Whose words.** Staff, customers, partners, contractors and guests in shared channels. Note any contract, NDA or tool term that mentions secrecy, data use or AI. 5. **Exclusions.** List the categories that stay out of any deal. Your counsel signs off on them. The [ten-minute check in the worth guide](/guides/how-much-is-your-business-data-worth-to-ai) has a template for the first four items. The [readiness checklist](/answers/data-readiness-checklist) lists the thresholds each program publishes. Figure: steps List your systems -> Mark exclusions -> Counsel review. Your counsel signs off on what stays out. ## What do intake forms ask first? Each company opens with a different slice of the packet. | Company or marketplace | First ask | Source | |---|---|---| | micro1 | Which services you use and rough sizes per tool, on a data manifest form | Recorded forum talk, date not stated | | Troveo | Data estimate details, with no access to your systems | [Business data page](https://www.troveo.ai/business-data) | | Mercor | Which tools to share, from 100+ supported connectors | [Data page](https://www.mercor.com/data/) | [Mercor](/buyers/mercor) connects to the tools you choose. [Troveo](/buyers/troveo) says you need no access to start. Keep raw data in your own systems until a signed agreement says who receives it. Our page on [the data manifest form](/answers/what-is-a-data-manifest-form) explains micro1's version. ## Should you scrub the data first? The companies say the cleaning is their job. Revland said in an undated recorded forum talk that micro1 swaps each person for the same stand-in in Slack and in Google Workspace. That way the role and the trail across tools survive. micro1 staff said in the same talk that redacting first destroys that trail. [Mercor](https://www.mercor.com/data/) says extraction and anonymization are automated and it covers the cost. [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) says it removes direct and indirect identifiers before delivery. The partner stays responsible for the legal side of its transfer. [Troveo](https://www.troveo.ai/business-data) says it scrubs names, contact details, credentials and client identities under one documented standard. Removing names from emails and chats is hard. Counsel warns that text with the names removed can still reveal sensitive details about people or small groups ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Our pages on [removing names from data](/answers/data-de-identification) and [micro1's name swapping](/answers/micro1-pii-transformation) go further. The [anonymization guide](/guides/data-anonymization) covers the legal tests. What you can do early is decide what stays out of scope. Leaving something out costs less than scrubbing it. ## What does the rights step involve? Your counsel owns this step. We judge no contract. Daniel Goldberg, a partner at [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), listed what a company reviews before a data deal: - Whether you own or control the data. Email and chat hold third-party information, often under NDAs. - Trade secrets and privileged messages. - Your privacy policy and employee handbook, and [the FTC's view](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) of quiet retroactive changes. - Privacy laws such as the CCPA, and sector rules for health or financial records. - Section 7 of the [National Labor Relations Act](https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/interfering-with-employee-rights-section-7-8a1). It can protect employee talk about pay and conditions. - The limits of removing names. His process advice has four parts. Gather legal, privacy, security, HR and communications people. List the sources. Confirm ownership through vendor contracts. Define exclusions and write down the review. Your packet is the raw material for that review. The [rights check](/rights-check) asks seven questions on the same ground. [What data you can't license to AI](/answers/what-data-can-i-not-sell-to-ai) lists the categories that usually come out. The [risk map](/risks) shows where deals break. _A packet with a clear "no" column beats a packet that says yes to everything. Lawyers like it, too._ ## Who needs to be involved on your side? You need one person with admin rights per system. Add whoever speaks for legal and HR. micro1's CFO estimated, in an undated talk, the transfer at about 10 hours of work over a week or two, from one or two IT people (self-reported). Name your export owner early and the wait gets shorter. See [how long it takes to license company data](/answers/how-long-does-it-take-to-sell-company-data). ## Where does the packet go? Counsel first. Then the free [fit check](/business) and the [buyer directory](/buyers), which lists each buyer's published terms. Want the packet built as a dated, sourced file? [Managed readiness](/managed-readiness) does that as an optional paid service. It turns descriptions and counts into a buyer one-pager, a systems inventory, questions for your counsel, a buyer shortlist and a term-question checklist in 2 to 3 weeks, and hands every legal call to your counsel. It can end in a no. The [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies) covers the full process. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Business data page](https://www.troveo.ai/business-data) - [Data page](https://www.mercor.com/data/) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [the FTC's view](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) - [National Labor Relations Act](https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/interfering-with-employee-rights-section-7-8a1) --- # Data monetization strategy for your company > A data monetization strategy picks among marketplace listings, AI buyer licenses, workflows and shutdown deals. Public prices, fees and the rights check first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/data-monetization-strategy Published: 2026-08-12 Updated: 2026-10-14 A data monetization strategy is a choice among ways to earn from your records. You make it after you know what you hold and whose words are in it. Public sources show four routes: - list data products on an enterprise marketplace - license operating records to AI buyers - join a recurring workflows program - license a closing company's archive Your rights decide which of them are open to you. > **Data licensing means a company gets to use your records for a while, under rules.** Think of renting a room. Each route is a different kind of guest. You keep the house either way. This guide maps the routes and what each one publishes about price and fees. The AI-lab license itself lives in the [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies). Most payout figures come from the firms selling the service. ## What does a data monetization strategy decide? Four things: which records, which buyers, how you get paid and how much control you keep. Everything else follows. A company that picks the buyer first can find out at the contract stage that it lacks the rights to the records that buyer wants. So work in this order. List your systems, check your rights, then pick a route. The ten-minute sheet in [how much your business data is worth to AI](/guides/how-much-is-your-business-data-worth-to-ai) does the first step. ## Which routes exist? | Route | Who pays | What it publishes | |---|---|---| | Enterprise marketplace listing | Enterprise buyers of data products | AWS lists 3% on public offers for Data Exchange products. Snowflake takes a transaction fee and does not publish the percentage | | Corpus license | AI labs and agent builders, through a marketplace or direct | micro1's Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. Handshake AI says $100K to $4M+ | | Workflows program | micro1, per finished task | micro1 pays employees per task to grade an AI agent on real work | | Shutdown deal | Buyers of a closing startup's archive | SimpleClosure reported nearly 100 deals at $10,000 to $100,000 | These are self-reported or press figures. Every public deal so far is a distressed company or a buyer headline. No public record shows what a working company with a decade of history receives. ## What do marketplaces like Snowflake and AWS Data Exchange offer? Marketplaces such as Snowflake, AWS Data Exchange, Databricks and [Datarade](/buyers/datarade) list data products for enterprise buyers. They do not buy archives. Snowflake said that its marketplace partners booked more than $100M gross in the first half of 2026, up 277% year on year ([Snowflake](https://www.snowflake.com/en/blog/snowflake-marketplace-agentic-ai-growth/)). Fees differ. AWS's announcement lists 3% on public offers for AWS Data Exchange products. On private offers it lists 3%, 2% and 1.5% by deal size ([AWS](https://aws.amazon.com/about-aws/whats-new/2024/01/aws-marketplace-simplified-reduced-listing-fees/)). Datarade's commission appears as 30% in one summary and in tiers in another, so read its current terms. The product on a marketplace is a packaged dataset with a set layout. A raw email archive is a different thing. ## What does the AI route look like? AI data companies want records of real work. A support ticket is a good example. It shows the problem, the steps and the result. [micro1](/buyers/micro1)'s CFO described the prize in an undated recorded forum talk as the chain from request to finished deliverable. The [buyer directory](/buyers) compares the players. [Where to license company data](/answers/where-to-sell-company-data) compares the routes. Three payment models appear: - a one-time payment - a revenue share on repeat deals - a royalty per use [Pricing models](/answers/data-monetization-pricing) shows the public figures for each. Plan around the gap. Epoch AI's review of RL environments describes app replicas and lab partnerships with product companies, and does not discuss real company archives ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). ## How do you choose a route? Score each route against five questions. 1. **Rights.** Do you hold the right to license every record in scope? Third-party confidentiality, trade secrets, privilege and employee talk that US labor law protects all limit the answer ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). 2. **Shape.** Is your data a packaged product, a pile of work records or a stream of new activity? Each fits a different route. 3. **Size.** The stated minimums differ. micro1's pages say 30 or more employees, with mature operations. [Handshake AI](/buyers/handshake-ai)'s referral page says 20 or more and 3 or more years. 4. **Control.** Who removes names, whether you may clean the data first, and what happens at the end of the term. micro1 staff said in an undated recorded forum talk that companies cannot clean first because micro1 transforms the data itself. 5. **Cadence.** One-off or recurring. In the same talk, micro1's David Revland, who works on human data, described a possible top-up about six months after a corpus deal, and a workflows track that repeats by task. ## What does it cost to carry out? micro1's CFO estimated, in an undated talk, about 10 hours over a week or two from one or two of your IT people to run a corpus transfer. You will also need counsel. None of the buyer pages price that. Ask each buyer who pays to remove names and who carries the blame if a record leaks. For the buyers we checked, that split is not public. ## What can go wrong? Removing names is the weak joint. Counsel writes that stripping identifying details from millions of emails and chats is much harder than doing it for structured fields ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). The [de-identification page](/answers/data-de-identification) covers each legal test. The largest public deal is still contested. The Spirit Airlines sale is still before the bankruptcy court, after union objections and an EPIC brief ([EPIC](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/)). The hearing was moved from 14 Oct to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. The [risk map](/risks) lists the other failure points. Figure: steps Inventory and rights -> Pick a route -> Sign with counsel. Know what you hold before you choose who buys it. _The last step is the one people skip. It is also the one that saves the money._ ## Where to start this week Run the inventory, then the [rights check](/rights-check), then take the free [fit check](/business). If you want help getting records ready, see the [managed readiness service](/managed-readiness). Take your list to a privacy or commercial lawyer in your state before you sign anything. Two answers matter: a buyer's estimate and your lawyer's view on rights. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Snowflake](https://www.snowflake.com/en/blog/snowflake-marketplace-agentic-ai-growth/) - [AWS](https://aws.amazon.com/about-aws/whats-new/2024/01/aws-marketplace-simplified-reduced-listing-fees/) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [EPIC](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) --- # Startup shutdown checklist: where AI data fits > A startup shutdown checklist with the AI data decision placed before you delete accounts or cancel Slack. Export clocks, approvals and buyers. Not legal advice. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/startup-shutdown-checklist-ai-data Published: 2026-08-12 Updated: 2026-10-14 Decide what happens to your company data before you delete accounts, cancel Slack or let subscriptions lapse. Those steps start export clocks and delete records. A data license needs the records to still exist. Eleven steps below run in order. The sources are vendor terms, Delaware statutes and a shutdown service's own advice. Take this checklist to your lawyer. It is not legal advice. > **Data licensing means a company gets to use your records for a while, under rules.** Think of the attic. Before you clear the house, look in the boxes. Once the dumpster comes, they are gone. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) ## What does the data decision cover? You have four options. Keep an export for the record. License the data. Hand it to the buyer of the company in an asset sale. Or delete it. A closing company can pick more than one for different data, such as licensing chat and deleting payroll. Some of it has buyers. [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) reported that [SimpleClosure](/buyers/simpleclosure) had processed nearly 100 deals in a year at $10,000 to $100,000 per company. [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) reported that Mercor offered up to $300,000 to failed and acquired startups. Those are company and press claims, and no outcome is promised. Our page on [AI labs buying startup archives](/answers/ai-labs-buying-startup-archives) has the reporting. ## What is the order of the checklist? 1. **Freeze deletion.** Pause account closures and auto-delete retention settings. [Slack's export help page](https://slack.com/help/articles/201658943-Export-your-workspace-data) says what you can export depends on your plan. 2. **List every system and its size.** micro1's data manifest form, as David Revland, who works on human data at micro1, described it in an undated recorded forum talk, asks which tools you use and rough sizes per tool. So the list doubles as your first intake conversation. See [the data manifest form](/answers/what-is-a-data-manifest-form). 3. **Find out who can export, and on which plan.** Slack's Free and Pro plans export public channels only. Business+ and Enterprise can request private channels and direct messages. [Zendesk exports](https://support.zendesk.com/hc/en-us/articles/4408886165402-Exporting-ticket-user-or-organization-data-from-your-account) are off by default until the account owner asks Zendesk support to enable them. 4. **Write down each export clock.** [Salesforce](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Salesforce_MSA.pdf) gives you 30 days after termination to ask for your Customer Data. Its [Data Export Service](https://trailhead.salesforce.com/content/learn/modules/lex_implementation_data_management/lex_implementation_data_export) deletes zip files 48 hours after the email goes out. Zendesk download links last at least three days. See [Salesforce](/answers/sell-salesforce-data-to-ai) and [Zendesk](/answers/sell-zendesk-tickets-to-ai). 5. **Pull the contracts.** Customer agreements, NDAs, vendor terms, investor documents and employee policies can all limit a license. Start with the [rights check](/rights-check) and our page on [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai). 6. **Get the corporate approvals.** For a Delaware corporation, [section 271](https://delcode.delaware.gov/title8/c001/sc10/index.html) ties a sale of all or substantially all property to board action and a stockholder vote. Section 275 sets the dissolution vote. Read [our Delaware walkthrough](/answers/can-a-shutting-down-company-sell-its-slack-to-ai). 7. **Choose a route.** Pick a shutdown service such as the [Asset Hub](/answers/simpleclosure-asset-hub), a listing board such as [BuyMyDeadStartup](/answers/buymydeadstartup), or a direct program. Compare them in [startup data routes](/answers/sell-startup-data-to-ai) and [SimpleClosure alternatives](/answers/simpleclosure-alternatives). 8. **Check the buyer.** SimpleClosure's CEO, Dori Yona, [wrote](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) that founders should look up the buyer's history. Ask whether it has completed a deal with another startup. Find out whether it uses the data or buyers the deal. 9. **Limit what you share.** The same advice says to avoid sharing full exports before meaningful offers. Share limited samples first, and search for embedded credentials such as API keys. It says scrubbing a dataset is more work than exporting it and deleting a few names. 10. **Get the money terms in writing.** Ask for specific prices instead of ranges, payment timing, which company is legally obligated to pay and where the funds come from. Read [reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) and [who is liable if the buyer is hacked](/answers/who-is-liable-if-the-data-buyer-is-hacked). 11. **Record the decision, then close the accounts.** Keep the counsel notes and the board record. [Frankfurt Kurnit Klein and Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) says that if the company is later acquired, a prior data license will come up in diligence. An acquirer will expect to see the record. Keep it with the deal file. _The order matters. Closing the accounts is the last box to tick, and the one you cannot untick._ ## What happens to creditor claims after a startup dissolves? A Delaware corporation continues as a legal entity for three years after dissolution to settle its business and defend suits (section 278). Section 280 sets notice to creditors, with at least 60 days to submit claims. Section 281(b) sets a plan for paying claims in priority. Under section 281(c), directors who follow section 281 are not personally liable to claimants. We found nothing on how far that shield reaches over privacy claims. The people in your messages are still people. Customer and partner contracts continue after the company stops. See [whether a shutting-down company can license its Slack](/answers/can-a-shutting-down-company-sell-its-slack-to-ai) for what your staff may object to. The state and federal filings run alongside the data decision. The [state-by-state dissolution table](/closing-a-business/how-to-dissolve-an-llc-or-corporation) gives each state's form and fee, and the [final tax return when closing a business](/answers/final-tax-return-when-closing-a-business) lists the IRS forms in order. Some records have to outlive the company. Our page on [what to do with company records when you close](/answers/what-to-do-with-company-records-when-you-close) gives the federal keep periods for tax, payroll and hiring records. ## What if the company is in bankruptcy? A bankruptcy adds a court. In some sales it also adds a consumer privacy ombudsman. The ombudsman exists only when the debtor's privacy policy barred transferring personal information to unaffiliated parties, under [11 U.S.C. 363(b)](https://www.law.cornell.edu/uscode/text/11/363). The Spirit Airlines sale is the live example. See [what is a consumer privacy ombudsman](/answers/what-is-a-consumer-privacy-ombudsman) and the [Spirit Airlines page](/answers/spirit-airlines-data-sale). An insolvent company can also wind down under state law, without a bankruptcy court. Our page on [an assignment for the benefit of creditors](/answers/assignment-for-the-benefit-of-creditors) covers what happens to the data there. ## What if you do nothing with the data? Subscriptions lapse and vendors delete it on their own schedules. The Salesforce agreement says it deletes or destroys copies after the 30-day period. For that data the default outcome is deletion. Deleting is a valid decision too, as long as someone made it on purpose and wrote it down. Doing nothing with the company itself costs more. Our page on [closing a business and walking away](/answers/close-my-business-and-walk-away) adds up the fees and taxes an unfiled company keeps owing. Figure: steps Inventory the tools -> Choose a route -> Close the accounts. Pick a route for the data while the accounts are still open. ## What should you do this week? List your systems and who can export from each. Run the [rights check](/rights-check). Then run the free [fit check](/business) to see whether buyers' published thresholds fit. If you want the file assembled for your lawyer, see our [managed readiness service](/managed-readiness). Talk to a corporate or insolvency lawyer and a privacy lawyer in your state before you sign anything. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Slack's export help page](https://slack.com/help/articles/201658943-Export-your-workspace-data) - [Zendesk exports](https://support.zendesk.com/hc/en-us/articles/4408886165402-Exporting-ticket-user-or-organization-data-from-your-account) - [Salesforce](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Salesforce_MSA.pdf) - [Data Export Service](https://trailhead.salesforce.com/content/learn/modules/lex_implementation_data_management/lex_implementation_data_export) - [section 271](https://delcode.delaware.gov/title8/c001/sc10/index.html) - [wrote](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) - [Frankfurt Kurnit Klein and Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [11 U.S.C. 363(b)](https://www.law.cornell.edu/uscode/text/11/363) --- # Best AI data brokers for company records > Best AI data brokers for company records: micro1, Troveo, Replay, SimpleClosure, Mercor, Handshake AI and more. What each asks of a company and what to check. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/best-ai-data-brokers Published: 2026-08-10 Updated: 2026-10-14 No public source ranks AI data brokers, so none is best for everyone. The firms handling company records include [micro1](/buyers/micro1), [Troveo](/buyers/troveo), [Replay](/buyers/replay), [Polyshares](/buyers/polyshares), [SimpleClosure](/buyers/simpleclosure), [Mercor](/buyers/mercor) and [Handshake AI](/buyers/handshake-ai). [Handshake AI's page](https://joinhandshake.com/ai/data-partnerships/) goes up to $4M+. None has independent proof of its payouts to companies. This guide lists each firm, what it asks of a company and what you can check yourself. Nearly every figure comes from the firms. None is a promise of what you would receive. > **Data licensing means a company gets to use your records for a while, under rules.** It's like renting out a room you never use. You keep the house. A broker is the agent who finds the tenant. ## What counts as an AI data broker? In AI, people say "data broker" for any firm that sits between two sides. One side holds records, such as Slack threads, email, tickets and CRM history. The other side is the AI labs and agent builders who want them. In law, a "data broker" resells consumer data and must register in some states. So this site calls these firms buyers, marketplaces, advisors and referral front ends. Some take the data themselves, by purchase or by license. Some resell it on a marketplace. Some collect your details and pass them to a partner. That choice decides who you deal with after the first form. A direct program sets the price. A marketplace finds buyers and shares the revenue. A referral front end hands you on. Figure: comparison of Three kinds of AI data broker: Direct programs (emphasized: They are the ones who pay you, Pay you directly), Marketplaces (Resell and share), Referral front ends (Pass you on). Direct programs are the ones who pay you. ## Who handles company data, and what do they ask? | Firm | Kind | What it asks of a company | What it publishes | |---|---|---|---| | [micro1](https://www.micro1.ai/data-partnerships) | Direct data partnership | 30+ employees on its pages, mostly English records, US, UK and Canada first | Tiers of $100K+, $500K+ and $1M+ | | [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) | Direct program that delivers to labs | A form, then a scoping call. [Handshake AI's company referral page](https://joinhandshake.com/ai/data-partnerships/referral) says 20+ full-time employees and 3+ years | $100K to $4M+ | | [Mercor](https://www.mercor.com/data/) | Buyer and reseller | No minimum stated. Connects 100+ tools | Wire within about 2 to 4 weeks of signing. No price list | | [Troveo](https://www.troveo.ai/business-data) | Marketplace | No minimum stated | Revenue share on each deal, split unpublished. No named buyers | | [Replay](https://www.replay.ai/) | Direct program | Bands start at 20 to 50 employees | $10K to $100K for 20 to 50 staff, up to $1M+ at 250+. Upfront plus revenue share | | [Polyshares](https://polyshares.com/) | Direct license | No minimum stated | $100K to $2M+. Net 30 to 60 after approval | | [SimpleClosure Asset Hub](https://simpleclosure.com/product/assethub/) | Shutdown platform | Built for closing companies, open to operating ones | Nearly 100 deals at $10,000 to $100,000 (Gizmodo). A percentage on a sale or license, rate unpublished | One more name comes up. [Protege](/buyers/protege) runs a governed marketplace in health, video and audio. Its pages do not mention workplace chat ([Protege](https://withprotege.ai/)). _Every firm here has a friendly website. The friendly part is free._ ## What can you check, and what can't you? Some facts anyone can check. - **People and companies:** micro1, Troveo and SimpleClosure name their leaders or companies. Troveo's footer names no legal entity. - **Terms pages:** SimpleClosure publishes terms. A missing terms or privacy page is a reason to ask for the contract before anything else. - **Domain age:** a lookup shows when a site was registered. A domain from this year has no track record to read. Other facts are claims. Troveo's own pages show $20M+ and $50M+ paid. Handshake AI's show $250M and $500M+. Each firm gives two totals that its pages do not reconcile. Troveo's $20M also covers video and audio licensors. None of these totals predicts what your company would receive. micro1's Enterprise Data Partnership listing says $100K-$2M+ for approved data packages (self-reported). The public price points outside the companies' own published ranges are bids and distressed sales. The largest is Google's $10M winning bid for Spirit Airlines' archive, pending court approval. Mercor was at $7.5M and micro1 at $12.5M after the auction closed. No public deal shows what a working company with ten years of CRM history receives. Our [deals tracker](/deals) follows these figures. ## Which kind of program fits which company? Ask which one fits you. A ranking can't tell you. - **A startup that is shutting down** fits SimpleClosure Asset Hub. It was built for that. - **A company with 30 or more people, English-language records and years of Slack, email or CRM data** fits the direct programs that publish tiers, micro1 and Handshake AI. - **A company of 20 to 29 people that wants a published price band** fits Replay, which starts its bands at 20 employees. Our [Replay review](/answers/replay-review) covers its terms. - **A company that wants a marketplace to find several buyers** fits Troveo. Ask about the revenue share first. - **A company that wants someone to prepare its records and rights first** fits a readiness service. Ours is [managed readiness](/managed-readiness). ## Who gets paid when you sign? Some companies in this market pay people who introduce a company, and that money can shape what gets written about them. Our own fee note at the end covers every buyer we mention. Ask any comparison, this one included, who gets paid when you sign up. ## What should you do before a first call? 1. Run the [rights check](/rights-check) so you know whose words sit in your systems. 2. Read the [risk map](/risks) for failure points for data owners. 3. Work through [how to choose an AI data broker](/guides/how-to-choose-an-ai-data-broker) and [AI data broker red flags](/answers/ai-data-broker-red-flags). 4. Keep your raw data in your own systems until a signed agreement says who receives what and when it is deleted. The [buyer directory](/buyers) records each firm's public terms. [How to license your company's data to AI companies](/guides/how-to-sell-company-data-to-ai-companies) walks through the whole process. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Handshake AI's page](https://joinhandshake.com/ai/data-partnerships/) - [micro1](https://www.micro1.ai/data-partnerships) - [Handshake AI's company referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Mercor](https://www.mercor.com/data/) - [Troveo](https://www.troveo.ai/business-data) - [Replay](https://www.replay.ai/) - [Polyshares](https://polyshares.com/) - [SimpleClosure Asset Hub](https://simpleclosure.com/product/assethub/) - [Protege](https://withprotege.ai/) --- # How Handshake AI uses your company data > How Handshake AI uses your company data: what it strips out, who gets it, the license, and the re-identification warning on its own page. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-handshake-ai-uses-your-company-data Published: 2026-07-31 Updated: 2026-10-14 [Handshake AI](/buyers/handshake-ai) says you hand over your company data as it exists today. Handshake says it removes identifying details. Then the prepared dataset goes to frontier AI labs for training and testing, under contractual confidentiality. It calls the deal a license and says partner companies are never named. > **Data licensing means a company gets to use your records for a while, under rules. The contract says who owns what.** Think of a library. AI labs borrow real work to learn how work gets done. Nobody walks out with the shelf. Handshake has the shortest data-handling text of the buyers we read. It is also the only one of the six that admits on its own page that removing names can fail. All of it comes from [Handshake's data partnerships page](https://joinhandshake.com/ai/data-partnerships/). The program overview is in [Handshake AI data partnerships](/answers/handshake-ai-data-partnerships). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) ## What data does Handshake AI ask for? [The page](https://joinhandshake.com/ai/data-partnerships/) doesn't list data types. You fill out an intake form about your company and your tools. Then you talk to a team member and hold a scoping call. The call covers data parameters, removing identifying details, terms and timeline. The page describes the offer as operational data from businesses, with names and details removed and records formatted to spec. So the real list gets set on the call. Ask for it in writing before anything moves. ## How does Handshake AI collect it? [The page](https://joinhandshake.com/ai/data-partnerships/) says you "transfer the data as it exists today" and that Handshake prepares it on its side. It doesn't say if that means an export, a connection or a shared drive. It doesn't say who does the work either. It does put one duty on you in plain words. Data partners remain responsible for making sure their transfer to Handshake AI complies with applicable legal requirements. That is the most important sentence on the page for a data owner. It puts the consent and notice question on you. ## What does Handshake AI say it does to the data? Two statements sit side by side. The first is a promise. [Handshake](https://joinhandshake.com/ai/data-partnerships/) applies a structured process to remove direct and indirect personal identifiers from all datasets before delivery. It takes commercially reasonable steps so the data can't be tied to a person without extra information. The second is the admission. No removal process wipes out the risk entirely. A third party might re-identify personal information by combining it with other data. We'd weigh that line more than any promise around it. The method, the tools and the sampling are not described. For how re-identification happens, read [can AI re-identify anonymized emails and Slack messages](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages). Figure: steps Scoping call -> Handshake says it removes names -> Labs train and evaluate. The prepared dataset reaches labs under a confidentiality contract. ## Who receives it? Frontier AI labs, under contractual confidentiality, per [the page](https://joinhandshake.com/ai/data-partnerships/). It names no lab. It says partner companies are never named. Access is limited to authorized teams. The data is for model training and testing only, and it is not published or made public. "Training and evaluation only" is a limit worth putting in the contract in the same words. A marketing line is not a clause. _A friendly page is not a signed clause. Get the clause._ ## Does Handshake AI license your data or take it outright? It describes a license: "We partner with you to license your company data." The license terms are not published. The page says nothing on exclusivity. It doesn't say if a lab can pass the data on. It doesn't say what happens to datasets built from yours. It also says nothing on retention or deletion, so those stay blank on the public record. The page's calculator adds two notes. Its figures are an indicative estimate, not an offer to buy your data. A payout depends on due diligence and your acceptance of its licensing terms. ## What security does Handshake AI claim? One sentence. Transfer and use are covered by your contract, with access limited to authorized teams. The page shows no certification, no encryption statement and no incident history. We found no breach report tied to the data program. Reviews of Handshake mostly concern the worker side, not data partnerships. We cover those in [is Handshake AI legit](/answers/is-handshake-ai-legit). ## How does Handshake AI pay? [The page](https://joinhandshake.com/ai/data-partnerships/) says partnerships "range from $100K to $4M+ depending on the data shared". A calculator example on the page shows $383,083 to $896,969 for 100 employees and 10 years of US data, labelled indicative. All figures are Handshake's, and none promises you an outcome. Its FAQ says payments follow defined delivery milestones. Payment typically comes 30 to 60 days after Handshake accepts the de-identified dataset. ## What should you ask Handshake AI? - What data types does the contract cover, and can I exclude systems? - Who removes the identifying details, with what method, and is it sampled? - Who holds any mapping between original and replaced identifiers? - Can the license be passed to another lab or turned into new datasets? - What are the retention and deletion terms? - If the dataset is re-identified, who is responsible? The [rights check](/rights-check) covers what you need to hold before you transfer. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Handshake's data partnerships page](https://joinhandshake.com/ai/data-partnerships/) - [Handshake AI referral](https://joinhandshake.com/ai/data-partnerships/referral) - [Business Insider via AOL](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) --- # Data anonymization before a company data license > Searching for anonymization before a company data sale? Licensing needs it too. What the legal tests ask, why email and chat are hard, and who does the work. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/data-anonymization Published: 2026-07-24 Updated: 2026-10-14 Data anonymization means changing records so no one can be picked out from them. Three facts shape the job when a company licenses an email, chat or ticket archive to an AI buyer. 1. The legal tests differ by place. 2. Free text is much harder to scrub than a database. 3. In the deals I read, the buyer or its chosen vendor does the work. So the company's job is to ask who does it, to what standard and with what certification. Most search results for this phrase come from software vendors. This guide is the data owner's view. It is research, not legal advice. ## What does data anonymization mean when you license an archive? Three words get used loosely. - **Anonymization** means a person can no longer be identified from the data. - **Pseudonymization** swaps identifiers for labels and keeps a way back. - **De-identification** is the American term. Its meaning depends on the statute. Our page on [pseudonymization vs anonymization](/answers/pseudonymization-vs-anonymization) covers the first two. [What de-identification means in a data license](/answers/data-de-identification) covers the third. > **Anonymizing records means removing what points to a person.** Think of the library. Anonymizing pulls the borrower's name card out of every book for good. Swapping names for labels keeps the card in a locked drawer. This matters because AI buyers often want linked records. A name swapped for the same stand-in in Slack and in a spreadsheet keeps the trail from request to deliverable. That trail is pseudonymization. _Swapping "Dana" for "Person 4" feels like privacy. Ask who holds the key._ ## Which legal tests apply? | Test | Source | The question it asks | |---|---|---| | Anonymous data | GDPR Recital 26 | Is the person no longer identifiable, counting all means reasonably likely to be used? | | Deidentified | California Civ. Code 1798.140(m) | Can it be linked to a consumer, and are measures, a public commitment and recipient contracts in place? | | Safe harbor | 45 CFR 164.514(b), health data | Are 18 listed identifier types removed, with no actual knowledge of re-identification? | | Hashed data | FTC | Hashes can still identify users, so hashing alone is not anonymization | GDPR Recital 26 asks what means are reasonably likely to be used. It counts cost, time and available technology ([Recital 26](https://gdpr-info.eu/recitals/no-26/)). The ICO says pseudonymised data is personal data in the hands of anyone holding the additional information. It marks its guidance as under review ([ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/)). The EDPB's draft Guidelines 02/2026 on anonymisation are open for comment until 30 Oct 2026. They address singling out, linkability and inference ([EDPB](https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en)). California's test has three parts: reasonable measures, a public commitment not to re-identify, and contracts that bind every recipient ([statute text](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). Without them, the statute treats a transfer of personal information for money as a sale. Our [CCPA page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) explains. HIPAA's safe harbor lists 18 identifier types. It bars reliance on it where the entity has actual knowledge that the data could still identify someone ([45 CFR 164.514](https://www.law.cornell.edu/cfr/text/45/164.514)). ## Why is an email and chat archive harder than a database? Names sit inside sentences, signatures and attachments. Context identifies people even without a name. The law firm Frankfurt Kurnit Klein and Selz wrote that removing identifying details from millions of emails and chats is much harder than removing names from structured fields. It also wrote that removing names says whether a record links to a person. It says nothing about whether the content is confidential ([FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Research points the same way. Staab and co-authors reported that language models inferred personal attributes from text with up to 85% top-1 accuracy. They found that text anonymization was ineffective against that inference ([arXiv 2310.07298](https://arxiv.org/abs/2310.07298)). Lermen and co-authors reported up to 68% recall at 90% precision when matching pseudonymous accounts across platforms ([arXiv 2602.16800](https://arxiv.org/abs/2602.16800)). Both are research papers on arXiv. Neither tests a company archive. They show what a determined model can do. The Spirit Airlines consumer privacy ombudsman wrote in a footnote that technology has "far outpaced the law" on re-identification ([Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). Our [re-identification page](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages) goes further. ## Who does the data anonymization in a deal? In the deals I read, the receiving company, the marketplace or a vendor they accept. **[micro1](/buyers/micro1).** Its CFO said in an undated recorded forum talk that every corpus goes through a scrubbing step for personal identifiable information, sampled at several points. micro1's David Revland, who works on human data, said it turns names into consistent stand-ins. micro1 staff said companies cannot pre-scrub, because blanking names out would destroy the cross-platform trail. **Spirit Airlines.** The sale agreement has the buyer accept or designate the de-identification agent ([Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)). The ombudsman says Tonic.ai will strip identifying details from unstructured data and file a certification before each transfer. It also says micro1 proposed to do that work itself ([Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). **[Handshake AI](/buyers/handshake-ai).** Its page says it removes direct and indirect identifiers before delivery. It also says a third party may still be able to re-identify personal information in combination with other data ([Handshake AI](https://joinhandshake.com/ai/data-partnerships/)). ## Should you scrub the data yourself first? Ask before you touch anything. micro1 staff said in an undated recorded forum talk that a company's own scrub gets in its way. FKKS advises you to stay in control. That means selecting or jointly selecting the provider, approving the protocol and requiring certification to your satisfaction. Both can be true in one deal. The company chooses and approves the process, and the receiving company's side runs it. Settle which of those a buyer accepts before any export. A scrub also leaves a second problem untouched. FKKS recommends leaving out privileged material, HR and personnel files, payroll, health and benefits data, union communications and customer or partner confidential information entirely. In FKKS's view, anonymization does not make confidential content safe to license. ## What should you do before the first call? 1. Inventory systems and record types, with rough sizes. 2. Mark the categories to exclude, and read contracts and NDAs for third-party content. 3. Collect the dated privacy notices and handbooks people were given. 4. Ask each buyer who transforms the data, to what legal standard, and who certifies it. 5. Ask whether links between records survive, why, and who can reverse them. 6. Ask whether the buyer can pass the data on, and on what terms. Our [rights check](/rights-check) covers the contract, NDA and personal-data questions in steps 2 and 3, and the [risk map](/risks) shows where deals have broken. A [managed readiness review](/managed-readiness) gathers the facts for your lawyer. Talk to a privacy or commercial lawyer in your state before you sign. Figure: steps Exclude high-risk records -> Agree who strips names -> Certify the result. Get all three settled in writing before any data leaves. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Recital 26](https://gdpr-info.eu/recitals/no-26/) - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [EDPB](https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en) - [statute text](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [45 CFR 164.514](https://www.law.cornell.edu/cfr/text/45/164.514) - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [arXiv 2310.07298](https://arxiv.org/abs/2310.07298) - [arXiv 2602.16800](https://arxiv.org/abs/2602.16800) - [Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) --- # How micro1 uses your company data > How micro1 uses your company data: what it asks for, how it collects, the name swap, who sees it, ownership, deletion and pay. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/how-micro1-uses-your-company-data Published: 2026-07-22 Updated: 2026-10-13 [micro1](/buyers/micro1) says it swaps the personal names in a company's workflow data, then uses the result to train and test AI agents for labs. Per [its own page](https://www.micro1.ai/data-partnerships), the company keeps ownership of the underlying data. Pay comes as a corpus deal, a recurring workflows track, or both. > **Data licensing means a company gets to use your records for a while, under rules. You keep ownership.** Think of the attic. The boxes stay yours. micro1 gets to look through them for an agreed time. Everything here is micro1 describing itself. It comes from its [data partnerships page](https://www.micro1.ai/data-partnerships), an undated recorded forum talk and its own video. We could not check any of it independently, so read each line as a claim. For the program mechanics, start with [how the micro1 data partnership works](/guides/micro1-data-partnership). This guide covers only what happens to the data. ## What data does micro1 ask for? [The page](https://www.micro1.ai/data-partnerships) says micro1 wants "operational data and business workflows." Its examples are SOPs, knowledge bases, internal documentation, CRM data, project histories and QA processes. It also lists human feedback on AI outputs in real business settings. In the undated recorded forum talk, David Revland, who works on human data at micro1, named Google Workspace, Slack, project management tools and GitHub. What labs want, Revland said, is the chain from a message asking for a report to the report itself. micro1's CFO said the names and vendor line items matter less than that path. ## How does micro1 collect it? By export and a hands-on transfer. This is the sequence Revland described in the undated recorded forum talk: 1. A referral, peer intro or direct contact. 2. A first call with a data partnership manager. 3. A data manifest form listing your tools and rough sizes. 4. A payment proposal, then contract language. 5. A transfer that micro1's forward-deployed engineering team walks your IT team through. 6. micro1 verifies what arrived, then pays. The CFO estimated, in an undated talk, about 10 hours over a week or two from one or two people in IT. A micro1 referral partner said in a micro1 video that no IT team is needed. Both are micro1 speakers, and they disagree. Ask which one applies to you. micro1 does not say on its pages how it connects. It could be admin access, an API (a connection between two systems) or a file you hand over. ## What does micro1 say it does to the data? [Its page](https://www.micro1.ai/data-partnerships) says personal information is removed "when relevant." Some datasets get synthetic rewrites. Those keep the workflow structure but loosen ties to the original records. In the undated recorded forum talk, micro1's David Revland called it transformation instead of redaction. A name becomes a consistent stand-in everywhere. So a request in Slack still matches the report in Google Workspace. micro1's CFO said every corpus is sampled at several points. micro1 staff said in the same talk that companies cannot scrub first, because blanking names would break the trail. A micro1 partner described the same step on video as removing names, emails and phone numbers. Those are different outcomes. [The transformation page](/answers/micro1-pii-transformation) lays them side by side. The page adds that companies get to review representative samples before prepared data is used. That is a useful promise to hold micro1 to in writing. Figure: steps Engineers transfer -> Names swapped, sampled -> Verified, then paid. micro1 checks what arrived before any money moves. ## Who receives it? [The page](https://www.micro1.ai/data-partnerships) says access is restricted to a limited number of authorized team members. Data runs through isolated pipelines that stop it mixing with other engagements. The page names no lab. Press coverage of micro1's Spirit offer is the closest public account of what micro1 wants from the data. Fortune wrote, in its own words, that an agent needs to learn how to choose actions and use tools, and that the record of those steps is a trajectory. micro1 also offered $12.5 million for that archive after the auction. The court's privacy ombudsman noted that micro1 proposed to remove identifying details from the data itself. Details are on [the micro1 Spirit page](/answers/micro1-spirit-airlines). ## Is it a license or an outright transfer? micro1's current page says companies keep ownership of their underlying data. Confirm licensed uses, duration, exclusivity and payment structure in the proposed agreement. In an earlier, undated talk the CFO called the corpus track a one-time sale. In the same talk Revland mentioned a possible top-up about six months later for newer data. The referral partner in the video said the company licenses the data and keeps full access to it. That is three descriptions of one deal. The contract decides which one is true. Ask for the grant clause before you ask about price. ## What about retention and deletion? [The page](https://www.micro1.ai/data-partnerships) says data is kept for a limited period under agreed retention policies. On request, or at the end of an engagement, it is deleted under the agreed terms. Deletion requests are honored per the engagement. No period is given. Deleting your files from micro1 does not reverse any training that already happened. See [deleting after training](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it). ## What security does micro1 claim? [The page](https://www.micro1.ai/data-partnerships) says staff with access use company-managed devices and follow security controls and training requirements. It publishes no SOC 2 or ISO certificate and no encryption statement. We found no incident report. ## How does micro1 pay? [The page](https://www.micro1.ai/data-partnerships) says pay runs from "$100k+" to "$1M+." It depends on dataset size, workflow complexity, quality, domain expertise and uniqueness. In the undated recorded forum talk the CFO said: - Deals near $2M - $700 to $800 per task on the workflows track The data partnerships page tops out at "$1M+," while the [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages. A referral partner in the video said payouts arrive about 60 days after engagement. None of this is a promise to you. _Two ceilings for one program. We'd pick the lower one for planning._ ## What should you ask micro1? - Who holds the name-to-stand-in mapping, and is it deleted? - Does the contract say removal or swap? - What exactly does deletion cover, and by when? - Which labs or buyers can receive derived datasets? - Can I see the samples before anything is used? - Who covers a breach on your side of the pipeline? Our [rights check](/rights-check) lists what to settle with a lawyer. [Is micro1 legit](/answers/is-micro1-legit) lays out the evidence on the company. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [its own page](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # What goes in a data licensing agreement? > A data licensing agreement in plain words: the clauses law firms say to check, what buyers publish, and what to bring a lawyer. Not legal advice. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/data-licensing-agreement Published: 2026-07-16 Updated: 2026-10-14 A data licensing agreement is a contract. The owner of data gives a buyer set permission to use it, usually to train or test an AI model. > **Data licensing means a company gets to use your records for a while, under rules.** It's like renting out a spare room. The guest uses the room. You keep the house. Seven terms do most of the work: - what the buyer may do with the data - which models it covers - how long the license lasts and what outlives it - whether it is exclusive - what you promise about your rights - who pays if someone else objects - when you get paid No buyer publishes its supplier contract. So we built this list from law-firm notes, published supplier terms and statutes. Take it to your lawyer. It is a checklist and not legal advice. ## What is a data licensing agreement? It grants permission. On paper, it does not hand over the data forever. The buyer gets a right to use a defined set of records for a defined purpose, and you keep the rest. The labels vary. [Troveo](/buyers/troveo) says ownership never transfers and that it licenses on your behalf ([Troveo](https://www.troveo.ai/business-data)). [micro1](/buyers/micro1) says companies keep ownership of their underlying data. Its CFO called the corpus track a one-time sale in an earlier, undated recorded forum talk (self-reported). Confirm licensed uses, duration, exclusivity and payment structure in the proposed agreement. [SimpleClosure](/buyers/simpleclosure)'s supplier terms grant a non-exclusive, transferable, sublicensable, perpetual and irrevocable license ([terms](https://simpleclosure.com/tos/)). A perpetual, irrevocable license looks a lot like an outright transfer. The verbs inside the contract matter more than the label on it. For personal information, the transfer matters most. California's privacy statute defines a sale as a transfer of personal information to a third party for "monetary or other valuable consideration" ([Civ. Code 1798.140(ad)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). On my reading, a revenue share is consideration under that text. Ask counsel whether your deal is a sale. ## Which clauses do published sources say to check? Troveo's guide lists five core terms. They are permitted use, model coverage, term and survival, exclusivity, and representations and warranties. It adds indemnification (a promise to cover the other side's losses) and audit rights ([Troveo](https://www.troveo.ai/resources/ai-data-licensing-deals)). Sidley Austin's note adds chain of title (proof you own the data) and who owns trained models. It also covers limits on passing the data on, audit and deletion ([Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data)). | Clause | What it settles | Where a published example shows up | |---|---|---| | Permitted use | Training, fine-tuning, testing, retrieval or a mix | Troveo guide | | Model coverage | Which models and successors, internal or commercial | Troveo guide, Sidley | | Term and survival | How long it runs and what outlives it | Troveo guide | | Exclusivity | One buyer or many | Troveo guide | | Reps and warranties | What you promise about your rights | SimpleClosure terms | | Indemnity and caps | Who pays if a third party objects | SimpleClosure terms | | Sublicensing | Whether the buyer can pass it on | Sidley, Spirit sale | | Audit and deletion | How you check use and what happens at the end | Sidley, CCPA | | Payment | Amount, timing, share | Mercor, Troveo pages | Whether the permitted use is training or retrieval changes the pricing, the term and what survives. [Training license vs RAG license](/answers/training-license-vs-rag-license) sets the two side by side. ## What happens to a trained model when the license ends? Troveo's guide says models already trained survive the end of the license. Daniel Goldberg, a partner at Frankfurt Kurnit, says data that trains a model cannot practically be pulled back out ([FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). So a deletion clause covers your copies and the buyer's stored data. It does not undo training. Read any deletion promise with that in mind. **Figure: Deletion covers the files, and training that already happened stays.** Two columns. Under your copies, a stack of files goes into a trash can, greyed out. Under trained model, a highlighted chip stays where it is. ## How much does exclusivity change the deal? Troveo's guide calls exclusivity the term with the most effect on price (self-reported). It says field-of-use exclusivity is a common middle path. That means exclusive for one application only. Epoch AI's interviews found exclusive RL-environment deals at about 4x to 5x the price of non-exclusive ones ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). That is a different product from a company archive. It shows the direction. It is not your number. Figure: comparison of Exclusivity options in a data license: Non-exclusive (Many buyers), Field-of-use (One application), Exclusive (emphasized: Biggest effect on price, One buyer, premium). Troveo's guide names exclusivity as the term that moves price most. ## What will a buyer ask you to promise in the agreement? SimpleClosure's supplier terms are the one published example. The supplier promises that it owns the assets or has authority over them. It also promises that nothing breaks third-party or privacy rights. The supplier also promises that it gave the required notices and got the required consents. Assets must be free of liens, and open-source duties must be disclosed. The supplier then protects SimpleClosure from lawsuits over breaches. SimpleClosure caps its own liability at the greater of what you paid in six months or $100. Troveo's guide says the supplier's protection usually carries a cap tied to deal value. The two examples sit far apart. For personal information, California's statute requires the transferring business to sign an agreement with the buyer. It limits purposes and requires the same level of protection. It also lets that business take reasonable steps to check how the buyer uses the data ([Civ. Code 1798.100(d)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). ## Who removes the names, and who signs off? In the Spirit Airlines sale, an independent agent, Tonic.ai, strips identifying details from the unstructured data. The court's ombudsman recommends that the agent file a certification before each transfer. The sale terms bar onward transfer unless the next party makes a similar public commitment ([Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). Frankfurt Kurnit's checklist says to pick the de-identification provider jointly with the company that receives the data, and to require certification to your satisfaction. micro1 staff said in an undated recorded forum talk that micro1 transforms the data itself and that companies cannot clean it first (self-reported). Settle this clause before you sign. ## What are the payment terms? Published payment terms vary. [Mercor](/buyers/mercor) says it wires payment when the anonymized dataset is delivered to the buyer, typically within 2 to 4 weeks of a signed agreement ([Mercor](https://www.mercor.com/data/)). micro1's David Revland, who works on human data, said in the same talk that it pays after it checks the delivered data. Troveo says it pays a revenue share on every deal and publishes no split. None of these is a promise to you. Put the schedule, the trigger and the share in the contract. _A handshake deal is a great way to learn what a handshake is worth. Write it down._ ## What should you bring to a lawyer? Frankfurt Kurnit's list is a good start. Know your data by system and record type before offers arrive. Confirm your right to license the records under your customer and vendor contracts and your own software licenses. Decide which categories to leave out for good. Examples are privileged material, HR files, payroll, health data and union communications. Write down the review. Our [rights check](/rights-check) asks seven questions on the same ground. The [risk map](/risks) shows where objections have come from. For the full process, read [how to license your company's data to AI companies](/guides/how-to-sell-company-data-to-ai-companies). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [terms](https://simpleclosure.com/tos/) - [Civ. Code 1798.140(ad)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [Troveo](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Mercor](https://www.mercor.com/data/) --- # Can your business license its content to AI? > For businesses with courses, a member community, a podcast or a video archive: who licenses video and audio, and the consent to settle first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/guides/license-your-business-content-to-ai Published: 2026-07-08 Updated: 2026-10-14 Video has the clearest buyers for business content so far. Broadcasters, producers and distributors license footage through marketplaces such as Troveo and Protege, and Bloomberg reported buyers pay about $1 to $4 a minute. Before you license anything, check who appears in the footage and who owns the words. Community members, coaching clients and podcast guests rarely agreed to AI use. > **Data licensing means a company gets to use your content for a while, under rules.** Think of renting out a room. The buyer stays for a term and follows your house rules. You keep the house. Licensing your business records instead? Start with the [pillar guide on licensing company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies). This page covers content your business owns: video, audio, posts, courses and sessions. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) ## Which programs take business content for AI training? **Video.** [Troveo](https://www.troveo.ai/content-owners) pays content owners a revenue share on gross earnings. It has not published the percentage ([Publish Press](https://news.thepublishpress.com/p/how-to-make-money-when-ai-uses-your-content)). Its content-owners page prefers 1080p or 4K and says processing takes 1 to 2 weeks. [Troveo](/buyers/troveo) also runs a separate business-data program. [Protege](/buyers/protege) works with broadcasters, producers and distributors. They license content they own outright or control with broad rights. No minimum is stated and the share is undisclosed ([Protege](https://withprotege.ai/data-provider/video)). Calliope Networks said it needed at least 25,000 hours of content ([Tubefilter](https://www.tubefilter.com/2024/10/01/calliope-networks-generative-ai-scraping-license-startup/)). Protege bought it on 18 Dec 2024 ([Protege](https://withprotege.substack.com/p/protege-acquires-calliope-networks-bc7)). **New footage of hands-on work.** [micro1's video data program](/answers/micro1-commercial-video-data-partner) asks companies with at least 20 employees to film first-person video of physical work. That is new footage recorded for micro1, so your staff are the people on camera. **Audio.** There is no public per-hour rate yet. AIPodcast.io offers back-catalog licensing with a quarterly revenue share and written guest re-clearance. It publishes no rates ([AIPodcast](https://www.aipodcast.io/solutions/podcast-audio-licensing)). **Text.** Pay-per-use is the live model, and it favors sites with traffic. ProRata says it pays publishers 50% of all revenue from its Gist.ai product ([News/Media Alliance](https://www.newsmediaalliance.org/prorata-licensing-partnership/), [WAN-IFRA](https://wan-ifra.org/2025/01/prorata-aims-to-be-pro-publisher-when-it-comes-to-revenue-sharing-on-ai-platforms/)). **Courses, community content and coaching transcripts.** No named buyer pays for these in public reporting so far. ## What do buyers pay for video? AI companies pay about $1 to $4 per minute of video. For ordinary YouTube-style footage it is $1 to $2 ([Bloomberg via The Star](https://www.thestar.com.my/tech/tech-news/2025/01/13/youtubers-are-selling-their-unused-video-footage-to-ai-companies)). Those are buyer prices. Public sources don't show how much of that price reaches the business that owns the footage. Troveo's revenue share is unpublished, and so is Protege's. _The buyer price is the headline. Your share of it is the number to get in writing._ ## Who owns the words and faces in your content? Platform terms say what the platform may do with your content. They don't decide what you may license to a third party. That depends on your copyright and on releases from everyone in the content. **Figure: The footage is yours to license once everyone in it has signed.** A video frame with three people in it, labelled member, client and guest. Under each person is an empty highlighted box and a signature line, labelled releases. | Platform | What the terms say | |---|---| | [Skool](https://www.skool.com/legal?t=terms) | Content is yours. Skool gets a sublicensable license to provide, develop and improve its services. No AI clause, and the terms don't address admin rights over members' posts | | [Circle](https://www.circle.so/terms) | Irrevocable, sublicensable license to process your content and use it, in non-identifying form, to develop and improve Circle's products | | [Kajabi](https://kajabi.com/policies/terms) | You keep your content and stay responsible for the consents your students' personal data needs. You may not use MCP data to train AI without Kajabi's written consent | | [Substack](https://substack.com/pa) | Your license to Substack does not permit it to train third-party AI models | | YouTube | Google trains Gemini and Veo on YouTube content and channel owners cannot opt out ([CNBC](https://www.cnbc.com/2025/06/19/google-youtube-ai-training-veo-3.html)) | The Substack clause limits Substack. As we read it, it says nothing about what you may license from your own posts. **Community members.** Members own their posts. As we read the terms, a business that licenses its Skool or Circle archive is licensing something the terms do not hand over. There's no public case of this yet, so the risk is untested. **Coaching clients.** Sessions carry confidentiality duties. Tandem Coach reads the ICF's Standard 2.5 on boundaries as meaning clients should know when AI tools touch the coaching relationship. It suggests disclosure in writing and consent spoken at intake. The standard itself doesn't mention AI ([Tandem Coach](https://tandemcoach.co/ai-disclosure-coaching-clients/)). No public market for these transcripts exists yet. Removing names from conversational text is harder than stripping fields ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). **Podcast guests.** Most signed releases before AI licensing existed. AIPodcast re-clears guests in writing and drops episodes where a guest declines or cannot be reached. **People on camera.** Content with identifiable people needs signed waivers ([AI Optimist](https://www.theaioptimist.com/p/the-5m-ai-video-licensing-wave-why)). That includes staff who appear in training videos or webinars. ## What should you do before licensing anything? 1. **Inventory what the business owns.** List its video, audio, courses and posts by type, and who made each: staff, contractors or guests. 2. **List the people.** Guests, clients, members and anyone on camera or named. This list decides what is licensable before a buyer enters the picture. 3. **Collect what each person signed.** Releases, guest agreements, community terms, client contracts and contractor agreements. Where nothing mentions AI, treat it as an open question for a lawyer. 4. **Flip the switches you control.** YouTube third-party training is off unless you turn it on. Substack's "Tell AI tools not to train" toggle applies only to the AI tools that respect it ([Substack Support](https://support.substack.com/hc/en-us/articles/20382615953556-How-can-I-block-AI-from-using-my-Substack-publication-to-train-their-models)). Spawning runs a Do Not Train registry ([Spawning](https://spawning.substack.com/p/the-spawning-guide-to-rights-reservations)). 5. **Ask the contract questions.** Revenue share, exclusivity, term, revocation, and whether your files pool into dataset-wide deals you never see. The [pillar guide](/guides/how-to-sell-company-data-to-ai-companies) has the full checklist. 6. **Talk to a lawyer and an accountant.** Pick a lawyer who handles media or IP licensing, and see them before you sign. An accountant can explain how any payout is taxed. We are neither. ## How do you do this safely? Run the [rights check](/rights-check) before you list anything with a buyer. It asks seven questions about whose words and faces sit in your content and what each person signed. The [risk map](/risks) covers the legal and security failure points for data owners. The [buyer directory](/buyers) and [deals tracker](/deals) show who pays what, with dates. Keep your files in your own storage until a signed agreement says who receives them and when they are deleted. Your business may also hold years of email, CRM or ticket records. The [readiness check for business data](/guides/how-much-is-your-business-data-worth-to-ai) takes ten minutes. The free [fit check](/business) comes next. Do step two above first, today. The list of people in your content sets the limit on everything else. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/content-owners) - [Publish Press](https://news.thepublishpress.com/p/how-to-make-money-when-ai-uses-your-content) - [Protege](https://withprotege.ai/data-provider/video) - [Tubefilter](https://www.tubefilter.com/2024/10/01/calliope-networks-generative-ai-scraping-license-startup/) - [Protege](https://withprotege.substack.com/p/protege-acquires-calliope-networks-bc7) - [AIPodcast](https://www.aipodcast.io/solutions/podcast-audio-licensing) - [News/Media Alliance](https://www.newsmediaalliance.org/prorata-licensing-partnership/) - [WAN-IFRA](https://wan-ifra.org/2025/01/prorata-aims-to-be-pro-publisher-when-it-comes-to-revenue-sharing-on-ai-platforms/) - [Bloomberg via The Star](https://www.thestar.com.my/tech/tech-news/2025/01/13/youtubers-are-selling-their-unused-video-footage-to-ai-companies) - [Skool](https://www.skool.com/legal?t=terms) - [Circle](https://www.circle.so/terms) - [Kajabi](https://kajabi.com/policies/terms) - [Substack](https://substack.com/pa) - [CNBC](https://www.cnbc.com/2025/06/19/google-youtube-ai-training-veo-3.html) - [Tandem Coach](https://tandemcoach.co/ai-disclosure-coaching-clients/) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [AI Optimist](https://www.theaioptimist.com/p/the-5m-ai-video-licensing-wave-why) - [Substack Support](https://support.substack.com/hc/en-us/articles/20382615953556-How-can-I-block-AI-from-using-my-Substack-publication-to-train-their-models) - [Spawning](https://spawning.substack.com/p/the-spawning-guide-to-rights-reservations) --- # Publicly documented company data deals and price claims By Matt Burns, Vaultfish. Published 9 Oct 2026. Updated 16 Oct 2026. Data through 10 Oct 2026. Page: https://vaultfish.com/research/what-company-data-sells-for ## The short answer Public figures are few, and they are different kinds of evidence, so we keep them in separate groups. The one named completed sale, Cielo24, reportedly went for "hundreds of thousands of dollars". The largest figure a court has seen is Google's $10M winning bid for Spirit Airlines' archive. No sale order as of 10 Oct 2026. Most other figures are ranges companies publish about their own programs. ## Five findings 1. **One named completed sale.** Cielo24, a defunct company, reportedly sold 13 years of Slack, email and Jira history for "hundreds of thousands of dollars". The buyer is unnamed and the report is secondary ([Forbes](https://www.forbes.com/sites/annatong/2026/04/16/ais-new-training-data-your-old-work-slacks-and-emails/)). 2. **The biggest court figure is still a bid.** Google's $10M bid won the 14 Aug 2026 auction for Spirit Airlines' archive: about 100 million emails, 500 million Teams items and 30 million lines of code ([court docket](https://www.courtlistener.com/docket/71233134/spirit-aviation-holdings-inc/), [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). The hearing was moved from 14 Oct to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. 3. **Three offers, one archive.** Mercor was the $7.5M alternate bidder at that auction. micro1 made a late $12.5M offer after it closed ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/), 14 Sep 2026). We mark the three Spirit rows as related observations of one archive. Count them as one case. 4. **Published ranges are marketing claims.** SimpleClosure says it has done nearly 100 archive deals in about a year at $10,000 to $100,000 per company, by its own count ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)). Handshake AI's ceiling is "$4M+", which it labels an indicative estimate and not an offer ([Handshake AI](https://joinhandshake.com/ai/data-partnerships/)). No named company has confirmed a figure in this group. 5. **Two rows rest on a court record.** Both are Spirit bids. Every other row rests on a press report or on the company's own figures ([court docket](https://www.courtlistener.com/docket/71233134/spirit-aviation-holdings-inc/)). Figure: scale, Spirit Airlines archive auction, 14 Aug 2026: Mercor, runner-up $7.5M, Google, winning bid $10M (emphasized). Google outbid Mercor for Spirit Airlines' archive. Source: Time and Fortune, from the court docket. ## What these examples cannot establish - They are not a price list. A handful of public figures, mostly bids and published claims, cannot set a market rate. - They do not estimate what any company would be paid. Your records, rights and terms will differ from every row here, and the guide to [how much company data is worth](https://vaultfish.com/guides/how-much-is-your-business-data-worth-to-ai) covers what moves the figure. - Published ranges are self-reported marketing claims. Treat them as a company's pitch until a named company that took part confirms a figure. ## Method Every row is a row in the deals tracker (https://vaultfish.com/deals), frozen on the date above. **Where we searched.** Court dockets through the CourtListener RECAP archive (the Spirit Airlines case, No. 25-11897), national, business and trade press, and the pages AI data companies and marketplaces publish about their own programs. **What gets a row.** A court filing or news report that records a price, bid or offer for company or user data sold or licensed for AI training, a price range an AI data company or marketplace publishes about itself (marked self-reported), or a named seller's sale plan that drew a lawsuit, even with no price (Photobucket). **What stays out.** Whole-company acquisitions (they price the business, not the data), publisher and media licensing deals, private figures told to us, and any number we cannot trace to a filing or a report. Reddit's reported $60M a year license with Google stays in, in the context group, because it is the best-known price anchor. It is a content license and neither company confirmed the figure. **How we group rows.** Each row sits in one group by its status: completed sales, bids and offers (none closed), published price ranges, or context. Rows that are offers for the same archive are marked related, so three Spirit bids read as one case. **Prices stay as the source states them.** We never average a range, turn a phrase like "six figures" into a number, or work out a price per employee. The study has no totals, averages or medians, inside a group or across groups. Dates are event dates. micro1's tiers page carries no date, so its row uses the day we read it. Events run from 22 Feb 2024 to 6 Oct 2026. **Known gaps.** Private deals under confidentiality terms never reach the public record, so this set undercounts them. Two rows rest partly on reports we could not open (Forbes and Fast Company for Cielo24, Reuters for Photobucket), and those rows say so in their notes. We read the Spirit docket through the RECAP mirror, which lags the court. The 9 Oct 2026 notice that moved the Spirit hearing was not on it when we looked, so that row cites Travel Weekly (https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) for the move. ## The dataset, by group 11 rows in four groups, oldest first inside each. CSV with a category column, notes and every source: https://vaultfish.com/research/what-company-data-sells-for.csv ### Completed sales (1 row) A press report, or the buyer itself, says a deal closed. No court or party has published the contract. | Date | Buyer or program | Records from | Figure as stated | Status | Evidence | Records covered | Related | Sources | |---|---|---|---|---|---|---|---|---| | 16 Apr 2026 | Undisclosed AI buyer | Cielo24 (defunct, via SimpleClosure) | "Hundreds of thousands of dollars", as reported | Reported completed | Secondary source only | 13 years of Slack messages, Email, Jira tickets, Multi-terabyte Google Drive archive | None | [Forbes (we could not open it, details via search summaries)](https://www.forbes.com/sites/annatong/2026/04/16/ais-new-training-data-your-old-work-slacks-and-emails/), [Fast Company (we could not open it)](https://www.fastcompany.com/91528808/shuttered-startups-are-selling-old-slack-chats-and-emails-to-ai-companies), [Strategic Signal deal tracker entry](https://strategicsignal.ai/ai-data-transactions/deals/ss-aidt-2026-0001/) | ### Bids and offers, none closed (4 rows) Figures offered for data. None of these has closed. Rows that share an archive are related observations of one archive, not independent deals. | Date | Buyer or program | Records from | Figure as stated | Status | Evidence | Records covered | Related | Sources | |---|---|---|---|---|---|---|---|---| | 14 Aug 2026 | Google | Spirit Aviation Holdings (Spirit Airlines, in Chapter 11) | $10M winning bid | Pending court approval | Court record plus press | About 100 million emails, About 500 million Teams items, About 30 million lines of code, Employee and payroll records | One of 3 related observations of the Spirit Airlines archive, not an independent deal. | [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/), [Bloomberg Law: ombudsman report](https://news.bloomberglaw.com/ip-law/spirit-data-sale-to-google-passes-muster-privacy-ombudsman-says), [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/), [EPIC amicus brief announcement](https://epic.org/epic-files-amicus-brief-challenging-spirit-airlines-bankruptcy-sale-of-employee-data-to-google/), [Travel Weekly: hearing moved to 6 Nov 2026](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), [Court docket, In re Spirit Aviation Holdings, No. 25-11897 (Bankr. S.D.N.Y.)](https://www.courtlistener.com/docket/71233134/spirit-aviation-holdings-inc/) | | 14 Aug 2026 | Mercor | Spirit Aviation Holdings (Spirit Airlines, in Chapter 11) | $7.5M alternate bid | Bid, not accepted | Court record plus press | Same Spirit archive as the Google bid | One of 3 related observations of the Spirit Airlines archive, not an independent deal. | [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/), [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) | | 17 Aug 2026 | Mercor | Shuttered and acquired startups (for example Warmly, per the report) | Offers of up to $300,000 reported | Offers reported | Press report | Slack logs, GitHub records, Asana files, Google Drive documents, Meeting transcripts and recordings | None | [BigGo editorial](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) | | 3 Sep 2026 | micro1 | Spirit Aviation Holdings (Spirit Airlines, in Chapter 11) | $12.5M reported offer | Bid, not accepted | Press report | Same Spirit archive as the Google bid | One of 3 related observations of the Spirit Airlines archive, not an independent deal. | [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/), [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) | ### Published price ranges (4 rows) Ranges that AI data companies and marketplaces publish about their own programs. They are self-reported marketing claims, and no named company has confirmed a figure. | Date | Buyer or program | Records from | Figure as stated | Status | Evidence | Records covered | Related | Sources | |---|---|---|---|---|---|---|---|---| | 17 Apr 2026 | Undisclosed AI companies and labs | Shut-down startups, through SimpleClosure Asset Hub | $10,000 to $100,000 per company, nearly 100 deals in about a year | Self-reported range | Self-reported by the company | Slack, email and workspace data, Source code | None | [Gizmodo, citing Forbes](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), [SimpleClosure Asset Hub announcement](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/), [SimpleClosure CEO post](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) | | 11 Sep 2026 | Troveo's buyers (unnamed) | Companies licensing through Troveo | Typical full-company deals start at six figures. Example dataset: $850,000 across four sales. Single repository: about $5,000, an unnamed platform's baseline it cites. Startup archives: $10,000 to $100,000 | Self-reported range | Self-reported by the company | Business data from about 30 systems, Source code | None | [Troveo: how much is company data worth](https://www.troveo.ai/resources/how-much-is-company-data-worth), [Troveo business data](https://www.troveo.ai/business-data) | | 2 Oct 2026 | Handshake AI | Not stated | $100K to $4M+. Calculator example: $383,083 to $896,969 for 100 employees and 10 years | Self-reported range | Self-reported by the company | Operational data from businesses (types not itemized) | None | [Handshake AI data partnerships page](https://joinhandshake.com/ai/data-partnerships/), [Handshake AI data partnerships criteria page](https://joinhandshake.com/ai/data-partnerships/referral) | | Undated | micro1 | Not stated | Tiers of $100K+, $500K+ and $1M+. Enterprise Data Partnership listing: $100K-$2M+ for approved data packages | Self-reported range | Self-reported by the company | Slack, Email, CRM, Tickets, SOPs and knowledge bases | None | [micro1 data partnerships page](https://www.micro1.ai/data-partnerships), [micro1 Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) | ### Context (2 rows) Announced plans and unconfirmed reports. They show how the market behaves, and none is a confirmed company data sale. | Date | Buyer or program | Records from | Figure as stated | Status | Evidence | Records covered | Related | Sources | |---|---|---|---|---|---|---|---|---| | 22 Feb 2024 | Google | Reddit | About $60M a year, reported | Reported, unconfirmed | Press report | User-generated posts and comments | None | [The Decoder, citing Reuters](https://the-decoder.com/reddit-signs-60-million-annual-training-data-deal-with-google/) | | 8 Apr 2024 | Unnamed technology companies (talks reported) | Photobucket | Not disclosed in the sources we could open. Press coverage of the CEO's remarks cites 5 cents to $1 per photo, unverified | Announced, no price | Secondary source only | About 13 billion user photos and videos | None | [Class Action.org on Pierce v. Photobucket, filed 11 Dec 2024](https://www.classaction.org/news/photobucket-facing-lawsuit-over-plan-to-sell-13-billion-user-photos-to-third-parties) | ## Corrections Newest first. **11 Oct 2026** - Retitled to "Publicly documented company data deals and price claims" (it was "Publicly documented company data deals and buyer price claims"). The group of self-published ranges is now "Published price ranges" (it was "Buyer marketing ranges") and the bids group is now "Bids and offers, none closed". The ranges group includes micro1's partnership tiers, and micro1 runs data partnerships in which companies keep ownership, so the old label described it wrongly. - Renamed four CSV columns to match the table headings: "buyer" is now "buyer_or_program", "data_sold" is now "records_covered", "seller" is now "records_from" and "price_as_stated" is now "figure_as_stated". Some rows are programs, such as micro1's company-data partnerships, where the company keeps ownership of its data. **10 Oct 2026** - Retitled to "Publicly documented company data deals and buyer price claims". The old title claimed complete coverage, which a search like ours cannot promise. The address stays the same. - Split the rows into separate groups: completed sales, bids and pending court sales, buyer marketing ranges, and context. The CSV gains category and related_to columns. - The Spirit Airlines hearing was moved from 14 Oct to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. - Removed the price-per-lost-job comparison for the Spirit bids from our guides and answers. This study never printed it. Also removed a chart here that set Google's bid against SimpleClosure's top self-reported price. - Updated the micro1 wording to describe company-data partnerships in which companies keep ownership of their data. ## How to cite this study Burns, M. (2026). Publicly documented company data deals and price claims. Vaultfish. Published 9 Oct 2026, data through 10 Oct 2026. https://vaultfish.com/research/what-company-data-sells-for License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Reuse freely and credit Vaultfish with a link to the study. ## For journalists Matt Burns can walk you through any row and give a comment on the record. Press inquiries: https://vaultfish.com/contact?topic=press --- # Appen: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/appen. Company site: https://www.appen.com/enterprise-data An AI training-data company that licenses company workflow records to AI labs and quotes each partnership on its own. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Appen Limited ## Data it wants Operating records in three groups: process documentation (docs, wikis, intranet, training and QA material), decision and escalation records, and systems of record. It says labs want approval chains, failure and recovery paths, and the reasoning behind decisions. ## Who it takes No minimum published on the page we read. Companies winding down are asked to flag it on the form for a faster reply. Not stated. ## How it earns Not published. Appen licenses the data to AI labs and says it covers extraction, anonymization and transfer, with no deductions from what you are paid. ## Process 1. Register interest on a short form. Appen says its partnerships team replies within two business days. 2. A mutual NDA comes before any further discussion. 3. You name the systems, teams, workflows and time periods in scope. 4. Appen extracts and anonymizes the data, and you approve a representative sample before anything is licensed. 5. Terms are agreed in writing before extraction, and payment is made on acceptance. ## Payout claims - No figure published. Each partnership is quoted on its own, priced on volume, how connected the systems are, workflow complexity, data quality and rarity. ## Security claims - No certification named on the page we read. - Says extraction is read-only, encrypted in transit and scoped per engagement, and your data is never mixed with another partner's. - Says no lab or third party sees raw data, and access runs on a named, time-bound roster with an audit trail. ## De-identification and privacy Personal data is detected and removed, with synthetic rewriting where the workflow structure has to survive. No de-identification standard is named. ## Terms for companies - **License or ownership.** Its FAQ says you keep ownership and grant a defined license for a defined use. Retention and deletion terms are agreed in writing before extraction. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - No price, range or payment timing is published. - The labs that receive the data are not named. - The license, retention and deletion terms are not public. --- # Brickroad: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/brickroad. Company site: https://brickroad.network/suppliers A data-feed network that packages a company's data, reviews it and routes licenses to AI labs, funds and corporate buyers. It does not buy the data itself. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Data it wants Recurring data feeds such as receipts, transactions, filings, claims, telemetry, usage, listings, procurement and logistics data, across industries from retail and finance to healthcare and government. Its buyers include financial firms as well as AI labs. ## Who it takes No minimum. Its FAQ says a small or niche feed is welcome and that it is built for companies licensing data for the first time. Not stated. ## How it earns Not published. Its FAQ says the split is set per offering, in writing, in the license you approve. Its pricing page lists fees for buyers only. ## Process 1. Start an information package: company, contact and what you produce. 2. Describe coverage and provenance, and add a sample buyers can review without a call. 3. Set license terms, or upload a license you already use. Exclusivity is your choice. 4. Brickroad reviews the source and sample before the feed enters its registry. 5. Once live, each refresh is repackaged, evaluated and routed to buyers. ## Payout claims - No deal size published. Its FAQ says building and submitting a package costs nothing, and enhancement work such as backtesting is scoped after review. ## Security claims - No certification named on the pages we read. - Says it cleans and anonymizes data during its enhancement step. ## De-identification and privacy Anonymization during enhancement. Connecting requires representations on provenance, rights, material non-public information and personal data. No de-identification standard is named. ## Terms for companies - **License or ownership.** Its FAQ says Brickroad does not buy your data and is not owned by anyone who does. You license on your terms, with your brand on the offering. - **Your warranties.** Connecting requires representations on provenance, rights, material non-public information and personal data. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The revenue split is not published. - No buyer is named. - The cost of enhancement work is not published. --- # Centific: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/centific. Company site: https://www.centific.com/enterprise-data An AI data company that extracts, anonymizes and licenses company operating records to frontier AI labs, paying on acceptance. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Data it wants Connected operating records across finance and accounting, healthcare operations, sales and deals, people operations and IT service management. Sources include email, chat, documents, CRM, HR, ERP and data warehouses. It says it supports 188 enterprise applications. ## Who it takes No minimum published. Its form's headcount options start at up to 50 employees, and it takes operating, winding-down and closed companies. Not stated. ## How it earns Not published. Centific licenses the data to AI labs and says it pays for extraction, anonymization and transfer, with no setup fees or deductions. ## Process 1. A call to review your applications and data. You leave with a written estimate of what the dataset is worth. 2. Connect the in-scope applications read-only, with your exclusions written into the extraction code. 3. A single extraction runs in the background. 4. Anonymization, then you review and sign off a sample pack. 5. Payment on acceptance. It says most partnerships reach a first accepted contribution in six to ten weeks, and most partners then move to a quarterly refresh. ## Payout claims - No figure published. Pay depends on volume, applications connected, work complexity, data quality and how rare comparable data is. Annotation by your own employees is optional and priced separately. ## Security claims - No certification named on the page we read. - Says extraction is read-only, encrypted in transit, scoped to one credential set per engagement and logged against a named, time-bound roster. - Says AI labs and third parties never see raw data, and no person reads it during extraction. ## De-identification and privacy Personal data is removed, with synthetic rewriting where a record's structure must survive. You review an anonymized sample before use. No de-identification standard is named. ## Terms for companies - **License or ownership.** Its page says you license the data and never hand it over. Companies winding down can use a separate asset-purchase agreement. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - No price or range is published. - Wind-down deals use an asset-purchase agreement, a different deal from a license. Ask which one you are signing. - The labs are not named and the contract is not public. --- # Collinear AI: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/collinear-ai. Company site: https://collinear.ai/data-acquisition A research lab that licenses code repositories and business-app history to build training and evaluation environments for AI agents. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Data it wants Private code repositories with pull requests, linked tickets, CI logs and coding-agent sessions, plus history from business apps such as Slack, Gmail, Google Drive, Notion, HubSpot, Salesforce, Jira and Linear, and database dumps. ## Who it takes No minimum published. It says the price rises with 15 or more people at peak, several years of history, human-written code and work visible across several tools. It does not want AI-generated code, loose documents or anything you lack the rights to. Not stated. ## How it earns Not published. It uses the data to build its own agent training and evaluation environments. ## Process 1. Share an overview of your tools and how much history you have. It says it usually quotes an initial range within a day. 2. Sign a licensing agreement granting Collinear rights to use the data. 3. The licensed data is exported, anonymized and prepared. 4. Collinear confirms delivery, then pays under the contract. It says the process takes about a week from first call to signature. ## Payout claims - No figure published. It quotes an initial range after an overview of your tools and history. ## Security claims - Its footer shows AICPA SOC and ISO 42001 badges. The reports are not on the page. - Says the export is one-time and any access you grant can be removed after the transfer. ## De-identification and privacy Personal data is removed after export: names become consistent pseudonyms and identifiers are stripped. You can hold back anything you prefer not to send. Consistent pseudonyms keep records linkable. ## Terms for companies - **License or ownership.** Its FAQ says a license grants Collinear rights to use the data, and ownership stays with you. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - No price range is published. - Your data is expanded synthetically into training environments, so its influence lasts beyond the files you send. - The licensing agreement is not public. --- # Dappier: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/dappier. Company site: https://dappier.com/publishers A marketplace of real-time publisher data that AI agents query and pay for, plus AI answer and conversational-ad products for publishers. It serves publisher content, not company archives. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Data it wants Does not buy. Its agent storefront lists publisher and content partners, such as Benzinga and WISH-TV AI, whose data APIs agents call, covering live web search, news, stock prices and financial insights. ## Who it takes Aimed at publishers and data vendors. No eligibility criteria published on the pages we read. Not stated. ## How it earns Per-unit pricing quoted through its API, paid through ZeroClick and Stripe checkout, and conversational ads. The revenue share to publishers is not published. ## Process 1. Agents buy through its storefront, which says payment runs through ZeroClick, with card payments on Stripe checkout pages. ## Payout claims - No payout figures or revenue-share percentages published. ## Security claims - No security claims or certifications stated on the pages we read. ## De-identification and privacy Not stated. It serves publisher content, and company records are not in its catalog. ## Terms for companies - **Your warranties.** Not found. - **Your indemnity and audit.** Not found. - **Liability cap.** Not found. - **Governing law.** Not found. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Licensing terms and the publisher revenue share are not published on the pages we read. - Its publisher page leads with ads and answer products and its storefront leads with data APIs, so check which product a deal covers. - It serves publisher content and does not take company archives. --- # Datarade: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/datarade. Company site: https://datarade.ai/ A listing marketplace where buyers contact data providers. It does not buy data. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Legal entity Monda Labs GmbH ## Data it wants Nothing. It lists third-party data products such as sales, financial, consumer and alternative data, and buyers contact the sellers. ## Who it takes None. Providers apply through its provider portal. Global. Its homepage cites 2700+ providers. ## How it earns Commission paid by the provider when a buyer purchases. Its homepage says the service is free for buyers and paid by the provider. ## Process 1. Apply as a provider. 2. Create listings and a storefront. 3. Respond to buyer requests. 4. Pay commission on facilitated purchases. ## Payout claims - Commission schedules differ between sources: 30%, 20% and 15% by plan on one summary, and a flat 30% on another page. (reported) ## Security claims - No certification or security statement found. ## De-identification and privacy Not found. It is a marketplace, and the seller handles the data and any anonymization. ## Terms for companies - **Your warranties.** Not found. - **Your indemnity and audit.** Not found. - **Liability cap.** Not found. - **Governing law.** Not found. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Its public pricing page returned "not found" and its commission tiers conflict across sources. - It is a lead marketplace, so payment between buyer and seller is arranged outside the platform. - Its typical sellers are commercial data vendors, not companies licensing their own archives. --- # DataVendor: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/datavendor. Company site: https://datavendor.ai/ A self-serve marketplace where organizations list private code, datasets and AI training tasks for invited AI-company buyers. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Data it wants Private supply that models have not seen: codebases, tasksets, RL environments, text corpora and raw data. Public repositories cannot be valued, because models are often trained on public code already. ## Who it takes Organizations only. Vendor setup is self-serve with no application review. A higher vendor tier, which can answer buyer requests, needs a signed agreement. Not stated. Bank withdrawals run through Stripe, set up per payout country. ## How it earns A 20% platform fee on withdrawals to a bank. Earnings converted to its own platform credits carry no fee. Buyers pay a separate transaction fee. ## Process 1. Sign up with a work email, which creates an organization, and choose to list data. 2. Accept a mutual NDA to open the workspace. 3. Add assets and run the automated quality checks. 4. Set a price and publish a listing. Buyers purchase it, take a sample or bid. 5. Earnings settle 14 days after payment and can then be withdrawn. ## Payout claims - You set the price. Its homepage shows codebase listings at $68K to $220K. The page does not say whether any of them were bought. - The minimum bank withdrawal is $1,000 before fees. A lost card dispute takes back the sale amount plus a $15 fee. Self-reported by the company unless marked reported. ## Security claims - No certification named on the pages we read. - Says buyers see metadata, redacted file trees and quality evidence before purchase, never the raw files. - Says vendors never learn who bought, bid on or sampled a listing. ## De-identification and privacy Not described on the pages we read. Buyers see redacted previews before purchase. ## Terms for companies - **License or ownership.** Its docs say a purchase licenses your assets for a commercial use, and the usual starting point is that you keep ownership. Exact rights depend on the agreement behind the listing. Purchases are final, with no refunds. - **Your warranties.** Submitting a listing confirms you own the supply and may license it. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Buyers stay anonymous, so you cannot see who licensed your data. - Purchases are final, and a buyer keeps access after you unpublish a listing. - The 20% fee applies when you withdraw cash. Converting to platform credits avoids it but cannot be reversed. --- # Defined.ai: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/defined-ai. Company site: https://defined.ai/partnerships A data lab with a long-running marketplace for licensed datasets. It wants datasets with consent documentation, not whole company archives. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Defined.ai (Seattle headquarters, per its press release) ## Data it wants Third-party and custom datasets across text, audio, image, video and sensor data. It is currently seeking cinematic video, anime-style media, code and STEM content (its partnerships page). ## Who it takes No fixed minimum dataset size. Partners need consent and licensing documentation. Not restricted on the pages we read. ## How it earns Licensing fees from marketplace sales. Its cut is not published. ## Process 1. Enrolment with an ethical questionnaire. 2. Clearance with dataset-level forms. 3. Onboarding after satisfactory completion. 4. Ongoing compliance monitoring. ## Payout claims - 65% revenue growth in 2025, the company's own figure. It says nothing about what your company would receive. - Its partnership page quotes partner revenue figures. We leave them out: they are undated, unaudited and predict nothing for your company. Self-reported by the company unless marked reported. ## Security claims - States ISO 42001 certification on its supplier terms. - Its ethics page also claims ISO 27001 and 27701 (per our research notes, not re-read today). - Says it is GDPR compliant. ## De-identification and privacy Requires consent and licensing documentation from the partner and runs an ethics and compliance review before listing. ## Terms for companies - **License or ownership.** Non-exclusive, with no minimum commitment for either party. - **Your warranties.** Suppliers provide rights and consent documentation. The full terms are in its supplier general terms and conditions. Defined.ai may audit a supplier once a year, or sooner if it suspects a material breach, with at least 15 business days' notice. - **Your indemnity and audit.** Section 3.4 of its supplier terms: the supplier defends, indemnifies and holds Defined.ai harmless against third-party claims arising from the supplier's breach of the terms. Any obligations from Defined.ai in return are left to a separate data license agreement. - **Liability cap.** The supplier's liability under its indemnity is limited to two times the total value of business conducted between the parties. - **Governing law.** Washington State law. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Its partner revenue figures are unaudited and undated. - Its fee split is not published. - It lists licensed datasets and does not target small-company archives. - The supplier indemnifies Defined.ai, and the terms leave Defined.ai's own obligations to a separate data license agreement. --- # Handshake AI: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/handshake-ai. Company site: https://joinhandshake.com/ai/data-partnerships/ A worker-and-employer network that runs an expert fellowship and a separate company-data partnerships program. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Handshake (joinhandshake.com) ## Data it wants Operational data from businesses across industries, de-identified by Handshake and delivered to AI labs under contract. The page does not itemize data types or source tools. ## Who it takes 20+ full-time employees and 3+ years in operation (referral page). Intake form lists the USA, Canada, Europe and other. ## How it earns Licenses de-identified company data to AI labs. Its FAQ says payments follow defined delivery milestones, typically 30 to 60 days after it accepts the de-identified dataset. Its margin is not published. ## Process 1. Submit an intake form with your company and tools. 2. For a referred company, the team says it reaches out within 1 to 2 days, then holds a scoping call on data parameters, de-identification, terms and timeline. 3. Handshake says it de-identifies and formats the data. 4. Confidential delivery to AI labs under contract. Its FAQ says payments follow defined delivery milestones, typically 30 to 60 days after acceptance of the de-identified dataset. ## Payout claims - Partnerships range from $100K to $4M+ depending on the data shared. - Calculator example: 100 employees, 10 years, USA shows $383,083 to $896,969, labelled indicative and not an offer. - Handshake AI's company referral page states $250M paid out to partners and 1K+ partner companies. Its fellowship page states $500M+ in payouts. The scope of each total is unclear, and neither predicts what one company would receive. Self-reported by the company unless marked reported. ## Security claims - No certification stated on the page we read. - Says access is limited to authorized teams. ## De-identification and privacy Its data partnerships page lists de-identification before delivery and never names partners. The same page notes that no de-identification process removes re-identification risk entirely, and that a third party may be able to re-identify personal information by combining it with other data. ## Terms for companies - **Your warranties.** Its page says data partners remain responsible for making their transfer to Handshake AI comply with applicable legal requirements. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Two payout totals on its own pages ($250M and $500M+) do not say what each covers. - Business Insider reported in Mar 2026 that contractors on OpenAI projects were suspended and some went unpaid (worker side of the business, via AOL syndication, dated 4 Mar 2026). - The contract for the company is not public. Its FAQ says terms are negotiated per agreement and put in writing before any data moves. --- # Labelbox Prism: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/labelbox-prism. Company site: https://prism.labelbox.com/ Labelbox's data-licensing program, which licenses company operating data to frontier AI labs for an upfront fee plus a revenue share. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Data it wants Work documents and operational data from systems like Salesforce, Jira, Slack, SAP, ServiceNow, CAD and financial workbooks. Its current demand list includes financial and scientific reasoning traces, cross-system workflows, six-plus months of support logs and code edit traces. ## Who it takes No minimum published. Companies in distress or wound down can license too, with a single payment for the whole operating corpus. Not stated. It says regional residency keeps data in the geography you designate. ## How it earns Not published. Prism licenses the data to AI labs, and any exclusivity premium is priced to the buyer. ## Process 1. Scope: an intake form and a call, then a written quote within 48 hours. Scoping is free and non-binding. 2. Process: one to three days. 3. License: five to ten days. It says the first payment comes in under 21 days from the first call. ## Payout claims - Smaller targeted datasets start around $50K and large enterprise partnerships reach $1M+, paid as an upfront fee at signing plus a revenue share on later use. - $100M+ distributed and 1k+ companies licensing. The totals are not broken down by type of data source, and they predict nothing for one company. Self-reported by the company unless marked reported. ## Security claims - No certification named on the pages we read. - Says personal data is removed before export, and data is encrypted in transit and at rest with customer-managed keys. - Says HR records, performance reviews, compensation and employee identifiers are excluded by default. ## De-identification and privacy Names, emails and internal IDs are tokenized before data leaves, and workflow traces are licensed at team level. No de-identification standard is named. ## Terms for companies - **License or ownership.** Licenses are exclusive by default, and you keep ownership and continued use of your data. Every license has a kill clause that forces deletion within 30 days for material breach, regulatory change or a change of control you define. Models already trained keep what they learned. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Licenses are exclusive by default, which limits who else you can license to. - The revenue-share percentage is not published. - The $100M+ and 1k+ totals are not broken down. --- # Magma: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/magma. Company site: https://magmahq.ai/ Packages the interaction data that a company's AI agent produces and licenses it to AI labs for a revenue share. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Legal entity Magma Intelligence Inc. ## Data it wants Data your AI agent already generates: traces, corrections and completed workflows. ## Who it takes Companies building AI agents. No size minimum published. Not stated. ## How it earns A share of license revenue. The split is not published and sits in the data agreement signed at onboarding. ## Process 1. A two-minute form about your company, your AI product and your agent data. 2. A 20-minute onboarding call to map your stack. 3. Magma connects read-only to the scope you approve, packages the data and licenses it to AI labs and researchers. ## Payout claims - No figure published. The dashboard on its homepage shows a sample company called Acme AI, not a result. ## Security claims - No certification named on the page we read. - Says the connection is read-only, encrypted and scoped to what you approve. ## De-identification and privacy You set the scope. Its FAQ says handling and retention of your users' data are covered in the data agreement. No de-identification method is described. ## Terms for companies - **License or ownership.** Not published. Its site terms say any data deal runs under a separate written agreement signed by both sides. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published for data deals. Its site terms use Texas law. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The revenue-share percentage is not published. - No de-identification method is described for your users' data. - Buyers are described as AI labs and researchers, and none is named. --- # Mercor: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/mercor. Company site: https://www.mercor.com/data/ An expert-labor platform with a company-data arm that extracts workflow data, says it anonymizes it, and licenses it to AI buyers. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Mercor.io Corporation (the name used in court filings) ## Data it wants Workflow data from Slack, Teams, Gmail, Confluence, Salesforce, Outlook, GitHub, Drive and Notion through 100+ supported connectors. Press also reports offers for shuttered-startup archives. ## Who it takes None stated on its data page. Not stated. Target industries listed: legal, healthcare, finance, insurance, professional services, manufacturing, retail, real estate and logistics. ## How it earns Licenses datasets it describes as anonymized to AI buyers. Says it covers extraction and anonymization costs and charges the company no fees. Its own margin is not published. ## Process 1. Scope which tools to share. 2. Connect accounts from 100+ supported tools. 3. It says its platform extracts and de-identifies the data. 4. Payout by wire. ## Payout claims - Wire payment on delivery of the dataset, which it calls anonymized, to the buyer, typically within 2 to 4 weeks of the signed agreement. - Reported offers of up to $300,000 for shuttered-startup Slack, GitHub and Drive archives. (reported) - Bid $7.5M for the Spirit Airlines archive and finished second to Google's $10M winning bid. micro1 later offered $12.5M, which the court has not accepted. (reported) Self-reported by the company unless marked reported. ## Security claims - Claims SOC 2 Type II. The page shows no scope, auditor or audit period, so the claim needs checking before you rely on it. - Says data is encrypted in transit, keys sit in AWS KMS and credentials are per session. - Says no AI lab buyer or third-party vendor ever sees raw data. - Reported incident: a March 2026 supply-chain compromise of the open-source LiteLLM library. Mercor's 25 Jun 2026 update says only a very limited subset of experts had sensitive information affected and impact to customer information was very limited. Press and plaintiffs report a larger scope (about 4 TB, per The Next Web). The breach class actions were consolidated in May 2026 and stayed pending mediation in July 2026. ## De-identification and privacy Its data page lists fully automated extraction and anonymization. No de-identification standard is named. ## Terms for companies - **License or ownership.** Its page describes licensing the data, packaging it and paying the company. - **Your warranties.** The contract for the company is not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Reported March 2026 security incident, with class actions that allege more than Mercor says. The suits were stayed pending mediation in July 2026, and no court has ruled. - Named in worker-classification suits in Texas and California state court (allegations about contractor treatment, not about data sales). - SOC 2 claim shows no scope or audit period. - The contract for the company is not public. --- # micro1: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/micro1. Company site: https://www.micro1.ai/data-partnerships Paid link: the profile page links to micro1 through our referral link, with an ordinary link to micro1's own page (https://www.micro1.ai/data-partnerships) beside it. micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra. An AI data company that runs company-data partnerships for AI development, alongside an expert-labor marketplace. Its page says companies keep ownership of their underlying data. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity micro1 Inc. (page footer) ## Data it wants Company operational data: SOPs, knowledge bases, internal documentation, CRM data, project histories, QA processes, ticket workflows and sales playbooks, per its data-partnerships page. Its referral page adds operational communications. ## Who it takes micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. Confirm exceptions directly with micro1. US companies first, then other Western markets, per its data-partnerships page. It says demand is strongest in the US, UK and Canada. ## How it earns Runs company-data partnerships for AI development and pays companies under the agreed partnership. Its pages name no AI lab that receives the data. ## Process 1. Get started with a short assessment. 2. micro1 reviews the submission to decide whether the company fits. 3. micro1 asks for more information and schedules a discovery call. 4. If approved, micro1 finalizes the agreement and data requirements and the partnership begins. 5. In an undated forum talk, micro1's David Revland described an earlier version: a data manifest form and a payment proposal before contract language. Its CFO put the transfer at about 10 IT hours over a week or two. Treat that as history. ## Payout claims - Partnership tiers of $100K+, $500K+ and $1M+, based on the quality, uniqueness and value of the data. - Company compensation of $100K-$2M+ for approved data packages, on its Enterprise Data Partnership listing. - In an undated recorded forum talk, micro1's CFO said deals near $2M are real. Historical context, not a current price. Self-reported by the company unless marked reported. ## Security claims - No certification published on the pages we read. - Says PII is removed "when relevant" and data runs through isolated pipelines. - Says access is restricted to a limited number of authorized team members. - Says data is retained only for agreed periods and deletion requests are honored. ## De-identification and privacy Its pages say PII is removed when relevant and data runs through isolated pipelines. In an undated recorded forum talk, micro1's David Revland described transforming data instead of redacting it, with names as consistent stand-ins across tools. micro1 staff said companies cannot pre-scrub. Consistent stand-ins keep the links between records, which is why re-identification is the open question on the risk map. Confirm the current method with micro1. ## Terms for companies - **License or ownership.** micro1 says companies keep ownership of their underlying data. Confirm licensed uses, duration, exclusivity and payment structure in the proposed agreement. - **Your warranties.** The data contract is not published. Its referral terms require referrers to hold consent from an authorized company representative. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Referral terms: California law, San Francisco courts. Data contract: not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The partnership contract is not public, so licensed uses, duration, exclusivity and payment structure only show up in the proposed agreement. - No AI lab that receives the data is named. - No company testimonial for any payment tier appears on the pages we read. - An undated recorded forum talk gave earlier thresholds: micro1 staff named 20 full-time employees and about 1 TB, and David Revland of micro1 about 80% English. Its current pages govern: 30+ employees and primarily English, with no size threshold. --- # Mode: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/mode. Company site: https://data.mode.inc/ Buys a de-identified copy of a company's operating records for AI research and training, at a price fixed before export. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Data it wants Email and calendar, documents and files, chat, call recordings and transcripts, CRM and sales, and billing and operations records, from tools such as Gmail, Outlook, Slack, Salesforce, QuickBooks and NetSuite. ## Who it takes 20+ full-time U.S. office employees for most businesses and nonprofits, 10+ employees for accounting firms and 6+ for law firms. Several years of owned records and a mainly U.S. team are the strongest fit. Strongest fit is a team mainly based in the U.S. Its estimator also covers the EU, Canada and Australia. ## How it earns Mode buys the agreed copy and resells it for AI research and training. It says it charges you no broker fee. ## Process 1. Tell Mode your size, operating history and systems. 2. Review its offer and approve the scope: value, terms, systems and date ranges, all before export. 3. Your team signs in to the approved systems. Mode exports and de-identifies the agreed copy, then pays under the agreed terms. 4. It expects about three months from first conversation to payment. ## Payout claims - Its page says a company's data could be worth $100K to $5M. The estimator range is labelled indicative, and the final offer is fixed after review. Self-reported by the company unless marked reported. ## Security claims - No certification named on the page we read. - Says your team signs in to approved systems and hands over no passwords. ## De-identification and privacy Sensitive material is removed, and names and contact details are removed or transformed in a secure workspace before onward delivery. No de-identification standard is named. ## Terms for companies - **License or ownership.** Mode buys the filtered copy outright. Your company keeps its original records and systems. The agreement sets the copy's scope and any exclusivity. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - This is a purchase of a copy, not a license, so ask what rights you keep over that copy. - The copy is resold for AI research and training, and the end buyers are not named. - Its headline range comes from its own estimator and is not an offer. --- # Nyne: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/nyne. Company site: https://nyne.ai/data-partnerships Licenses de-identified company workflow data to frontier AI labs for training and evaluation, paying once the dataset is accepted. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Nyne AI Inc. ## Data it wants Chat and messaging, email and calendar, documents and files, and business platforms such as Salesforce, HubSpot, Workday, ServiceNow, SAP and Zendesk. ## Who it takes 20+ full-time U.S. W-2 employees and 3+ years of operational workflows, plus a decision-maker such as the owner or CEO who can approve packages. Its estimator covers the USA, Canada, Europe and other countries. ## How it earns Not published. Nyne licenses the data to AI labs. ## Process 1. Scope: you decide what to share and which protections apply. 2. Preparation: Nyne removes identifying details and formats the records on its side. 3. Confidential delivery to frontier AI labs. Partner companies are never identified. 4. Payment once the dataset is delivered and accepted, under the partnership agreement. ## Payout claims - Its page names six-figure payouts as the result. - Estimator example at 100 employees, 10 years, USA: $41,462 to $97,081, labelled indicative and not an offer. Self-reported by the company unless marked reported. ## Security claims - No certification named on the page we read. - Lists de-identification, encryption in transit and at rest, per-package approval and a full audit trail. ## De-identification and privacy Nyne strips personal data, passwords and financial records so they cannot be traced to people or accounts. No de-identification standard is named. ## Terms for companies - **License or ownership.** Its page says Nyne licenses the data under an agreement covering transfer and use, for model training and evaluation only, and the data is never published. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The headline promises six figures, while its own estimator example comes in under $100K. - The labs are not named. - Its FAQ does not commit to recurring payments. --- # Ooak Data: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/ooak-data. Company site: https://ooakdata.com/partner A Y Combinator-backed lab that licenses anonymized company operating data as training material for frontier AI models. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Ooak Data, Inc. ## Data it wants Operational, strategy and business data: documents, project management, CRM and sales, financial records, product analytics, wikis, code repositories, email and chat. It values the links between tools more than isolated files. ## Who it takes No minimum published. Its estimator starts at 1 to 10 people and 2+ years of history, and covers operating, winding-down and closed companies. Not stated. It says it checks jurisdiction and requirements during scoping. ## How it earns Not published. Ooak licenses the anonymized dataset to AI buyers under a code name. ## Process 1. A 15-minute call to map workflows and tools, with an estimate. 2. You pick systems and date ranges. Exclusions are annexed to the contract. 3. A joint count of volume and coverage, under an hour of your time. 4. Ooak's own engine anonymizes the data, and you review a sample before delivery. 5. Payment. Your raw archive is deleted within 30 days of delivery, as a contract term, with written confirmation. ## Payout claims - Its headline says up to $300K, paid in 2 to 4 weeks. - Its FAQ says deals to date run from $20K, the smallest closed, to several hundred thousand dollars. Self-reported by the company unless marked reported. ## Security claims - No certification named on the page we read. - Says only Ooak handles the raw archive and its QA team works on the anonymized output. - Says it has recorded zero re-identification incidents. No method is shown. ## De-identification and privacy One entity dictionary replaces names, companies and addresses the same way across every source, and faces, logos and signatures are blacked out. Consistent stand-ins keep records linkable. ## Terms for companies - **License or ownership.** Its FAQ says the contract licenses the records for training only, with your exclusions annexed. Only the anonymized dataset is kept, for the license term. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The zero re-identification claim is its own record, with no method shown. - Consistent replacement keeps records linkable across sources, which raises the stakes if one stand-in is traced back. - No buyer is named. --- # Opendatabay: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/opendatabay. Company site: https://www.opendatabay.com/data-providers A UK data marketplace where registered businesses list datasets for AI buyers, with a sliding platform fee on each self-serve sale. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Legal entity Opendatabay Ltd, registered in England and Wales (15711573) ## Data it wants Datasets of any kind, including AI and LLM training data, synthetic data, media and niche data. ## Who it takes Registered businesses, organizations or legal entities only, verified by KYC and KYB checks. You must own the data or hold the right to license it. Not restricted on the pages we read. Prices are in US dollars. ## How it earns A platform fee on self-serve sales that slides from 30% on small sales to 5% above $250,000. In brokered deals it takes a license at your price and sets its own price to the buyer. ## Process 1. Register as a data provider and pass business verification. 2. Confirm your rights to the data and list it for free. 3. Buyers license it self-serve, or Opendatabay brokers a deal by confirming files, scope and your price in writing. 4. Self-serve sales pay out within 30 days of the end of the month, once your balance reaches $50. Brokered deals pay within 14 days of the buyer's cleared funds. ## Payout claims - Fee schedule: 30% up to $100, falling step by step to 5% above $250,000, so the provider keeps 70% to 95% of the sale price. Self-reported by the company unless marked reported. ## Security claims - No certification named on the pages we read. - Says raw datasets are never exposed unless explicitly public. ## De-identification and privacy The provider is responsible. Data must be collected lawfully under UK GDPR, GDPR and CCPA. Opendatabay does not describe de-identifying data for you. ## Terms for companies - **License or ownership.** In brokered deals you grant Opendatabay a non-exclusive, worldwide, transferable license within the confirmed scope, with the right to sublicense to the end client. Self-serve sales use the license you pick for the listing. - **Your warranties.** In brokered deals you warrant that you are a registered legal entity and hold the rights to the files, at each confirmation and each delivery. For 12 months after delivery you may not grant an exclusive license over the same files. - **Your indemnity and audit.** You indemnify Opendatabay against claims over your data, including amounts it owes buyers. In brokered deals that indemnity has no cap. - **Liability cap.** Your cap is what you were paid for that data product in the prior 12 months, except the brokered-deal indemnity and warranties. Opendatabay's cap is its fee on that product over the same period. - **Governing law.** England and Wales, in the courts of London. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - In brokered deals the buyer's price and identity stay confidential, so you cannot see Opendatabay's margin. - A fee is owed on deals you close directly with a buyer it introduced, for 12 to 24 months. - Your brokered-deal indemnity and warranties have no cap. --- # Polyshares: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/polyshares. Company site: https://polyshares.com/ A buyer that licenses a company's operational data for a defined scope and term, says it anonymizes it, and supplies AI labs. Its data handling page says buyers see de-identified listings in a buyer portal, and that you keep the business and the underlying data. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Polyshares, Inc. (site) ## Data it wants Slack, email, CRM, tickets and files, per its site. ## Who it takes Any company with real operating history, per its site. It says record length and texture matter more than headcount. No employee minimum stated. Not stated on the pages we read. ## How it earns Licenses the data, says it anonymizes it, and supplies AI labs. Its site says there is no fee and no commission to the company on a license. It does not say which labs take which data. ## Process 1. Check your data by picking the systems you use and answering a short intake. 2. A sample is read after anonymization and before pricing. 3. Its data handling page says the record is listed de-identified in a buyer portal, under a code instead of your name. 4. Offer within one to two weeks of intake, per its terms page. 5. Payment net 30 to 60 once the data is approved, shared and anonymized. ## Payout claims - Deals of $100K to $2M and above for large records, offer in one to two weeks. - Case studies list four perpetual exclusive licenses: a roofing company at $450K, a general contractor at $300K, a solar company at $275K and a global marketing agency at $110K. Companies are unnamed and the page is undated. Self-reported by the company unless marked reported. ## Security claims - No certification published on the pages we read. - Says a specialist PII partner, unnamed, removes names, emails, phone numbers, account numbers and addresses before Polyshares reviews the record. - Says two people at Polyshares can see an unmasked record. - Says nothing moves before an offer is accepted. ## De-identification and privacy It says an outside partner strips identifying fields, and that roles, timestamps and work content stay. Its data handling page says identifiers are stripped before Polyshares or any lab sees the record, and names two people who can see identity alongside the anonymized data. An article by co-founder Ryan Lock says Polyshares never touches raw files. The same page says listings in its buyer portal carry no company name, website, people or exact locations. ## Terms for companies - **License or ownership.** Its site says you keep the business and the data, and that a license is not a sale. It covers defined systems for a defined term, exclusive unless agreed otherwise. Read the full terms before you sign. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published on the pages we read. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Every figure is Polyshares' own. No outside review or named lab customer found. - The article says Polyshares never touches raw files, and its data handling page says two Polyshares people can see an unmasked record. - Its homepage says "No marketplace, no listing", while its data handling page describes de-identified listings in a buyer portal. Ask who can see a listing. - The broker program is described in an X article and not on the site. - The anonymization partner is unnamed. - The full license, warranties and liability terms are not public. - Its homepage says the founders licensed data on their own companies first, and the partner bios name Roofer.com and Simplicity Solar. The case studies include a roofer and a solar company without saying whether those are the founders' own firms. - All four published case studies are perpetual exclusive licenses. Ask whether a shorter or non-exclusive term is on offer before you sign. --- # pre.dev: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/pre-dev. Company site: https://pre.dev/code-licensing A coding-agent company whose labs arm licenses private codebases and turns them into coding tasks for frontier AI labs. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Pre.dev Corp. ## Data it wants Private code repositories and their git history. Each task is built from one real commit in a codebase no model has seen. ## Who it takes No minimum published. Its sign-up offers an agency or company account as well as a personal one. This profile covers the company account. Not stated. ## How it earns pre.dev Labs builds coding tasks from licensed code and supplies them to AI labs. Labs get tasks, not access to your repository. ## Process 1. Pick the agency or company account and connect a Git account. 2. Choose only the repositories you are willing to license. 3. Each repository gets a value and a grade in minutes. 4. Sign one agreement once. Later deals pay without a new contract. ## Payout claims - Its page shows example rates of $100 per million tokens of source and $40 per million tokens of git history, and an example of $6,000 per repo. The grades shown are labelled examples. - Paid Net 15 after funds land, under a non-exclusive license. Self-reported by the company unless marked reported. ## Security claims - No certification named on the page we read. - Says labs receive tasks, not repository access, and the real solution stays hidden. ## De-identification and privacy Not described on the page we read. ## Terms for companies - **License or ownership.** Non-exclusive by default. You keep the code and keep using it, and the same code can be licensed more than once. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The per-repo figure is an example. Your grade sets the real value. - No step for removing secrets or personal data from code is described. - The license agreement is not public. --- # Protege: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/protege. Company site: https://withprotege.ai/ A data lab that runs a governed marketplace for licensed datasets, mostly healthcare, video and audio. Its homepage does not mention workplace chat or email. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Protege (169 Madison Ave, New York, per its site) ## Data it wants Licensed proprietary datasets for AI pre-training, post-training, fine-tuning and evaluation: healthcare, video, audio and speech, and spatial or physical-world data. ## Who it takes None stated. Companies hold their content or data rights outright or hold broad rights. Not restricted on the page we read. ## How it earns Revenue share on qualified deals that include your data. The split is not published. ## Process 1. Assess the library and the rights. 2. Sign a revenue-share agreement. 3. Prepare the data, for example face-masking and quality checks. 4. Content enters qualified deals and the company receives revenue-share payments. (Its data-provider pages, per our research notes.) ## Payout claims - Two undated case studies on its video page report what a broadcaster and a sports distributor received. We leave the amounts out, because one company's result predicts nothing for yours. - Series A of $25M (August 2025) plus a $30M extension led by a16z (January 2026). (reported) Self-reported by the company unless marked reported. ## Security claims - Shows a SOC 2 badge in its homepage footer (self-reported, scope not shown). - Its video data-provider page lists automated detection and removal of personal identifiers, and GDPR, CCPA and HIPAA-aligned workflows where applicable. ## De-identification and privacy Its video data-provider page lists automated detection and removal of personal identifiers, sampling and quality assurance, and optional anonymization or voice modification, depending on the dataset and jurisdiction. ## Terms for companies - **Your warranties.** Companies must hold the rights to license. The contract is not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Revenue-share percentage not published. - Press and founder interviews give different partner counts and different totals raised. - Its scope is healthcare, media and video. We found no workplace-chat product. --- # Replay: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/replay. Company site: https://www.replay.ai/ Licenses de-identified company operating data to frontier AI and data labs, paying upfront plus a revenue share. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Legal entity Replay Data, LLC, a Delaware limited liability company (website terms). The site footer reads Sunsets HQ Corp. ## Data it wants Records that document how work gets done: communications, tickets, logs and project histories. Its homepage lists code and commits, decision threads, financial records, support history, product logs, presentations, CRM data, sales conversations, internal docs and analytics. Industries listed: tech, B2C, e-commerce, services, legal, hardware, CPG and finance. ## Who it takes The page says any industry, with one requirement: records that document operational processes. Its value bands start at 20 to 50 employees. Not stated. ## How it earns Not published. Its page says the company gets an upfront payment plus a revenue share of every license. ## Process 1. Value: Replay reviews your industry, systems, data volume and how your team worked. 2. Terms: Replay presents an offer, typically an upfront cash payment plus a perpetual revenue share. 3. Protect: Replay exports the data and removes identifying information. 4. Payout: historical data is paid first, and new data pays again. The page puts the four steps at about 120 minutes of your time. ## Payout claims - Value bands by size: 20 to 50 employees $10K to $100K, 50 to 250 employees $100K to $1M, and 250+ employees $1M+. - "Paid up front, plus a revenue share of every license". Its offers are typically an upfront cash payment plus a perpetual revenue share. Self-reported by the company unless marked reported. ## Security claims - No certification published on the pages we read. - Says it covers HIPAA's 18 identifier categories and 60+ categories in all, and that every engagement runs in its own isolated environment. - Says its model finds 99% of PII on a benchmark where NVIDIA's GLiNER model found 36%. The benchmark itself is not shown. - Says raw data is used only for de-identification, and only the cleaned output is ever licensed. ## De-identification and privacy De-identification before licensing. Its AI buyers page says stable placeholders stay consistent across every system, so the same entity stays linked end to end. Consistent placeholders keep the links between records, which is why re-identification is the question to ask. No outside standard is named. ## Terms for companies - **License or ownership.** Its data privacy page says "This is a license, not a sale", nothing is transferred, and your data is deleted on request if you stop. Its website terms say nothing on the site grants a license or obliges a deal. A separate written agreement governs. - **Your warranties.** Its data privacy page says you will be asked to represent that the data is yours to license, and that Replay works through that representation with you. - **Your indemnity and audit.** Website terms, which cover the site only: you indemnify Replay for your use of the site and what you submit. The data agreement is not public. - **Liability cap.** Its data privacy page says your exposure is capped at the fees paid. The website terms, which cover the site only, cap Replay's own liability at $100. - **Governing law.** Website terms, which cover the site only: New York law and Manhattan courts. Replay may require arbitration at its option, and you can opt out in writing within 30 days of first agreeing. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The buyers are described as "frontier AI and data labs" and none is named. - The 99% against 36% PII comparison names the rival model but shows no benchmark. - The site footer names Sunsets HQ Corp. and the website terms name Replay Data, LLC. Ask which entity signs. - Fees and payment terms sit in separate agreements that are not public. - The value bands are the company's own model output. --- # Scale AI: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/scale-ai. Company site: https://scale.com/data-partnership An AI training-data company that turns de-identified company workflow records into training data for frontier models, with approval on every data package. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Scale AI, Inc. ## Data it wants Records from data warehouses, chat, email and calendar, documents, work tools like Jira and Notion, and business platforms such as Salesforce, Workday, ServiceNow and SAP. It lists industries from software and finance to field services and property management. ## Who it takes 40+ employees is its preferred starting point, assessed case by case. It also looks for years of records, real workflows, domain depth and an owner who can approve packages. Not stated. ## How it earns Not published. Scale says it designs partnerships for recurring revenue. ## Process 1. Book an intro call. 2. Scope a first workflow. It says partnerships can start with a limited scope. 3. Scale anonymizes records inside your environment before extraction. 4. You approve each data package before it moves. ## Payout claims - $10K to $1M+ per data partnership, labelled illustrative and scaling with how often data is delivered. Self-reported by the company unless marked reported. ## Security claims - No certification named on the page we read. - Lists de-identification, encryption in transit and at rest, per-package approval gates, a full audit trail, and on-premises and VPC options. ## De-identification and privacy Scale anonymizes inside your environment before any data is extracted, stripping personal data so records cannot be traced to people or accounts. No standard is named. ## Terms for companies - **License or ownership.** Not published. Its page says your data stays under your governance and on your terms. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The $10K to $1M+ range is labelled illustrative. - The contract and the end buyers are not public. - Scale also offers to advise on AI inside your business, so ask what the partnership covers beyond the data. --- # SimpleClosure Asset Hub: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/simpleclosure. Company site: https://simpleclosure.com/ A company shutdown service whose Asset Hub, launched in Apr 2026, licenses or sells source code and workspace data. It was built for startups winding down and now takes operating companies too. ## Type Shutdown service. Winds companies down and licenses or sells their data, and takes operating companies too. ## Legal entity SimpleClosure ## Data it wants Source code, and workspace data such as email, Slack, Notion and documents (workspace data was in beta at launch). Its AssetHub page says companies that are still operating can license while they keep using the assets. ## Who it takes No staff minimum stated. Its AssetHub page says you do not need to be shutting down, and operating companies can explore licensing. Not stated. ## How it earns Its AssetHub page says there is no upfront cost and SimpleClosure takes a percentage only when assets are sold or licensed. The percentage is not published. Its terms refer to a separate asset purchase agreement. ## Process 1. The founder lists assets. 2. Its AssetHub page says every dataset is processed for PII before it is licensed to a buyer. Its terms say only that its evaluation may include an assessment of embedded personal information. 3. Transfer to buyers, described as AI companies, research labs and enterprise teams. 4. Separate asset purchase terms govern price and fees. ## Payout claims - Nearly 100 deals in about a year at $10,000 to $100,000 per company, as SimpleClosure told Forbes, and Gizmodo relayed it. - More than 350 companies have listed assets on the hub since April. - Deals in the tens to hundreds of thousands of dollars for unique assets, including assets from companies still operating, per its AssetHub page. Self-reported by the company unless marked reported. ## Security claims - No certification published on the pages we read. - Its AssetHub page says every dataset is processed for PII before it is licensed to a buyer. Its terms make no such promise. ## De-identification and privacy Its AssetHub page says every dataset is processed for PII before licensing, and that sensitive employee, compensation and health information is excluded. Its terms say only that its evaluation may include an assessment of embedded personal information. No method or standard is named. Privacy advocates dispute that anonymization of workplace messages works, and Gizmodo reported that a policy group, the Center for AI and Digital Policy, wrote to the US Senate Commerce Committee urging stronger FTC oversight of AI companies. ## Terms for companies - **License or ownership.** The company grants SimpleClosure a non-exclusive, transferable, sub-licensable, royalty-free, perpetual, irrevocable, worldwide license. After an acquisition, title vests in the acquirer, who may license or sell onward. - **Your warranties.** Six company representations: ownership and authority, no infringement, privacy-law compliance (CCPA, CPRA, GDPR) with required notices and consents, no liens, open-source use disclosed, and known issues disclosed in writing. - **Your indemnity and audit.** The company indemnifies SimpleClosure for breach of the representations, IP claims, privacy-law violations and undisclosed open-source obligations. - **Liability cap.** SimpleClosure's own liability is capped at the greater of six months of amounts paid or $100. - **Governing law.** Delaware law, with exclusive jurisdiction in Los Angeles County, California courts. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The percentage it takes on a sale or license is not published. - The company carries a broad warranty and indemnity stack while SimpleClosure's own liability cap is $100. - The PII promise is on its AssetHub page, not in its terms, and the terms put privacy-law compliance on the company. - Deletion terms are not published, and the license is perpetual and irrevocable. - Deal counts and price ranges are the company's own, relayed by press. --- # SuperAnnotate: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/superannotate. Company site: https://www.superannotate.com/data-partnerships An AI data platform that prepares a company's operational records and licenses them to the AI labs and enterprise AI teams the company approves. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Legal entity SuperAnnotate AI, Inc. ## Data it wants Everyday communication such as Slack threads and email chains, process documents and wikis, tickets and approvals, domain records such as inspection reports and claims files, and screen recordings of multi-step tasks. ## Who it takes Any size, any industry, anywhere, by its FAQ. You need records built up over time and the rights to license them. Any country, by its FAQ. ## How it earns Not published. It licenses the data to buyers you approve. ## Process 1. A scoping call on what you hold and whether buyers want it. 2. A sample review for volume, quality and uniqueness, then a written valuation. 3. Scope, terms and approvals agreed in writing. 4. SuperAnnotate prepares the data and licenses it to buyers you approve. Payment on delivery and on each relicense. ## Payout claims - An indicative valuation range of $100K to $1M+, priced on rarity, depth and exclusivity. Self-reported by the company unless marked reported. ## Security claims - Lists SOC 2 Type II, ISO 27001, GDPR and CCPA, with a trust center link. The reports are not on the page. - Says each engagement is processed in isolation, access is logged, and third-party penetration tests run every year. ## De-identification and privacy Identifying detail is removed to the standard your team sets. Data is kept for an agreed period, then deleted, and deletion is honored on request. ## Terms for companies - **License or ownership.** Its FAQ says this is a license of rights for a set period, not a transfer of the data. You approve each buyer and can block competitors permanently. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The split on relicenses is not published. - The $100K to $1M+ range is labelled indicative. - Ask how many relicenses to expect and on what terms, because buyers are approved one by one. --- # The General Data Company: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/the-general-data-company. Company site: https://thegeneraldata.com/data-partnerships/ Licenses anonymized operating records of industrial companies to AI labs and to manufacturers training their own models. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity General Data Labs, Inc. ## Data it wants Company archives (finished projects, correspondence, orders, technical documentation, scanned folders), operational records (complaints, inspection and maintenance records, tickets, CRM, order and stock exports) and expertise (technical drawings, CAD models, change requests, commissioning records). ## Who it takes Industrial companies, including ones no longer trading. It takes only what no longer gives you an edge: current designs and prices stay with you. Not stated. Anonymization runs under GDPR Article 28 on your instruction. ## How it earns Not published. It licenses the anonymized results to AI companies. ## Process 1. Describe formats, scope and content. A rough description is enough. 2. After a confidentiality and data-processing agreement, it reviews a sample, your rights to it and its suitability. 3. Agree scope, uses, recipients and payment in writing. No file moves before a signed agreement. 4. It prepares, anonymizes and checks the data. Payment follows agreed milestones. ## Payout claims - No figure published. Its FAQ says payment is a one-off price or a share of what it earns from licensing. ## Security claims - No certification named on the page we read. - Says it carries tech errors-and-omissions and cyber insurance, set out in the agreement. - Says its contracts are drafted with an international law firm. ## De-identification and privacy Names, addresses and other identifiers are replaced with invented ones, consistently across documents. Its model finds them, a person checks the result, and the key linking new names to real ones is then deleted. ## Terms for companies - **License or ownership.** You set recipients and uses in writing and know who receives the data. Customer or supplier records go in only if you hold the rights and no confidentiality agreement stands in the way. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - No price range is published, and the page does not say when a revenue share applies instead of a one-off price. - Consistent replacement keeps documents linkable, so ask what checks guard against re-identification. - The contract is not public. --- # TollBit: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/tollbit. Company site: https://tollbit.com/ A platform where publishers meter and charge AI bots and agents for access to their content. Built for publishers' web content, not company archives. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Legal entity Novoscribe, Inc., New York (copyright line on the site) ## Data it wants Does not buy. Publishers set the terms and usage-based prices for AI access. Its products include a bot and agent paywall and licensed retrieval access to content. ## Who it takes Aimed at publishers. The page says the core platform is free for publishers. Not stated. ## How it earns No commission or fee percentage is published. Its Publisher Platform Agreement says publishers pay for optional extra services at prices set in their account portal. ## Process 1. A publisher connects its site and sees which bots and agents visit. 2. The publisher defines what AI systems may access and at what price. 3. AI companies pay under those terms. (Its page's description of its products.) ## Payout claims - No payout figures, minimums or payment schedules published. - Names Reuters, Bloomberg, CNN, Forbes, AP News and TIME among publishers on the platform, and says TIME used TollBit traffic data to negotiate licensing deals with OpenAI and Perplexity. ## Security claims - No security claims or certifications stated on the page we read. ## De-identification and privacy Not applicable in the way it is for company records. It handles publisher content access and traffic analytics, and names no method for personal data. ## Terms for companies - **License or ownership.** Its Publisher Platform Agreement says each content license is an agreement between the publisher and the AI company, and TollBit is not a party to it. Publishers set their own fees and keep their rights to their content. - **Your warranties.** The publisher warrants it holds the rights TollBit needs to use the content on the platform, and that TollBit owes no fees or royalties for that use. - **Your indemnity and audit.** The publisher indemnifies TollBit for breach of the agreement or the law, any dispute with an AI company, and infringement of third-party rights. - **Liability cap.** TollBit's total liability is capped at the greater of $100 or the fees the publisher paid TollBit in the 12 months before the claim. - **Governing law.** New York law and New York courts, with binding JAMS arbitration and a 30-day opt-out. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Its fee or revenue split to publishers is not published. - The publisher indemnifies TollBit, while TollBit caps its own liability at $100 or 12 months of fees. - TollBit is not a party to the content license and does not guarantee that AI companies pay. - It serves publishers' content and does not take company archives. --- # Troveo: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/troveo. Company site: https://www.troveo.ai/business-data A licensing marketplace that started with video and audio and added business data in 2026. ## Type Marketplace. Lists or licenses data to buyers and shares the revenue. ## Data it wants Business data in eight categories: chat, email, documents, work and knowledge tools, CRM, business platforms, finance, and data and code. Also video and audio. ## Who it takes No minimum stated on the business-data page we read. Its estimator's headcount options start at 20, a form setting. Its guide says a 40-person firm with specialized records can be worth more than a 4,000-person firm with generic data. Not stated. ## How it earns Revenue share on every sale to its buyers. The split is not published. ## Process 1. Scope: an estimate in minutes. 2. Agree: standard terms. 3. Package: anonymization, by its own description. 4. Get paid: a first sale, then recurring revenue share. ## Payout claims - Its page says AI labs and startups are paying six figures for company data exports. - An illustrative example on its page, not a real deal, shows one dataset sold four times. We leave the example amount out, because it predicts nothing for your company. - Guide: cites an unnamed platform's baseline of about $5,000 per code repository, and startup archives at about $10,000 to $100,000 per deal. - $20M+ paid to licensors, 40+ active buyers and 4x average sales per dataset. These totals cover all data types, mostly video and audio licensors, not only business data, and predict nothing for one company. Self-reported by the company unless marked reported. ## Security claims - No certification published on the pages we read. - Says names, contact details, credentials and client identities are scrubbed to one documented standard. The standard is not published. - Says your company is never named publicly. ## De-identification and privacy Anonymization by scrubbing, to a standard it calls documented. Its guide says models already trained survive the end of a license, because nothing can be untrained. ## Terms for companies - **License or ownership.** Its page says the company owns the data and Troveo licenses it on the company's behalf under terms the company signs off on. Its FAQ says exclusivity is time-limited, has to be earned and comes with exit terms. - **Your warranties.** Its guide says the data owner promises to hold the rights and to have acquired the data lawfully. - **Your indemnity and audit.** Its guide says liability caps are typically tied to deal value. The actual terms are not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - The revenue-share percentage is not published. - Its business-data page says $20M+ paid and its content-owners page says $50M+ paid, with no date on either claim. - The paid totals cover video and audio licensors as well as business-data licensors. - No business-data buyer is named. --- # Turing Lazarus: what it takes, how it earns, what to check Canonical page: https://vaultfish.com/buyers/turing-lazarus. Company site: https://lazarus.turing.com/ Turing's Project Lazarus acquires defined rights to a company's operating record for frontier AI training, for a single payment. ## Type AI lab or data lab. Licenses or partners for the data itself, under its own agreement. ## Legal entity Turing Enterprises, Inc. ## Data it wants Communications, tickets, wikis, knowledge bases, databases and source code, across software, finance, support, sales, legal and operations. Code is welcome but never bought on its own. ## Who it takes Any company with a real operating history and someone authorized to transfer the data. Operating, winding-down and closed companies all qualify. Most regions. Demand is strongest in the US, UK, Canada and the EU, and it flags data-export limits early. ## How it earns Not published. Turing uses the record for frontier AI training. ## Process 1. Intake: a call scheduled within one business day, under NDA. 2. Sampling: it reviews a representative slice, usually within a week. 3. Offer: one valuation and one contract, with no retainer and no recurring commitment. ## Payout claims - A single payment of up to $1M, scaled to how complete, rare and well kept the record is. The figure is confirmed after sampling. Self-reported by the company unless marked reported. ## Security claims - Lists SOC 2 Type II. The report is not on the page. - Says processing runs in an isolated, air-gapped environment, with access limited to a named team. ## De-identification and privacy Personal data and secrets are removed before anything reaches a model. You approve the scope before work begins. ## Terms for companies - **License or ownership.** Its FAQ says you keep ownership of the underlying data and Turing acquires defined rights to the prepared record under one agreement. The page also lists a clean rights transfer. - **Your warranties.** Not published. - **Your indemnity and audit.** Not published. - **Liability cap.** Not published. - **Governing law.** Not published. ## Check before you share anything These are facts from the company's own pages or from news and court reports, listed so you can ask about them. They are not verdicts. Companies change their terms, so confirm each one on the company's own page. - Acquiring defined rights is closer to a transfer than a license, so ask what you can still do with the same record. - The figure is a ceiling, and the price comes only after sampling. - The labs it trains for are not named. --- # License architecture firm data to AI: who owns drawings > Looking to sell architecture firm data to AI? Licensing starts with the drawings. AIA's B101 keeps them with the architect and licenses the owner one project. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-architecture-firm-data-to-ai Published: 2026-10-16 Updated: 2026-10-16 ## The short answer Before an architecture firm licenses its data to AI, it checks two things. AIA's B101 form deems the architect the owner of its drawings and gives the client a license for one project. AIA Rule 3.401 bars members from disclosing what a client asked them to keep confidential. This page reports what the forms, the code and the statutes say. It is not legal advice. ## Who lists architecture firms? Not by name, on the pages I read. [Mercor's data page](https://www.mercor.com/data/) lists eight sectors and [micro1's page](https://www.micro1.ai/data-partnerships) lists six areas, and neither names architecture. [Polyshares](/buyers/polyshares)' [intake](https://polyshares.com/intake) lists AutoCAD among its design and CAD tools. I found no published price for architecture records. Polyshares' [case studies](https://polyshares.com/track-record) list a general contractor, the nearest field, and the [construction page](/answers/sell-construction-company-data-to-ai) covers it. All of it is self-reported. Mercor's [Benchmark Map](https://www.mercor.com/research/labor-index/benchmark-map/) (Oct 2026) puts architecture and engineering at 19 of 56 occupations covered by its 29 AI benchmarks. That measures how well AI is tested on the work, not what anyone pays for records of it. ## Who owns the drawings under AIA's B101? The architect does, on the standard form. AIA's contract help center [says](https://help.aiacontracts.com/hc/en-us/articles/1500009310881-The-Rights-of-an-Architect-s-Instruments-of-Service) that under B101-2017, the Owner-Architect Agreement, the architect and its consultants are deemed the authors and owners of their Instruments of Service. They keep their common law and statutory rights, including copyright. The client gets a license to use those documents "solely and exclusively for constructing, using, maintaining, altering and adding to the Project." That license ends only if the architect rightfully terminates for cause over the client's default. If the client terminates for convenience, B101 has it pay the architect a licensing fee to keep using them. My reading is that a firm on unedited B101 terms holds the copyright in its drawing sets, and the client's license reaches one building. Firms and clients often edit these forms, so read each signed agreement. ## What does copyright law add for buildings? [17 U.S.C. 102(a)(8)](https://www.law.cornell.edu/uscode/text/17/102) lists architectural works among the works copyright protects. [Section 101](https://www.law.cornell.edu/uscode/text/17/101) defines one as the design of a building in any tangible medium, including a building, architectural plans or drawings. It covers the overall form and the arrangement of spaces and elements, but not individual standard features. [Section 120](https://www.law.cornell.edu/uscode/text/17/120) limits that right in two ways. Anyone may photograph a built work that is visible from a public place, and a building's owner may alter or destroy it without the architect's consent. Ownership starts with the author, and an employer owns work made for hire ([17 U.S.C. 201](https://www.law.cornell.edu/uscode/text/17/201)). A transfer needs a writing signed by the owner ([17 U.S.C. 204(a)](https://www.law.cornell.edu/uscode/text/17/204)). ## Can an architect disclose client information? AIA members face a written limit. Rule 3.401 of the [AIA Code of Ethics](https://www.aia.org/sites/default/files/2024-04/aia-code-of-ethics-april-2024.pdf) bars them from knowingly disclosing information that would adversely affect a client, or that a client asked them to keep confidential, except as the Code or law allows. Its commentary notes that the law does not recognize an architect-client privilege. In [Decision 2013-12](https://aia.org/sites/default/files/2023-11/2013-12%20Redacted%20NEC%20Case-Admonishment.pdf), AIA's National Ethics Council found a member broke Rule 3.401 by publishing photos of a client's home against the client's wishes. A dataset is a different use from a magazine spread, but it's the closest ruling I found. The same Code's Rule 5.302 treats designs, drawings and data as the firm's: a member who leaves needs the employer's permission to take them. State licensing boards set their own conduct rules, so ask counsel what yours says. ## What can an architecture firm list first? List CAD and BIM models, drawing sets, specifications, RFIs and submittals by project. Next to each, note the signed agreement and any client that asked for confidentiality. The [engineering page](/answers/sell-engineering-firm-data-to-ai) covers the consultants' licensing rules, and the [rights check](/rights-check) lists what to settle with counsel. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two rights in an architect's drawing set under B101: Copyright (emphasized: Deemed the owner, Architect keeps it), Project license (Client, one project). AIA's B101-2017 deems the architect the owner of its Instruments of Service and licenses the client to use them for the project. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's data page](https://www.mercor.com/data/) - [micro1's page](https://www.micro1.ai/data-partnerships) - [intake](https://polyshares.com/intake) - [case studies](https://polyshares.com/track-record) - [Benchmark Map](https://www.mercor.com/research/labor-index/benchmark-map/) - [says](https://help.aiacontracts.com/hc/en-us/articles/1500009310881-The-Rights-of-an-Architect-s-Instruments-of-Service) - [17 U.S.C. 102(a)(8)](https://www.law.cornell.edu/uscode/text/17/102) - [Section 101](https://www.law.cornell.edu/uscode/text/17/101) - [Section 120](https://www.law.cornell.edu/uscode/text/17/120) - [17 U.S.C. 201](https://www.law.cornell.edu/uscode/text/17/201) - [17 U.S.C. 204(a)](https://www.law.cornell.edu/uscode/text/17/204) - [AIA Code of Ethics](https://www.aia.org/sites/default/files/2024-04/aia-code-of-ethics-april-2024.pdf) - [Decision 2013-12](https://aia.org/sites/default/files/2023-11/2013-12%20Redacted%20NEC%20Case-Admonishment.pdf) --- # Assignment for the benefit of creditors and your company data > An assignment for the benefit of creditors (ABC) hands every asset, data included, to an assignee under state law. How it differs from a 363 sale. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/assignment-for-the-benefit-of-creditors Published: 2026-10-14 ## The short answer An assignment for the benefit of creditors (ABC) is a state-law wind-down: the company hands all its assets, data included, to an independent assignee who turns them into money for creditors. No consumer privacy ombudsman is appointed. That role exists only in a bankruptcy sale under 11 U.S.C. 363(b)(1). Bankruptcy gets the headlines. Plenty of insolvent companies close through a quieter state process instead, and the records leave with the desks and the laptops. ## How does an assignment for the benefit of creditors work? A company signs an assignment that hands all its assets to an assignee. The assignee owes duties to the creditors, turns the assets into money and pays the claims in the order state law sets. - **Delaware.** The assignee can't be a creditor, an insider or an affiliate of either, under [10 Del. C. 7304A](https://delcode.delaware.gov/title10/c073a/index.html). The assignee files a petition with the Court of Chancery within 14 days and notifies creditors, recent employees and contract counterparties within 30 days. The claims deadline is at least 90 days out. - **Florida.** Under [chapter 727 of the Florida Statutes](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0700-0799/0727/0727.html), the assignee records the assignment and files a petition in circuit court within 10 days. The court supervises from there. Notice runs in a local newspaper once a week for 4 weeks, and known creditors get it by mail within 20 days of the petition. - **California.** [Code of Civil Procedure section 493.010](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CCP§ionNum=493.010) defines a general assignment. It must cover all the assignor's transferable assets that are not exempt, be for the benefit of all creditors, and create no new preference among them. ## What changed in Delaware's assignment for the benefit of creditors law in 2026? Delaware replaced its old voluntary assignment sections, 10 Del. C. 7381 to 7387, with the Uniform Assignment for Benefit of Creditors Act. The act was approved on 10 Jun 2026 as [85 Del. Laws chapter 291](https://legis.delaware.gov/SessionLaws/Chapter?id=42454) and now sits in chapter 73A of title 10. The [old sections, 7381 to 7387](https://delcode.delaware.gov/title10/c073/sc06/index.html), still govern any assignment made before the act took effect. The new chapter sets out an independent assignee, a signed agreement that describes the assets and the fees, creditor notices on a deadline and a final accounting to creditors. ## How is an assignment for the benefit of creditors different from a 363 sale? A 363 sale happens inside a bankruptcy case. Under [11 U.S.C. 363(b)(1)](https://www.law.cornell.edu/uscode/text/11/363), the trustee may sell estate property outside the ordinary course only after notice and a hearing. An assignment for the benefit of creditors runs under state law, with an assignee the company picks. | | Assignment for the benefit of creditors | 363 sale | |---|---|---| | Law | A state statute, such as Delaware chapter 73A or Florida chapter 727 | The federal Bankruptcy Code | | Who sells | The assignee | The trustee, after notice and a hearing | | Court | Delaware: a Court of Chancery petition within 14 days. Florida: circuit court supervision | The bankruptcy court | | Privacy ombudsman | None in the Delaware or Florida statutes | Possible under section 332, when the privacy policy barred the transfer | Figure: comparison of Two ways to wind down an insolvent company: ABC (State statute), 363 sale (emphasized: Ombudsman possible, Bankruptcy court). Only a bankruptcy sale can bring in a consumer privacy ombudsman. ## Is a consumer privacy ombudsman involved in an assignment for the benefit of creditors? No. The ombudsman comes from 11 U.S.C. 332 and is appointed only when a bankruptcy sale of personally identifiable information needs court approval under section 363(b)(1)(B). The Delaware and Florida assignment statutes appoint no one in that role. That doesn't free the data from rules. Your privacy policy, your customer contracts and state privacy law still travel with the records. The bankruptcy side is on our pages about [the consumer privacy ombudsman](/answers/what-is-a-consumer-privacy-ombudsman) and [customer data in bankruptcy](/answers/selling-customer-data-in-bankruptcy). ## What happens to company data in an assignment for the benefit of creditors? Company data is an asset like any other, so it goes to the assignee with everything else. Florida's statutory assignment form transfers "all books, records, and electronic data pertaining to all such assets," wherever they are. Delaware's act gives the assignee the power to sell, lease or license an asset. A chat archive or a customer database can be licensed out of the estate the same way a patent can. There is one carve-out. Delaware's definition of an asset leaves out property whose assignment another law restricts, unless that law allows it with consent and the consent is given. The company has to help the assignee get it. ## What should owners do with company data before an assignment for the benefit of creditors? Map the data before you sign. Once the assignment is signed, Delaware's act makes the company preserve and turn over the assets it controls, with a list of every asset, employee and known creditor, so deletion decisions belong before that point. Know which records you must keep anyway. Our page on [what to keep, delete or license when you close](/answers/what-to-do-with-company-records-when-you-close) has the federal periods. The [rights check](/rights-check) asks about the contracts and consents an assignee will need. A clean export and a clear rights picture give the assignee something it can license instead of something it has to dig for. If the company is solvent and simply done, a plain dissolution is the usual route. Our page on [closing a business and walking away](/answers/close-my-business-and-walk-away) compares that with leaving it unfiled. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [10 Del. C. 7304A](https://delcode.delaware.gov/title10/c073a/index.html) - [chapter 727 of the Florida Statutes](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0700-0799/0727/0727.html) - [Code of Civil Procedure section 493.010](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CCP§ionNum=493.010) - [85 Del. Laws chapter 291](https://legis.delaware.gov/SessionLaws/Chapter?id=42454) - [old sections, 7381 to 7387](https://delcode.delaware.gov/title10/c073/sc06/index.html) - [11 U.S.C. 363(b)(1)](https://www.law.cornell.edu/uscode/text/11/363) --- # Do you qualify? Every program's stated size and history minimum > The size, history and language each AI data program states for companies: micro1, Handshake AI, Replay, Troveo, Mercor, Polyshares and SimpleClosure, dated. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/ai-data-program-minimums Published: 2026-10-14 Updated: 2026-10-14 ## The short answer Stated floors differ. Handshake AI asks for 20+ full-time staff and 3+ years. The micro1 floor is 30+ employees. Replay's bands and Troveo's estimator start at 20 employees. Mercor and Polyshares state no minimum. SimpleClosure is built for companies winding down and says operating companies can apply too. A stated floor is easier to check before the intake form than after it. Each program's floor is printed here with its source instead, read on each company's own page on 14 Oct 2026. Every one is the company's own criteria. Meeting one gets you a review, and any offer comes after it. ## What size and history does each AI data program ask for? Handshake AI states a hard floor of 20+ full-time staff and 3+ years, and Replay's bands and Troveo's estimator start at 20 employees. Mercor and Polyshares state none. The highest floor is micro1 at 30+ employees, and SimpleClosure is built for closing companies. | Program | Stated size | Stated history and other gates | Source | |---|---|---|---| | [micro1](/buyers/micro1) | 30+ employees | Mature operations, primarily English, US first | [Data partnerships](https://www.micro1.ai/data-partnerships) | | [Handshake AI](/buyers/handshake-ai) | 20+ full-time employees | 3+ years in operation | [Referral page](https://joinhandshake.com/ai/data-partnerships/referral) | | [Replay](/buyers/replay) | Value bands start at 20 employees | Any industry, with records of how work was done | [Homepage](https://www.replay.ai/) | | [Troveo](/buyers/troveo) | None stated, estimator starts at 20 | Estimator asks years of operating history | [Business data](https://www.troveo.ai/business-data) | | [Mercor](/buyers/mercor) | None stated | Target industries listed, none required | [Data page](https://www.mercor.com/data/) | | [Polyshares](/buyers/polyshares) | None stated | "Any company with real operating history" | [Homepage](https://polyshares.com/) | | [SimpleClosure](/buyers/simpleclosure) | None stated | Built for wind-downs, operating companies may explore licensing | [AssetHub](https://simpleclosure.com/product/assethub/) | Figure: scale, Stated staff floors: micro1 30 employees (emphasized), Handshake AI 20 employees, Replay, first band 20 employees. micro1 states the highest staff floor of the programs that publish one, 30 employees. Source: Each company's own pages. ## How do you apply to each AI data program? | Program | How you start | What follows | |---|---|---| | micro1 | A short assessment | Evaluation, a discovery call, then the agreement | | Handshake AI | An intake form about your company and tools | A follow-up, then a scoping call on data, terms and timeline | | Replay | A valuation form | A valuation, then an offer | | Troveo | A three-question estimate | A scoping call and guided exports | | Mercor | A quote request, or linking your tools | Extraction and de-identification on its platform | | Polyshares | Three questions, record counts only | A sample review, then an offer within one to two weeks | | SimpleClosure | A short form or a GitHub connection | A viability assessment, often within days | ## What if your company is below every stated minimum? Then the programs with no stated floor are where to start: Mercor, Polyshares and Troveo. Polyshares says the length and texture of the record matter more than headcount. For micro1, acceptance depends on its review and current demand, so confirm any exception directly with micro1. Its 30+ floor and where older figures came from are in [micro1 data partnership minimum employees](/answers/micro1-data-partnership-minimum-employees). ## Does peak headcount count toward an AI data program's size minimum? Replay counts peak headcount. Its valuation form asks for the most full-time employees the business has had at once, so a company that shrank can still report its peak. Handshake AI's page says 20+ full-time employees. The micro1 pages say 30+ employees without defining the term. Ask each whether contractors and part-time staff count, and keep the answer in writing. ## Can a closed company meet an AI data program's history minimum? Some programs take closed companies. Replay's valuation form asks whether the business is still operating, which suggests it takes both. SimpleClosure's AssetHub was built for startups winding down. Mercor has approached shuttered startups, per a 17 Aug 2026 report. Handshake AI asks for 3+ years in operation and does not say whether the company must still be running. The two shutdown routes are side by side in [Mercor vs SimpleClosure](/answers/mercor-vs-simpleclosure). ## What else do AI data programs check besides size? Language and location come next. micro1 asks for primarily English documentation and puts US companies first. Replay's form asks what share of your work communications is in English, and whether you keep your own codebase. Then the tools. Which tools each company names is in the [connector matrix](/answers/ai-data-company-connectors), and how they pay is in [micro1 alternatives](/answers/micro1-alternatives). The full field-by-field records are in the [company directory](/buyers). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Meeting a floor gets you a call. The contract still decides what you keep, so have a lawyer read it. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Data partnerships](https://www.micro1.ai/data-partnerships) - [Referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Homepage](https://www.replay.ai/) - [Business data](https://www.troveo.ai/business-data) - [Data page](https://www.mercor.com/data/) - [Homepage](https://polyshares.com/) - [AssetHub](https://simpleclosure.com/product/assethub/) --- # Final tax return when closing a business: what to file and when > Final tax return when closing a business: Form 966, the final 941 and 940, W-2s, 1099s, the final 1065, 1120 or 1120-S, and the EIN letter, in order. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/final-tax-return-when-closing-a-business Published: 2026-10-14 ## The short answer Your final tax return when closing a business depends on the entity: Form 1065, 1120 or 1120-S, with the final return box checked. Corporations add Form 966 within 30 days. Employers file a final 941 and 940 and issue W-2s early. A letter then closes the EIN account. The IRS doesn't take a closing notice by phone. It takes a stack of final returns, each with a box ticked, and a letter at the end. ## What is the order of IRS forms when closing a business? Corporations start with Form 966, due 30 days after the plan to dissolve is adopted. Then come the final payroll returns, the year-end information returns and the final income tax return. A letter closing the EIN account goes last. | Form | Due | What to mark | |---|---|---| | [Form 966](https://www.irs.gov/pub/irs-pdf/f966.pdf), corporations only | Within 30 days after the resolution or plan to dissolve is adopted | File another within 30 days if the plan is amended | | Final [Form 941](https://www.irs.gov/instructions/i941) | By the last day of the month after the quarter you paid final wages | Check line 17, enter the last date you paid wages, attach the payroll records statement | | [Forms W-2 and W-3](https://www.irs.gov/instructions/iw2w3) | By the due date of the final 941, to employees and to the Social Security Administration | W-2s for the calendar year of termination | | Final [Form 940](https://www.irs.gov/instructions/i940) | The annual due date after the year you paid final wages | Check box d | | [Form 1099-NEC](https://www.irs.gov/instructions/i1099mec) | January 31 after the year you paid | Nonemployee pay of $2,000 or more, for payments in 2026 | | Final [Form 1065](https://www.irs.gov/instructions/i1065), partnerships | 15th day of the 3rd month after the tax year ends, and that year ends when the partnership winds up | Final return box, final K-1 box | | Final [Form 1120](https://www.irs.gov/instructions/i1120), C corporations | 15th day of the 4th month after the date it dissolved | Final return box, item E | | Final [Form 1120-S](https://www.irs.gov/instructions/i1120s), S corporations | 15th day of the 3rd month after the date it dissolved | Final return box, item H, and the final K-1 box | | EIN letter | After every return is filed and all tax is paid | Legal name, EIN, address and the reason you are closing | A sole proprietor files Schedule C with the owner's own Form 1040 for the year the business closes. The IRS [closing-a-business page](https://www.irs.gov/businesses/small-businesses-self-employed/closing-a-business) lists the extra forms, such as Form 4797 for business property and Form 8594 when the business itself is sold. **30 days** To file Form 966 after a corporation adopts its plan to dissolve ## What does a final Form 941 need when a business closes? A final Form 941 is the return for the quarter in which you paid your last wages. Check the box on line 17, enter the final date you paid wages, and attach a statement naming the person keeping the payroll records and the address where they will be kept. That statement matters later. The [IRS employment tax record rules](https://www.irs.gov/businesses/small-businesses-self-employed/employment-tax-recordkeeping) say the records stay available for IRS review for at least four years after the 4th quarter is filed. Our page on [what to keep when you close](/answers/what-to-do-with-company-records-when-you-close) has every federal keep period. ## When are W-2s due when a business closes? W-2s come due early when a business closes. The IRS instructions say to give employees their W-2s for the year of termination, and file them with the Social Security Administration, by the due date of the final Form 941 or 944. So a company that pays its last wages in May owes the final 941, and the W-2s, by 31 July. That is six months ahead of the usual end-of-January deadline. ## What 1099 threshold applies in the year a business closes? For payments made in 2026, Form 1099-NEC covers nonemployee compensation of $2,000 or more. The IRS instructions for Forms 1099-MISC and 1099-NEC say the reporting threshold rose to $2,000 for tax years beginning after 2025. The IRS closing-a-business page still says $600, the figure for earlier years. Form 1099-NEC is due to the IRS and the contractor by January 31. Our page on [1099s for data licensing](/answers/1099-data-licensing) covers the other boxes. ## How do I close the EIN when a business closes? Send the IRS a letter with the business's legal name, EIN, address and the reason you want the account closed. Enclose a copy of the EIN assignment notice if you kept it. The IRS won't close the account until every return is filed and all tax is paid. The IRS gives two different addresses. The closing-a-business page lists Cincinnati, OH 45999. The IRS page for [an EIN you no longer need](https://www.irs.gov/businesses/small-businesses-self-employed/if-you-no-longer-need-your-ein) says the IRS can't cancel an EIN, only deactivate it. It lists Kansas City, MO 64108 (MS 6055) and Ogden, UT 84201 (MS 6273). Check both pages on the day you mail it. Figure: steps Form 966 and payroll -> Final income return -> EIN letter. The EIN letter goes last, after every return is filed and paid. ## Does a closing business file a final state tax return too? Usually, yes, and some states won't accept the dissolution until the tax side is done. California's [Franchise Tax Board](https://www.ftb.ca.gov/forms/misc/1038.html) wants the final return marked final, then the dissolution papers within 12 months of it. Our table of [which states require a tax clearance to dissolve](/closing-a-business/tax-clearance-by-state) gives each state's answer. The [closing checklist](/closing-a-business) puts the federal and state steps in order for your state. If you are deciding whether to file at all, our page on [closing a business and walking away](/answers/close-my-business-and-walk-away) covers what an unfiled company keeps owing. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Form 966](https://www.irs.gov/pub/irs-pdf/f966.pdf) - [Form 941](https://www.irs.gov/instructions/i941) - [Forms W-2 and W-3](https://www.irs.gov/instructions/iw2w3) - [Form 940](https://www.irs.gov/instructions/i940) - [Form 1099-NEC](https://www.irs.gov/instructions/i1099mec) - [Form 1065](https://www.irs.gov/instructions/i1065) - [Form 1120](https://www.irs.gov/instructions/i1120) - [Form 1120-S](https://www.irs.gov/instructions/i1120s) - [closing-a-business page](https://www.irs.gov/businesses/small-businesses-self-employed/closing-a-business) - [IRS employment tax record rules](https://www.irs.gov/businesses/small-businesses-self-employed/employment-tax-recordkeeping) - [an EIN you no longer need](https://www.irs.gov/businesses/small-businesses-self-employed/if-you-no-longer-need-your-ein) - [Franchise Tax Board](https://www.ftb.ca.gov/forms/misc/1038.html) --- # Mercor vs SimpleClosure for a closing startup's data > Mercor vs SimpleClosure for a startup that is closing: the reported prices side by side, each with its source, plus fees, license terms and payment timing. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/mercor-vs-simpleclosure Published: 2026-10-14 Updated: 2026-10-14 ## The short answer For a closing startup, Mercor has made direct offers for archives, reported at up to $300,000 on 17 Aug 2026. SimpleClosure lists them on its AssetHub and told Forbes it did nearly 100 deals at $10,000 to $100,000 per company. Neither figure is an offer to you. When a startup shuts down, its Slack, Drive, GitHub and email archive is often the last thing left with a price on it. There are two common routes. An AI data company such as [Mercor](/buyers/mercor) makes you an offer, or the service winding you down, [SimpleClosure](/buyers/simpleclosure), lists the archive for you. ## How do Mercor and SimpleClosure compare on terms for a closing startup? | Term | Mercor | SimpleClosure AssetHub | |---|---|---| | Reported price | Offers up to $300,000 for one archive (BigGo, 17 Aug 2026) | $10,000 to $100,000 per company, nearly 100 deals (Gizmodo citing Forbes, 17 Apr 2026) | | How it starts | Mercor contacts you, or you connect tools on its data page | You list assets during your wind-down | | Fee to you | None. Mercor says it covers extraction and anonymization | A percentage when assets are sold or licensed. Rate not published | | When you are paid | Wire on delivery, typically 2 to 4 weeks after signing | Not published | | License you grant | Not published | Perpetual, irrevocable, non-exclusive license in its terms | | Your liability | Contract not public | Six representations plus an indemnity. Its own cap is the greater of six months of fees or $100 | Sources: Mercor's [data page](https://www.mercor.com/data/), SimpleClosure's [terms](https://simpleclosure.com/tos/) and [AssetHub page](https://simpleclosure.com/product/assethub/). ## What has Mercor offered closing startups? BigGo reported on 17 Aug 2026 that Mercor emailed Warmly, an AI startup, eight days after Warmly announced its sale to HubSpot. Mercor's offer for Slack, GitHub, Asana, Drive and meeting transcripts went up to $300,000, and founder Max Greenwald declined ([BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). BigGo names no source of its own. Mercor also bid $7.5M for the Spirit Airlines archive in bankruptcy and finished second to Google's $10M ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). Our [deals tracker](/deals) keeps both rows. Figure: scale, Reported prices for one startup archive: SimpleClosure, per company $10K to $100K (emphasized), Mercor offers, reported Up to $300K. SimpleClosure's reported band tops out at a third of the largest Mercor offer reported. Source: Gizmodo citing Forbes, 17 Apr 2026. BigGo, 17 Aug 2026. ## What has SimpleClosure reported about AssetHub deals? SimpleClosure told Forbes it had done nearly 100 deals in about a year at $10,000 to $100,000 per company, as [Gizmodo relayed](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916). Its CEO wrote on 1 Oct 2026 that assets from more than 350 companies have come through AssetHub ([SimpleClosure](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/)). Its AssetHub page now says deals run in the tens to hundreds of thousands of dollars for unique assets. It also says operating companies can explore licensing, so the route is no longer only for shutdowns. ## Which terms matter most when a startup is closing? A warranty is only as good as the company that gives it. SimpleClosure's terms make the company indemnify it for privacy-law claims and undisclosed open-source use, so ask counsel who carries that after dissolution. Then ask who removes personal data, and when. SimpleClosure's AssetHub page says each dataset is processed for PII before licensing, though its terms do not promise it. Mercor says its platform de-identifies the data automatically. In both cases, the raw files leave your hands first. ## Can a closing startup use both Mercor and SimpleClosure? SimpleClosure's terms take a non-exclusive license, which on its own leaves room for a second deal. Mercor publishes no exclusivity terms. Read both agreements for exclusivity before you sign either, because the first one signed sets what the second can cover. The [startup shutdown checklist](/guides/startup-shutdown-checklist-ai-data) puts the data step in order with the rest of the wind-down. Our reads of each are in [is SimpleClosure legit](/answers/is-simpleclosure-legit) and [is Mercor legit](/answers/is-mercor-legit). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) The board that approves the dissolution should approve the data deal too. A lawyer can tell you whether yours needs to. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data page](https://www.mercor.com/data/) - [terms](https://simpleclosure.com/tos/) - [AssetHub page](https://simpleclosure.com/product/assethub/) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Gizmodo relayed](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [SimpleClosure](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) - [Mercor security incident update](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [CourtListener docket, Deboni v. Mercor.io Corp.](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) - [SimpleClosure Asset Hub announcement](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) --- # micro1 alternatives: other companies running data programs > micro1 alternatives for a company with records to license: Handshake AI, Mercor, Troveo, Replay, Polyshares and SimpleClosure on size, pay and terms. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-alternatives Published: 2026-10-14 Updated: 2026-10-14 ## The short answer Handshake AI, Mercor, Troveo, Replay, Polyshares and SimpleClosure also run programs for company records. They differ on minimum size, how and when they pay, and what you keep. micro1 asks for 30+ employees and states tiers from $100K+. Every figure is each company's own claim. If a [micro1](/buyers/micro1) ad brought you here, you want to know who else runs a program for company records before you book the call. Fair. I read each company's own pages on 14 Oct 2026 and compared them on the four things that change a deal. ## How does micro1's data partnership work? micro1 runs company-data partnerships for AI development. Its [data partnerships page](https://www.micro1.ai/data-partnerships) asks for 30+ employees, mature operations and primarily English documentation, with US companies first. It states tiers of $100K+, $500K+ and $1M+, and says companies keep ownership of their underlying data. The steps, from assessment to agreement, are in [how micro1's data partnership works](/guides/micro1-data-partnership). ## Which other companies run data programs for company records? Handshake AI, Mercor, Troveo, Replay, Polyshares and SimpleClosure all take records such as Slack, email, tickets and CRM history. Each publishes its own size floor, pay model and ownership terms. **micro1 and six other company-data programs, side by side** | Buyer or program | Minimum size | Stated range | Pay model | Payment timing | What you keep | |---|---|---|---|---|---| | [micro1](https://vaultfish.com/buyers/micro1) | 30+ employees, US first | Tiers of $100K+, $500K+, $1M+ | Paid under the agreed partnership | Not published | Companies keep ownership | | [Handshake AI](https://vaultfish.com/buyers/handshake-ai) | 20+ full-time staff, 3+ years | $100K to $4M+ | License fee | 30 to 60 days after dataset acceptance | Not published | | [Mercor](https://vaultfish.com/buyers/mercor) | None stated | Up to $300K, press report | One wire, no fees to you | 2 to 4 weeks after signing | Not published | | [Troveo](https://vaultfish.com/buyers/troveo) | None stated, estimator from 20 | Six figures, per its page | Revenue share on each sale | On each sale | You own it, ownership stays | | [Replay](https://vaultfish.com/buyers/replay) | Bands start at 20 employees | $10K to $1M+ by headcount | Upfront plus revenue share | Upfront, then on each license | License only, nothing transferred | | [Polyshares](https://vaultfish.com/buyers/polyshares) | None stated | $100K to $2M+ | License fee, no commission | Net 30 to 60 after approval | You keep data, exclusive by default | | [SimpleClosure Asset Hub](https://vaultfish.com/buyers/simpleclosure) | None stated, closing or operating | $10K to $100K per company, press | A percentage on a sale or license | Not published | Perpetual license to SimpleClosure | _Every figure is the company's own claim unless marked press. Terms change, so confirm on each company's page._ ## How do minimum size and history compare across micro1 alternatives? Handshake AI asks for 20+ full-time staff and 3+ years in operation. Replay's value bands and Troveo's estimator start at 20 employees, and Mercor and Polyshares state no minimum. Against those, micro1's 30+ employees is the highest stated floor. Below 20 people, the programs with no stated floor are the ones to ask first. Every stated floor, with its source, is in [do you qualify for an AI data program](/answers/ai-data-program-minimums). ## How and when do micro1 alternatives pay? Mercor wires one payment on delivery, typically 2 to 4 weeks after signing, per its [data page](https://www.mercor.com/data/). Polyshares pays net 30 to 60 once the data is approved and anonymized, per its [homepage](https://polyshares.com/). Troveo shares revenue on every sale. Replay pays upfront plus a revenue share of every license, per its [homepage](https://www.replay.ai/). Handshake AI says it typically pays 30 to 60 days after it accepts the dataset. micro1 publishes ranges but no payment timing, so get the date written into the agreement. Figure: comparison of Three ways the programs pay: One payment (Mercor, Polyshares), Upfront plus share (emphasized: The only one that pays both ways, Replay), Share of each sale (Troveo). Replay is the one program that pays upfront and then shares each later license. ## What do micro1 alternatives let you keep? micro1 says companies keep ownership of their underlying data. Replay says nothing is transferred and that your data is deleted on request if you stop, on its [data privacy page](https://www.replay.ai/data-privacy). Polyshares covers defined systems for a defined term, exclusive by default, per its [data handling page](https://polyshares.com/data-handling). Troveo says ownership never transfers and that exclusivity is time-limited, with exit terms. SimpleClosure's [terms](https://simpleclosure.com/tos/) take a perpetual, irrevocable license to what you submit. Mercor and Handshake AI publish no ownership terms for companies, so ask for them before any export. ## How does Replay compare with micro1? Replay publishes a small-company band, $10K to $100K for 20 to 50 employees. micro1's pages start at 30+ employees and $100K+. That makes Replay the one to ask first if you have 20 to 29 people. Replay pays upfront plus a revenue share. micro1 pays under the agreed partnership and publishes no schedule. The full read is in our [Replay review](/answers/replay-review). ## How does Polyshares compare with micro1? Polyshares states no employee minimum and says the length and texture of the record matter more than headcount. It states $100K to $2M and above, the same span as micro1's listing. Polyshares licenses for a defined term, exclusive by default, and pays net 30 to 60 after approval. micro1 says companies keep ownership and leaves term, exclusivity and timing to its proposed agreement. More on Polyshares is in [is Polyshares legit](/answers/is-polyshares-legit). ## Which micro1 alternative fits a company that is closing? SimpleClosure's AssetHub is built for startups winding down. SimpleClosure told Forbes it had done nearly 100 deals at $10,000 to $100,000 per company, as [Gizmodo relayed](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916). Mercor has approached shuttered startups too, with offers reported up to $300,000. The two routes are side by side in [Mercor vs SimpleClosure](/answers/mercor-vs-simpleclosure). ## How should a company choose between micro1 and the others? Count your staff and your years of records, then pick the pay model you want. If two programs fit, ask both the same questions in writing: who signs, what the license covers, when you are paid and who removes personal data. Before any of that, run the [rights check](/rights-check) on whose words sit in your systems. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) A lawyer who reads data licenses is cheaper than a lawyer who reads the lawsuit afterward. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [data page](https://www.mercor.com/data/) - [homepage](https://polyshares.com/) - [homepage](https://www.replay.ai/) - [data privacy page](https://www.replay.ai/data-privacy) - [data handling page](https://polyshares.com/data-handling) - [terms](https://simpleclosure.com/tos/) - [Gizmodo relayed](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Replay review: pay bands, terms, what to check > Replay review for a company licensing its records: the $10K to $1M+ bands by headcount, upfront plus revenue share, its terms and what to check first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/replay-review Published: 2026-10-14 Updated: 2026-10-14 ## The short answer Replay (replay.ai) licenses de-identified company operating data to AI labs. Besides SimpleClosure, it is the only program we track that publishes a small-company band: $10K to $100K for 20 to 50 employees, self-reported. It pays upfront plus a revenue share and names no lab. This Replay is [replay.ai](https://www.replay.ai/), the company that licenses operating data. Replay QA at replay.io, which tests software builds, is a different company with a similar name. Everything below comes from replay.ai's own pages. ## What is Replay? Replay licenses a company's records of how work gets done to frontier AI and data labs, after removing names and identifiers. Its website terms name Replay Data, LLC, a Delaware company based in Brooklyn, New York. Its [about page](https://www.replay.ai/about) says the founder also started Sunset, which helps founders wind companies down, and the site footer reads Sunsets HQ Corp. Our [Replay profile](/buyers/replay) keeps the record field by field. The replay.ai domain was registered in 2017 and moved registrars on 25 Aug 2026, per its RDAP record. The terms on the site are dated 28 Sep 2026, so ask how long the data program itself has run and how many licenses it has closed. ## How much does Replay say it pays? Replay's [homepage](https://www.replay.ai/) states $10K to $100K for 20 to 50 employees, $100K to $1M for 50 to 250, and $1M+ for 250 or more. The bands are its own model output, and nobody promises you a number. | Employees | Replay's stated band | |---|---| | 20 to 50 | $10K to $100K | | 50 to 250 | $100K to $1M | | 250 or more | $1,000,000+ | Replay says headcount is a proxy. Years in operation, industry, the apps you run on and the data in each set the final price. Its offers are typically an upfront cash payment plus a perpetual revenue share. ## How does Replay's process work? 1. **Value** Replay reviews your industry, systems and data volume. 2. **Terms** It presents an offer, upfront cash plus revenue share. 3. **Protect** It exports the data and removes identifiers. 4. **Payout** Historical data pays first, new data pays again. The homepage puts the four steps at about 120 minutes of your time. Its valuation form asks whether you are still operating, years in business, peak headcount, the English share of your communications and whether you keep your own codebase. ## What do Replay's terms say about ownership and liability? Replay's [data privacy page](https://www.replay.ai/data-privacy) calls the deal "a license, not a sale." It says your data, code, trademarks and IP stay yours, nothing is transferred, and your data is deleted on request if you stop. You are asked to represent that the data is yours to license. Replay says it works through that representation with you and caps your exposure at the fees paid. The [website terms](https://www.replay.ai/terms), last updated 28 Sep 2026, cover the site only. Nothing you submit grants a license, a separate written agreement governs any deal, and Replay's own liability under the site terms is capped at $100. New York law applies. ## How does Replay handle personal data? Replay says it removes HIPAA's 18 identifier categories and 60+ categories in all, in an isolated environment per client. It says raw data is used only for de-identification, and only the cleaned output is licensed. It claims its model finds 99% of PII on a benchmark where NVIDIA's GLiNER model found 36%. The benchmark itself is not on the page. Its [AI buyers page](https://www.replay.ai/ai-buyers) says stable placeholders stay consistent across every system, so the same person stays linked end to end. That keeps the record useful, and it is also why re-identification is the question to ask. Our [risk map](/risks) covers it. ## How does Replay compare with Troveo? Replay and Troveo both pay a share of later licenses. Replay adds an upfront payment and publishes headcount bands. [Troveo](/buyers/troveo) publishes a six-figure claim, no bands, and names more than 30 tools it takes exports from. | Term | Replay | Troveo | |---|---|---| | Size floor | Bands start at 20 employees | None stated, estimator from 20 | | How you are paid | Upfront plus revenue share | Revenue share on each sale | | Ownership | "A license, not a sale," nothing transferred | You own it, ownership never transfers | | Tools named | None, data types only | Slack, Gmail, Jira, Salesforce and more | | Exclusivity | Not stated | Time-limited, with exit terms | Troveo's own read is in [is Troveo legit](/answers/is-troveo-legit). Every tool each company names is in the [connector matrix](/answers/ai-data-company-connectors). ## What should a company check before sharing data with Replay? - **Which entity signs.** The footer says Sunsets HQ Corp. and the terms say Replay Data, LLC. - **What the license passes on.** The AI buyers page says Replay holds "the full rights and titles to license it onward." Match that against "nothing is transferred" in your agreement. - **The revenue share.** No percentage is published. - **Which labs.** The pages say frontier AI and data labs and name none. Replay is one of seven programs in [micro1 alternatives](/answers/micro1-alternatives), compared on the same terms. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Get the contract read by a lawyer who has seen a data license before. One afternoon of theirs beats a year of yours. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [replay.ai](https://www.replay.ai/) - [about page](https://www.replay.ai/about) - [data privacy page](https://www.replay.ai/data-privacy) - [website terms](https://www.replay.ai/terms) - [AI buyers page](https://www.replay.ai/ai-buyers) --- # Should you license company data before you sell the business? > How a data license meets a company sale: what the LOI should say, what diligence asks, which reps and warranties it touches and what goes in the data room. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/license-company-data-before-selling-your-business Published: 2026-10-14 Updated: 2026-10-14 ## The short answer Only with your acquirer in the loop. A data license is a contract the acquirer inherits or has to unwind, so it shows up in the LOI, in diligence and in your reps and warranties. Read it for term, exclusivity and assignment, then disclose it in the data room. Data offers tend to land at awkward moments. BigGo reported that Mercor emailed Warmly, an AI startup, eight days after Warmly announced HubSpot would acquire it ([BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). If your company is in an acquisition process, the next offer could arrive mid-deal too. ## How does a data license affect the sale of a business? A data license is a contract that outlives the signature. If it is exclusive, it limits what the acquirer can do with records it is paying for. If it carries a revenue share, it is an income stream the acquirer will want to value. Either way it changes the deal, so the acquirer needs to hear about it before it finds it. The Frankfurt Kurnit law firm notes that gaps in data rights "can surface in M&A diligence and affect how the company and its data are valued" ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). ## What should the LOI for a business sale say about a data license? If the license is signed before the LOI, list it among the material contracts and say whether it transfers with the company. If you are still talking to a data program, say so, because most LOIs carry a no-shop or exclusivity period. Purchase agreements usually require you to run the business in the ordinary course between signing and closing. A new data license can fall outside that, so get the acquirer's written consent first. Our [letter of intent template](/templates/letter-of-intent-template) has the clauses to fill in. ## What will due diligence on the business ask about a data license? An acquirer's diligence team will want the signed license, a record of what was shared, the de-identification method and what happens to the data when the license ends. Frankfurt Kurnit says a prior data deal "will come up in diligence, and buyers will expect to see this record" of the review. So keep the record as you go: the inventory, the exclusions, the de-identification method and counsel's sign-off. The [data room checklist](/tools/data-room-checklist) has a row for each. ## Which reps and warranties in a business sale does a data license touch? A data license usually touches three of them. You represent that you own your IP and data, that you complied with privacy law and your own notices, and that no contract conflicts with the sale. An exclusive license qualifies the first. A license granted without employee or customer notice puts pressure on the second. And a license that needs the program's consent to assign touches the third. The reps a data program asks of you are in [reps and warranties in a data deal](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for). ## What do the data programs' own terms say about ownership and term? | Program | Ownership, in its own words | Term or exclusivity | |---|---|---| | [micro1](https://www.micro1.ai/data-partnerships) | "Companies retain ownership of their underlying data" | Set in its proposed agreement | | [Polyshares](https://polyshares.com/data-handling) | "You keep the business and the data" | Defined term, exclusive by default | | [Replay](https://www.replay.ai/data-privacy) | "Nothing is transferred" | Deleted on request if you stop | | [Troveo](https://www.troveo.ai/business-data) | "Ownership never transfers" | Exclusivity time-limited, with exit terms | | [SimpleClosure](https://simpleclosure.com/tos/) | "You retain ownership of all rights" | Perpetual, irrevocable license | Read on each company's own pages on 14 Oct 2026. A perpetual license survives the sale. A defined, exclusive term binds the acquirer until it ends. ## How does a business disclose a data license in the data room? Put the signed license in the material contracts folder, with the data inventory and the de-identification method beside it. Add the payment schedule, and any revenue share still owed, so the acquirer can price it. One more line belongs there. California's AB 2013 requires generative AI developers to publish high-level information about their training data sources, so a license may not stay private. Figure: steps Read the license for term and assignment -> List it for diligence -> Disclose it in the data room. A data license signed before a sale gets read, listed and disclosed, in that order. ## Should a business wait until after the sale to license its data? Often, yes. Once an LOI is signed, the acquirer usually gets a say, and a data deal can wait for closing. Before any sale process starts, a short non-exclusive license is the easiest kind to carry into one. How an acquirer treats data under California's merger exception is in [licensing data in an acquisition](/answers/sell-data-in-acquisition). The price gap between the two kinds of license is in [exclusive vs non-exclusive pricing](/answers/exclusive-vs-non-exclusive-data-license-price). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _An M&A lawyer and a privacy lawyer should both read the data license before it goes in the data room._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [micro1](https://www.micro1.ai/data-partnerships) - [Polyshares](https://polyshares.com/data-handling) - [Replay](https://www.replay.ai/data-privacy) - [Troveo](https://www.troveo.ai/business-data) - [SimpleClosure](https://simpleclosure.com/tos/) --- # What happens if I close my business and walk away? > Want to close your business and walk away? An abandoned company keeps owing state fees and taxes, and unpaid payroll tax can follow you personally. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/close-my-business-and-walk-away Published: 2026-10-14 ## The short answer If you want to close your business and walk away, file the dissolution first. An abandoned company keeps owing state fees and taxes until the state dissolves it, and unpaid payroll tax can follow you personally under IRC 6672. Export your records before the accounts close. Walking away feels like the clean exit. On paper it leaves the company alive, and a live company keeps getting mail long after the Slack goes quiet. ## What happens to a business you abandon instead of dissolving? A company you stop running stays on the state's books until someone files to end it. Until then, annual reports and state taxes keep coming due, and the state can end the company itself through administrative dissolution or forfeiture. The [Alabama Department of Revenue's closing guide](https://www.revenue.alabama.gov/wp-content/uploads/2022/03/Business-How_to_Close_a_Business_for_Business_Privilege_Tax_Purposes.pdf) gives the plainest example. A company that stopped operating in 2009 but dissolved in 2013 owed business privilege tax for 2010 through 2013. California runs the same clock. Every corporation registered there owes the [$800 minimum franchise tax](https://www.ftb.ca.gov/file/business/types/corporations/index.html) each year after its first. The [Franchise Tax Board's guide to dissolving](https://www.ftb.ca.gov/forms/misc/1038.html) lets you avoid it for later years only if you file the final return on time and the dissolution papers within 12 months of it. The [Utah State Tax Commission](https://tax.utah.gov/business/create-manage/tax-clearance/) says the same about its corporations. Until a registered corporation legally dissolves, it keeps filing and paying corporation income and franchise taxes. ## What is administrative dissolution of a business? Administrative dissolution is a state ending a company for missed filings or unpaid fees, with no vote from the owners. The company loses its good standing, and a later clean dissolution usually means catching up on what it missed first. - **Arizona.** A corporation that files articles of dissolution has six months to get its tax clearance certificate to the Corporation Commission. If the certificate doesn't arrive, the [Commission's dissolution instructions](https://www.azcc.gov/docs/default-source/corps-files/instructions/c022i-instructions-articles-of-dissolution.pdf) say the corporation is administratively dissolved. It may then only wind up its affairs. - **Kansas.** The [Secretary of State's closing page](https://www.sos.ks.gov/businesses/close-a-business.html) says forfeiture follows a missed information report or a lapsed resident agent. A forfeited business must reinstate before it can file closing papers. The same page says a business, with its own advisors, decides whether to file closing documents or let itself forfeit. Kansas is unusually candid about that choice. - **California.** The Franchise Tax Board says the Secretary of State cannot accept termination papers from a suspended or forfeited entity. You file the missing returns, pay the balance and apply for revivor first. ## Can I be personally liable for my business's unpaid payroll taxes? Yes. Under [IRC section 6672](https://www.law.cornell.edu/uscode/text/26/6672), a person required to collect and pay over withheld taxes who willfully fails to do so owes a penalty equal to the unpaid tax. The IRS calls it the trust fund recovery penalty. The [IRS page on the trust fund recovery penalty](https://www.irs.gov/businesses/small-businesses-self-employed/employment-taxes-and-the-trust-fund-recovery-penalty-tfrp) says it equals the withheld income tax plus the employees' share of FICA that went unpaid. It can reach officers, directors, shareholders, partners and anyone else with authority over the money. Paying other creditors with available funds while the payroll tax goes unpaid is, in the IRS's words, an indication of willfulness. The business doesn't have to stop operating for the IRS to assess it. Once assessed, the IRS can file a lien or levy your personal assets. Most other company debts stay with the company. The usual exception is a lease or loan you backed with your own signature, since that promise is yours. Pull every one you signed. Figure: comparison of Two ways to stop running a company: Walk away (Fees keep coming), Dissolve (emphasized: Ends the annual bills, Fees end at filing). Filing the dissolution is what stops the state's annual fees and reports. ## What should I do with company records before I walk away? Export them before the accounts go dark. Email, chat and CRM vendors delete data on their own schedules once you stop paying, and federal rules still make you keep tax and payroll records for years after you close. The IRS [closing-a-business page](https://www.irs.gov/businesses/small-businesses-self-employed/closing-a-business) says to keep employment tax records for at least four years. Our page on [what to keep, delete or license when you close](/answers/what-to-do-with-company-records-when-you-close) has every federal period. Some of what you export may be worth licensing to an AI lab. Run the [rights check](/rights-check) before you share any of it, because customer contracts and privacy notices decide what you can license. ## What is the shortest clean way out of a business? The shortest clean way out of a business is three moves: export the records, file the final tax returns, then file the state dissolution. The state's annual bills stop at that last filing. Figure: steps Export the records -> File the final returns -> File the dissolution. The state's annual bills stop when the dissolution is filed. The [closing checklist](/closing-a-business) puts these in order for your state. The [final tax return steps](/answers/final-tax-return-when-closing-a-business) list each IRS form and deadline. For the state filing itself, the [state-by-state dissolution table](/closing-a-business/how-to-dissolve-an-llc-or-corporation) gives each checked state's form and fee. Walking away is a decision too. Make it on paper, with a filing date, and the bills stop with it. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Alabama Department of Revenue's closing guide](https://www.revenue.alabama.gov/wp-content/uploads/2022/03/Business-How_to_Close_a_Business_for_Business_Privilege_Tax_Purposes.pdf) - [$800 minimum franchise tax](https://www.ftb.ca.gov/file/business/types/corporations/index.html) - [Franchise Tax Board's guide to dissolving](https://www.ftb.ca.gov/forms/misc/1038.html) - [Utah State Tax Commission](https://tax.utah.gov/business/create-manage/tax-clearance/) - [Commission's dissolution instructions](https://www.azcc.gov/docs/default-source/corps-files/instructions/c022i-instructions-articles-of-dissolution.pdf) - [Secretary of State's closing page](https://www.sos.ks.gov/businesses/close-a-business.html) - [IRC section 6672](https://www.law.cornell.edu/uscode/text/26/6672) - [IRS page on the trust fund recovery penalty](https://www.irs.gov/businesses/small-businesses-self-employed/employment-taxes-and-the-trust-fund-recovery-penalty-tfrp) - [closing-a-business page](https://www.irs.gov/businesses/small-businesses-self-employed/closing-a-business) --- # What to do with company records when you close > What to do with company records when you close: federal keep periods for tax, payroll, hiring, OSHA and I-9 records, what you may delete, and licensing first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-to-do-with-company-records-when-you-close Published: 2026-10-14 ## The short answer When you close a company, keep what federal rules require: employment tax records 4 years, FLSA payroll records 3, hiring records 1, OSHA logs 5, and I-9s 3 years from hire or 1 after the job ends. Past those, delete, or license first if your contracts allow it. Closing the company doesn't close the filing cabinet. The retention clocks keep running after the last paycheck, and someone has to hold the records until each one stops. ## How long do I have to keep company records after closing a business? Federal rules set the floor, and closing the business doesn't shorten them. Most run 1 to 5 years: hiring records 1, FLSA payroll records 3, employment tax records at least 4 and OSHA logs 5. Income tax records run 3 years or longer. | Record | Keep for | Rule | |---|---|---| | Employment tax records | At least 4 years after the tax is due or paid, whichever is later | [IRS record keeping guidance](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records) | | Records behind an income tax return | 3 years after filing. 6 years if you left out more than 25% of gross income. 7 years for a bad debt or worthless securities claim | [IRS record keeping guidance](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records) | | Property records | Until the limitations period ends for the year you dispose of the property | [IRS record keeping guidance](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records) | | Payroll records, under the FLSA | At least 3 years from the last entry | [29 CFR 516.5](https://www.ecfr.gov/current/title-29/section-516.5) | | Time cards and wage rate tables | At least 2 years | [29 CFR 516.6](https://www.ecfr.gov/current/title-29/section-516.6) | | Personnel and hiring records, including applications | 1 year from the record or the action, whichever is later. Until final disposition if a discrimination charge is filed | [29 CFR 1602.14](https://www.ecfr.gov/current/title-29/section-1602.14) | | OSHA 300 log, annual summary and 301 reports | 5 years after the end of the year they cover | [29 CFR 1904.33](https://www.ecfr.gov/current/title-29/section-1904.33) | | Form I-9 | 3 years after the hire or 1 year after employment ends, whichever is later | [8 CFR 274a.2](https://www.ecfr.gov/current/title-8/section-274a.2) | The OSHA row applies only if the company had to keep OSHA logs. The hiring row runs one year from the termination date for anyone let go involuntarily, which in a shutdown is usually everyone. **4 years** The IRS minimum for employment tax records, which every closing employer holds ## Who keeps company records once you close? Someone has to, and the IRS asks you to name them. A final Form 941 needs a statement with the name of the person keeping the payroll records and the address where they will be kept. That person is usually a founder, an officer or the company's accountant. Pick one before the shared drive goes read-only, and give them the export, the access and the list of what expires when. ## Which company records can I delete when the business closes? Once a record is past every retention period that covers it, and no audit, charge or lawsuit touches it, you can generally delete it. State rules can run longer than the federal ones, so check your state's tax and labor pages too. The [IRS adds one more check](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records): before you discard records you no longer need for tax, find out whether an insurer or a creditor needs them kept longer. Most of what a closing company holds was never on that list. Slack history, email threads, support tickets, the CRM and the code repository carry no federal keep period of their own, unless they hold one of the records above. ## Can I license company records before I delete them at closing? Often, yes, when the contracts and laws behind the records allow it. Retention rules say what you must hold. Who else may get a copy is a question for your customer contracts, your privacy notices and privacy law. Deletion is the one step you can't take back, so put licensing in front of it. A chat archive or a ticket history you were about to wipe may be worth something to an AI lab, and a data license leaves you holding the original. Start with the [rights check](/rights-check), which asks about the contracts and consents that decide what you can license. Employee records need the most care. Our page on [licensing HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai) covers them. Figure: steps Export everything -> Check the rights -> License or delete. Check the rights while the records still exist, then license or delete. ## What is the right order for company records at closing? Export first, while every account is still paid for. Then set aside what the retention rules require, check the rights to the rest, and only then license or delete. The [closing checklist](/closing-a-business) runs the records steps before the state filing for that reason. If you are tempted to skip all of it, our page on [closing a business and walking away](/answers/close-my-business-and-walk-away) explains what that costs. The final payroll returns and the payroll records statement are on the [final tax return list](/answers/final-tax-return-when-closing-a-business). _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [IRS record keeping guidance](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records) - [29 CFR 516.5](https://www.ecfr.gov/current/title-29/section-516.5) - [29 CFR 516.6](https://www.ecfr.gov/current/title-29/section-516.6) - [29 CFR 1602.14](https://www.ecfr.gov/current/title-29/section-1602.14) - [29 CFR 1904.33](https://www.ecfr.gov/current/title-29/section-1904.33) - [8 CFR 274a.2](https://www.ecfr.gov/current/title-8/section-274a.2) --- # Which tools does each AI data company accept? > Slack, Gmail, Outlook, Teams, Drive, Notion, Jira, Zendesk, HubSpot, Salesforce, Shopify, GitHub: which AI data companies name each tool on their own pages. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/ai-data-company-connectors Published: 2026-10-14 Updated: 2026-10-14 ## The short answer Four of the seven company-data programs we track name tools on their own pages. Troveo names 34, including Gmail, Outlook, Zendesk and Shopify. Mercor names nine and says it supports 100+. Polyshares and SimpleClosure name a handful. micro1, Handshake AI and Replay describe data types and name no tools. If you run your company on Gmail, Outlook or Shopify, the first question is whether anyone takes that data at all. I read each company's own pages on 14 Oct 2026 and wrote down every tool it names. Where a company names none, the cell says "Not listed", which means its pages are silent on that tool. ## Which tools does each AI data company name on its own pages? "Yes" means the tool is named on that company's page. "Sample offer" means it appears only in an illustrative offer. Sources: [Mercor](https://www.mercor.com/data/), [Troveo](https://www.troveo.ai/business-data), [Polyshares](https://polyshares.com/data-licensing), [SimpleClosure](https://simpleclosure.com/product/assethub/), [Replay](https://www.replay.ai/), [micro1](https://www.micro1.ai/data-partnerships) and [Handshake AI](https://joinhandshake.com/ai/data-partnerships/). | Tool | Mercor | Troveo | Polyshares | SimpleClosure | Replay | micro1 | Handshake AI | |---|---|---|---|---|---|---|---| | Slack | Yes | Yes | Yes | Yes | Not listed | Not listed | Not listed | | Microsoft Teams | Yes | Yes | Yes | Not listed | Not listed | Not listed | Not listed | | Google Chat | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Zoom | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Gmail | Yes | Yes | Sample offer | Not listed | Not listed | Not listed | Not listed | | Outlook | Yes | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Google Calendar | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Google Drive | Yes, as Drive | Yes | Yes, as Drive | Yes | Not listed | Not listed | Not listed | | OneDrive | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | SharePoint | Not listed | Yes | Yes | Not listed | Not listed | Not listed | Not listed | | Dropbox | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Notion | Yes | Yes | Not listed | Yes | Not listed | Not listed | Not listed | | Confluence | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | Not listed | | Jira | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Linear | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Asana | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Monday | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Figma | Not listed | Yes | Not listed | Yes | Not listed | Not listed | Not listed | | Salesforce | Yes | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | HubSpot | Not listed | Yes | Sample offer | Not listed | Not listed | Not listed | Not listed | | Zendesk | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Intercom | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Gong | Not listed | Not listed | Not listed | Not listed | Not listed | Not listed | Not listed | | Shopify | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Stripe | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | QuickBooks | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | NetSuite | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Pigment | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | GitHub | Yes | Yes | Not listed | Yes | Not listed | Not listed | Not listed | | GitLab | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Snowflake | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Databricks | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | ServiceNow | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Workday | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | SAP | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | | Microsoft Dynamics | Not listed | Yes | Not listed | Not listed | Not listed | Not listed | Not listed | Figure: scale, Tools each company names on its own pages: Troveo 34 tools (emphasized), Mercor 9 tools, SimpleClosure 5 tools. Troveo names the most tools of any company-data program we track, 34 by our count. Source: Each company's own pages. ## How do AI data companies take data out of your tools? Mercor asks you to link accounts from its 100+ supported tools and says its platform extracts and de-identifies the data. Troveo says "No OAuth into your systems" and guides you through exports instead. Polyshares asks only for record counts at intake and says nothing leaves your systems before you accept an offer. SimpleClosure takes a short form or a GitHub connection. Replay says it exports the data securely, then removes identifiers. ## Can you license Gmail or Outlook data to an AI data company? Mercor and Troveo both name Gmail and Outlook. Polyshares shows Gmail only in a sample offer, and SimpleClosure says "Email" without naming a provider. Email holds other people's words: customers, vendors and former staff. Whether you can license it turns on your notices and contracts, so run the [rights check](/rights-check) before any inbox leaves your hands. ## Which AI data companies accept Shopify, Stripe or QuickBooks data? Troveo is the only company here that names Shopify, Stripe, QuickBooks and NetSuite, under its finance and business platforms group. Store and payment records carry customer personal data, so expect de-identification to strip more of them than of a Jira board. ## Does any AI data company name Gong? None of the seven names Gong. Polyshares lists call recordings among the records it takes, and Troveo names Zoom. If your sales calls live in Gong, ask whether transcripts and recordings count, and who removes the voices and names. ## What if an AI data company does not list your tool? Troveo's page says that if your team works in a system, "it's likely to be valuable." Mercor names nine tools and says it supports 100+. micro1 describes data types such as SOPs, knowledge bases and CRM data instead of tools. So treat "Not listed" as a question to put to the company. The size and history each program asks for is in [do you qualify for an AI data program](/answers/ai-data-program-minimums), and the pay terms are in [micro1 alternatives](/answers/micro1-alternatives). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Export permissions differ by plan for most of these tools. Check yours before you promise anyone a full history. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor](https://www.mercor.com/data/) - [Troveo](https://www.troveo.ai/business-data) - [Polyshares](https://polyshares.com/data-licensing) - [SimpleClosure](https://simpleclosure.com/product/assethub/) - [Replay](https://www.replay.ai/) - [micro1](https://www.micro1.ai/data-partnerships) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) --- # Can the FTC make a buyer delete a model trained on your data? > The FTC has ordered model deletion in consumer cases like Everalbum (Paravision). What it covers, and why your contract matters more. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-the-ftc-make-a-buyer-delete-a-model-trained-on-your-data Published: 2026-10-10 Updated: 2026-10-13 ## The short answer Not on your behalf. The FTC has ordered companies to delete models built from data the FTC said they collected or used unlawfully, like Everalbum, also known as Paravision, in 2021. The orders I found all came from consumer cases, so put deletion terms in your contract. The remedy is often called algorithmic disgorgement, because it reaches the model as well as the data. The FTC has used it several times, though it covers less than the name suggests. ## What did the Everalbum order require? Everalbum ran Ever, a photo storage app. The [FTC's January 2021 Everalbum announcement](https://www.ftc.gov/news-events/news/press-releases/2021/01/california-company-settles-ftc-allegations-it-deceived-consumers-about-use-facial-recognition-photo) says the FTC alleged the company deceived Ever users about face recognition and about deleting their photos. The FTC said Everalbum turned face recognition on by default for all mobile app users at launch, used their photos to build its own face recognition technology and kept deactivated users' photos after promising to delete them. The [final Everalbum Decision and Order](https://www.ftc.gov/system/files/documents/cases/1923172_-_everalbum_decision_final.pdf), issued 6 May 2021, names "Everalbum, Inc., also d/b/a Ever and Paravision." Its deletion section required three things: - photos and videos of users who had deactivated their accounts, deleted within 30 days - face embeddings made without users' express consent, deleted within 90 days - any models or algorithms developed "in whole or in part" from Ever users' biometric data, deleted within 90 days Each deletion needed a written statement to the FTC, sworn under penalty of perjury. The order runs for 20 years. The FTC's announcements list no money payment. ## Did Paravision actually delete the models? It says so. In a [Paravision compliance report filed with the FTC](https://www.ftc.gov/system/files/ftc_gov/pdf/paravision_compliance_report_redacted.pdf) in 2022, the company, renamed Paravision, Inc. on 7 September 2021, states that it sent the written statements the order required, confirming each deletion on time. That is the company's own report to the regulator. ## Has the FTC ordered model deletion in other cases? Yes. The [FTC's announcement of the WW International and Kurbo order](https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensitive), dated 4 March 2022, says the order required deleting children's data collected without parental consent, destroying algorithms derived from it and paying a $1.5 million penalty. Orders against Rite Aid and Avast, announced in December 2023 and February 2024, required the same kind of deletion for face images and browsing data. Both are covered in [what the FTC says about retroactive terms](/answers/ftc-retroactive-terms-of-service-ai). Figure: steps FTC charges the company -> Order names the models -> Deleted, with a sworn statement. In the Everalbum order, the models built from users' photos had to go within 90 days. ## What does model deletion cover? Read the Everalbum order closely and the reach has edges: - **The data's origin.** The model clause reaches models built from biometric data collected from Ever app users, the data at the center of the FTC's charges. - **Derived work.** Models built "in whole or in part" from that data are covered, so mixing it with clean data doesn't save the model. - **The company named.** The order binds the respondent, its successors and people acting with it who get notice of the order. - **Proof.** Deletion is confirmed in a sworn statement to the FTC. ## What does this mean for your contract? It cuts two ways. First, the model-deletion orders I found all came from consumer cases. None enforced a business's license, so don't count on the FTC to undo a model if a buyer breaks yours. Write the deletion terms yourself: the trigger, the deadline, whether derived data and trained models are included, backups, and a signed confirmation. [Our deletion page](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it) lists what to look for in a draft. Second, the risk can run back to you. My reading of these orders: if your records were collected under notices that don't cover an AI license, the buyer's model is what's at stake. That's analysis. The nearest case is Avast, where the order reached what its subsidiary Jumpshot built from data the FTC says was sold against promises to users. No order I found has applied it to a company licensing its own records to an outside AI buyer. Buyers ask for [reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) about lawful collection and consent. The [rights check](/rights-check) gathers what your customers and staff were told. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [FTC's January 2021 Everalbum announcement](https://www.ftc.gov/news-events/news/press-releases/2021/01/california-company-settles-ftc-allegations-it-deceived-consumers-about-use-facial-recognition-photo) - [final Everalbum Decision and Order](https://www.ftc.gov/system/files/documents/cases/1923172_-_everalbum_decision_final.pdf) - [Paravision compliance report filed with the FTC](https://www.ftc.gov/system/files/ftc_gov/pdf/paravision_compliance_report_redacted.pdf) - [FTC's announcement of the WW International and Kurbo order](https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensitive) --- # Can you insure an AI data licensing deal? > Can you insure an AI data licensing deal? No published policy turned up. What to ask before anyone calls a deal insured: insurer, insureds, limits, exclusions. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-you-insure-an-ai-data-licensing-deal Published: 2026-10-10 Updated: 2026-10-13 ## The short answer Not off the shelf, as far as I can find: no published policy, named insurer or limits. If anyone calls a deal insured, ask for the policy: the insurer, who is insured, the limits, the exclusions and proof it's bound. Until you've read it, treat the deal as uninsured. "Insured" is a reassuring word in a data deal. It's also easy to say. ## Does anyone publish insurance for a data licensing deal? Not that I found. On 10 October 2026 I read [micro1's data partnerships page](https://micro1.ai/data-partnerships) and three [Polyshares](/buyers/polyshares) pages: [Polyshares data licensing](https://polyshares.com/data-licensing), [Polyshares deal process](https://polyshares.com/answers/how-data-licensing-deals-work) and [Polyshares data handling](https://polyshares.com/data-handling). None of them mentions insurance for the company licensing its data. I also found no insurer publishing a policy built for licensing company records to AI buyers. If someone mentions a pilot or a partner insurer, the questions below turn that into paperwork you can read. ## Will your existing policies cover a data licensing deal? Don't assume so. [Fenwick's June 2026 review](https://www.fenwick.com/insights/publications/end-silent-ai-emerging-ai-exclusions-coverage-fragmentation-and-practical-implications) reports insurers adding AI exclusions to several kinds of business policy, and advises reading the insuring agreement, definitions, exclusions and endorsements together. Which policy types are moving, and where liability lands, are in [our page on who carries a breach at the buyer](/answers/who-is-liable-if-the-data-buyer-is-hacked). ## What should you ask for? Ask for each of these in writing: 1. **The insurer.** The company that carries the risk, by its legal name. A broker or a platform is not the insurer. 2. **The insureds.** Whose name is on the policy. Are you an insured, or only the buyer? 3. **The limits.** The most it pays per claim and in total, and the deductible or retention you'd carry first. 4. **The exclusions.** Ask directly whether the policy excludes claims from the licensing itself, failed de-identification, breach of confidentiality and intellectual property claims. 5. **Proof it's bound.** A policy number and effective dates, on the policy or a binder from the insurer. A quote or a proposal is not cover. ## Is a certificate of insurance enough? No. A certificate summarizes a policy. The [Iowa Insurance Division's Bulletin 10-04](https://iid.iowa.gov/media/129/download) (13 July 2010) reminds insurers and agents that certificates "do not convey any contractual rights." It adds that the policy governs the cover and a certificate can't alter it. So the policy, or a binder, is the document to read. Figure: steps A named insurer -> You are an insured -> Bound, exclusions read. A deal counts as insured once you hold a bound policy that names you. ## When can you call a deal insured? When you hold a bound policy that names you, with limits and exclusions you have read with your broker or lawyer. Until then, your protection is the contract: the [reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) you give, the indemnity, and the caps on each side. We are not insurance brokers. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's data partnerships page](https://micro1.ai/data-partnerships) - [Polyshares data licensing](https://polyshares.com/data-licensing) - [Polyshares deal process](https://polyshares.com/answers/how-data-licensing-deals-work) - [Polyshares data handling](https://polyshares.com/data-handling) - [Fenwick's June 2026 review](https://www.fenwick.com/insights/publications/end-silent-ai-emerging-ai-exclusions-coverage-fragmentation-and-practical-implications) - [Iowa Insurance Division's Bulletin 10-04](https://iid.iowa.gov/media/129/download) micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) --- # How does an AI lab's data team judge a data offer? > How AI labs judge a data offer, from their own job posts, partnership page and intake form: research value, quality, hard-to-find data and rights. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-ai-labs-evaluate-a-data-offer Published: 2026-10-10 Updated: 2026-10-14 ## The short answer OpenAI's data acquisition job post (5 Jun 2026) says the role balances research value, feasibility, quality and responsible execution. Its partnership page wants large datasets that aren't already easy to find online. Its intake form asks whether you hold the rights. I found no lab that publishes its scoring sheet. Labs' job posts come close, and they say more than you'd expect. Everything below comes from pages the labs and data companies wrote themselves. It describes what they say they look for. It can't tell you whether a given lab will say yes. ## Who reads your offer at a lab? [OpenAI's data acquisition job post](https://jobs.ashbyhq.com/openai/71004494-9a55-4ed5-b458-2ff475f0d881) (5 Jun 2026) describes its research program manager as a key interface with outside data offers. [Anthropic's Research Counsel job post](https://job-boards.greenhouse.io/anthropic/jobs/5413418008) (3 Sep 2026) adds a lawyer who advises on data sourcing, licensing, partnerships and use. Across the two labs' posts, three roles sit near a data offer: - **Researchers.** OpenAI's post says the role works with researchers to scope data needs and define success criteria. - **Engineers.** The same OpenAI post says the role works with engineers on data platforms and security practices such as access management. - **A lawyer.** That Anthropic counsel advises the research and data teams, so the legal read sits beside the technical one. So one offer has to answer a research question, a delivery question and a legal question. ## What do the labs say they look for? OpenAI's data acquisition job post lists four things it balances in data opportunities, and [OpenAI's Data Partnerships page](https://openai.com/index/data-partnerships/) (9 Nov 2023) adds what it wants and what it isn't seeking. **What OpenAI says it looks for in a data offer, from its own pages.** | What they look for | What the lab wrote | Where | |---|---|---| | Four factors | Research value, feasibility, quality and responsible execution | OpenAI job post | | Not easy to find online | Large datasets not easily accessible to the public | OpenAI partnerships page | | Human intent | Long-form writing or conversations, not disconnected snippets | OpenAI partnerships page | | Format | Almost any form, with OCR and transcription help | OpenAI partnerships page | | Not sought | Sensitive or personal information, or data owned by a third party | OpenAI partnerships page | Put plainly, the OpenAI pages ask whether your records hold something a model can't get from the public web, whether whole conversations survive, and whether anyone else's rights or personal details sit inside. The partnership page says OpenAI can help remove personal or third-party information. Even so, the "Not sought" row above shows which of your records will raise questions first. ## What does a lab's own intake form ask? [OpenAI's data partnerships interest form](https://openai.com/form/data-partnerships/), the one lab form I found (live on 10 Oct 2026), asks what the data is, how much there is, whether you hold the rights to share it and what help you need to deliver it. The form says submitting commits you to nothing and the answers stay private to OpenAI. Past your name, email, company and country, it asks eight required questions: - your organization type, with for-profit private companies one of the options - the data type: written text, spoken language, images, video, numeric and others - an estimated size, in units you choose, such as words or hours - whether the data is digital or in print - a short description of the data - whether you have the rights to share it - what help you need to clean and deliver it - whether you would share it publicly, privately or either way It ends with an optional "Anything else?" box. Three of those eight questions are about volume and form. One is about rights, a free-text box worth drafting with your lawyer. ## What do data companies ask first? Data companies with company-data programs publish their own first questions. These are each company's own descriptions: - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) asks about your company and the tools you use. Its estimator asks for headcount, years in operation and country. - Handshake AI says payouts turn on the data sources, volume and quality and its due diligence. A scoping call covers data parameters, de-identification, terms and timeline. - [Troveo](https://www.troveo.ai/business-data)'s estimator asks for headcount and years of operating, and its page says value grows with the systems you license. It wants complete chat threads with participants and replies intact, and documents with authorship, versions and timestamps. - [micro1's Enterprise Data Partnership](https://www.micro1.ai/data-partnerships) program looks for companies with 30+ employees, mature operations and English documentation, with US companies prioritized. - That program reviews a submission for fit, then holds a discovery call on data and privacy requirements. Handshake AI also says partners remain responsible for making sure their transfer meets legal requirements. That puts the rights work on you before anyone opens a file. ## What should your first message say? Write it for the roles above. Descriptions and counts are enough for a first read: 1. **What the records are.** The systems, such as email, chat, tickets or a CRM, and the kind of work they show. 2. **How much and how far back.** Rough counts and the years covered. 3. **Whether any of it is public.** OpenAI says it wants data that isn't already easy to find online. 4. **Who is in it.** Employees, customers or partners, and what you would leave out. 5. **Where the rights stand.** Contracts, notices and who can sign, with your lawyer's questions listed. 6. **How it would export.** File formats, and whether threads and metadata come out whole. Keep the records themselves back until counsel has read the terms. Delivered data gets checked later, after the contract is signed, as [data verification before payment](/answers/data-verification-before-payment-ai) shows, so the first message only needs to earn the scoping call. For what labs do with the chain of work inside those records, see [what data AI labs want from companies](/answers/what-data-do-ai-labs-want-from-companies) and [why AI labs want real company data](/answers/why-ai-labs-want-real-company-data). The [data readiness checklist](/answers/data-readiness-checklist) turns the list above into a working sheet. ## What do labs leave out? What labs pay, how many offers they turn down and how long a review takes. Neither OpenAI's nor Anthropic's pages above say. OpenAI's form is general, written for any organization with data. I found no lab form built for company archives such as email or chat, so the visible routes for those run through data companies. [Licensing direct or through a data company](/answers/sell-direct-to-ai-lab-or-through-a-broker) weighs the two routes. The free [rights check](/rights-check) walks through seven rights questions to take to your lawyer. Optional, paid [managed readiness](/managed-readiness) builds the systems inventory, questions for your counsel and buyer shortlist from descriptions and counts, quoted in writing first. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [OpenAI's data acquisition job post](https://jobs.ashbyhq.com/openai/71004494-9a55-4ed5-b458-2ff475f0d881) - [Anthropic's Research Counsel job post](https://job-boards.greenhouse.io/anthropic/jobs/5413418008) - [OpenAI's Data Partnerships page](https://openai.com/index/data-partnerships/) - [OpenAI's data partnerships interest form](https://openai.com/form/data-partnerships/) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [Troveo](https://www.troveo.ai/business-data) - [micro1's Enterprise Data Partnership](https://www.micro1.ai/data-partnerships) micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) --- # Training license vs RAG license: what changes for you? > Training license vs RAG license: a training buyer usually keeps what its model learned, while retrieval platforms like Sphere charge per use. Sourced and dated. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/training-license-vs-rag-license Published: 2026-10-10 Updated: 2026-10-14 ## The short answer A training buyer's model usually keeps what it learned from your records, which Troveo says almost every buyer insists on. Retrieval platforms such as Sphere charge per use while access lasts. Company-data programs describe training. Most of what you negotiate in an AI data license follows from one choice: will the buyer train on your records, or look them up each time someone asks? That one difference changes how you get paid, what you can take back at the end and whether your name ever appears. ## What is the difference between a training and a RAG license? A **training license** lets a model learn from your records, and the buyer usually keeps that model after the license ends. A **retrieval license**, often called a RAG license, lets an AI system look your library up each time someone asks, so the library has to stay available. RAG is short for retrieval-augmented generation. The system searches the licensed library at the moment of the question, then writes its answer from what it found. [Troveo's guide to licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) (1 Sep 2026), from a data licensing marketplace, lists training, fine-tuning, evaluation and retrieval at answer time as separate rights with different values. One contract can grant any mix of them. **Training license and retrieval (RAG) license, term by term, from the public sources on this page.** | License term | Training license | Retrieval (RAG) license | |---|---|---| | How the buyer uses it | A model learns from it | Looked up for each answer | | Pricing basis | Flat, per-unit or recurring fee | Per query, token or request | | Term | The model usually outlives the term | Use runs while access lasts | | At the end | Files may be deleted, the model usually stays | Access can be switched off | | Your name | No attribution term found | Results carry the source | | Who offers it | Company-data programs and labs | Publisher licensing platforms | | Usually fits when | You hold a finished archive of internal records | You publish material people look things up in | ## What does a training license look like? A training license names training as the permitted use, and the trained model usually stays with the buyer afterwards. [OpenAI's Data Partnerships page](https://openai.com/index/data-partnerships/) (9 Nov 2023) offers to prepare private datasets "for training proprietary AI models," including its foundation models. [Wiley's annual report for the year to 30 Apr 2026](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm) (filed 24 Jun 2026) says the science and education publisher licenses content for AI, including training large language models. For its learning content, those licenses carry a fixed price, and Wiley books the revenue at one point in time instead of spreading it over a term. [micro1's Enterprise Data Partnership page](https://www.micro1.ai/data-partnerships) says a company's operational data and workflows help train and evaluate frontier AI models. That is micro1's own description of its program. ## What does a retrieval license look like? A retrieval license names lookup at answer time as the use. [Wiley's 3 Mar 2026 release](https://newsroom.wiley.com/press-releases/press-release-details/2026/Wiley-and-OpenEvidence-Partner-to-Deliver-Trusted-Research-to-Physicians-at-the-Point-of-Care/default.aspx) describes a deal close to one: OpenEvidence will cite Wiley content in its answers. The release doesn't say whether training is excluded. Cochrane reviews and more than 400 journals and books will be referenced inside OpenEvidence's evidence layer. OpenEvidence is a medical answer engine for physicians, and the release describes its models as trained on peer-reviewed literature. Two licensing platforms describe the retrieval model on their own pages: - [Sphere's FAQ](https://www.getsphere.ai/buy-data) says no training use is permitted and access is for inference and retrieval only, though the same page also mentions a "fine-tuning stack." Buyers pay by query, token or request volume, and every result carries source metadata. - [TollBit](https://tollbit.com/) offers publishers "Licensed RAG access," and its bot and agent paywall uses usage-based pricing on terms the publisher sets. Some deals cover both. [Google's 22 Feb 2024 post on its Reddit partnership](https://blog.google/company-news/inside-google/company-announcements/expanded-reddit-partnership/) says the Data API gives it real-time content to "display, train on, and otherwise use." Read the permitted-use clause itself before you trust the headline. ## How does the money differ? Troveo's guide says a finished archive is licensed once for a flat price, and that the largest disclosed deals are mostly recurring, for sources that keep producing. Wiley's learning-content AI licenses are fixed-price deals too. On the two retrieval platforms above, pay follows use. Sphere prices by query, token or request, and TollBit describes usage-based pricing, so the income tracks how often AI systems access your content and ends when that stops. Think of training as letting a chef memorize your recipe binder for an agreed fee, and retrieval as charging every time they open it. Neither platform publishes a rate card, so no public number tells you which pays more for your material. ## What survives when a training or retrieval license ends? A trained model usually survives. Troveo's guide calls it the clause almost every buyer insists on, because, in its words, "nothing can be untrained." A retrieval license ends with access, and Sphere says licensed content is never fully exported. Whether the buyer must delete your files at expiry is a separate, negotiated term. For retrieval, write deletion of any copies or search indexes into the contract anyway. Figure: comparison of What the buyer keeps after the license ends: Training (emphasized: Plan for the model to stay, The model usually keeps what it learned), Retrieval (Lookups stop with access). Price a training license as permanent use. Model deletion has happened, through a regulator. The FTC's final order against Everalbum, a photo-app company, required it to delete the models and algorithms it built from users' photos and videos ([FTC, 7 May 2021](https://www.ftc.gov/news-events/news/press-releases/2021/05/ftc-finalizes-settlement-photo-app-developer-related-misuse-facial-recognition-technology)). That followed FTC allegations that it deceived users, not a license expiring. [Can you delete your data after training](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it) covers what regulators and contracts can and can't reach. ## Does your company's name show up? In the Wiley release and on Sphere, the source travels with the content. The Wiley release says its content will be cited in OpenEvidence's answers the way the platform already cites its sources, and Sphere attaches source metadata to every result. For training, Troveo's guide names output restrictions, which limit a model reproducing licensed material word for word, and lists no attribution term. For company records, staying unnamed is usually the point. [Troveo's business data page](https://www.troveo.ai/business-data) says companies are never named publicly, and [Handshake AI's company-data program](https://joinhandshake.com/ai/data-partnerships/) says partner companies are never identified. ## Which one fits company records? The retrieval platforms above serve publishers, and the [buyer profiles](/buyers) for [TollBit](/buyers/tollbit) and [Dappier](/buyers/dappier) say the same. Internal records such as Slack, email and tickets reach buyers through programs that describe training. If you publish a help center, product documentation or a research library, retrieval is worth asking about. Whichever you are offered, put these to the buyer in writing: 1. Which uses does the license name: training, fine-tuning, evaluation, retrieval or a mix? 2. Does the trained model survive the term? Assume it does unless the contract says otherwise. 3. Must the buyer delete your files, copies and search indexes at the end, and confirm it in writing? 4. Is the fee fixed or tied to use, and who reports the usage? 5. Will your company be named, cited or kept anonymous? Exclusivity is its own question, covered in [what an exclusivity term means](/answers/what-is-an-exclusivity-term-in-a-data-license). The promises a buyer will ask of you are in [what reps and warranties a buyer asks for](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for), and the full contract walk-through is the [data licensing agreement guide](/guides/data-licensing-agreement). The free [rights check](/rights-check) walks through seven rights questions to take to your lawyer. Optional, paid [managed readiness](/managed-readiness) builds the systems inventory, questions for your counsel and buyer shortlist from descriptions and counts, quoted in writing first. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's guide to licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) - [OpenAI's Data Partnerships page](https://openai.com/index/data-partnerships/) - [Wiley's annual report for the year to 30 Apr 2026](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm) - [micro1's Enterprise Data Partnership page](https://www.micro1.ai/data-partnerships) - [Wiley's 3 Mar 2026 release](https://newsroom.wiley.com/press-releases/press-release-details/2026/Wiley-and-OpenEvidence-Partner-to-Deliver-Trusted-Research-to-Physicians-at-the-Point-of-Care/default.aspx) - [Sphere's FAQ](https://www.getsphere.ai/buy-data) - [TollBit](https://tollbit.com/) - [Google's 22 Feb 2024 post on its Reddit partnership](https://blog.google/company-news/inside-google/company-announcements/expanded-reddit-partnership/) - [FTC, 7 May 2021](https://www.ftc.gov/news-events/news/press-releases/2021/05/ftc-finalizes-settlement-photo-app-developer-related-misuse-facial-recognition-technology) - [Troveo's business data page](https://www.troveo.ai/business-data) - [Handshake AI's company-data program](https://joinhandshake.com/ai/data-partnerships/) --- # What do publishers earn from AI licensing? > What publishers earn from AI licensing, from SEC filings: Wiley reported $49.1M in its year to April 2026. What the numbers tell a private company. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-do-publishers-earn-from-ai-licensing Published: 2026-10-10 Updated: 2026-10-13 ## The short answer Wiley, the journal and textbook publisher, reported $49.1 million of AI license revenue for its year to 30 April 2026, about 3% of its revenue. Reddit disclosed $203 million of data licensing contracts running two to three years. Those are their own results and predict nothing for your company. Public companies file their numbers with the SEC, so their filings are one of the few places AI licensing money shows up in writing. I read Wiley's 2025 and 2026 annual reports, its quarterly report for the three months to July 2026 and Reddit's IPO prospectus. **$49.1M** Wiley's AI license revenue, year to 30 April 2026 ([source](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm)) ## What has Wiley reported? | Period | AI license revenue | Filing | |---|---|---| | Year to 30 Apr 2024 | $23M | [Wiley 10-K filed 25 Jun 2025](https://www.sec.gov/Archives/edgar/data/107140/000010714025000081/jwa-20250430.htm) (prior-year figure) | | Year to 30 Apr 2025 | $40M | [Wiley 10-K filed 25 Jun 2025](https://www.sec.gov/Archives/edgar/data/107140/000010714025000081/jwa-20250430.htm) | | Year to 30 Apr 2026 | $49.1M | [Wiley 10-K filed 24 Jun 2026](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm) | | Quarter to 31 Jul 2026 | $13.7M, against $28.9M a year earlier | [Wiley 10-Q filed 4 Sep 2026](https://www.sec.gov/Archives/edgar/data/107140/000162828026060632/jwa-20260731.htm) | Wiley's total revenue for the year to April 2026 was about $1.68 billion, so AI licensing was close to 3% of it. The 10-K describes the uses as training large language models, point-of-care medical tools and corporate inference models for R&D. ## Why does the number swing so much? Wiley licenses content for AI generally at a fixed price and books it at a point in time, or partly over time, so a big deal can land in one quarter and not the next. Its 2025 annual report was narrower: most of that revenue was recognized on acceptance. The segment lines show it. In the year to April 2026, Research AI revenue rose to $33.1M from about $11M. Learning AI revenue fell to $16.0M from about $29M. In the quarter to July 2026, Learning booked no AI license revenue at all, against $13.1M a year earlier. Figure: scale, Wiley's AI license revenue, same quarter a year apart: Quarter to 31 Jul 2025 $28.9M, Quarter to 31 Jul 2026 $13.7M (emphasized). Wiley's filing says AI license revenue can swing with the timing and type of content licensed. Source: Wiley 10-Q, filed 4 Sep 2026. ## What does the $19.4 million tell you? Of Wiley's $49.1M, $19.4M came from content it licensed in from other publishers and paid royalties on. So some rights holders reach AI buyers through a bigger party that bundles their content. Content Wiley publishes brought in the other $29.7M. The 10-K says Wiley's royalty costs rose too, including higher royalties on AI revenue from the licensed-in content. ## What did Reddit file? Reddit's IPO registration statement ([Reddit S-1 filed 22 Feb 2024](https://www.sec.gov/Archives/edgar/data/1713445/000162828024006294/reddits-1q423.htm)) says it signed data licensing arrangements in January 2024 with an aggregate contract value of $203.0M. The terms run two to three years, and Reddit expected at least $66.4M of it as 2024 revenue. That is multi-year contract value. Divide it by the years before you compare it with an annual figure, and note the filing names no counterparty. ## What do these filings mean for a private company? Two things carry over: - **Rights come first.** Wiley licenses books and journals it publishes or has licensed in from other publishers. Your records need the same answer about where the rights come from before any price talk, and the [rights check](/rights-check) starts it. - **Fees are lumpy.** A fixed fee booked at one point in time lands in one period. Don't annualize it in a forecast or a valuation. [How to record data licensing revenue](/answers/how-to-record-data-licensing-revenue) covers the booking side, and [what an acceptance period is](/answers/what-is-an-acceptance-period-in-a-data-deal) covers the test that triggers payment. ## What can't they tell you? The filings give no price per article, token or record. The revenue lines I read name no buyer and print no terms. Nothing in them converts to a value for an email archive, a ticket history or a CRM export. A content catalog and a company's internal records are different products. For prices attached to company records, see the [deals tracker](/deals) and the [dated roundup of AI data licensing deals](/answers/ai-data-licensing-deals). These figures are what public companies reported about their own businesses. They say nothing about what your company would receive. How you'd book a licensing fee is a question for your accountant. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Wiley 10-K filed 25 Jun 2025](https://www.sec.gov/Archives/edgar/data/107140/000010714025000081/jwa-20250430.htm) - [Wiley 10-K filed 24 Jun 2026](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm) - [Wiley 10-Q filed 4 Sep 2026](https://www.sec.gov/Archives/edgar/data/107140/000162828026060632/jwa-20260731.htm) - [Reddit S-1 filed 22 Feb 2024](https://www.sec.gov/Archives/edgar/data/1713445/000162828024006294/reddits-1q423.htm) --- # Re identification risk emails carry with pseudonyms > Re identification risk emails carry: consistent pseudonyms keep links across messages. What Troveo, the ICO and the Spirit union say, and what to ask a buyer. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/re-identification-risk-emails Published: 2026-10-07 Updated: 2026-10-14 ## The short answer Emails carry re-identification risk because consistent pseudonyms keep one person's messages linked across your archive. Troveo shows labels like PERSON-014. Someone with clues like job titles or rare incidents could rebuild identities. A lawyer should review your archive. Names are the easy part of an email. The links between messages are the harder part, and buyers want to keep them. ## Why do consistent pseudonyms keep links? A pseudonym that changes from one message to the next would break the thread. So the swap is consistent, and the same label keeps one person's work connected across records. [Troveo's business data page](https://www.troveo.ai/business-data) shows a before and after in which PERSON-014 and EMAIL-019 stand in for a customer and an address. David Revland, who works on human data at micro1, said in an undated recorded forum talk that micro1 swaps a name for a consistent stand-in across tools, so the cross-tool trail survives. ## What do emails add that other records do not? An email thread carries a sender, recipients, replies and dates. [Troveo](/buyers/troveo) describes what a buyer receives from email as threads with senders, recipients and linked responses. Those fields are the links. My reading is that the same fields can point back to a person when a job title, a rare incident or a signature block stays in the text. The [UK ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) makes the same point about context: people can stay indirectly identifiable through additional information or other techniques, even when no key is held. ## What did the Spirit union object to? [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) reported that the flight attendants' [union objected](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) because the dataset keeps referential integrity, so even anonymized information about members could be reconstructed. The court's privacy ombudsman [wrote](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) on 5 Oct 2026 that she did not examine risks to employees or third parties. My [Spirit Airlines page](/answers/spirit-airlines-data-sale) has the timeline, and the [de-identification page](/answers/data-de-identification) compares the legal tests. ## What do the legal tests say about pseudonyms? The [UK Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) says pseudonymised data stays personal data for anyone who holds the additional information. The [Justice Department's bulk-data rule](https://www.law.cornell.edu/cfr/text/28/202.206) counts data whether or not it is pseudonymized, as the [DOJ rule page](/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data) explains. Recent studies on whether language models can match accounts and find missed identifiers are on my [re-identification study page](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages). ## What should an owner ask the buyer? 1. Who holds the key that maps labels back to names? 2. Do links between messages and across tools survive, and why? 3. Does anyone test for re-identification after the swap? 4. Are employees in the archive, and what did they agree to? My [rights check](/rights-check) lists what to settle with counsel, and the [risk map](/risks) lists what published buyer terms say. Talk to a privacy or commercial lawyer in your state before you sign. Figure: steps Name swapped for a label -> Same label, thread order intact -> Context can point to a person. A consistent label keeps the links between emails, and links plus context are where re-identification starts. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's business data page](https://www.troveo.ai/business-data) - [UK ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [union objected](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) - [wrote](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Justice Department's bulk-data rule](https://www.law.cornell.edu/cfr/text/28/202.206) --- # Spirit Airlines data union objection: what it asked > The Spirit Airlines data union objection (Doc 1489, 18 Aug 2026) asks to exclude flight attendant records from Google's pending $10M winning bid. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/spirit-airlines-data-union-objection Published: 2026-10-07 Updated: 2026-10-14 ## The short answer The Spirit Airlines data union objection (Doc 1489, filed 18 Aug 2026) asks the court to exclude flight attendant data from Google's $10M winning bid or add protections like a ban on profiling attendants. The ombudsman recommended approval on 5 Oct 2026 but did not investigate employee risks. The union's filing is nine pages and readable. This page sums up what it says, what the ombudsman answered, and what is still open. ## What does the union say is wrong with the sale? Its core point is that de-identification and confidentiality are different things. Removing names tells you whether a record can be traced to a person. It says nothing about whether the contents are confidential. The union lists these as sensitive, with or without a name attached ([Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf), paragraph 2): - disciplinary letters - crew training gaps - leave and accommodation requests - staffing grievances - payroll adjustments ## What is in the sale that worries it? The assets schedule includes: - 100 million emails across 80,000 accounts - about 17.1 million OneDrive items - 20.6 million SharePoint items - 500 million Teams items - 175,658 employee records back to August 1986 - 3,426,618 payroll records from June 2016 The union says nearly every consumer-facing category is marked "Not Included." Nearly every employee category is marked "Included." Its words: the privacy design is consumer-facing and the payload is employee-facing. ## Which contract terms does it point to? Two. First, the sale agreement requires de-identification "while preserving referential integrity across the data set." So the links between payroll, timekeeping, training and messages are kept on purpose (section 3(c)). Second, the debtors promise that no part of the assets has been deleted, changed or removed, except for de-identification and a few exceptions (section 3(e)). The union says this would block a court-ordered carve-out. It notes the crew base is 4,600 people. It also notes that the buyer's promise covers only intentional re-association. ## What does it ask the court to do? First choice: leave all flight attendant information out of the sale. Alternative: approve the sale only with protections (Doc 1489, paragraphs 17 and 18). Those protections are: - a review protocol for confidential employee and labor content - steps suited to free-form messages - a ban on profiling or scoring identifiable flight attendants - written, enforceable limits on onward transfer, with notice to the union The union says none of this needs a price change or a new auction. ## What did the ombudsman say? The consumer privacy ombudsman's supplemental report of 5 Oct 2026 says three things. Passenger databases were taken out of the sale. Tonic.ai will de-identify unstructured data such as email. The agent will file a certification before every transfer. She recommends approval from a privacy view ([Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). Footnote 3 says she did not look into risks to affected employees or third parties, and reached no conclusion on them. Footnote 4 says technology has "far outpaced the law" on re-identification. She also asks for more research if the court picks the bid from Mercor or [micro1](/buyers/micro1). She notes that micro1 proposed to de-identify the data itself. ## Why does it matter if you hold a company archive? The filing shows where an objection comes from when employee records sit in the archive. Our pages on [HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai) and [licensing employee emails](/answers/can-i-sell-employee-emails-to-ai) cover what your staff may object to. The [sale overview](/answers/spirit-airlines-data-sale) tracks prices and bids. [What de-identification means](/answers/data-de-identification) explains the three-part test. The [risk map](/risks) lists the other risks. Talk to a privacy or commercial lawyer in your state before you sign. ## What is still open? The court has not approved the sale. The debtors say they are working to settle objections by agreement. The reply deadline was 9 Oct 2026. The debtors' notice ([Doc 1663](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1663.0.pdf)) first set the hearing for 14 Oct 2026, and it was later moved to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). Judge Sean H. Lane presides. No sale order as of 10 Oct 2026. Other parties filed objections too, and this page covers only the union's. Check the docket before you quote any of this. Figure: steps Auction, union objects 18 Aug -> Ombudsman reports 5 Oct -> Hearing 6 Nov. The union objected after the auction, the ombudsman reported next and the court now hears the sale on 6 November. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) - [Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Doc 1663](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1663.0.pdf) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) --- # License construction company data to AI: the records > Hoping to sell construction company data to AI? Licensing is the route. One buyer lists a general contractor license, and OSHA and copyright rules apply. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-construction-company-data-to-ai Published: 2026-10-06 Updated: 2026-10-16 ## The short answer Polyshares lists a $300,000 perpetual exclusive license to an unnamed general contractor's operational record, undated and self-reported. Before you license yours, sort records by who holds the rights. OSHA rule 1904.29 keeps names off privacy cases in injury logs. Copyright gives drawings to their author first. This page reports what the texts and buyer pages say. It is not legal advice. ## Does any buyer list construction? Yes. [Polyshares](/buyers/polyshares)' [case studies page](https://polyshares.com/track-record) lists a general contractor under construction at $300,000. It describes the deal as a perpetual exclusive license to the operational record, anonymized before delivery. The same page lists a roofing company at $450,000 under home services, covered on the [home service page](/answers/sell-home-service-company-data-to-ai). Company names stay confidential and the page carries no dates. Every figure is Polyshares' own, and no outside report confirms it. Both rows sit in the [deals tracker](/deals). Polyshares' [homepage](https://polyshares.com/) names construction among the sectors that qualify, and its [intake](https://polyshares.com/intake) lists Procore and Buildertrend among field operations tools. [Mercor's data page](https://www.mercor.com/data/) and [micro1's page](https://www.micro1.ai/data-partnerships) do not name construction. The [industry page](/answers/does-industry-matter-for-selling-company-data) puts the lists side by side. ## Which field records should a contractor list? Start with the project record: RFIs, submittals, change orders, daily logs and schedules, and the system each one sits in. The case studies don't say which records the general contractor's license covered, so ask any buyer what its scope takes in. Polyshares' homepage says its license does not cover "what you hold on behalf of your own clients." For a contractor, that question reaches the project owner's documents and the design team's drawings. ## What do injury logs show? Under [29 CFR 1904.29](https://www.law.cornell.edu/cfr/text/29/1904.29)(b)(6) to (9), an employer may not enter the employee's name on the OSHA 300 Log for a privacy concern case. It enters "privacy case" in its place and keeps a separate confidential list that matches case numbers to names. The listed cases cover injuries to intimate body parts or the reproductive system, sexual assault, mental illness, HIV, hepatitis or tuberculosis, and needlestick or sharps injuries contaminated with another person's blood. They also cover other illnesses when the employee asks to be left off the log. A safety archive can hold that confidential list, the incident narratives and the photos as well. ## Who owns drawings and specifications? Copyright vests initially in the author ([17 U.S.C. 201](https://www.law.cornell.edu/uscode/text/17/201)). In a work made for hire, the employer or the person the work was prepared for is treated as the author. A transfer of ownership is not valid unless it is in writing and signed by the owner ([17 U.S.C. 204(a)](https://www.law.cornell.edu/uscode/text/17/204)). AIA's standard owner-architect form treats the architect as owner of the drawings and gives the project owner a license for the project, as the [architecture page](/answers/sell-architecture-firm-data-to-ai) explains. Drawings a contractor received from the design team came under those agreements, so list them apart from the records your own staff wrote. ## What can a contractor gather first? List the projects, the clients and public bodies on them, the agreements that cover project files and the systems that hold field communication. The [rights check](/rights-check) asks the contract and personal-data questions and lists what to settle with counsel. The [engineering page](/answers/sell-engineering-firm-data-to-ai) covers the design side. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two construction records and where the rights come from: Injury log (Privacy cases leave names off), Drawings (emphasized: Transfer needs a signed writing, Author owns first). 17 U.S.C. 204(a) says a copyright transfer is not valid without a signed writing. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [case studies page](https://polyshares.com/track-record) - [homepage](https://polyshares.com/) - [intake](https://polyshares.com/intake) - [Mercor's data page](https://www.mercor.com/data/) - [micro1's page](https://www.micro1.ai/data-partnerships) - [29 CFR 1904.29](https://www.law.cornell.edu/cfr/text/29/1904.29) - [17 U.S.C. 201](https://www.law.cornell.edu/uscode/text/17/201) - [17 U.S.C. 204(a)](https://www.law.cornell.edu/uscode/text/17/204) --- # License Microsoft Teams data to AI: exports and limits > Googled how to sell Microsoft Teams data to AI? You'd license it. Spirit's archive held about 500 million Teams messages. What the export APIs return. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-microsoft-teams-data-to-ai Published: 2026-10-06 Updated: 2026-10-14 ## The short answer You export Microsoft Teams chats and channel messages through export APIs. The largest example is Spirit Airlines, which held 500 million Teams messages. Google's $10M winning bid for Spirit Airlines' archive is pending court approval. Microsoft's API terms bar reselling. Teams is the second workplace tool in the biggest public data deal so far. Companies on Microsoft 365 hold their chat there. ## Has anyone bought Teams data? The Spirit Airlines archive covers about 100 million emails and 500 million Teams messages ([The Next Web](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google)). [Google won the auction at $10 million](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/), and [the court's privacy ombudsman](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) said on 5 Oct 2026 that approval would be appropriate from a privacy perspective. The hearing was moved from 14 Oct to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. The full timeline is on our [Spirit Airlines page](/answers/spirit-airlines-data-sale). Bloomberg reported that SpaceX held informal talks about buying customer and operational records from troubled or defunct startups. ## What can a Teams export return? For a Teams export, [Microsoft's documentation](https://learn.microsoft.com/en-us/microsoftteams/export-teams-content) lists one-to-one chats, group chats, meeting chats and channel messages, including shared channel messages. Deleted messages stay reachable for 21 days, and deleted teams for 30 days. Meeting transcripts and recordings come back for private scheduled meetings, with the organizer as the lookup key. Microsoft's averages are about 300 KB per transcript and about 350 MB per recording for a 30 to 60 minute meeting. ## What does an admin need? An app calls the export APIs with admin-approved application permissions, such as Chat.Read.All and ChannelMessage.Read.All. The users whose data is exported need an active Teams license. ## What do Microsoft's API terms say? The [Microsoft APIs terms of use](https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use) bar an app from building databases or creating copies of API data beyond what its intended use needs. They also bar redistributing or reselling that data. I found no sentence about AI training in that text. An app a buyer connects through Graph is the kind of app those terms describe. That's my reading. Shared channels bring in other organizations' messages, so [rights come first](/rights-check) and the [risk map](/risks) lists the contract limits. Talk to a privacy or commercial lawyer in your state before you sign. Figure: scale, File size per meeting in a Teams export: Transcript About 300 KB, Recording About 350 MB (emphasized). A meeting recording runs over a thousand times the size of its transcript. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [The Next Web](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google) - [Google won the auction at $10 million](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [the court's privacy ombudsman](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) - [Microsoft's documentation](https://learn.microsoft.com/en-us/microsoftteams/export-teams-content) - [Microsoft APIs terms of use](https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use) --- # Selling customer data in bankruptcy: the rules > Selling customer data in bankruptcy: 11 U.S.C. 363(b)(1) lets a debtor sell it if it fits its privacy policy, or after an ombudsman reports. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/selling-customer-data-in-bankruptcy Published: 2026-10-06 Updated: 2026-10-14 ## The short answer Selling customer data in bankruptcy is allowed under 11 U.S.C. 363(b)(1) if the sale fits the debtor's privacy policy or a court-appointed consumer privacy ombudsman reviews it. The ombudsman advises the court but has no veto. Courts add conditions, such as Toysmart limiting sales to the whole business. The statute covers consumer information. Anything else a bankrupt company holds falls outside its text. ## What does Bankruptcy Code section 363(b)(1) require? [Section 363(b)(1)](https://www.law.cornell.edu/uscode/text/11/363) applies when the debtor's privacy policy bars transferring personally identifiable information to people who are not affiliates. That policy must have been in force when the case began. The trustee may then sell only if the sale is consistent with that policy. Otherwise the court must take three steps: - appoint an ombudsman under [section 332](https://www.law.cornell.edu/uscode/text/11/332) - hold a notice and a hearing - find that "no showing was made" that the sale would violate applicable nonbankruptcy law ## What counts as personally identifiable information there? [Section 101(41A)](https://www.law.cornell.edu/uscode/text/11/101) covers information an individual gave the debtor "in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes." The examples are a name, a home address, an email address, a phone number, a Social Security number and a credit card number. Employee records and business-to-business contacts don't clearly fit that definition. That's my reading, not a court ruling. The [ombudsman page](/answers/what-is-a-consumer-privacy-ombudsman) explains the role. ## What conditions have courts and regulators attached? - **Toysmart ([FTC](https://www.ftc.gov/news-events/news/press-releases/2000/07/ftc-announces-settlement-bankrupt-website-toysmartcom-regarding-alleged-privacy-policy-violations), 21 Jul 2000).** The settlement allowed a sale of the customer list only to a qualified buyer in a related market. That buyer had to agree to follow the privacy statement. The list could not be sold alone. The company had to delete it if no buyer appeared within a year. - **23andMe ([Missouri Attorney General](https://ago.mo.gov/attorney-general-bailey-secures-privacy-protections-in-sale-of-23andme-to-nonprofit-entity/)).** A $305M sale to TTAM Research Institute was approved on 27 Jun 2025. After that, the release listed a deletion right for consumers and limits on resale. It also banned sharing data with foreign adversaries. - **Spirit Airlines (2026).** The ombudsman's [report of 5 Oct 2026](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) recommends approval from a privacy view. The union that [objected](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) says it does not contend that section 363(b)(1) is triggered. The [Spirit objection page](/answers/spirit-airlines-data-union-objection) has the details. The [sale overview](/answers/spirit-airlines-data-sale) tracks the hearing. ## What changes outside bankruptcy? A company that closes without a bankruptcy case has no ombudsman. That includes an [assignment for the benefit of creditors](/answers/assignment-for-the-benefit-of-creditors), the state-law way to wind down an insolvent company. See [shutting down and licensing Slack](/answers/can-a-shutting-down-company-sell-its-slack-to-ai). Customer data also raises consent questions in any sale. The [consent page](/answers/do-i-need-consent-to-sell-customer-data-for-ai-training) covers them. Talk to a bankruptcy lawyer and a privacy lawyer in your state before you sign anything tied to an insolvent company. Our [risk map](/risks) and [rights check](/rights-check) list the facts counsel will ask for. Figure: comparison of Three bankruptcy cases of customer data and what each limited: Toysmart (Whole business only), 23andMe (Deletion right), Spirit Airlines (emphasized: Pending, hearing moved to 6 Nov 2026, Passenger data out). Toysmart limited the sale to the whole business, 23andMe added a deletion right, and Spirit left passenger databases out. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Section 363(b)(1)](https://www.law.cornell.edu/uscode/text/11/363) - [section 332](https://www.law.cornell.edu/uscode/text/11/332) - [Section 101(41A)](https://www.law.cornell.edu/uscode/text/11/101) - [FTC](https://www.ftc.gov/news-events/news/press-releases/2000/07/ftc-announces-settlement-bankrupt-website-toysmartcom-regarding-alleged-privacy-policy-violations) - [Missouri Attorney General](https://ago.mo.gov/attorney-general-bailey-secures-privacy-protections-in-sale-of-23andme-to-nonprofit-entity/) - [report of 5 Oct 2026](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [objected](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) --- # What is a consumer privacy ombudsman? > What is a consumer privacy ombudsman? A person the US trustee appoints under 11 U.S.C. 332 to inform the court when a debtor sells consumer personal data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-consumer-privacy-ombudsman Published: 2026-10-06 Updated: 2026-10-14 ## The short answer A consumer privacy ombudsman is a person appointed under 11 U.S.C. 332 when a bankruptcy debtor proposes to sell consumer personal information against its privacy policy. The ombudsman reports to the court on privacy, gains and losses. The court decides whether to approve the sale. This job only exists inside a bankruptcy case. It comes straight from the Bankruptcy Code, so a state-law [assignment for the benefit of creditors](/answers/assignment-for-the-benefit-of-creditors) has no ombudsman. ## When does a court need one? [Section 363(b)(1)](https://www.law.cornell.edu/uscode/text/11/363) says a trustee may sell personally identifiable information only if the sale fits the debtor's own policy. If it doesn't, the court can appoint an ombudsman under [section 332](https://www.law.cornell.edu/uscode/text/11/332). The court holds a notice and hearing. It can then approve the sale anyway. It does so by finding that "no showing was made" the sale would violate applicable nonbankruptcy law. All of this starts only when the debtor's posted policy barred transfer to unaffiliated parties before the case began. ## What does the ombudsman do? Section 332 tells the court to order the US trustee to appoint one disinterested person. That must happen no later than 7 days before the sale hearing. The ombudsman gives the court information. The court decides. ## What counts as personally identifiable information under the Bankruptcy Code? [Section 101(41A)](https://www.law.cornell.edu/uscode/text/11/101) of the Bankruptcy Code covers information an individual gave the debtor to get a product or service "primarily for personal, family, or household purposes." Think name, address, email address, phone number, Social Security number or credit card number. That is a consumer definition. Employee and business records don't clearly fit it. That is my reading and not a court ruling. ## What happened in the Spirit Airlines case? In the Spirit Airlines case, the ombudsman's [supplemental report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) (Doc 1684, 5 Oct 2026) recommends approval of the deidentified-data sale from a privacy view. Footnote 3 says she did not look into risk to affected employees or third parties, and reached no conclusion on it. Footnote 4 says technology "has far outpaced the law" on reidentification. I'd read that one twice. The sale was not approved in the filings I read. If your own records are in play, see [licensing HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai). Talk to a bankruptcy lawyer in your state before you sign anything tied to an insolvent company. For non-bankruptcy shutdowns, read [shutting down and licensing Slack](/answers/can-a-shutting-down-company-sell-its-slack-to-ai). Figure: steps Policy bars transfer -> Trustee appoints ombudsman -> Report, hearing, court finding. The ombudsman informs the court, and the court makes the finding. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Section 363(b)(1)](https://www.law.cornell.edu/uscode/text/11/363) - [section 332](https://www.law.cornell.edu/uscode/text/11/332) - [Section 101(41A)](https://www.law.cornell.edu/uscode/text/11/101) - [supplemental report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) --- # Company data worth per employee: two ways to count > Company data worth per employee: a buyer calculator shows about $3,830 to $8,970 per head at 100 staff. Why a bid for an archive doesn't divide by headcount. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/company-data-worth-per-employee Published: 2026-10-05 Updated: 2026-10-14 ## The short answer Few public figures work per head. Handshake AI's calculator shows about $3,830 to $8,970 per head at 100 staff, a self-reported estimate and not an offer. Spirit Airlines' $10M is a pending bid for one archive, so I don't divide it by headcount. Value follows the records and the rights. Divide a price by headcount and the answer depends on what the price was for. Only one public source states a figure you can read per head. ## Which per-employee figure is public? | Source | Inputs | Figure shown | Per head, my arithmetic | |---|---|---|---| | Handshake AI calculator | 100 staff, 10 years, USA | $383,083 to $896,969 | $3,831 to $8,970 | The [Handshake AI](/buyers/handshake-ai) row comes from the estimator on its [data partnerships page](https://joinhandshake.com/ai/data-partnerships/). Handshake labels it indicative, so read it as a buyer's marketing estimate. ## Why not divide the Spirit bid by headcount? The bid was for an archive of records, and a headcount measures something else. Google's $10M bid was for Spirit Airlines' archive, and Time reports about 100 million emails, 500 million Teams messages and 30 million lines of code ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). Mercor's alternate bid and micro1's later offer were for that same archive, so they are one case, too few to fit a curve. It is also still a bid. The hearing was moved from 14 Oct to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. The [Spirit Airlines page](/answers/spirit-airlines-data-sale) tracks it. ## What does Troveo's guide say drives value? Troveo's guide names uniqueness, history, connected context, visible outcomes, rights cleanliness and buyer demand. It adds that a 40-person firm with a decade of specialized records can hold more training value than a 4,000-person company with generic data. The guide gives no per-head price. ## What can you do with a per-head figure? I'd use it to question a quote. If a buyer's number sits at $10,000 a head, ask what records, years and rights it is built from. A per-head number only means something once you know what it counts. Then look at your own records. The guide to [how much company data is worth](/guides/how-much-is-your-business-data-worth-to-ai) has a ten-minute check, [data valuation for AI](/answers/data-valuation-for-ai) compares what each calculator asks, and the [price calculator page](/answers/company-data-price-calculator) lists their outputs. Run the [rights check](/rights-check) before any number matters, and talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) --- # micro1 PII transformation: what its page and forum talk say > micro1 PII transformation: its page says PII is removed when relevant, and micro1's David Revland described swapping names for stand-ins. Self-reported. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-pii-transformation Published: 2026-10-05 Updated: 2026-10-14 ## The short answer micro1's data partnerships page says personal information "is removed when relevant." micro1's David Revland said in an undated talk that each name gets one stand-in across tools. Ask which your contract means. [micro1](/buyers/micro1)'s [data partnerships page](https://www.micro1.ai/data-partnerships) says personally identifiable information "is removed when relevant," and that companies can review representative samples before use. Its CFO said in an undated recorded forum talk that the value of company data in the [micro1 data partnership](/guides/micro1-data-partnership) sits in the workflow. David Revland, who works on human data at micro1, said a workflow needs consistent people in it. ## What is the difference between transformation and redaction? Redaction blanks a name. Transformation replaces it with a stand-in and keeps the replacement the same everywhere. Revland's example of a consistent stand-in in Slack and Google Workspace keeps the role and the cross-tool trail. ## Why can a company not scrub first? micro1 staff said in an undated recorded forum talk that micro1 must transform the data itself, because blanking names first would destroy the trail it needs. micro1's CFO said in the same talk that every corpus goes through a scrubbing step, sampled at several points before use. ## Do micro1's descriptions match? They describe the same step in different words, and all three are micro1 (self-reported). | Source | What it says | |---|---| | [micro1 data partnerships page](https://www.micro1.ai/data-partnerships) | "Personally identifiable information (PII) is removed when relevant." | | Revland (micro1), undated recorded forum talk | A consistent stand-in replaces each name across tools, in place of redaction. | | A micro1 referral partner, micro1 video (about 13:27) | Anonymization of the whole data set, "state-of-the-art," removing personal information, phone numbers, emails and names. | Removal and a swap leave different data behind. Ask which one the contract says, and who holds any name mapping. ## Is a name swapped by PII transformation still personal data under UK law? Possibly. The UK Information Commissioner's Office says pseudonymised data is personal data in the hands of someone who holds the additional information ([ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/)). That is UK guidance, and your state's law may differ. In the Spirit Airlines sale, a union objected to "referential integrity" for the same reason, since links between records can let someone rebuild who is who ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). ## Who does the transforming? In the Spirit case, the court's ombudsman noted on 5 Oct 2026 that micro1 proposed to de-identify the data itself and not use an independent party ([Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). That is the same question you can ask micro1 about your corpus. See the [Spirit page](/answers/micro1-spirit-airlines). ## What should you ask micro1? - Who holds the mapping between real and stand-in names, and for how long? - Who checks the samples, and at which points? - What happens to the mapping when the engagement ends? The [re-identification page](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages) and the [de-identification page](/answers/data-de-identification) explain the limits. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two ways to treat a name before a transfer: Redaction (Trail breaks), Transformation (emphasized: What Revland (micro1) described, Trail survives). Revland (micro1) said a consistent stand-in keeps the trail across tools. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [ICO guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # What is the Spirit Airlines data sale? > Spirit Airlines data sale: Google's $10M winning bid awaits court approval, with the hearing reported moved to 6 Nov 2026. The bids and objections. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/spirit-airlines-data-sale Published: 2026-10-05 Updated: 2026-10-14 ## The short answer The Spirit Airlines data sale is a bankruptcy auction Google won with a $10 million bid for about 100 million emails, 500 million Teams messages and 30 million lines of code. It still needs court approval. The hearing moved from 14 Oct to 6 Nov 2026. ## What happened, in order? Spirit Aviation Holdings filed for chapter 11 in the Southern District of New York on 29 Aug 2025 (No. 25-11897). Its business data went to auction in mid-August 2026. The [ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) puts the close on 13 Aug 2026, while the debtors' notice ([Doc 1663](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1663.0.pdf)) and the flight attendants' objection ([Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)) date it 14 Aug 2026. Google was the successful bidder at $10 million. Mercor.io bid $7.5 million ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)) and was named the alternate bidder ([ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). On 3 Sep 2026 micro1 filed notice that it would submit a competing bid. [Fortune reported](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) the figure as $12.5 million. The hearing has moved several times since August. ## Why did AI labs want it? Real corporate records show how people do their jobs. One expert quoted by Time said the purchase matters if you believe agents will generalize across the economy. [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) describes the prize as trajectories, meaning a record of steps that shows how to choose actions, use tools and recover from mistakes. Our page on [RL environments](/answers/what-is-an-rl-environment) explains where those records get used. ## What is the privacy objection? A flight attendants' union filed an objection about "referential integrity" ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). The worry is that links kept between data sets could let someone rebuild who is who after names are removed. The Electronic Privacy Information Center (EPIC) filed an amicus brief on 2 Oct 2026 challenging the sale of employee data. The ombudsman is a court appointee under 11 U.S.C. 332. Her [5 Oct 2026 supplement](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) says passenger databases came out of the sale and Tonic.ai will de-identify unstructured data such as email. It also says she did not investigate risk to employees or third parties. ## Is the sale final? No. Google won the auction, and its $10 million winning bid still needs the bankruptcy court's approval. I found no sale order as of 10 Oct 2026. The approval hearing was moved from 14 Oct to 6 Nov 2026, [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) reported on 9 Oct 2026. The earlier date came from the debtors' notice of 28 Sep 2026 ([Doc 1663](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1663.0.pdf)). Travel Weekly reports that the move followed an 8 Oct letter from 121 members of Congress. The debtors' 9 Oct adjournment notice was not yet on the public docket mirror when I checked, so the new date rests on that press report. In the 28 Sep notice the debtors said they were working to resolve objections. Check the docket before you quote any of this. ## What does it mean if you hold company data? It's one data point from a bankruptcy sale, and a working company licenses under different terms. It's also one of the few prices in this market with a docket number attached. Our [deals tracker](/deals) logs public prices as they appear. The case shows where objections come from. Employees, customers and vendors can all claim a stake in an email archive, so [rights come first](/rights-check) and the [risk map](/risks) lists the pressure points. The [pillar guide](/guides/how-to-sell-company-data-to-ai-companies) walks through the full process. Talk to a privacy or commercial lawyer in your state before you sign anything. Figure: scale, Bids and offers for Spirit Airlines' data: Mercor's bid $7.5M, Google's winning bid $10M, micro1's later offer $12.5M (emphasized). micro1's later offer topped Google's winning bid. Source: Time, Fortune, and court filing Doc 1684. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Doc 1663](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1663.0.pdf) - [Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Fortune reported](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) --- # micro1 Spirit Airlines: the $12.5M offer explained > micro1 Spirit Airlines: micro1 filed to outbid Google's $10M for the airline's data archive and reportedly offered $12.5M. Dated facts, deal still open. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-spirit-airlines Published: 2026-10-04 Updated: 2026-10-14 ## The short answer micro1 Spirit Airlines offer was $12.5 million to Google's $10 million in a bankruptcy auction. micro1 filed to bid in September 2026, but no deal is approved. The court's ombudsman asked to research whether micro1 should de-identify the data itself instead of using an independent party. This page covers [micro1](/buyers/micro1)'s slice of the case. The [Spirit Airlines data sale page](/answers/spirit-airlines-data-sale) has the whole timeline. ## What did micro1 offer? Spirit Aviation Holdings filed for chapter 11 in the Southern District of New York on 29 Aug 2025. The [ombudsman's filing](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) records that micro1 filed a notice of intent to submit a competing and superior bid on 3 Sep 2026 (Doc. 1556). [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) put the figure at $12.5 million against Google's $10 million. ## What is a trajectory, and why did labs pay? Fortune explains that an AI agent has to learn how to choose actions, use tools and respond to intermediate results. The record of those steps is a trajectory, and a finished document can't give you one. Spirit's archive holds about 100 million emails, 500 million Microsoft Teams messages and around 30 million lines of code ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). My [RL environment page](/answers/what-is-an-rl-environment) shows where records like that get used. ## What did the ombudsman say about micro1? The Spirit Airlines ombudsman is a court appointee. She wrote that the debtors built the auction process around an independent expert doing the de-identification, and micro1 proposed to do it itself. If the court considers micro1 as the successful bidder, she asked for the chance to research its proposal and whether micro1 is qualified to take the archive ([Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). ## Is the sale final? No. Fortune reported that no sale had court approval, and I found no sale order. Check the docket before you quote any of this. ## What does it mean for a company talking to micro1? It is one filing about one bankruptcy, and a working company licenses under different terms, described in [how micro1's data partnership works](/guides/micro1-data-partnership). Still, it shows the question a court asked, which is who de-identifies the data. Ask micro1 the same question about yours, and read [how micro1 handles names](/answers/micro1-pii-transformation). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Mid-Aug auction, Google top bidder -> micro1 files notice 3 Sep -> Fortune 14 Sep, ombudsman 5 Oct. micro1 entered the Spirit bidding three weeks after the auction closed, and the deal still awaited court approval. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [ombudsman's filing](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [micro1 data partnerships](https://www.micro1.ai/data-partnerships) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Does industry matter for licensing company data? > Searching whether industry matters for selling company data? For licensing, micro1 staff said any industry can apply. Its page lists six areas, with no ranking. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/does-industry-matter-for-selling-company-data Published: 2026-10-02 Updated: 2026-10-16 ## The short answer Partly. micro1 staff said any industry can join, yet micro1's data partnerships page lists six areas. Mercor's page lists eight sectors. Polyshares labels four self-reported deals by sector. We found no source that ranks industries. Industry shows up in the buyers' wording. One buyer labels its published deals by sector, and no buyer ranks industries. > **Labs say they want the chain from a request to a deliverable across tools.** Think of the attic. Buyers care less about which street you live on and more about what is in the boxes. ## What does micro1 say about industry? [micro1](/buyers/micro1)'s [data partnerships page](https://www.micro1.ai/data-partnerships) names six areas: software and engineering, finance and accounting, customer support, sales and CRM, legal and contracts, and operations and logistics. micro1 staff said in an undated recorded forum talk that any industry can take part (self-reported, recording date not stated). The page says price depends on dataset size and volume, workflow complexity, data quality, domain expertise represented and uniqueness. Domain expertise is a pricing factor. No source says which domains count for more. The [requirements page](/answers/micro1-data-partnership-requirements) puts the talk's and the page's statements side by side. ## Which sectors does a micro1 referral partner name? In a micro1 video, a referral partner said any owner interested in AI can take part in practice. Her own pipeline is mostly tech-enabled B2B services, home services, and lending and finance (about 4:48). She told two stories of unnamed companies, a New York loans company and a Florida pool builder (about 8:44 and 18:18). Both are unverifiable, and neither is evidence of a price. ## What do other buyers list? [Mercor's data page](https://www.mercor.com/data/) names legal, healthcare, finance and insurance, professional services, manufacturing, retail and e-commerce, real estate, and logistics and supply chain. [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) says "every major industry." [Polyshares](/buyers/polyshares)' [homepage](https://polyshares.com/) says any business with real operating history qualifies, in any sector, and names construction among them. Its [case studies](https://polyshares.com/track-record) list four perpetual exclusive licenses by sector: a roofing company at $450,000, a general contractor at $300,000, a solar company at $275,000 and a global marketing agency at $110,000. Companies are unnamed, the page is undated and every figure is Polyshares' own. The [construction](/answers/sell-construction-company-data-to-ai), [home service](/answers/sell-home-service-company-data-to-ai) and [architecture](/answers/sell-architecture-firm-data-to-ai) pages cover the fields nearest those deals. ## Has an unusual industry drawn bids? Yes. Spirit Airlines, an airline, drew bids of $10M from Google, $7.5M from [Mercor](/buyers/mercor) and $12.5M from micro1 ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). The sale is pending and ran through bankruptcy, so it says little about an ordinary operating company. See the [Spirit page](/answers/spirit-airlines-data-sale). _"Any industry" is a welcome mat. Prices live somewhere else._ ## Which work do AI benchmarks miss? Most of it, by Mercor's count. Its [Benchmark Map](https://www.mercor.com/research/labor-index/benchmark-map/) (Oct 2026) checks 29 AI benchmarks against the 923 occupations in the Labor Department's O*NET list. It counts an occupation as covered when one of its tasks matches at least 5 benchmark prompts. Only 208 of the 923 pass that bar, and Mercor estimates 90% of US working hours go to tasks with little or no coverage. The gaps sit in ordinary office work. Mercor counts 21 of 51 office and admin occupations as covered, 19 of 56 in architecture and engineering and 6 of 22 in sales. It calls the long tail of smaller, middle-income knowledge jobs undercovered. A benchmark is a test, not a purchase. The map says where AI is hardest to measure. It names no buyer and no price, and Mercor publishes it as provisional. ## What matters more than industry? Any industry can produce the request-to-deliverable chains labs want. See [what labs want](/answers/what-data-do-ai-labs-want-from-companies). Rights to the records decide whether licensing can happen at all, and the [rights check](/rights-check) covers them. Regulated records such as health or financial client data add separate questions. They are covered on the [regulated data page](/answers/can-i-sell-health-or-financial-client-data-to-ai). Figure: comparison of How three public statements describe the industries they take: micro1 forum talk (emphasized: Broadest statement, Any industry), micro1 page (Six areas listed), Mercor page (Eight sectors listed). micro1 staff said in an undated recorded forum talk that any industry can take part, while its page lists six areas and Mercor's page lists eight sectors. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [Mercor's data page](https://www.mercor.com/data/) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [homepage](https://polyshares.com/) - [case studies](https://polyshares.com/track-record) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Benchmark Map](https://www.mercor.com/research/labor-index/benchmark-map/) --- # How much do AI labs pay for company data? > How much do AI labs pay for company data? No price list exists. Public points run from $10K per startup to a $10M bid for Spirit Airlines' archive. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-much-do-ai-labs-pay-for-company-data Published: 2026-10-02 Updated: 2026-10-14 ## The short answer No public rate card exists. SimpleClosure reported nearly 100 deals at $10K to $100K per startup. Google won Spirit Airlines' archive auction with $10 million, and micro1 later offered $12.5 million. Handshake AI states $100K to $4M+, self-reported. None is a rate for your records. Prices for company data come from bids, press reports and what buyers say about themselves. Here they are by payer, each with its date. ## What did Google bid for Spirit Airlines' data? Google won the Spirit Airlines auction with a $10 million winning bid, pending court approval. [Mercor](/buyers/mercor) bid $7.5 million and was named the alternate bidder ([ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). [micro1](/buyers/micro1) filed notice on 3 Sep 2026 that it would bid, and Fortune reported its figure as $12.5 million ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/), [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). All three figures are offers for the same archive, so read them as one case. None is a completed sale. The court has not approved the sale. The hearing was moved from 14 Oct to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. Our [Spirit Airlines data sale](/answers/spirit-airlines-data-sale) page tracks the status. ## What does SimpleClosure say shut-down startups get for their data? Forbes reported, as [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) relayed, that SimpleClosure had run nearly 100 deals in a year at $10,000 to $100,000 per company. Mercor reportedly approached shuttered startups with offers of up to $300,000, according to a summary of The Information's reporting ([BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). That is a second-hand report of offers, not completed prices. ## What figures do the programs state for working companies? micro1's data partnerships page lists tiers of $100K+, $500K+ and $1M+. Its [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages (self-reported). Its CFO said in an undated recorded forum talk that deals near $2M are real. [Handshake AI](/buyers/handshake-ai) states partnerships from $100K to $4M+, and [Troveo](/buyers/troveo) says labs are paying "six figures" for company data exports (all self-reported). Troveo's own page says no public price list exists. ## What do labs pay for simulated workplaces? Epoch's interviews put website replicas near $20,000 each, a Slack-grade clone near $300,000, and single tasks at $200 to $2,000 ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). Those are prices for software environments that vendors build. Epoch's review describes app replicas and lab partnerships with product companies and does not discuss real company archives, so treat them as adjacent. See [what an RL environment is](/answers/what-is-an-rl-environment). ## What should you do with these numbers? Use them as context for a conversation and not as a quote. The drivers a buyer prices are headcount, years of history, which systems you run and how clean the rights are. Our [pricing models page](/answers/data-monetization-pricing) covers the four ways a deal can pay, and our guide to [how much company data is worth](/guides/how-much-is-your-business-data-worth-to-ai) lists what moves the figure. The [deals tracker](/deals) logs each public price as it changes, and the free [fit check](/business) starts from your headcount and years of records. Talk to a privacy or commercial lawyer in your state before you sign. Figure: scale, Spirit Airlines archive auction, 14 Aug 2026: Mercor, alternate bid $7.5M, Google, winning bid $10M (emphasized). Google outbid Mercor for Spirit Airlines' archive, and the sale still needs court approval. Source: Time, from the court docket. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # micro1 vs Mercor: how each pays companies for data > micro1 vs Mercor compared for company data: published tiers against reported offers, minimums, process, payment timing and security claims. Self-reported. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-vs-mercor Published: 2026-10-02 Updated: 2026-10-14 ## The short answer micro1 vs Mercor: micro1 publishes tiers ($100K+, $500K+, $1M+), but Mercor's data page shows no figure. Press reports put Mercor's offers at up to $300,000 for startup archives. Mercor pays by wire in two to four weeks. micro1 states no timing for company data. Both firms also hire experts to train AI models. This page covers their company-data programs only. ## What figures does each publish? [micro1](/buyers/micro1)'s [data partnerships page](https://www.micro1.ai/data-partnerships) lists $100K+, $500K+ and $1M+ tiers. Its Enterprise Data Partnership listing says $100K-$2M+ for approved data packages, and its CFO said in an undated recorded forum talk that it pays $100K to $2M per company on its corpus track. [Mercor](/buyers/mercor)'s [data page](https://www.mercor.com/data/) says pay depends on data volume, tools connected and data depth. It states no figure. Everything I have on Mercor's numbers comes from outside the company. The Information, relayed by [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d), reported offers up to $300,000 for shuttered-startup archives. [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) reported that Mercor bid $7.5M for Spirit Airlines' archive. [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) reported that micro1 later offered $12.5M. Figure: comparison of Company-data programs from two AI data firms: micro1 (emphasized: Publishes deal tiers, Publishes tiers), Mercor (No figure on page). micro1 is emphasized because it publishes deal tiers and Mercor's data page does not. ## How does the process differ? micro1's page lists four stages: assessment, evaluation, discovery and partnership. In an undated recorded forum talk, David Revland, who works on human data at micro1, described a data manifest form, a payment proposal and a contract. Then its own engineers help run the transfer, and payment comes after it checks the data. Mercor's page describes these steps: - Scope the tools. - Connect your accounts. - Run automated extraction and removal of personal details. - Get paid when the data reaches the buyer. It says no data leaves your systems until you approve it. ## Who can take part? micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. Mercor's data page names no minimum. ## What do they say about security? Mercor claims SOC 2 Type II certification, encryption in transit and keys held in AWS KMS (self-reported, unverified). micro1 names no certification. In March 2026 a supply-chain attack hit Mercor. The data involved was contractor and applicant data. My [Mercor data breach](/answers/mercor-data-breach) page has the dated record. Read the full terms in [how micro1's data partnership works](/guides/micro1-data-partnership) and [Mercor data licensing](/answers/mercor-data-licensing). Run the [rights check](/rights-check) before a first call. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [data page](https://www.mercor.com/data/) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Mercor security incident update](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [CourtListener docket, Deboni v. Mercor.io Corp.](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # What is referential integrity in data? > What is referential integrity in data? The rule that every link points at a real record. Why Spirit's data sale and its union objection turned on it. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-referential-integrity-in-data Published: 2026-10-02 Updated: 2026-10-14 ## The short answer Referential integrity is the rule that every link between records points at a real record. In AI data deals, Spirit Airlines kept links while de-identifying, and the union said links raise re-identification risk. The UK ICO says pseudonymised data stays personal data for anyone with the key. Two groups use the term for opposite reasons. Database engineers want the links kept. Privacy lawyers want to know who can follow them. ## What does referential integrity mean in a database? A foreign key constraint says the values in one column must match values in a row of another table. [PostgreSQL's documentation](https://www.postgresql.org/docs/current/ddl-constraints.html) calls this maintaining referential integrity between two related tables. Its example has an orders table that points at a products table. Once the constraint exists, no order can name a missing product. ## Why do AI companies want the links kept? A trajectory only shows up when records connect. [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) described the value in Spirit's archive this way: an IT ticket linked to a Teams discussion, a code change and an operational result. That works only if the links can be rebuilt. Our [trajectory entry](/answers/what-is-a-trajectory-in-ai) explains the term. micro1's David Revland, who works on human data, said in an undated recorded forum talk that micro1 swaps each name for a consistent stand-in across every platform. The same person gets the same stand-in in Slack and in Google Workspace. micro1 staff said in the same talk that companies cannot pre-scrub. Redacting first destroys the cross-platform trail it needs. ## Why does it worry privacy lawyers? A stand-in that stays the same across tools is a persistent identifier. The [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) says pseudonymised data is personal data in the hands of anyone who holds the additional information. That extra information must be kept apart and secure. The [FTC wrote](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous) that hashes are not anonymous and can still be used to identify users. Both points ask one question: can a link be followed back to a person? ## What did the Spirit union say? The union's objection (Doc 1489) quoted section 3(c), the de-identification clause in the sale agreement. It said the clause keeps the joins among timekeeping, pairing, training, payroll and communications data by design. It made no technical claim that a particular record can be re-identified. [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) reported that the union warned even anonymized information about members could be reconstructed. Google told Time the data would be rigorously scrubbed by a third party. Our page on the [union objection](/answers/spirit-airlines-data-union-objection) lists what it asked the court to do. ## What should a company ask about stand-ins? Ask who holds any key that maps stand-ins to real people. Ask whether stand-ins repeat across systems. Ask what the AI company promises about re-association. [Pseudonymization versus anonymization](/answers/pseudonymization-vs-anonymization) and [re-identification risk](/answers/re-identification-risk-emails) cover the legal test. Run the [rights check](/rights-check) before you list anything. We give no legal advice, so talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Real name found, swapped -> Same stand-in in every tool -> Cross-tool trail survives. Revland (micro1) said in an undated recorded forum talk that one consistent stand-in per person keeps the trail across tools intact. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [PostgreSQL's documentation](https://www.postgresql.org/docs/current/ddl-constraints.html) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [FTC wrote](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) --- # Who bid on Spirit Airlines' data, and who else takes it? > Google won Spirit Airlines' data auction with a $10M bid, pending court approval. Mercor bid $7.5M, micro1 later offered $12.5M and Handshake AI runs a program. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/who-buys-company-data-for-ai Published: 2026-10-01 Updated: 2026-10-14 ## The short answer Time and the court's privacy ombudsman name the bidders: Google, which won the auction for Spirit Airlines' archive with a $10M bid, and Mercor, which bid $7.5M. micro1 later offered $12.5M for the same archive. Handshake AI runs a direct program. Google's deal still needs court approval. The Spirit Airlines auction is the clearest public record of what companies will bid for company data. These are its bidders, plus the other names that have a public source. For every company that could license your records, with terms and fees side by side, see [who buys company data for AI, compared](/buyers). ## Which named companies have bid or run programs? - **Google.** It won the August 2026 bankruptcy auction for the Spirit Airlines archive with a $10M winning bid. The archive holds about 100 million emails, 500 million Teams chats and about 30 million lines of code ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). - **Mercor.** It bid $7.5M ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)) and is the alternate bidder ([ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). Reports say it approached acquired and shuttered startups for Slack, Jira and email archives with offers up to $300,000 ([BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). - **micro1.** It offered $12.5M for the Spirit archive later ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). It also runs a direct program for operating companies (self-reported). - **[Handshake AI](/buyers/handshake-ai).** Its data partnerships page says it builds lab training environments from business operational data. The Spirit sale needs the bankruptcy court's approval, and no sale order had been entered as of 10 Oct 2026. The approval hearing was moved from 14 Oct to 6 Nov 2026, [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) reported on 9 Oct 2026. Treat the $10M as a bid until a court approves it. The [deals tracker](/deals) follows it. Figure: scale, Bids on Spirit Airlines' archive: Mercor $7.5M, Google, winning bid $10M (emphasized), micro1, later offer $12.5M. Google's winning bid sat between the other two figures. Source: Time and Fortune, reported bids. ## Who are the agent builders? They build RL gyms. An RL gym is a simulated workplace stocked with real Slack threads, tickets and email, so an agent can practice an employee's job ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), [Futurism](https://futurism.com/artificial-intelligence/employer-selling-emails-train-ai)). > **Labs want to see how real work gets done.** It's the library. They borrow real work and study how it went. Marketplaces and vendors sit between them and owners. The end buyer is rarely named. ## What is missing from the public record? Epoch AI's review of RL environments describes app replicas and lab partnerships with product companies, and does not discuss real company archives ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). Outside Spirit, I found no named enterprise AI vendor buying company email or support archives. If email is what you hold, [licensing company emails to AI](/answers/sell-company-emails-to-ai) covers what to check first. For labs by name, see [license data to OpenAI](/answers/sell-data-to-openai) and [license data to Anthropic](/answers/sell-data-to-anthropic). _Ask any marketplace, this site included, who its buyers are and who pays whom._ micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Futurism](https://futurism.com/artificial-intelligence/employer-selling-emails-train-ai) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # Can you license company emails to AI? > Searching how to sell company emails to AI? You license them. Buyers want full threads with metadata, and Spirit's archive drew a $10M bid. Rights first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-company-emails-to-ai Published: 2026-09-30 Updated: 2026-10-14 ## The short answer Yes, if counsel confirms you hold the rights. Troveo lists whole email threads. Google bid $10 million for Spirit's 100 million emails and more. No per-email price is public. Law firm Frankfurt Kurnit advises excluding privileged and HR mail. Email shows who asked for what, who approved it and how it ended. micro1's CFO says labs want that chain. It is also full of other people's words. Employees, customers and partners all write into the same archive, which is why the rights work comes before any price talk. ## Which companies take company emails? The companies list email among the systems they take (from their pages, plus one talk): - [Troveo](https://www.troveo.ai/business-data) lists "Email & calendar" as a category: threads with senders, recipients and linked responses. - [Mercor](https://www.mercor.com/data/) lists Gmail ("email messages and metadata") and Outlook among 100+ connectors. - [micro1](/buyers/micro1)'s CFO, in an undated recorded forum talk on its company data partnerships, described the chain from a request to a deliverable across tools. Email is one link next to chat and documents. I have no public link to that recording, so read the CFO's remarks on this page as micro1's own account. None of the three names an end buyer for email. My page on [who bid on Spirit Airlines' data](/answers/who-buys-company-data-for-ai) lists the named bidders. ## What do Troveo and Mercor list for an email archive? Troveo lists whole email threads with senders, recipients and linked responses, and Mercor lists Gmail messages with their metadata. One message on its own shows little. The reply chain, who was copied and the order of the answers show how the work moved. So plan any export to keep headers and thread links. ## What does a lab do with company email? [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) reported on 25 Aug 2026 that AI companies build reinforcement learning environments. These are simulations of commonly used software where agents practice tasks. Nick Heiner of Surge AI told Time that RL environments are only as good as the data that populates them. The article adds that training agents for other office work may depend on private material held in company email and chat. Epoch AI's [review of RL environments](https://epoch.ai/gradient-updates/state-of-rl-envs) (12 Jan 2026) describes app replicas and lab partnerships with product companies, not real company archives. Demand for archives is a claim from buyers and press, so treat it as one. ## What is an email archive worth? No public price per email exists, and none of the figures here estimates what your archive would fetch. The public bids are for one whole archive: - Google won Spirit Airlines' bankruptcy auction with a $10 million bid for about 100 million emails, 500 million Teams messages and about 30 million lines of code ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). - Mercor bid $7.5 million ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)) and is the alternate bidder ([ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). - micro1 later proposed $12.5 million for the same records, [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) reported on 14 Sep 2026. micro1 also states its own range for company data. Its [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages (self-reported). Its CFO gave $100,000 to $2 million per company in a separate, undated recorded talk. Neither is a price for email alone. Spirit was one distressed airline's whole archive, and the sale is still waiting on the court ([docket](https://www.courtlistener.com/docket/71233134/spirit-aviation-holdings-inc/)): Google's $10M winning bid for Spirit Airlines' de-identified business data still needs bankruptcy court approval. A court notice reported on 9 Oct 2026 moved the hearing from 14 Oct to 6 Nov 2026. No sale order as of 10 Oct 2026. Read the bid as one data point. My [Spirit page](/answers/spirit-airlines-data-sale) has the timeline. ## Do rights or price come first? Rights. An archive holds many kinds of messages: - Employees' messages, which raise [privacy and labor questions](/answers/can-i-sell-employee-emails-to-ai). - Customers' messages. - Partners' messages under [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai). - Sometimes legal advice covered by [attorney-client privilege](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege). Owning the mailbox and having the right to license what is inside it are separate questions. [Who owns company emails](/answers/who-owns-company-emails) pulls them apart. ## What has to come out first? [Daniel Goldberg](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), a partner at Frankfurt Kurnit, writing in October 2026, advises owners to exclude high-risk data entirely instead of relying on de-identification. His list: - Privileged material. - HR and personnel files. - Payroll and tax records. - Health and benefits information. - Union-related communications. - Customer and partner confidential information. - Licensed data and data from regulated systems. He warns that licensing may waive privilege over legal communications. Employee messages about pay, scheduling and working conditions may be protected concerted activity under Section 7 of the National Labor Relations Act, with or without a union. He also notes that removing identifying details from millions of emails is harder than scrubbing names from structured fields. He adds that de-identification deals with who can be linked and leaves the content as confidential as it was. A disciplinary thread stays sensitive without a name on it. ## Who removes the names? It varies by deal. micro1 staff said in the undated forum talk that micro1 transforms the data itself. The same talk said companies cannot scrub first, because redaction would break the cross-tool trail. Troveo's page says names, contact details, credentials and client identities are scrubbed, and its example swaps them for labels such as PERSON-014 and EMAIL-019. In the Spirit sale the debtors hired an independent agent, Tonic.ai, to de-identify unstructured data such as corporate emails, the court's consumer privacy ombudsman [reported in an October 2026 supplemental filing](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf). Before each transfer, Tonic.ai is to deliver a certification, filed with the court, that the approved procedures ran. That certified de-identification is a closing condition of the sale. The ombudsman wrote that she did not investigate whether the sale presents risks to affected employees or third parties. She also noted that micro1 proposed to do the de-identification itself, without an independent party, and asked for time to look into that if the court considers micro1's bid. Stand-ins that stay the same across messages keep the links between them, and those links are also the re-identification risk. My [re-identification page](/answers/re-identification-risk-emails) and the [de-identification explainer](/answers/data-de-identification) cover it. ## What does an email mailbox inventory look like? The first job is a list of what you have, in descriptions and counts only. Daniel Goldberg, a partner at Frankfurt Kurnit, suggests listing each data set by system, record count and start date. Retention rules and who runs each system belong on the same sheet. The example on this page is a made-up sheet for Larkspur Freight, a 60-person freight company. **Fictional mailbox inventory for Larkspur Freight, a made-up 60-person freight company. Counts and descriptions only, no messages.** | Mailbox group | Note for counsel | Messages, rough | Retention or hold | Who runs it | |---|---|---|---|---| | Sales, 14 accounts, 2016-2025 | Customer pricing under NDAs, check NDAs | 1.9 million | Kept 10 years by policy | Outside IT firm | | Dispatch, 22 accounts, 2018-2025 | Drivers' personal details | 2.6 million | No policy, nothing deleted | Office manager | | Shared inboxes (info@, support@), 5 accounts, 2022-2025 | Customers' own messages | 1.2 million | 3-year auto-delete since 2023 | Support lead | | Former staff, 31 accounts, 2016-2024 | Departed staff's personal mail | 800,000 | Archived as PST files | Outside IT firm | | Finance and HR, 4 accounts, 2016-2025 | Payroll and health, exclude | 310,000 | Litigation hold since 2021 | CFO | | Executive and legal, 3 accounts, 2016-2025 | Privileged advice, exclude | 240,000 | Litigation hold since 2021 | CEO | A sheet like this lets you talk scope with a buyer before one message leaves the building. In this example: - Finance, HR and the executive mailboxes hold categories from Goldberg's list, so on his advice they come out of scope before any buyer sees the sheet. - Sales holds customer pricing under NDAs, also on his list. Ask counsel whether those NDAs allow any use at all. - Two groups sit under a litigation hold. Ask counsel whether held mail can move at all. - The shared inboxes have deleted anything older than three years since 2023, so older support threads are gone. A buyer that wants whole threads will ask about that gap. Larkspur, being imaginary, has a lot less paperwork than you. ## How does an email deal run? Figure: steps Inventory, counsel checks rights -> Exclude and de-identify -> Transfer and check. An email archive moves through an inventory and a rights check, then exclusions and de-identification, before any transfer. Start with the [rights check](/rights-check), which walks through seven rights questions, including staff messages, customer contracts, privilege, NDAs and who can sign. Then read the [risk map](/risks). Optional, paid [managed readiness](/managed-readiness) builds the inventory with you, quoted in writing first. We work from inventories, counts and file lists, and never accept raw records, credentials or data-room access. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Mercor](https://www.mercor.com/data/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [review of RL environments](https://epoch.ai/gradient-updates/state-of-rl-envs) - [ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [docket](https://www.courtlistener.com/docket/71233134/spirit-aviation-holdings-inc/) - [Daniel Goldberg](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # What do AI labs do with company data? Sourced uses > What do AI labs do with company data? Time and Fortune tie the Spirit Airlines archive to agent training and RL environments. Here is what each says. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-do-ai-labs-do-with-company-data Published: 2026-09-30 Updated: 2026-10-14 ## The short answer AI labs use company data to train and test AI agents. Google told Time the Spirit Airlines data "can be helpful in improving our products and AI models." Time linked the bid to RL environments. No source shows real company data in a training run yet. Every use below comes from a named report. None comes from a lab's own filing about a specific purchase. > **A lab trains an agent on real work so it can learn how work gets done.** Think of a library. The lab borrows real work to read and practice from, under rules. ## How do labs train agents on company records? An agent is software that acts for a user instead of only writing text. In its report on [micro1](/buyers/micro1)'s offer for the Spirit records, Fortune wrote that an agent "needs to learn how to choose actions, use tools, respond to intermediate results and recover from mistakes." That takes workflows documented across several systems. [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) calls the record of those steps a trajectory. ## What does an RL environment do with the data? [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) defines an RL environment by the actions a model can take and the context that decides their effects. The model tries a task. A grader, usually automated, scores the attempt. The scores update the model. Time tied Google's Spirit Airlines bid to reinforcement learning environments, where an agent practices tasks and gets scored, and wrote that such environments "are only as good as the data that populates them." Google itself told Time only that the data "can be helpful in improving our products and AI models." Our [RL environment page](/answers/what-is-an-rl-environment) has the prices Epoch reported, with a Slack-grade clone near $300,000. ## What other uses are named? Epoch AI's review of the RL market lists three uses of an environment. They are reinforcement learning, benchmarking and supervised fine-tuning on successful trajectories. Epoch says reinforcement learning is the main use. micro1's workflows track, as its CFO described it in an undated recorded forum talk, has employees grade a general-purpose agent on their real daily work. micro1 receives the evaluation plus the agent's trajectory (self-reported). ## What is not shown in public? Epoch's FAQ describes clones and expert-written tasks. It does not say real company data fills them. It notes that some labs use their own user data to build tasks. Marketplace pages name no lab buyers. Our [comparison of who buys company data](/buyers) lists the few names reporting supports. The plain bottom line: the link from your archive to a training run is a plan buyers have stated. _Nobody has confirmed that your old lunch-order threads are in a training run. Yet._ ## What should a company ask? Ask which of these uses the buyer plans. Ask whether derived products can be resold. Ask what deletion means after training. Our [deletion page](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it) covers the last one. The [rights check](/rights-check) lists what to settle with counsel. Figure: steps Records, names swapped -> Tasks built with a grader -> Agent practices and is scored. Time links records like Spirit's to RL environments, where agents practice tasks and get scored. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # Who owns company emails? > Who owns company emails? Owning the mailbox, owning what is inside it and having the right to license it are three separate questions with different answers. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/who-owns-company-emails Published: 2026-09-30 Updated: 2026-10-14 ## The short answer Who owns company emails depends on which of three questions you mean. Who controls the mailbox is a contract and employment question. Who owns the contents is mixed: a mailbox mixes company writing with clients' and vendors' records. The right to license is separate. A lawyer can sort them. People type this query before licensing, a shutdown or an employee dispute. The honest answer has layers. ## Who owns the mailbox? Start with the provider's terms. The [Google Workspace terms](https://workspace.google.com/terms/premier_terms/) say "Customer retains all Intellectual Property Rights in Customer Data". [Slack's privacy principles](https://slack.com/trust/data-management/privacy-principles) say customers own their Customer Data. Those lines settle the relationship between you and the provider. Between you and your employees, the answer sits in employment agreements and handbooks. A lawyer reads those. ## Who owns what is inside? Several parties can have a claim to one thread. [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) says email and chat contain other companies' confidential information, often under NDAs. The Spirit Airlines sale shows the pattern. A software vendor, [Springshot](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google), argued that part of the archive was data generated by its software under its contract. An engine maker, International Aero Engines, pointed to confidentiality agreements. ## How do you sort out who owns what? Start by sorting the data into three groups: - **First-party data** is what your company wrote. - **Held-for-others data** is what you process for customers. - **Third-party data** is content from partners, guests and shared channels. [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data), a law firm, says a data provider should offer representations that it has sufficient rights to license the dataset. It adds that the provider should offer indemnification for third-party claims. A mailbox that mixes the three groups makes that representation hard to give. ## Does owning it mean I can license it? Not by itself. Ownership and the right to license are separate questions. [California's CCPA](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) treats disclosing personal information for "monetary or other valuable consideration" as a sale, whoever owns the mailbox. Work through [your NDAs](/answers/does-my-nda-let-me-sell-data-to-ai), [employee privacy](/answers/can-i-sell-employee-emails-to-ai) and [privileged material](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) before any offer. Our [rights check](/rights-check) asks whether a policy says the company owns work communications. If you are weighing a license of the archive itself, [licensing company emails to AI](/answers/sell-company-emails-to-ai) covers buyers, exclusions and a sample mailbox inventory. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Three questions that sound like one: Own the mailbox (Contract, employment), Own the contents (Split among parties), Right to license (emphasized: Separate from mailbox ownership, Its own question). The right to license is its own question, separate from who owns the mailbox. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Google Workspace terms](https://workspace.google.com/terms/premier_terms/) - [Slack's privacy principles](https://slack.com/trust/data-management/privacy-principles) - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Springshot](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google) - [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) - [California's CCPA](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) --- # Data valuation for AI: what buyer calculators use > Data valuation for AI: the inputs two buyer calculators use (headcount, years, systems, country) and the ones they leave out. Ranges are indicative. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-valuation-for-ai Published: 2026-09-28 Updated: 2026-10-13 ## The short answer No standard method exists. Calculators count headcount and years. Neither asks about data cleanliness or rights you hold. For 100 staff and 10 years, Handshake AI shows $383,083 to $896,969. All are indicative, self-reported. Short version: a calculator tells you what the buyer's form counts, and it won't tell you what your data is worth. This page is about those inputs. For what public deals and bids show, read [how much is your business data worth to AI](/guides/how-much-is-your-business-data-worth-to-ai). ## What does each calculator ask? | Buyer | Inputs | Example output | |---|---|---| | [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) | Employees, years of operation, country | 100 staff, 10 years, USA: $383,083 to $896,969 | | [Troveo](https://www.troveo.ai/business-data) | Employees, years operating, systems in use | Not recorded | ## What do they leave out? A form with three or four inputs can't inspect your systems, confirm which records you may license or stand in for a buyer offer. [Handshake AI says](https://joinhandshake.com/ai/data-partnerships/) its payout depends on the data, its due diligence and your acceptance of its terms, and it labels the calculator result indicative only. ## What do the buyers' own guides say drives value? [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) says no per-employee price exists. It names uniqueness, historical depth, connected context across systems, documented outcomes, rights clarity and current buyer demand. Rights, structure, recorded outcomes and buyer demand show up in the guides and in neither calculator. ## Which inputs track public prices? Public price points are few. Google's winning bid for Spirit Airlines' archive was [$10M](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/), still awaiting court approval, and it priced the archive's records, so headcount is not an input there. [Handshake AI](/buyers/handshake-ai)'s 100-employee example works out to about $3,831 to $8,970 per employee by my arithmetic. The inputs differ, so the tools are not a like-for-like test. See [data monetization pricing](/answers/data-monetization-pricing). ## What should you do with a calculator number? Use it to start a conversation, and ask what the figure is built from. Bring your own counts, dates and rights notes, which the [readiness check in the worth guide](/guides/how-much-is-your-business-data-worth-to-ai) lays out. Run the [rights check](/rights-check) too. Figure: comparison of Inputs in two buyer calculators: Troveo (emphasized: The one that asks your systems, Staff, age, systems), Handshake AI (Staff, years, country). Troveo gets the emphasis because its calculator asks which systems you use, and Handshake AI's asks for country instead. Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [Troveo](https://www.troveo.ai/business-data) - [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [$10M](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) --- # Do customer contracts allow licensing data? > Searching whether customer contracts allow selling data? For a license, scan confidentiality, processor terms, service data, AI training and return duties. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/do-customer-contracts-allow-selling-data Published: 2026-09-28 Updated: 2026-10-14 ## The short answer The contract decides. Scan five clause types: confidentiality, processor terms, service-generated data ownership, AI-training clauses and deletion duties. A processor under GDPR Article 28 works only on documented instructions. CCPA service-provider contracts must bar selling. Counsel reads the clauses. A scan gathers facts and doesn't judge a contract. The goal is a short list of agreements and clauses to put in front of counsel, so the lawyer's time goes where it counts. ## Which clauses should you look for? **Confidentiality and permitted use.** Find the definition of confidential information, the permitted-use clause and how long the duty lasts. Our [NDA page](/answers/does-my-nda-let-me-sell-data-to-ai) covers how a use limit meets a license. **Processor or service-provider terms.** A data processing addendum shows whether you hold the customer's data on its behalf. Under [CCPA section 1798.140(ag)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), a service provider's written contract must prohibit selling or sharing the personal information. **Data generated by a service.** In the Spirit Airlines sale, the software vendor Springshot argued that data generated by its service belongs to it under its contract ([The Next Web, 18 Sep 2026](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google)). Look for the same wording in your vendor agreements. **AI-training clauses.** [Common Paper's 2026 report](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/) on 16,140 signed agreements found language prohibiting AI training in 14% of cloud service agreements, up from under 1% in 2024. Its default clause lets the vendor train on aggregated, de-identified data. **Return and deletion.** [GDPR Article 28(3)(g)](https://gdpr-info.eu/art-28-gdpr/) has a processor delete or return personal data when the service ends. An old agreement may already require that the data be gone. ## Does the vendor-side carve-out let a customer license? The aggregated-data clause covers the vendor's own use. My reading is that it gives a customer no right to license a vendor's or a client's records. Counsel confirms that reading against your actual wording. ## How do you sort the data first? [Daniel Goldberg](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), a partner at Frankfurt Kurnit, lists the inventory work as a first step: identify data held as a service provider or processor, and review platform terms for the systems the data comes from. Sort each system into data you collected yourself, data you hold for a customer and data that belongs to a third party. The [SaaS page](/answers/can-a-saas-company-sell-its-customers-data-to-ai) covers the middle group, and the [rights check](/rights-check) asks whose records these are and what your customer contracts say. Figure: steps List systems, pull agreements -> Mark five clauses, sort by holder -> Counsel reads clauses. A contract scan ends with marked clauses for counsel to read. ## What about buyers' own terms? Buyers ask the owner to warrant that it holds the rights. Our [reps and warranties page](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) lists the public examples, and the [risks page](/risks) shows where deals drew objections. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [CCPA section 1798.140(ag)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [The Next Web, 18 Sep 2026](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google) - [Common Paper's 2026 report](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/) - [GDPR Article 28(3)(g)](https://gdpr-info.eu/art-28-gdpr/) - [Daniel Goldberg](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # Troveo vs Datarade: AI licensing or a data marketplace > Troveo vs Datarade: an AI-training licensing marketplace that handles buyers against a general data marketplace with a provider commission. Fees and fit. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/troveo-vs-datarade Published: 2026-09-27 Updated: 2026-10-14 ## The short answer Troveo is a licensing marketplace that matches buyers and pays a revenue share on every sale. Datarade is a general data marketplace where providers list products and buyers request samples. Deals close off the platform. Datarade reportedly charges 30% commission on some plans. Troveo publishes no split. People compare the two because both are marketplaces that sell data to businesses. Once you list something, they work nothing alike. ## What does each marketplace do? [Troveo](https://www.troveo.ai/business-data) says it handles buyer matching, packaging and privacy review for the company data you license. It started with video and audio licensing and [added business data in 2026](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html), and it says you share in revenue on every sale. [Datarade](https://datarade.ai/) says it lists data products from 2,700+ providers, charges buyers nothing and is paid by the provider when a purchase happens. Providers apply to sell, build a listing and respond to buyer requests. ## Who buys through each one? [Troveo](/buyers/troveo) names no buyers for business data and describes them as frontier labs and AI startups. [Datarade](/buyers/datarade)'s buyers are companies sourcing sales, financial, consumer and other third-party data. Our page on [the Datarade marketplace](/answers/datarade-marketplace) covers its listing model. ## What does a provider pay? Datarade's commission is 30% on one source, [ZoomInfo's pricing page](https://pipeline.zoominfo.com/sales/datarade-pricing), which describes plans as quote-based subscriptions with usage fees. Another source lists 30%, 20% and 15% tiers by plan. Ask Datarade for the rate in writing. Troveo pays you a share of each sale and publishes no percentage. Its [guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) puts full-company data at six figures or more, and cites an unnamed platform's baseline of about $5,000 for a single repository. ## Who handles the deal? Troveo describes four steps: scope, agree, package and get paid. Datarade's model stops at introductions, so you negotiate the contract, the price and the delivery with each buyer yourself. ## Which fits which kind of data? Datarade fits a company that already sells a clean, rights-cleared data product to other businesses. Troveo fits records of real work, such as tickets, email and CRM history, that a lab could use to train an agent. Rights come first either way, so use the [rights check](/rights-check). Figure: comparison of Two marketplaces and who closes the deal: Troveo (emphasized: Handles buyer matching, Handles buyers), Datarade (Lists, you close). Troveo is emphasized because it handles buyer matching, while Datarade stops at introductions. Compare more routes in [where to license company data](/answers/where-to-sell-company-data). Talk to a privacy or commercial lawyer in your state before you sign anything. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [added business data in 2026](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html) - [Datarade](https://datarade.ai/) - [ZoomInfo's pricing page](https://pipeline.zoominfo.com/sales/datarade-pricing) - [guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [Troveo: AI data licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Troveo content owners](https://www.troveo.ai/content-owners) --- # Why AI labs want real company data > Why AI labs want real company data: micro1's CFO says built environments imitate work and real data shows how it got solved. Epoch's review adds a check. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/why-ai-labs-want-real-company-data Published: 2026-09-27 Updated: 2026-10-14 ## The short answer Labs want real company data because it shows how a real problem got solved, per micro1's CFO. Synthetic environments built by experts imitate the world. Epoch AI's review describes clone-built environments with no mention of real company data. The claim comes from companies with a stake in the data. Two kinds of source speak to this. Vendors explain the pull. Researchers describe what labs build today. ## What does micro1 say about real versus synthetic? [micro1](/buyers/micro1)'s CFO described the ideal training environment as the real world itself. Environments that hired experts build can only imitate it. A real company's records show how a real problem got resolved: who asked, which spreadsheets and emails were involved, and what approvals followed (self-reported, recording date not stated). Our page on [what labs want from companies](/answers/what-data-do-ai-labs-want-from-companies) covers the chain micro1 describes, and [how a lab's data team judges an offer](/answers/how-ai-labs-evaluate-a-data-offer) covers what a lab says it looks for in an offer. ## What do other public sources say? [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) reported that the archive behind Google's $10M winning bid for Spirit Airlines' data, pending court approval, would feed reinforcement learning environments, and that the data encodes how people carry out their jobs, with even poor decisions offering training value. An expert quoted there said the purchase makes sense if you believe agents will generalize across the economy. [Epoch's FAQ](https://epoch.ai/gradient-updates/state-of-rl-envs), by Jean-Stanislas Denain and Chris Barber, says many enterprise-workflow environments rely on clones of apps such as Slack or SAP. It also says labs such as Cursor can use their own user data to build training tasks. ## Does anyone argue synthetic data is enough? Troveo, which licenses real data, [wrote](https://www.troveo.ai/resources/synthetic-vs-real-training-data) that synthetic data works best as a supplement and that evaluation data must be real. Our [real versus synthetic page](/answers/real-data-vs-synthetic-data-for-ai-agents) sets the two sides out. ## What does this mean for a company with records? The pull is plausible, and no public price ties it to your archive. Epoch's interviewees put a Slack-grade clone near $300,000, which shows what labs pay for a built version. Whether a lab pays more for a real one is the open question. Before any record leaves, you need the right to license it. Start with the [rights check](/rights-check) and the free [fit check](/business). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two sources of workplace training examples: Built by experts (Imitates the world), Real company data (emphasized: Shows how a problem got solved, Shows what happened). micro1 says real company data shows how a real problem got solved, which a built environment imitates. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Epoch's FAQ](https://epoch.ai/gradient-updates/state-of-rl-envs) - [wrote](https://www.troveo.ai/resources/synthetic-vs-real-training-data) --- # Can I scrub data before licensing it? Who cleans it > Looking to scrub data before you sell it? Before licensing, know who cleans it. micro1 staff said companies cannot pre-scrub. Troveo cleans on its side too. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-scrub-data-before-selling-it Published: 2026-09-25 Updated: 2026-10-14 ## The short answer No. micro1 staff said in an undated recorded forum talk that companies cannot pre-scrub because it would break the cross-tool trail. Troveo and Handshake AI both say they handle cleaning themselves. Control scope instead by agreeing which systems to include before anything moves. Scrubbing sounds like the responsible first move. In this market the company you license to, or its partner, usually owns that step, and the company's job is to say what goes in. ## Why does micro1 say companies cannot pre-scrub? In an undated recorded forum talk, [micro1](/buyers/micro1)'s David Revland, who works on human data, described transformation, which is a different operation from redaction. A name becomes a consistent stand-in across every tool, so a request in Slack can still be matched to the report in Google Workspace. Blanking names first would break that match. My [PII transformation page](/answers/micro1-pii-transformation) has the detail and the caveats. ## Who cleans the data at other companies? | Company or marketplace | Who does the cleaning, in its own words | |---|---| | micro1 | Its staff said micro1 transforms the data. Its page says companies can review representative samples before use. | | Troveo | [Troveo](https://www.troveo.ai/resources/sell-data-to-ai-companies) handles anonymization and packaging, to a documented standard it does not publish. | | Handshake AI | [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) says it de-identifies and cleans the data on its side before delivery to labs. | All of it is self-reported. A name swap alone leaves risk behind, and the [UK ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) still treats pseudonymised data as personal data for anyone who holds the extra information. ## What does the company control instead? Scope. You choose which records to include and exclude, and you agree the permitted uses before any records move. [Handshake AI](/buyers/handshake-ai) says the company keeps control of its data-sharing decisions. [micro1](https://micro1.ai/data-partnerships) says every partnership defines an approved data scope and clear boundaries. The data manifest form is where you list tools and rough sizes, so the [form page](/answers/what-is-a-data-manifest-form) is a good first read. ## What can you prepare before the first call? A list comes first. Write down which tools hold which kinds of records and which categories a lawyer would want kept out. [Frankfurt Kurnit's checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) names privilege, payroll, health files and union communications as categories to exclude. The [rights check](/rights-check) asks whether privileged material, health records or NDAs are in play, and the [managed readiness service](/managed-readiness) builds the list with you and never touches your data. ## Should you delete anything first? The sources I read don't address deleting records before a licensing deal. I'd ask your lawyer before you delete anything. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Who cleans the data, by company: micro1 (emphasized: micro1 staff: no pre-scrubbing, Says it transforms), Troveo (Marketplace handles it), Handshake AI (Says it de-identifies). micro1 staff said in an undated recorded forum talk that companies cannot pre-scrub, and Troveo and Handshake AI also put the cleaning on their own side. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [UK ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [micro1](https://micro1.ai/data-partnerships) - [Frankfurt Kurnit's checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # License internal documents to AI: what to check first > Want to sell internal documents to AI? Companies license them, though Troveo says docs alone are valued low. micro1 lists SOPs. Frankfurt Kurnit flags NDAs. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-internal-documents-to-ai Published: 2026-09-25 Updated: 2026-10-14 ## The short answer To license internal documents to AI, sort them by who owns them first. micro1's partnership page lists SOPs and knowledge bases. Troveo says documents alone are valued less without outcomes. Licensed material, open source, vendor code and third-party copyrights can block a deal. Sharing legal documents may also waive privilege. Documents and sheets are the deliverable end of the chain [micro1](/buyers/micro1) describes for its data partnerships. They're also where other people's work hides. ## Which internal documents do the companies name? [micro1's page](https://www.micro1.ai/data-partnerships) lists SOPs, internal documentation, knowledge bases, project histories and QA processes. [Mercor's data page](https://www.mercor.com/data/) lists Notion, Confluence and Drive content. [Troveo's guide](https://www.troveo.ai/resources/license-company-docs-to-ai) names SOPs, runbooks, proposals, specs, postmortems and meeting notes as worth licensing, with people's names, client details and credentials masked. ## Why do documents complete the chain? David Revland, who works on human data at [micro1](/buyers/micro1), described a Slack message that asks for a finance report and the report in Google Sheets. The report is the deliverable, and the request gives it context. I cover the wider picture in [what labs want from companies](/answers/what-data-do-ai-labs-want-from-companies). ## What can block licensing documents? [Frankfurt Kurnit's list](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) has four items. Other companies' confidential information, often under NDAs. Licensed data, open source and vendor code. Third-party copyrighted material in attachments and shared files. Data generated by vendor tools. It adds that licensing may waive privilege over legal communications and weaken trade secret protection for pricing logic and strategy documents. Our pages on [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai), [privilege](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) and [shared Slack channels](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai) cover each one. Talk to a commercial lawyer in your state before you sign. ## Do documents have value on their own? [Troveo](/buyers/troveo) says a folder of documents sits at the lower end of what company data pays. A proposal doesn't say whether the deal closed, and that gap costs you. Value climbs when records from the CRM, tickets and email come with it. That's a marketplace's view, and it carries no price. ## What is the next step? Sort folders into yours, a client's and a partner's. The [data readiness checklist](/answers/data-readiness-checklist) lists the questions, and the [rights check](/rights-check) lists what to settle with counsel. For Drive specifically, see [licensing Google Drive data](/answers/sell-google-drive-data-to-ai). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Pick folders, set aside client files -> Check NDAs and licenses -> Counsel reviews, scope the offer. Sorting by ownership and contract comes first, then counsel reviews and the offer is scoped. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's page](https://www.micro1.ai/data-partnerships) - [Mercor's data page](https://www.mercor.com/data/) - [Troveo's guide](https://www.troveo.ai/resources/license-company-docs-to-ai) - [Frankfurt Kurnit's list](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # What is micro1? > What is micro1? An AI data company that calls itself a data lab and runs company-data partnerships for AI development. Its figures are unaudited. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-micro1 Published: 2026-09-25 Updated: 2026-10-14 ## The short answer micro1 is an AI data company that calls itself a data lab. It supplies data and expert work to train AI models. It runs company-data partnerships for companies with 30+ employees and mature operations. Its figures come from micro1, Forbes, TechCrunch and Sacra, so ask who sees your data first. [micro1](/buyers/micro1) shows up when company owners look for a data partnership for their workplace records. It also runs a marketplace where experts do paid tasks that train AI models, which is a separate business. ## What does micro1 say it is? In an undated recorded forum talk for the data program, micro1's team called the company a data lab. It trains and improves AI models and agents by supplying data in the formats models learn from. Its company data page invites organizations to turn their operational data into revenue. > **micro1 supplies the real work examples that AI models learn from.** Think of a library of how work gets done, which micro1 opens to AI labs. The company-side pitch is that real company data shows how a real problem got solved. It shows who asked, which tools were used and what was approved. micro1's CFO said in the undated recorded forum talk that this chain from request to deliverable is what labs want. _Lab here means data, not beakers._ ## How big is micro1? None of these figures has an outside audit. Treat them as self-reported or press-reported. - [TechCrunch](https://techcrunch.com/2026/08/20/ai-data-startup-micro1-reaches-500m-gross-run-rate-amid-ai-training-boom/) reported that micro1 reached a $500 million gross annualized run rate. That is up from $100 million about eight months earlier. Net revenue is near $150 million to $200 million a year. - A Series A of $35 million at a $500 million valuation closed in September 2025, per [Sacra](https://sacra.com/c/micro1/). - [Forbes'](https://www.forbes.com/sites/annatong/2026/09/22/this-25-year-old-raised-over-100-million-for-his-ai-data-startup-at-a-4-billion-valuation/) headline reports a raise of more than $100 million at a $4 billion valuation. ## How does a company apply? Companies apply through the [data partnerships page](https://www.micro1.ai/data-partnerships). It lists $100K+, $500K+ and $1M+ tiers set per deal. micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. Its [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages, and its CFO said in the undated recorded forum talk that deals near $2M are real. micro1 staff gave different, earlier thresholds in the undated recorded forum talk, including 20 full-time employees and about 1 TB of data. Those are history, and the current pages govern. The [full walkthrough](/guides/micro1-data-partnership) prints both. ## What should a company check before applying to micro1? Confirm licensed uses, duration, exclusivity and payment structure in micro1's proposed agreement. Ask which AI labs see your data, how micro1 transforms personal information and how long it keeps copies. micro1 pays companies under data partnerships and does not name the labs it supplies. It says companies keep ownership of their underlying data. micro1's page says it removes personal information "when relevant" and keeps data only for agreed periods. Run the [rights check](/rights-check) first. See [how to license company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies) for the whole process. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [TechCrunch](https://techcrunch.com/2026/08/20/ai-data-startup-micro1-reaches-500m-gross-run-rate-amid-ai-training-boom/) - [Sacra](https://sacra.com/c/micro1/) - [Forbes'](https://www.forbes.com/sites/annatong/2026/09/22/this-25-year-old-raised-over-100-million-for-his-ai-data-startup-at-a-4-billion-valuation/) - [data partnerships page](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Can non-US companies license data to AI labs? > Wondering if non-US companies can sell data to AI labs? They can license it. Mercor and Troveo state no country limit. The GDPR transfer rule still applies. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-non-us-companies-sell-data-to-ai-labs Published: 2026-09-24 Updated: 2026-10-14 ## The short answer Maybe. Mercor and Troveo state no geographic limit, and Handshake AI's form lists Europe. micro1's data partnership page puts the US first, then the UK and Canada, and considers others. EU companies face GDPR transfer rules. Ask each program directly whether they consider your country. All statements are self-reported. No buyer publishes a separate process or price for companies outside the US. What you get is a set of stated preferences. ## What does micro1 say about place? [micro1](/buyers/micro1)'s [data partnerships page](https://micro1.ai/data-partnerships) puts companies with 30 or more employees in the US first, names the UK and Canada next, and says companies from other regions may still be considered. It also asks that documentation and workflows be in English and that your representatives can talk to its team in English. Its CFO said in an undated recorded forum talk that micro1 prefers US and Canadian companies and is open to others (recording date not stated). In a micro1 video, a referral partner pitched the program to US business owners. The partner named no other country (self-reported, about 15:08 and 21:00). The CFO's US and Canada preference is the wider statement. The [Canada page](/answers/micro1-data-partnership-canada) compares micro1's three sources on place, and the [English page](/answers/micro1-english-data-requirement) covers language. ## What do other buyers say? [Mercor's data page](https://www.mercor.com/data/) lists eight sectors and mentions no country limit. [Troveo's business data page](https://www.troveo.ai/business-data) mentions none either. [Handshake AI's interest form](https://joinhandshake.com/ai/data-partnerships/) lists USA, Canada, Europe and Other as choices, and its page says a scoping call covers data parameters, de-identification, terms and timeline. A page that mentions no limit has made no promise either. The [buyer comparison](/guides/how-to-choose-an-ai-data-broker) lists what to ask. ## Does EU law change the answer? [Article 44 of the GDPR](https://gdpr-info.eu/art-44-gdpr/) says a transfer of personal data to a third country takes place only if the conditions in that chapter are complied with. An archive full of employee or customer messages usually holds personal data. The [EU employee data page](/answers/can-i-sell-eu-employee-data-to-ai) covers the other GDPR checks, and the [rights check](/rights-check) asks whether GDPR or UK GDPR data subjects are in the records. ## What should a non-US company ask first? - Does the buyer consider companies in my country, and on what terms? - Where is my data stored and who can see it? - Does the price or the process change for me? Talk to a privacy or commercial lawyer in your country before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of How three companies' public pages treat location: micro1 (emphasized: Ranks regions by priority, US first, UK, Canada), Mercor (No limit stated), Handshake AI (Form offers Europe). micro1 ranks regions by priority, Mercor states no limit, and Handshake AI's form offers Europe as a choice. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://micro1.ai/data-partnerships) - [Mercor's data page](https://www.mercor.com/data/) - [Troveo's business data page](https://www.troveo.ai/business-data) - [Handshake AI's interest form](https://joinhandshake.com/ai/data-partnerships/) - [Article 44 of the GDPR](https://gdpr-info.eu/art-44-gdpr/) --- # License GitLab repos to AI: what we could verify > Want to sell GitLab repos to AI? They go out under a license. Troveo lists GitLab, storage shows under Usage quotas, and Duo inputs don't train GitLab models. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-gitlab-repos-to-ai Published: 2026-09-24 Updated: 2026-10-14 ## The short answer License GitLab repos to AI? Troveo lists GitLab. Use Usage quotas to check storage. GitLab says Duo inputs don't train GitLab models. Open-source licenses, client code and export rules apply as they do for GitHub. GitLab repositories raise the same rights questions as GitHub ones. The size and export routes differ, and the buyer evidence is thinner. ## Who lists GitLab? [Troveo's page](https://www.troveo.ai/business-data) lists GitHub, Snowflake, Databricks and GitLab under data and code. [Mercor's page](https://www.mercor.com/data/) names GitHub and describes repositories, commits, pull requests and issues. [micro1's page](https://www.micro1.ai/data-partnerships) mentions source code documentation and bug tracking. I found no price for a GitLab repository and no case of one being licensed. All of this is buyer self-description. ## How do you check the size? In a project or group, go to Settings, then Usage quotas, then the Storage tab ([GitLab docs](https://docs.gitlab.com/ee/user/storage_usage_quotas.html)). Users with the Maintainer or Owner role can see it at project level, and the namespace Owner role is needed at group level. GitLab says only the repository and LFS count toward the storage limit, and container registry, package registry and build artifacts do not. The docs give no date. ## How does a project leave GitLab? [GitLab's project export API](https://docs.gitlab.com/api/project_import_export/) produces an archive, and its download examples use `*export.tar.gz` files. The page notes you must move CI/CD variables and the container registry separately. I did not confirm GitLab.com's export limits. ## What do GitLab's AI terms say? [GitLab's AI transparency center](https://about.gitlab.com/ai-transparency-center/) says no inputs to or outputs from GitLab Duo features are currently used to train GitLab models. That describes GitLab's own models, and it leaves your right to license the code to your contracts and licenses. ## Which rights questions carry over? Check open-source licenses inside dependencies, code written for clients, and export-control rules for code. [Can I license source code to AI](/answers/can-i-sell-source-code-to-ai) covers them, including the Ninth Circuit's 16 Sep 2026 ruling in Doe v. GitHub. [Licensing GitHub data to AI](/answers/sell-github-data-to-ai) covers the buyer side, and [checking GitHub organization size](/answers/how-to-check-github-organization-size) the sizing side. Run the [rights check](/rights-check) on code separately from documents. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Open the project or group -> Choose Settings, then Usage quotas -> Open the Storage tab. GitLab shows repository and LFS storage on the Storage tab of Usage quotas. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's page](https://www.troveo.ai/business-data) - [Mercor's page](https://www.mercor.com/data/) - [micro1's page](https://www.micro1.ai/data-partnerships) - [GitLab docs](https://docs.gitlab.com/ee/user/storage_usage_quotas.html) - [GitLab's project export API](https://docs.gitlab.com/api/project_import_export/) - [GitLab's AI transparency center](https://about.gitlab.com/ai-transparency-center/) --- # What is a forward deployed engineer? > What is a forward deployed engineer? An engineer embedded with a customer to build solutions. Palantir's definition, and the FDE role in micro1's data transfer. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-forward-deployed-engineer Published: 2026-09-24 Updated: 2026-10-14 ## The short answer A forward deployed engineer (FDE) works directly with a customer to understand problems and build solutions using that customer's data. Palantir says the role owns end-to-end execution. At micro1, the FDE team helps run the transfer, which its CFO put at about 10 IT hours in an undated talk. The title shows up in enterprise software hiring, and now in AI data licensing. The common thread is an engineer who sits close to the customer. ## What does Palantir say an FDE does? [Palantir's posting](https://jobs.lever.co/palantir/98b81271-9e15-40b7-8dce-0c62f24702f9) for the role says the work is done in small teams with minimal supervision, owning end-to-end execution of high-stakes projects. A day might span discussing architecture, wrangling massive-scale data, coding a custom web app, speaking with customer executives or setting team strategy. That is one employer's wording. [micro1](/buyers/micro1) also hires for the title. An [Arc job listing for a micro1 forward deployed engineer](https://arc.dev/remote-jobs/j/micro1-forward-deployed-engineer-pelafale7s) says the work is with AI labs and enterprise partners, building systems that collect, organize and improve training data. The listing says nothing about running a company's data transfer. Other companies use the title for different jobs, and I compared only these two. ## What does an FDE do in a micro1 partnership? In a micro1 partnership, forward-deployed engineers walk the company's IT team through the data transfer, said David Revland, who works on human data at micro1, in an undated recorded forum talk. That step comes after the data manifest form, the payment proposal and the contract. Then micro1 verifies the delivered data and pays (self-reported, recording undated). The company's side is small. The number from micro1's CFO is about 10 hours of one or two IT people across a week or two. Our page on [how long a transfer takes](/answers/how-long-does-a-data-transfer-take) breaks that down, and [the data manifest form](/answers/what-is-a-data-manifest-form) comes first. ## What should a company ask about it? Ask which accounts or files the engineer needs, who at micro1 holds those credentials and when access ends. I found no published statement from micro1 on what access its engineers need. Our [risk map](/risks) lists the security questions, and our [readiness service](/managed-readiness) prepares the file before any outside engineer arrives. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Contract signed -> FDE team, about 10 IT hours -> micro1 verifies and pays. Revland of micro1 said in an undated recorded forum talk that its engineers walk your IT team through the transfer, after contract and before payment. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Palantir's posting](https://jobs.lever.co/palantir/98b81271-9e15-40b7-8dce-0c62f24702f9) - [Arc job listing for a micro1 forward deployed engineer](https://arc.dev/remote-jobs/j/micro1-forward-deployed-engineer-pelafale7s) --- # Handshake AI data partnerships: what they state > Handshake AI data partnerships: the $100K to $4M+ range, the 20+ staff and 3+ year floor, the calculator example, the process and where its pages disagree. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/handshake-ai-data-partnerships Published: 2026-09-23 Updated: 2026-10-14 ## The short answer Handshake AI data partnerships license company data that Handshake says it de-identifies and delivers to AI labs. It states $100K to $4M+ and asks for 20+ full-time staff and 3+ years. A calculator example gives $383K to $897K for 100 employees and 10 years. No outcome is promised. Here's what [Handshake AI](/buyers/handshake-ai) says on its own pages, and where those pages disagree with each other. ## What is a Handshake AI data partnership? Handshake AI is the AI arm of Handshake. Its data partnerships page says it licenses operational data from businesses, removes identifying details and formats the records to specification. It delivers them to "frontier AI labs for training and evaluation under contractual confidentiality." It adds that "partner companies are never identified" ([Handshake AI](https://joinhandshake.com/ai/data-partnerships/)). ## What are the requirements for a Handshake AI data partnership? Handshake AI's [referral page](https://joinhandshake.com/ai/data-partnerships/referral) says it is "looking for companies with 20+ full time employees & 3+ years in operation." The data partnerships page itself states no minimum. Its calculator asks for headcount, years of operation and country, with the USA, Canada, Europe and other as the options. How that floor sits beside six other programs is in [do you qualify for an AI data program](/answers/ai-data-program-minimums). ## How does the Handshake AI data partnership process work? 1. **Submit the form** A few minutes on your company and the tools you use. 2. **Talk to the team** A team member follows up directly. 3. **Scoping call** Data parameters, de-identification, terms and timeline. 4. **Confidential delivery** Handshake prepares the data and delivers it to labs. The page says the preparation work "happens on our side," so you transfer the data as it exists today. The referral page adds that the team reaches out within 1 to 2 days of a referral. ## How much does Handshake AI say it pays? The stated range is "$100K to $4M+ depending on the data shared." Its calculator example, 100 employees, 10 years and the USA, shows $383,083 to $896,969. The calculator calls that "an indicative estimate only and is not an offer to purchase your data." Pay varies with data sources, volume and quality, its due diligence and your acceptance of its licensing terms. Its FAQ says payments follow defined delivery milestones. Payment typically comes 30 to 60 days after Handshake accepts the de-identified dataset. Figure: range, Calculator example: 100 employees, 10 years, USA, $383.1K to $897K. Handshake AI's own calculator example sits well inside its stated $100K to $4M+ range. Source: Handshake AI data partnerships page, self-reported, labelled indicative and not an offer. ## Where do Handshake AI's own pages disagree? Handshake AI's [fellowship page](https://joinhandshake.com/ai/) shows "$500M+ payouts made," up from the $100M it showed on earlier reads. Handshake AI's [company referral page](https://joinhandshake.com/ai/data-partnerships/referral) shows $250M paid out to partners. Each number may cover a different group, and neither predicts what your company would receive. Neither page says which group it counts. ## What does Handshake AI say about privacy risk? It says "no de-identification process eliminates that risk entirely." It adds that a third party might re-identify personal information by combining it with other sources. Read that admission alongside our [risk map](/risks), and ask counsel who bears the risk in the contract. The page also says data partners remain responsible for making their transfer to Handshake AI legal. The fuller review, including the contractor pay disputes [Business Insider reported](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html), is in [is Handshake AI legit](/answers/is-handshake-ai-legit). Other programs that take the same records are in [Handshake AI alternatives](/answers/handshake-ai-alternatives). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [fellowship page](https://joinhandshake.com/ai/) - [Business Insider reported](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) --- # License sales call recordings to AI: what to check > Want to sell sales call recordings to AI? Licensing them carries real exposure. Few buyers name recordings, and the Otter.ai ruling shows the claims. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-sales-call-recordings-to-ai Published: 2026-09-23 Updated: 2026-10-14 ## The short answer Consent from each person on the call is the first question, and counsel answers it. Few buyer pages name recordings, and none I read publish a price. Gong offers three consent methods. A 2026 federal ruling let Wiretap Act claims against Otter.ai go forward. Tools such as Gong record sales calls by design, which makes them a ready-made archive. Every call also raises a consent question for each person on it. ## Who says it takes call recordings? [Troveo](https://www.troveo.ai/business-data) lists Zoom under chat and messaging, the closest any buyer page I read comes to naming recordings. [micro1's data page](https://www.micro1.ai/data-partnerships) names CRM data, support tickets and contract workflows, and Mercor names no recordings. I found no buyer that publishes a price for recordings. ## What do call platforms let you set? [Gong's help page](https://help.gong.io/docs/call-recording-and-consent-settings) says an admin can set a consent profile with three methods: an email 10 minutes before the call, a consent page before joining, or an audio message on joining. Microsoft Teams has an explicit consent setting, `ExplicitRecordingConsent`, that requires participants to agree to being recorded or transcribed ([Microsoft Learn](https://learn.microsoft.com/en-us/MicrosoftTeams/meeting-recording)). Those settings show what a tool can ask. Whether your calls used them, and when, is a fact to pull from your own admin history. ## What did the Otter.ai court decide? [The court](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) let Wiretap Act, California Penal Code 631 and Illinois biometric claims go forward against a vendor that trained on conversations. Those are allegations at the pleading stage, and the defendant was a vendor. [Can I license call recordings to AI](/answers/can-i-sell-call-recordings-to-ai) walks through the order, the voiceprint statute and Spirit Airlines' carve-out. ## How do sales calls connect to your other data? Calls link to CRM notes, so the same people show up twice. See [licensing CRM data to AI](/answers/sell-crm-data-to-ai) and [meeting transcripts](/answers/sell-meeting-transcripts-to-ai). The [rights check](/rights-check) asks about personal data and customer contracts. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Consent controls two call platforms offer: Gong (emphasized: Three methods to choose from, Email, page or audio), Microsoft Teams (Explicit consent setting). Gong is emphasized because its consent profile offers three methods, where Teams offers one explicit consent setting. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [micro1's data page](https://www.micro1.ai/data-partnerships) - [Gong's help page](https://help.gong.io/docs/call-recording-and-consent-settings) - [Microsoft Learn](https://learn.microsoft.com/en-us/MicrosoftTeams/meeting-recording) - [The court](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) --- # What is data provenance? > What is data provenance? The record of where data came from, how it was made and what rights attach. W3C and industry definitions, and why AI buyers ask for it. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-data-provenance Published: 2026-09-23 Updated: 2026-10-14 ## The short answer Data provenance is the record of where data came from, how it was made and who handled it. The W3C defines it as information about the entities, activities and people involved. For owners, it covers rights: contracts, notices and consents. California requires AI developers to post training data sources. Think of provenance as the paper trail for a dataset. ## What does provenance record? The W3C's PROV overview is a working group note. It treats provenance as information about the entities, activities and people involved in producing data ([W3C](https://www.w3.org/TR/prov-overview/)). It is metadata, so it travels with the data or points to where the facts live. An industry standard makes it concrete. The Data Provenance Standards, version 1.0.0, launched in Nov 2023. A coalition of large companies co-developed them. They group metadata fields into source, provenance and use. Items include collection method, consent documentation location and usage license terms ([D&TA](https://www.dtaalliance.org/work/data-provenance-standards)). ## Why do AI buyers care? Rights and regulation, mostly. California's AB 2013 is in force. It requires developers of generative AI for public use in California to post a high-level summary of their training data. The summary must cover these points ([Crowell](https://www.crowell.com/en/insights/client-alerts/californias-ab-2013-requires-generative-ai-data-disclosure-by-january-1-2026)): - The sources. - Whether the data was purchased or licensed. - Whether it contains personal information. So a buyer has its own reasons to document where your records came from, and it will ask you. Expect questions about ownership, notices and consents. ## Who markets provenance? [Protege](/buyers/protege), a data marketplace, tells data owners they can monetize their assets "while maintaining clear rights protections and provenance" ([Protege](https://withprotege.ai/)). I'd treat that as marketing. The page does not publish a revenue split. ## What does provenance look like for a company archive? A short file per system, nothing fancy. It lists these facts: - Which tool the records come from. - What years they cover. - Who created them. - Which customer contracts and vendor terms touch them. - What notice staff and customers received. - Which categories you excluded. Our [readiness checklist](/answers/data-readiness-checklist) lists the same inputs as seven lines. The [rights check](/rights-check) turns the contract and consent ones into questions. The [risk map](/risks) shows where gaps have caused objections. We give no legal advice. Talk to a privacy or commercial lawyer in your state before you sign. Figure: steps Source: who issued it -> Provenance: how it was made -> Use: rights and limits. A data provenance record covers three groups of facts: source, provenance and use. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [W3C](https://www.w3.org/TR/prov-overview/) - [D&TA](https://www.dtaalliance.org/work/data-provenance-standards) - [Crowell](https://www.crowell.com/en/insights/client-alerts/californias-ab-2013-requires-generative-ai-data-disclosure-by-january-1-2026) - [Protege](https://withprotege.ai/) Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) --- # Will licensing company data to AI help my competitors? > Worried that selling company data to AI helps competitors? We found no license term limiting how the data is used. A micro1 referral partner called it fair. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/will-selling-company-data-to-ai-help-my-competitors Published: 2026-09-23 Updated: 2026-10-14 ## The short answer The public record has no contract answer yet. A micro1 referral partner said the worry is fair, but AI companies want scoped tasks, not the company playbook. I found no use limit on micro1's public pages. Frankfurt Kurnit, a law firm, says the contract should restrict data use. If you're asking this, you're checking whether licensing hands rivals an edge. Here is what each source says, and what none of them says. ## What did the micro1 partner say? A [micro1](/buyers/micro1) referral partner, interviewed in a micro1 video, called the concern fair. In her telling it assumes the whole company playbook changes hands, while micro1 wants individual scoped tasks and how they get done. Her closing line was that "these models are going to learn either way" (self-reported). The interviewer summed it up as less about trade secrets and more about operational workflows. Neither speaker described a contract term, and micro1 also pays the people who introduce companies to it. Read it as a sales answer. ## What does the contract say about how the data is used? [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) says data is handled under an agreed use case, and that scope and security standards are defined with the company before it takes part (self-reported). It names no competitor term. Its only separation language covers pipelines that keep one customer's data from mixing with other engagements. That says nothing about what the trained model later does. I haven't seen micro1's agreement, and none of the firms I researched publishes one. [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), a law firm, wrote that "the agreement should restrict how the buyer can use the data." It warns that a buyer could train AI that powers a competing product. ## Does US trade secret law protect company data from competitors? The Defend Trade Secrets Act protects information when its owner has taken reasonable measures to keep it secret ([18 U.S.C. 1839(3)](https://www.law.cornell.edu/uscode/text/18/1839)). Misappropriation includes use by someone who knew the information came under a duty to limit its use (1839(5)(B)(ii)(II)). The same law firm says licensing may jeopardize trade secret protection for pricing logic, strategy documents and source code. Whether your records qualify is a question for counsel. ## Can a model like GPT-2 or ChatGPT repeat what it learned? Sometimes. Researchers extracted hundreds of verbatim training sequences from GPT-2 ([Carlini and others](https://arxiv.org/abs/2012.07805)) and, in 2023, extracted training data from ChatGPT ([Nasr and others](https://arxiv.org/abs/2311.17035)). Neither paper tests a micro1 model. The law firm adds that data cannot practically be pulled back out once a model trains. I found no test of any buyer's model, so the risk is established in research and unmeasured here. ## What can an owner do? Leave out strategy, pricing logic and source code. Ask the buyer in writing about use limits, resale, exclusivity and deletion. Our [list of data you cannot license](/answers/what-data-can-i-not-sell-to-ai) and [NDA page](/answers/does-my-nda-let-me-sell-data-to-ai) cover the rest, and the [rights check](/rights-check) covers contracts, NDAs and personal data. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Ask for the use clause -> Check resale, field, exclusivity -> Have counsel read it. Ask the buyer for the use terms in writing, then have counsel read them. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [18 U.S.C. 1839(3)](https://www.law.cornell.edu/uscode/text/18/1839) - [Carlini and others](https://arxiv.org/abs/2012.07805) - [Nasr and others](https://arxiv.org/abs/2311.17035) --- # License Zendesk tickets to AI: export, terms, limits > Want to sell Zendesk tickets to AI? The deal is a license. Exports are off by default, and Zendesk's agreement puts consent duties on you. No price is public. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-zendesk-tickets-to-ai Published: 2026-09-22 Updated: 2026-10-14 ## The short answer To license Zendesk tickets to AI, the account owner must ask Zendesk to turn on exports, which are off by default. You keep ownership but must hold customer and agent consents. Troveo names Zendesk as a source. No per-ticket price is published. This page covers what is specific to Zendesk. The general case for support data is on our [support tickets page](/answers/sell-support-tickets-to-ai). ## Which companies name Zendesk? [Troveo](/buyers/troveo)'s [business-data page](https://www.troveo.ai/business-data) lists Salesforce, HubSpot, Intercom and Zendesk under CRM, sales and support. That is a marketplace describing its own program. ## How do you get tickets out of Zendesk? Exports aren't enabled by default. Zendesk's [help article](https://support.zendesk.com/hc/en-us/articles/4408886165402-Exporting-ticket-user-or-organization-data-from-your-account) says the account owner must contact Zendesk Customer Support to turn them on. Admins can then export tickets, users or organizations to JSON, CSV or XML. The path is Admin Center, then Account, Tools, Reports. The export tools aren't available on Team plans, though the REST API works on every plan. Zendesk recommends JSON above 200,000 tickets. CSV leaves out comments, which is where the conversation sits. The download link arrives by email and stays valid for at least three days. ## What does the Zendesk agreement say about the data? The [customer agreement](https://www.zendesk.com/company/agreements-and-terms/main-services-agreement/), as it applies to existing customers, says the customer retains ownership of all service data. It also makes the customer responsible for notices to agents and end users. The customer must get any needed consents from them too, so Zendesk can process the data lawfully. A ticket holds a customer's name, email address and account facts. See [customer consent](/answers/do-i-need-consent-to-sell-customer-data-for-ai-training) for the notice side. ## What does Zendesk do with your tickets for its own AI? Zendesk's [AI data use page](https://support.zendesk.com/hc/en-us/articles/5729714731290-Zendesk-AI-Data-Use-Information) (undated) says its proprietary models are not generative. It also says no third party will use your inputs to train its models. That describes Zendesk's use of your data. A license to a buyer is a separate act. ## Who removes the customers' names? Troveo says it scrubs names, contact details, credentials and client identities under one documented standard. A scrubbed ticket can keep a stable label per customer, and that keeps the thread. Our [re-identification page](/answers/re-identification-risk-emails) covers that trade. ## What should you check first? Your customer contracts, your privacy notice and the notices your agents received. Our [rights check](/rights-check) asks what your customer contracts allow and whether staff messages are included. The free [fit check](/business) asks where the work happens. Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Owner asks Zendesk for exports -> Admin exports, link arrives by email -> Counsel reviews the files. A Zendesk export starts when the account owner asks Zendesk to turn exports on. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [business-data page](https://www.troveo.ai/business-data) - [help article](https://support.zendesk.com/hc/en-us/articles/4408886165402-Exporting-ticket-user-or-organization-data-from-your-account) - [customer agreement](https://www.zendesk.com/company/agreements-and-terms/main-services-agreement/) - [AI data use page](https://support.zendesk.com/hc/en-us/articles/5729714731290-Zendesk-AI-Data-Use-Information) --- # Can you license data to AI labs? What they want > Looking to sell data to AI labs? Most companies license it through a buyer or marketplace. What labs want, such as workflows, and what a small company can do. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-data-to-ai-labs Published: 2026-09-21 Updated: 2026-10-14 ## The short answer Yes, through vendors or marketplaces, since most labs don't publish direct intake. micro1's CFO says labs want workflows: the chain from request through tools to deliverable. micro1's data partnership page lists $100K+ to $1M+ tiers for companies with 30+ employees. Smaller teams have fewer public routes. The visible routes into a lab run through another company, so that is where I start. Below: what labs ask for, who sits between, and what size of company fits which route. ## What do AI labs want from company data? Records of work, with the path visible. [micro1](/buyers/micro1)'s CFO said in an undated recorded forum talk that the prize is the chain from a message to a finished product. In the same talk, micro1's David Revland gave an example: a Slack message asking for a finance report, then the report in a spreadsheet (self-reported). Fortune calls the recorded steps a trajectory ([Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/)). Labs and their vendors use such records to build RL environments. These are simulated workplaces where an agent practices a job. Epoch's interviews give these prices: - A website-clone environment costs near $20,000. - A Slack-grade clone costs near $300,000. - Tasks cost $200 to $2,000. - Exclusive deals cost roughly 4x to 5x non-exclusive ones. The source is [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs). ## Who sits between you and the lab? Direct programs such as micro1, [Handshake AI](/buyers/handshake-ai) and Mercor. Marketplaces such as Troveo. RL environment vendors. [Where to license company data](/answers/where-to-sell-company-data) compares the routes, and [who bid on Spirit Airlines' data](/answers/who-buys-company-data-for-ai) lists the named bidders. ## What can a small company realistically do? micro1's CFO described three routes in an undated recorded forum talk (self-reported): - **Corpus deal.** A data partnership covering your stored records, and micro1 says companies keep ownership of the underlying data. The CFO named $100K to $2M per company in that undated talk. The current criteria on micro1's pages list 30+ employees, mature operations and primarily English documentation. - **Workflows track.** Employees use an AI agent on real daily work and grade it. micro1 receives the grades and the agent's trajectory. The company chooses how many employees take part. - **Referral.** An introduction of another company. Idler says it licenses codebases and de-identified operating data from businesses with 10 to 100 employees. It publishes no price. Below those minimums, the public routes thin out fast. ## What is the gap in the demand case? Epoch's review of RL environments describes app replicas and lab partnerships with product companies, and does not discuss real company archives. Marketplace copy keeps buyers generic. No public record shows the price a working company with ten years of CRM history gets. Start with the [rights check](/rights-check). Talk to a privacy or commercial lawyer in your state before you sign. Figure: range, RL environment task, per task, $200 to $2K. RL environment tasks vary tenfold in price, per Epoch's interviews. Source: Epoch AI interviews with RL environment vendors. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # How fast should a buyer de-identify your data? > De-identification timelines set the days a buyer has to remove names after extraction. Polyshares' Ryan Lock suggests about 14 days and a deletion certificate. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-deidentification-timeline-after-extraction Published: 2026-09-21 Updated: 2026-10-14 ## The short answer A de-identification timeline says how many days a buyer has to take names out of your data. Ryan Lock of Polyshares suggests asking for about 14 days and a deletion certificate. That is one buyer's advice, not a rule. Until the names are out, the buyer holds your raw data. De-identification means taking names and other details out of records. The timeline is how long the buyer takes to do it. ## Why does the gap matter? Lock calls the time between extraction and finished de-identification the riskiest period for an owner ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). Our page on [safety](/answers/is-it-safe-to-sell-company-data-to-ai) says that in most models a buyer handles raw data before names come out. Mercor's breach in March 2026 is the dated test case. Reports put about four terabytes at risk. See the [breach page](/answers/mercor-data-breach). 1. **Extract** Data leaves your systems. 2. **Raw files held** Names still inside. 3. **De-identified** Names come out. 4. **Raw deleted** Ask for a certificate. _The risk sits in steps one to three. A deadline shortens it._ ## What does the article suggest? Ask for de-identification to finish within about 14 days of extraction, scaled to the size of the data. Ask for a certificate of deletion once the raw files are transformed. Lock also says most deals include no such terms. That is his view, and we found no survey to confirm it. ## Do the companies handle raw data the same way? No. Lock says third-party firms do the work so [Polyshares](/buyers/polyshares) never touches raw files. Its data handling page says two Polyshares people can see an unmasked record ([page](https://polyshares.com/data-handling)). [micro1](/buyers/micro1) staff said in an undated recorded forum talk that micro1 transforms data itself. micro1's David Revland described swapping names for consistent stand-ins. See [micro1 PII transformation](/answers/micro1-pii-transformation). [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), a law firm, advises limiting access to raw data and requiring certification of the de-identification to your satisfaction. ## What belongs in the contract? 1. A completion date. 2. Who does the work. 3. A deletion certificate. 4. What happens if the date slips. Read [data de-identification](/answers/data-de-identification) first. Talk to a privacy lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [X article](https://x.com/RyanLockAI/status/2107864069105389717) - [polyshares.com](https://polyshares.com/data-handling) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # License Salesforce data to AI: terms, export, Slack > Trying to sell Salesforce data to AI? Before a license, know Salesforce puts data legality on you and gives 30 days to export after termination. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-salesforce-data-to-ai Published: 2026-09-21 Updated: 2026-10-14 ## The short answer Read your Salesforce agreement first. It makes you responsible for your data's legality and gives you 30 days to export after termination. Mercor and Troveo name Salesforce accounts, contacts and opportunities. Slack's API terms bar third-party apps from using API data to train an LLM. This page covers what is specific to Salesforce. The general case for CRM records is on our [CRM data page](/answers/sell-crm-data-to-ai). ## Which Salesforce records do the companies name? [Mercor](https://www.mercor.com/data/) lists Salesforce accounts, contacts, opportunities and reports. [Troveo](https://www.troveo.ai/business-data) names Salesforce, and [micro1](https://www.micro1.ai/data-partnerships) lists CRM data. All of them are companies describing their own programs. ## What does the Salesforce agreement say about your data? [Section 6.2](https://salesforce.com/company/msa.jsp) says Salesforce acquires no right, title or interest in Customer Data beyond a limited license to run the service. Section 3.3 puts responsibility for the accuracy, quality and legality of Customer Data, and the means by which you acquired it, on you. Section 2.5 says processing by the AI features follows your documented instructions. None of this authorizes licensing. It tells you the legal duty stays with the customer. ## How do you export it? Setup has a Data Export Service. Weekly exports run on Enterprise, Performance and Unlimited editions, and Professional and Developer editions export every 29 days. The files arrive as CSV in zip archives, and Salesforce deletes the zips 48 hours after the email is sent ([Salesforce Trailhead](https://trailhead.salesforce.com/content/learn/modules/lex_implementation_data_management/lex_implementation_data_export)). ## What if the company is closing? The agreement gives you 30 days after termination to ask for your Customer Data. After that Salesforce has no duty to keep it and deletes it. Make the data decision before you cancel. Our [shutdown checklist](/guides/startup-shutdown-checklist-ai-data) puts that step in order. ## What do Slack's API terms add? Slack's chat product sits inside the Salesforce family, and its [API terms](https://slack.com/terms-of-service/api) are tighter. They bar apps from using API data to train a large language model and from bulk exporting Slack message and file data, unless an additional agreement allows it. They cover API access by third-party apps, and I didn't verify how they treat an admin's own export. See [what Slack allows with exported data](/answers/does-slack-allow-ai-companies-to-use-my-exported-data) and [licensing Slack data](/answers/sell-slack-data-to-ai). Contact records are also personal data. See [CCPA sales](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa). Talk to a privacy or commercial lawyer in your state before you sign. Our [rights check](/rights-check) asks what personal data the records hold and what your customer contracts allow. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two time limits on Salesforce data: Export Service files (Gone in 48 hours), Post-termination export (emphasized: Applies when a company closes, Ask within 30 days). After termination Salesforce makes Customer Data available for export only if the customer asks within 30 days. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor](https://www.mercor.com/data/) - [Troveo](https://www.troveo.ai/business-data) - [micro1](https://www.micro1.ai/data-partnerships) - [Section 6.2](https://salesforce.com/company/msa.jsp) - [Salesforce Trailhead](https://trailhead.salesforce.com/content/learn/modules/lex_implementation_data_management/lex_implementation_data_export) - [API terms](https://slack.com/terms-of-service/api) --- # micro1 data partnership Canada: who can apply? > micro1 data partnership Canada: Canadian companies can apply, with US companies prioritized. What an undated forum talk and micro1's pages say. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-data-partnership-canada Published: 2026-09-21 Updated: 2026-10-14 ## The short answer Canadian companies can apply. micro1 said in an undated recorded forum talk that it prefers US and Canadian companies and is open to others. Its data partnerships page lists the US, UK and Canada where demand is strongest. Its referral page says US Prioritized. All self-reported. Three sources on the [micro1 data partnership](/guides/micro1-data-partnership) mention place. They agree on the US first and differ on who comes next. ## What does each source say? - **Recorded forum talk:** prefers US and Canadian companies, open to others (recording, date not stated). - **[Data partnerships page](https://www.micro1.ai/data-partnerships):** US companies, followed by other Western markets, with the United States, United Kingdom and Canada named for the strongest demand. - **[Referral page](https://www.micro1.ai/company-referral):** "US Prioritized", then other Western markets, with no country named after the US. ## Does a Canadian company follow a different process? I found nothing saying so. The steps on the [process page](/answers/micro1-data-partnership-process) are the only ones micro1 has described, and they name no country. ## Do the other thresholds change in Canada? None of the sources adjusts them by country. micro1's current pages say 30 or more employees and primarily English documentation, and state no data-size threshold. An undated micro1 forum talk gave different, earlier figures, and the [requirements page](/answers/micro1-data-partnership-requirements) dates both. ## What about Canadian privacy rules? Privacy law differs by country and province. The pages I read do not say how micro1 handles Canadian law, and I'm not giving legal advice. Raise it with counsel, and ask micro1 where the data is stored and who can see it. [How micro1 transforms names](/answers/micro1-pii-transformation) is the starting question. ## What if you sit outside the US and Canada? micro1 said in the talk that it is open to others, and its pages name other Western markets after the US. Neither says what that means for a company in your country, so ask on the first call. Talk to a privacy or commercial lawyer in your province or state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of How micro1's three sources name the places it prefers: Forum talk (emphasized: Only one pairing US and Canada, US and Canada), Data page (US, UK, Canada), Referral page (US first). Only the undated recorded forum talk pairs Canada with the US as micro1's preferred markets. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Data partnerships page](https://www.micro1.ai/data-partnerships) - [Referral page](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Can I license source code to AI? > Trying to sell source code to AI? You'd license it after checking open-source licenses, client code and export controls. The GitHub ruling left claims open. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-source-code-to-ai Published: 2026-09-20 Updated: 2026-10-14 ## The short answer Check three things first: open-source licenses, client-owned code, and export controls. The Ninth Circuit rejected DMCA claims against GitHub but left open-source license claims alive. Under export rules, releasing code to a foreign person in the US counts as an export. A lawyer must read your licenses and contracts. Code looks like the cleanest asset in a company, since you wrote it. Repositories rarely stay that clean, and I'd open the license report before anything else. ## What is inside my repositories? Open-source packages arrive with licenses, and some licenses carry attribution or sharing duties. [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) lists licensed code, vendor data and third-party copyrighted material as items needing careful review before a licensing deal. Code written for a client may belong to the client under the contract. A lawyer checks each client agreement. ## What did the Ninth Circuit decide in Doe v. GitHub? In [Doe v. GitHub](https://www.eff.org/files/2026/09/16/doe_v_github.pdf) (No. 24-7700, 16 Sep 2026) the panel held that Section 1202(b) of the DMCA reaches acts against copyright management information attached to an existing work. It didn't reach newly generated output that never contained that information. Two claims over breach of open-source license terms continue in the district court. Whether the GPL's sharing terms reach a model trained on GPL code is untested in the sources I read. ## Why do export controls come up? The EAR defines "deemed export" at [15 CFR 734.13(a)(2)](https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-734/section-734.13): releasing or transferring technology or source code to a foreign person in the United States. The text covers a release inside the United States, so a buyer or its labeling team with foreign-national staff can be the trigger. That's my reading. I didn't research export law beyond this section, so export-controls counsel should take it from here. ## What about code written for clients? Our readiness checklist lists repositories and runs a license report, then hands clearance to counsel. [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) lists chain of title as the first item in a training-data agreement, meaning who owns or controls each component of the dataset. Code with mixed ownership makes that line hard to write. Talk to a commercial lawyer in your state before you sign. The [rights check](/rights-check) asks about customer contracts, NDAs and who can sign, and the free [fit check](/business) asks whether code repositories are among your systems. Neither reviews open-source licenses. Figure: steps List repos, scan licenses -> Client code, export controls -> Counsel clears. Checks on the code come before counsel clears the license. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Doe v. GitHub](https://www.eff.org/files/2026/09/16/doe_v_github.pdf) - [15 CFR 734.13(a)(2)](https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-734/section-734.13) - [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) --- # micro1 vs Troveo: data partnership or marketplace > micro1 vs Troveo for company data: a direct data partnership with stated tiers against a revenue-share marketplace. Minimums, payment and privacy. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-vs-troveo Published: 2026-09-20 Updated: 2026-10-14 ## The short answer micro1 vs Troveo: micro1 pays companies under data partnerships with stated tiers ($100K+, $500K+, $1M+), while Troveo is a marketplace paying a share of the revenue on every deal. In both, you keep ownership of the data. Troveo publishes no minimum staff count. micro1's pages say 30 or more. The two firms solve the same problem with different payment shapes. Facts below come from the firms unless a source is named. ## How do micro1 and Troveo pay? [micro1](/buyers/micro1)'s [pages](https://www.micro1.ai/data-partnerships) list $100K+, $500K+ and $1M+ tiers, set per deal. Its Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. Payment comes as compensation under the agreed data partnership, so confirm the payment structure in the proposed agreement. In an undated recorded forum talk, David Revland, who works on human data at micro1, also mentioned a possible top-up about six months later covering newer data. [Troveo](https://www.troveo.ai/business-data) says it pays you "on every sale, not just the first." It publishes no split and no price list, and its [guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) says typical full-company deals start at six figures. It cites an unnamed platform's baseline of about $5,000 for a single repository. Figure: comparison of How two programs pay companies for data: micro1 (Paid under a partnership), Troveo (emphasized: Pays again on every deal, Share of each deal). Troveo is emphasized because its pay repeats on every deal, while micro1 pays under the terms of each partnership. ## Who qualifies? micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. Confirm exceptions directly with micro1. [Troveo](/buyers/troveo)'s business-data page states no staff minimum, and its guide says a small firm with a decade of specialized records can hold more training value than a large one with generic data. ## What changes hands? micro1 says companies keep ownership of their underlying data. Confirm licensed uses, duration, exclusivity and payment structure in the proposed agreement. In the undated recorded talk, Revland described a transfer of the corpus that micro1's engineers walk your team through. Troveo says you license, keep ownership and grant a defined right for a defined purpose and period. ## How do they handle privacy? micro1's David Revland said in an undated recorded forum talk that micro1 transforms names into consistent stand-ins across tools. micro1 staff said companies cannot pre-scrub. Troveo says names, contact details, credentials and client identities are scrubbed under one documented standard. That standard is not published, so ask for it in writing. For each firm alone, see [how micro1's data partnership works](/guides/micro1-data-partnership) and [is Troveo legit](/answers/is-troveo-legit). Run the [rights check](/rights-check) first, and talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [pages](https://www.micro1.ai/data-partnerships) - [Troveo](https://www.troveo.ai/business-data) - [guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) - [Troveo: AI data licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Troveo content owners](https://www.troveo.ai/content-owners) --- # How long does a data transfer take? > How long does a data transfer take? micro1's CFO estimated about 10 hours of IT work over one to two weeks, in an undated talk. Others publish none. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-long-does-a-data-transfer-take Published: 2026-09-19 Updated: 2026-10-14 ## The short answer A data transfer takes about one to two weeks. micro1's CFO estimated, in an undated talk, about 10 hours of IT work over that time, with micro1's engineers helping. A micro1 referral partner said no tech department is needed, so the accounts differ. Other programs publish no transfer time. A transfer is the step where your records move from your tools to the program, buyer or marketplace you work with. How long it takes depends on the tools you run and how much data each holds. ## What did micro1 say about transfer time? In an undated, recorded Company Data Partnerships forum talk, [micro1](/buyers/micro1)'s CFO said the transfer takes about 10 hours of work over a week or two from one or two IT people at the company. micro1's forward-deployed engineering team helps your IT people run it (self-reported, recording, date not stated). Ten hours is the company's effort. The elapsed time of one to two weeks is mostly waiting for exports and access, and the talk gave no breakdown. ## Can a company with no IT team do this? micro1 gave two descriptions, side by side. | Speaker | What was said | Time stated | |---|---|---| | micro1's CFO, undated recorded forum talk | "One or two people on the IT side," then "a single person" | About 10 hours over a week or two | | A micro1 referral partner, micro1 video | No tech department, engineers or IT directors needed, no heavy lifting | Two to three weeks, interested to finished | Both are micro1 speakers describing the program. The partner earns from referrals and the video is promotional. Whether a company with no IT person can finish is unconfirmed, so ask micro1 in writing who must do what on your side and who holds the admin access. ## What comes before and after the transfer? The transfer is step six of the seven steps David Revland, who works on human data at micro1, described in the undated talk for a corpus deal. A referral or intro, a first call, a data manifest form, a payment proposal and contract language come first. Revland said micro1 verifies the delivered data before it pays. The whole path is in the [micro1 data partnership guide](/guides/micro1-data-partnership). ## Do other buyers publish a transfer time? Not for company data. [Mercor's data page](https://www.mercor.com/data/) says payment is a wire on delivery of the anonymized dataset, typically within two to four weeks of agreement. That is a payment window, and it says nothing about how long the owner's side takes. [Handshake AI's company referral page](https://joinhandshake.com/ai/data-partnerships/referral) says its team reaches out to a referred company within one to two days and then holds a scoping call. SimpleClosure and Troveo publish no transfer time I could find. ## What speeds your side up? Know your sizes before the first call. micro1's David Revland said in an undated talk that the manifest form asks for rough sizes per tool and that micro1 supplies instructions for finding them, for example in Google Drive. A list of the tools you use and who administers each one removes most of the waiting. The [rights check](/rights-check) covers the rights questions that come before the transfer, and [how to license company data to AI companies](/guides/how-to-sell-company-data-to-ai-companies) shows where the transfer sits in a full deal. Figure: range, Elapsed time for micro1's data transfer, 7 days to 14 days. micro1's CFO estimated in an undated talk that the transfer runs one to two weeks, with about 10 hours of IT work. Source: micro1 CFO in an undated recorded forum talk, self-reported. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's data page](https://www.mercor.com/data/) - [Handshake AI's company referral page](https://joinhandshake.com/ai/data-partnerships/referral) --- # Who is liable if the data buyer is hacked? > Who is liable if the data buyer is hacked? No company-data deal publishes the answer. Published terms put indemnity on the owner and cap buyer liability. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/who-is-liable-if-the-data-buyer-is-hacked Published: 2026-09-19 Updated: 2026-10-14 ## The short answer No public source says who is liable if a data buyer is hacked in a company-data deal. SimpleClosure's terms have the owner indemnify the buyer. All 50 states have breach-notification laws, and who must notify depends on the contract. Insurers are adding AI exclusions. A breach at a buyer is a live question. In March 2026 a poisoned open-source release exposed [Mercor](/buyers/mercor), an AI data company. The story is in [Mercor data breach](/answers/mercor-data-breach). ## What do published buyer terms say about breach liability? Very little, and what they say favors the buyer. [SimpleClosure's terms](https://simpleclosure.com/tos/) make the owner indemnify [SimpleClosure](/buyers/simpleclosure), which means cover its losses. That covers three things: - breach of warranties - privacy-law violations - claims tied to personal information in the owner's data They cap SimpleClosure's own liability at the greater of the amount paid in the prior six months or $100. ## Who has to notify people after a breach? All 50 states, the District of Columbia and several territories have breach-notification laws ([National Conference of State Legislatures](https://www.ncsl.org/technology-and-communication/security-breach-notification-laws)). Who must notify after a breach at a licensee depends on the contract. It also depends on whether the data was licensed or sold. That is a question for counsel before the deal. After an incident it is late. California adds a duty on the seller side. A business that sells personal information has to keep reasonable security in place alongside the sale contract ([California Civil Code 1798.100(d) to (e)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). ## Does insurance cover it? Don't assume so. [Fenwick's](https://www.fenwick.com/insights/publications/end-silent-ai-emerging-ai-exclusions-coverage-fragmentation-and-practical-implications) review sorts the policy types: - Cyber policies are relatively stable. - Tech errors and omissions forms face growing scrutiny. - Directors and officers and employment practices forms show the biggest change. Broad "absolute" AI exclusions are appearing. ISO introduced generative-AI exclusions for general liability forms in January 2026. Fenwick's advice is to read insuring agreements, definitions and exclusions together. Ask your buyer or insurer in writing whether a claim from an AI data license would be covered. If someone says the deal itself is insured, [what to ask for when a deal is called insured](/answers/can-you-insure-an-ai-data-licensing-deal) has the checklist. ## What should you ask before you sign? Ask who holds the data and where. Ask who must notify after a breach, who pays for the loss and which policy responds. Get each answer in writing. The [rights check](/rights-check) covers your own side: contracts, personal data and who can sign. The [risks page](/risks) tracks what buyers publish about security. Figure: steps Who holds and who notifies -> Who pays for the loss -> Which policy responds. A breach question gets written answers before you sign. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [SimpleClosure's terms](https://simpleclosure.com/tos/) - [National Conference of State Legislatures](https://www.ncsl.org/technology-and-communication/security-breach-notification-laws) - [California Civil Code 1798.100(d) to (e)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [Fenwick's](https://www.fenwick.com/insights/publications/end-silent-ai-emerging-ai-exclusions-coverage-fragmentation-and-practical-implications) Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) --- # AI data broker red flags, ranked with examples > AI data broker red flags ranked: a headline payout with no method, no terms page, conflicting totals, unnamed buyers, hidden fees and new domains. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/ai-data-broker-red-flags Published: 2026-09-18 Updated: 2026-10-14 ## The short answer Red flags for AI data brokers are a headline payout with no method, no named legal entity, missing terms or privacy pages, conflicting payout totals, unnamed buyers, or an unpublished fee. Each takes minutes to check. Payout figures here are self-reported and not guaranteed. People search for "data broker" when they mean an AI data company, but legally a data broker resells consumer data and has to [register in some states](https://cppa.ca.gov/data_broker_registry/). On this site I call AI data companies buyers. ## Which red flags matter most? I ranked these by how much each one can cost an owner if it goes wrong: 1. **A headline payout with no method behind it.** A homepage range tells you little until the buyer shows how it reaches a number for a company your size. If the site offers a calculator, compare its top result with the headline. A gap between the two is the first thing I'd ask about. 2. **No named entity or live terms.** [Troveo](/buyers/troveo)'s footer names no legal entity, and its `/terms` path returned 404. A missing privacy page is the same warning. 3. **Totals that disagree across its own pages.** Troveo shows $20M+ paid on its [business-data page](https://www.troveo.ai/business-data) and $50M+ on its [content-owners page](https://www.troveo.ai/content-owners). [Handshake AI](/buyers/handshake-ai) shows [$250M paid to partners](https://joinhandshake.com/ai/data-partnerships/referral) on one page and $500M+ in payouts on another. Company-wide totals predict nothing about your deal anyway. 4. **Buyers that are never named.** [Troveo's page](https://www.troveo.ai/business-data) says "Mag 7 company." A site that hands you to an unnamed "partner" leaves you unable to check who ends up holding your data. 5. **A fee or split that isn't published.** Troveo's revenue share is not stated as a percentage. A success fee with no stated percentage is the same gap. 6. **A brand-new domain with big claims.** A domain registered weeks before the pitch is worth a lookup. Domain age is a weak signal on its own, because Mercor's domain predates the company. ## Do these flags mean a buyer is a scam? Nothing I found says that. Each flag is a missing disclosure or a mismatch, and a legitimate firm can show several in its first months. Handshake AI publishes a range and a process, and still shows two different payout totals, as above. ## Why do owners doubt the pitch? A [micro1](/buyers/micro1) referral partner said in a micro1 video that at least 90% of owners first think it is too good to be true (self-reported, about 10:42). Her reply was that AI makes data worth a premium, and the video gives no price. The evidence on sizes stays with micro1's pages, its CFO's undated recorded forum talk and the [deals tracker](/deals). ## What do you ask when you spot one? I'd ask for the contracting entity, the written fee, the buyer categories and the owner agreement. Then I'd ask which group each payout total counts. If a buyer can't answer in writing, pause before sharing anything. Check your own side too. The [rights check](/rights-check) lists what you must hold, and the [risk map](/risks) lists failure points. The full process is in [how to choose an AI data broker](/guides/how-to-choose-an-ai-data-broker), and [best AI data brokers](/guides/best-ai-data-brokers) lists who handles company data. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [register in some states](https://cppa.ca.gov/data_broker_registry/) - [business-data page](https://www.troveo.ai/business-data) - [content-owners page](https://www.troveo.ai/content-owners) - [$250M paid to partners](https://joinhandshake.com/ai/data-partnerships/referral) --- # Troveo business data: how the program works > Troveo business data program: four steps from estimate to payment, the systems it lists, what it charges and what it leaves unpublished. Self-reported By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/troveo-business-data Published: 2026-09-18 Updated: 2026-10-14 ## The short answer Troveo business data lets companies export records in four steps: get an estimate, agree terms, have Troveo package the data and, it says, anonymize it, then share revenue on each deal. Troveo says full-company deals start at six figures. The revenue share is unpublished. Every figure is Troveo describing itself. [Troveo](/buyers/troveo) started with video and audio and now lists company data too ([announcement](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html)). This page covers how the business-data program works. The evidence on the company is in [is Troveo legit](/answers/is-troveo-legit). ## How does the Troveo business data program work? Troveo's [business-data page](https://www.troveo.ai/business-data) lays out its process in order. Figure: steps Scope and agree terms -> Troveo says it anonymizes -> Get paid. Troveo's process runs from scoping your data to getting paid. You answer a few questions for an estimate, sign standard terms, and Troveo says it anonymizes and packages the data with a manifest. It says nothing connects to your systems. You export the data, with Troveo guiding you, and it handles buyer conversations. ## What data does it list? Eight system groups: chat, email and calendar, documents, work tools, CRM and support, business platforms, finance, and data and code. Named examples include Slack, Gmail, Google Drive, Jira, Salesforce, QuickBooks and GitHub. The page also invites internal and custom systems. It states no minimum headcount. Its estimate tool's headcount options start at 20, which is a form setting rather than a stated floor. ## What does Troveo say it pays? You "share in the revenue" on every sale, the first and each later one. Troveo says typical full-company deals [start at six figures](https://www.troveo.ai/resources/how-much-is-company-data-worth) and that a dataset can be sold again as new products, such as enriched sets and feeds. The estimate tool's default shows $800K to $1M, labelled illustrative. Its FAQ says owners pay nothing: no fees, no setup costs, no deductions from payouts. The split between you and Troveo isn't published. See [Troveo revenue share](/answers/troveo-revenue-share). ## What does it say about privacy? Names, contact details, credentials and client identities are scrubbed "under one documented standard," and buyers are introduced only after you sign. The standard isn't published, so nobody outside can check it. Exclusivity is "time-limited" and ["has to be earned,"](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) with exit terms in the agreement. ## What should you check first? Request the owner agreement and the written standard, then run the [rights check](/rights-check) on every system you plan to export. Compare Troveo with other buyers in the [buyers directory](/buyers). Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [announcement](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html) - [business-data page](https://www.troveo.ai/business-data) - [start at six figures](https://www.troveo.ai/resources/how-much-is-company-data-worth) - ["has to be earned,"](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - [Troveo: AI data licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Troveo content owners](https://www.troveo.ai/content-owners) --- # Anonymize Slack export: who does it in a data deal > Anonymize a Slack export before a data deal? micro1, Troveo and Mercor each say they do the anonymizing themselves. What a Slack export holds, and the limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/anonymize-slack-export Published: 2026-09-17 Updated: 2026-10-13 ## The short answer micro1, Troveo and Mercor each say they anonymize the Slack export themselves, not you. A Slack export holds names in the user list and message text, so masking one leaves the other exposed. Ask each program in writing about its standard and certification. The short version: hand over what the company you license to asks for. Then ask who changes it, with what standard, and who certifies the result. ## What is inside a Slack export? [Slack's help page on reading exports](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) says each channel or direct message gets its own folder, with JSON files by date. Each message carries a user ID, the text and a timestamp. A `users.json` file maps the IDs to people. The page says mentions appear in the message text itself. Files come through as links back to your workspace. The files themselves stay behind. ## Why does masking the user list not anonymize it? The sender field is one place a person shows up. The text field is free-form. A message can name a customer, a colleague or a project in any form someone typed. My reading is that a mask on `users.json` leaves those untouched. Slack's page doesn't discuss anonymization, so that's my inference from the structure it describes. Names swapped for stand-ins can still count as personal data. The [UK ICO says](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) pseudonymised data is personal data in the hands of someone who holds the additional information. See our [pseudonymization page](/answers/pseudonymization-vs-anonymization). ## Who anonymizes the data in practice? Each of these is the company describing itself. - **[micro1](/buyers/micro1).** micro1's David Revland, who works on human data, said in an undated recorded forum talk that micro1 swaps each name for a consistent stand-in across tools. The role and the trail survive. micro1 staff said in the same talk that companies cannot pre-scrub. See [micro1 PII transformation](/answers/micro1-pii-transformation). - **Troveo.** Its [business data page](https://www.troveo.ai/business-data) says it handles the anonymization, packaging and buyer talks. It says anonymization follows its standard, documented in a manifest. The page gives no technical detail of the standard. - **Mercor.** Its [data page](https://www.mercor.com/data/) says extraction and anonymization are fully automated. It says no AI lab buyer or third-party vendor sees raw data. In the Spirit Airlines sale, the court ombudsman's [report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) says Tonic.ai de-identifies unstructured data under a certification. The certification is filed before each transfer. See [data de-identification](/answers/data-de-identification). ## What does your company do, then? I'd gather the facts a buyer will ask for: - Which channels exist. - The date range. - Who can run an export on your Slack plan. - Which channels hold customers' or partners' messages. - Which channels you want left out. Counsel's [checklist from Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) makes two points. Leave out categories such as HR files, union communications and customer confidential data entirely, and do not rely on de-identification. Also limit who sees raw data before it is de-identified. My [readiness checklist](/answers/data-readiness-checklist) covers the inventory. The [managed readiness service](/managed-readiness) lays out the de-identification options and the published methods for your counsel. It never touches the data. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps You hand over the export -> micro1 swaps names, samples -> micro1 uses the data. Revland and the CFO of micro1 said in an undated recorded forum talk that micro1 swaps names for stand-ins itself and samples the result before use. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Slack's help page on reading exports](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) - [UK ICO says](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [business data page](https://www.troveo.ai/business-data) - [data page](https://www.mercor.com/data/) - [report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [checklist from Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # What is human data? > What is human data? Data that people produce on request, such as expert grading and demonstrations, sold to AI labs. How it differs from company data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-human-data Published: 2026-09-17 Updated: 2026-10-13 ## The short answer Human data is data people produce on request to train and test AI models, like expert answers, grading and rankings. AI labs buy it from vendors that recruit contractors. Deedy Das estimated that 50+ companies sell data and RL environments, with total revenue near $8.5B. ## What does human data include? Anything a person is paid to produce for a model. Experts write ideal answers, compare two model outputs, grade a long task or record themselves doing work. Vendors recruit and manage the contractors and sell the results to labs. [micro1](/buyers/micro1)'s [human data page](https://www.micro1.ai/human-data) lists expert data and evaluation environments built with domain specialists across 100+ fields, along with services for recruiting, performance tracking and robotics demonstrations (micro1, self-reported). ## How big is the market? Estimates are rough. Deedy Das posted that more than 50 companies sell AI training data and RL environments, that together they bring in about $8.5B and that Scale, Surge, Mercor and Handshake make up over 75% of it ([X](https://x.com/deedydas/status/2076124392711696455)). It is one person's estimate. [TechCrunch reported](https://techcrunch.com/2026/08/20/ai-data-startup-micro1-reaches-500m-gross-run-rate-amid-ai-training-boom/) that micro1 reached a $500M gross annual run rate, per a person familiar with the company, with net near $150M to $200M. Gross figures count revenue before contractor payouts. ## How is human data different from company data? Human data is made to order. A vendor recruits people, sets the task and pays them for their time. Company data is a by-product. Your tickets, emails and spreadsheets exist because you ran a business. micro1 works on both, with a human data business and a separate company data program. Its CFO said in an undated recorded forum talk that the real world is the ideal training environment (self-reported). Our [RL environment entry](/answers/what-is-an-rl-environment) explains where records get used. ## Where does a company's own data fit? Your stored records sit in the company-data lane. Nobody made them to order, so the first questions are about rights and consent. Run the [rights check](/rights-check) or the free [fit check](/business). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Two things AI labs buy from vendors: Human data (emphasized: The term this entry defines, Made to order), Company data (Already exists). Human data is made to order by paid people, which is the contrast this entry defines. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [human data page](https://www.micro1.ai/human-data) - [x.com](https://x.com/deedydas/status/2076124392711696455) - [TechCrunch reported](https://techcrunch.com/2026/08/20/ai-data-startup-micro1-reaches-500m-gross-run-rate-amid-ai-training-boom/) --- # What is workflow data? > What is workflow data? In AI data deals it is the trail of a task across tools, request to deliverable. Fortune calls the agent version a trajectory. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-workflow-data Published: 2026-09-17 Updated: 2026-10-13 ## The short answer Workflow data is the record of how work moved across tools, from request to deliverable. micro1's CFO used a marketing budget request as the example, and David Revland of micro1 used a Slack request with the report in Google Sheets. The terms overlap, and no standard glossary exists yet. The phrase has no formal definition, so I'm following how buyers use it. ## What does workflow data contain? [micro1](/buyers/micro1)'s CFO said in an undated recorded forum talk that what labs want is the chain from communication to deliverable: the request, the tools used, the output and what came after. In the CFO's budget example, the value was the path from request to analysis to approval, and the names and vendors inside it mattered less (self-reported). ## Is it the same as a trajectory? Close, but the words come from different places. [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) says micro1 would rebuild links such as an IT ticket tied to a Teams discussion, a code change and an operational result, to test whether agents reach correct outcomes. [Epoch AI](https://epoch.ai/gradient-updates/state-of-rl-envs) defines a task as a prompt plus a grader and describes "gold trajectories" as human-verified examples of completing a task. Workflow data is the human trail in the records. A trajectory is the step record an agent produces or learns from. The [RL environment page](/answers/what-is-an-rl-environment) shows where each is used. ## Is it the same as the workflows track? No. The [workflows track](/answers/micro1-workflows-track) is a micro1 program in which employees grade an AI agent on their real tasks and micro1 receives the grade plus the agent's trajectory. Workflow data is the kind of record the term names, wherever it sits. ## How is it different from operational data? Operational data is the wider label for records a company produces while working. Workflow data is the part that keeps the links between them. See [what operational data is](/answers/what-is-operational-data). ## What does it mean if you hold it? The links that make workflow data valuable can also point back to people. See the [re-identification page](/answers/re-identification-risk-emails). Rights to the records come first, and the [rights check](/rights-check) lists the facts counsel will ask for. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps A request -> Work across tools -> Deliverable and approval. micro1's CFO described the chain with a budget request: the request, the analysis and back-and-forth across tools, then the approval. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Epoch AI](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # AI data licensing deals: a dated roundup > AI data licensing deals with public prices, dated: Spirit Airlines, SimpleClosure, Reddit and Google, Shutterstock and News Corp. Sources beside each. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/ai-data-licensing-deals Published: 2026-09-16 Updated: 2026-10-14 ## The short answer Public AI data licensing deals fall into two groups. Company-data deals are few and recent. The largest is Google's $10M winning bid for Spirit Airlines' archive, pending court approval. Content deals are older and bigger, like Reddit and Google at about $60 million a year. Here is a dated list of public prices. Each row says who reported it. A second table covers the content deals that sit next to the company-data market. **$10M** Google's winning bid for Spirit Airlines' archive ([source](/answers/spirit-airlines-data-sale)) ## Which company-data deals have a public figure? | Deal | Date | Reported figure | Source | |---|---|---|---| | Google's winning bid for Spirit Airlines' archive, pending court approval | Aug 2026 | $10M winning bid. Mercor alternate at $7.5M | [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/), [ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) for the alternate bidder | | micro1 offer for the same archive | 14 Sep 2026 | $12.5M | [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) | | SimpleClosure Asset Hub | Apr 2026 | Nearly 100 deals, $10,000 to $100,000 each | [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) | | Mercor offers to shuttered startups | Aug 2026 | Up to $300,000, reported | [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) summary of The Information | The Spirit sale has no court approval yet. See the [Spirit Airlines data sale](/answers/spirit-airlines-data-sale) for its status, and the [deals tracker](/deals) for each figure as it changes. _A bid is not a sale. Always check the verb._ ## Which content deals sit next to it? | Deal | Date | Reported figure | Source | |---|---|---|---| | Reddit and Google | Feb 2024 | About $60M a year | Reuters, via [The Decoder](https://the-decoder.com/reddit-signs-60-million-annual-training-data-deal-with-google/) | | Reddit, licensing revenue | Aug 2026 | $43M "other revenue" in Q2 2026, about 5% of revenue | [Yahoo Finance](https://finance.yahoo.com/media-advertising/articles/reddits-data-licensing-revenue-grew-125000998.html) | | Shutterstock AI licensing | Jun 2024 | $104M in 2023, per its CEO | [Bloomberg Law](https://news.bloomberglaw.com/artificial-intelligence/shutterstocks-ai-licensing-business-generated-104-million) | | News Corp and OpenAI | May 2024 | About $250M over five years, per the WSJ | [VentureBeat](https://venturebeat.com/ai/openai-partners-with-wall-street-journal-publisher-news-corp) | Publishers' own filings add a revenue view. Wiley reported $49.1M of AI license revenue for its year to April 2026 in [Wiley's 2026 10-K](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm). [What publishers earn from AI licensing](/answers/what-do-publishers-earn-from-ai-licensing) reads those numbers for a private company. These content deals license published content with a clear source. A company's internal records are a different product. The deals show that buyers pay for licensed data. They say little about what an email or ticket archive earns. ## What does Troveo say it has paid? Troveo says it has paid more than $20 million to rights holders across video, audio, gaming, robotics and now business data ([its guide](https://www.troveo.ai/resources/ai-data-licensing-deals), self-reported). The total covers every data type, so it can't stand in for what company-data owners get. ## What do the deals have in common? Each public price attaches to a whole archive, a whole catalog or a company's published headline. No source I read publishes a price per record, per token or per employee. Reddit adds a dry footnote. [Yahoo Finance's report](https://finance.yahoo.com/media-advertising/articles/reddits-data-licensing-revenue-grew-125000998.html) on its results says licensing is "immaterial today" next to advertising, which brought in $762 million in the same quarter. ## How should you read a roundup? I check three things: the date, the reporter, and whether the number is a bid, a completed sale or a buyer's claim. My [pricing models page](/answers/data-monetization-pricing) explains how deals pay. [Who buys company data](/buyers) compares the buyers. The [rights check](/rights-check) comes before any price talk. Figure: scale, Reported archive prices: SimpleClosure archive deals $10K to $100K, Google's winning bid for Spirit $10M (emphasized). Most reported archive prices sit far below the one big bid. Source: Gizmodo, Time, Fortune. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [ombudsman's report](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [The Decoder](https://the-decoder.com/reddit-signs-60-million-annual-training-data-deal-with-google/) - [Yahoo Finance](https://finance.yahoo.com/media-advertising/articles/reddits-data-licensing-revenue-grew-125000998.html) - [Bloomberg Law](https://news.bloomberglaw.com/artificial-intelligence/shutterstocks-ai-licensing-business-generated-104-million) - [VentureBeat](https://venturebeat.com/ai/openai-partners-with-wall-street-journal-publisher-news-corp) - [Wiley's 2026 10-K](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm) - [its guide](https://www.troveo.ai/resources/ai-data-licensing-deals) --- # License GitHub data to AI: repos, history and checks > Looking to sell GitHub data to AI? You license repos. Troveo names history, pull requests and reviews, and an unnamed platform's $5,000 per repo. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-github-data-to-ai Published: 2026-09-16 Updated: 2026-10-14 ## The short answer To license GitHub data to AI, know what Troveo's guide says labs want: history, pull requests, code review and issues. Troveo's guide cites an unnamed platform's $5,000 baseline per repo. Troveo says buyers check that every contributor assigned work to you. Counsel clears the license and secrets side. Code is the asset startups license first when they shut down. micro1's data partnership asks about it too: David Revland, who works on human data at micro1, named GitHub in an undated recorded forum talk. ## What does Troveo say labs want from a GitHub repository? The whole development story of a GitHub repository, per [Troveo's guide](https://www.troveo.ai/resources/sell-startup-assets-to-ai-labs): full commit history, pull requests and code review, and issues and tickets linked to code. They show how decisions got made. [SimpleClosure's Asset Hub](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/), launched 16 Apr 2026, lists source code as its first product and says it licenses codebases to vetted buyers. The Spirit Airlines archive carried about 30 million lines of code in the archive behind Google's $10M winning bid, pending court approval. My [Spirit Airlines page](/answers/spirit-airlines-data-sale) has the status. ## What does a repository earn? [Troveo](/buyers/troveo)'s guide cites $5,000 per repository as an unnamed platform's baseline, adjusted after grading. Troveo does not name the platform. [SimpleClosure](/buyers/simpleclosure) said its nearly 100 deals paid $10,000 to $100,000 per company, which covers code and workspace data together ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)). Troveo says in [another guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) that there is no public price list. My [deals tracker](/deals) logs public prices as they appear. ## Does micro1 ask about GitHub? [micro1](/buyers/micro1)'s David Revland named GitHub in an undated recorded forum talk. It is one of the tools the data manifest form asks about. ## Who owns the code? [GitHub's terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) say you own your content and that GitHub treats private repository contents as confidential to you. The terms bar using the API to download content in order to sell GitHub users' personal information. Ownership on GitHub's side is the easy part. Troveo says buyers verify that every contributor, including contractors and agencies, assigns work to the company. [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) lists licensed code, open source and vendor code among items needing careful review. ## What about a startup's code? A shutting-down startup holds the same repositories, plus the stockholder and creditor questions on my [shutdown page](/answers/can-a-shutting-down-company-sell-its-slack-to-ai). The legal side of code, including the Ninth Circuit's 16 Sep 2026 ruling in Doe v. GitHub and export controls, is on [can I license source code to AI](/answers/can-i-sell-source-code-to-ai). Talk to a commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Assignments and licenses -> Secrets and customer data -> Counsel clears. The code checks come first. Counsel clears the license last. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's guide](https://www.troveo.ai/resources/sell-startup-assets-to-ai-labs) - [SimpleClosure's Asset Hub](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [another guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [GitHub's terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) - [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # micro1 Slack data: what a workflow trail looks like > micro1 Slack data: Slack is one of the services micro1's manifest asks about. What a Slack-based workflow trail looks like to a lab, and what Slack exports. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-slack-data Published: 2026-09-16 Updated: 2026-10-14 ## The short answer micro1 Slack data is part of the workflow trail micro1's CFO says labs want. Your request in Slack and the report in Google Sheets show how work moves through your company. Slack's export rules vary by plan, and your rights depend on your contracts with employees. Slack matters to a lab because work starts there. The request, the question and the sign-off live in channels and direct messages. ## What does a Slack trail look like to a lab? David Revland, who works on human data at [micro1](/buyers/micro1), gave one example in an undated recorded forum talk on the [micro1 data partnership](/guides/micro1-data-partnership): a Slack message asking for a finance report and the report built in Google Sheets (self-reported, recording, date not stated). [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) describes the prize in the Spirit Airlines sale the same way. It is the record of steps, which it calls a trajectory, and the finished document matters less. Our [RL environment page](/answers/what-is-an-rl-environment) shows where such records get used. ## Is Slack data in demand elsewhere? [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) reported that failed startups were selling old Slack chats and email archives to train AI. Our [shutdown Slack page](/answers/can-a-shutting-down-company-sell-its-slack-to-ai) covers that route. ## What can you export from Slack? [Slack's help page](https://slack.com/help/articles/204897248-Guide-to-Slack-import-and-export-tools) says Free and Pro workspaces can export public channels. Business+ workspaces can apply for exports that include all channels and direct messages, and Enterprise plans offer custom exports. Workspace owners can request them, as can members with the Export Admin role. On the Free plan, exports include file links only from the last 90 days. ## What stands between you and a deal? Messages belong to several parties. Employees wrote direct messages, shared channels contain outside companies' words, and Slack's API terms limit apps, though they say nothing about your own export. [Does Slack allow AI companies to use exported data](/answers/does-slack-allow-ai-companies-to-use-my-exported-data) reads the text. The [rights check](/rights-check) asks whose records these are and whether staff messages are included. micro1 also said it swaps names itself, so see [PII transformation](/answers/micro1-pii-transformation). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps A Slack message asks for a finance report -> The report is built in Google Sheets -> The finished report. micro1's David Revland described a request and its deliverable as one chain. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Slack's help page](https://slack.com/help/articles/204897248-Guide-to-Slack-import-and-export-tools) - [micro1 data partnerships](https://www.micro1.ai/data-partnerships) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # What are expertise traces? An unsettled term, defined > What are expertise traces? A marketing label for records of how professionals work. No standard definition exists, and nearby terms include workflow trajectory. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-are-expertise-traces Published: 2026-09-16 Updated: 2026-10-14 ## The short answer Expertise traces is a marketing label for records of how professionals work: the steps taken, judgment calls made and checks run. No standard definition exists. I found no published price for expertise traces and no established buyer naming them. The phrase sounds like a category. The sources show a marketing tag and a set of older terms that cover the same idea. ## Where does the phrase appear? I found it as a tag on a lead-capture site for company data, with no definition attached and no terms page behind it. The closest wording from a named buyer is [Troveo](/buyers/troveo)'s. Its [release](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html) lists "agentic trajectories (enterprise workflow traces)" among the data categories it sells. ## What does the phrase seem to mean? Read plainly, it's a record of how a professional did the work: the steps taken, the judgment calls made and the checks run before signing something off. That reading is mine. No buyer publishes a definition I could check. ## What do other sources call the same idea? [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/), reporting on the Spirit Airlines archive, says AI companies call the record of an agent's steps a trajectory. [Epoch AI](https://epoch.ai/gradient-updates/state-of-rl-envs) describes training on trajectories that solve a task. [Troveo's glossary](https://www.troveo.ai/glossary) defines a workflow trajectory as a structured sequence showing how a task moved from request to result, and adds that a raw export is not automatically one. It also defines expert demonstrations as examples produced by domain specialists to order. ## Can a company license expertise traces? I found no buyer terms that use the phrase. If a buyer uses it, ask what the files contain and which tools they come from. Our [red flags page](/answers/ai-data-broker-red-flags) lists what else to check. Records of professional work usually sit in an employer's systems and mix in client material. Rights come first, and [who owns company emails](/answers/who-owns-company-emails) shows how the layers split. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Three names for a record of how work was done: Expertise traces (Marketing tag), Trajectory (Fortune, Epoch AI), Workflow trajectory (emphasized: Has a published definition, Troveo's glossary). Workflow trajectory is the one name of the three that a buyer defines in writing. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [release](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [Epoch AI](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Troveo's glossary](https://www.troveo.ai/glossary) --- # Company data valuation service: what is on offer > A company data valuation service gives you an estimate, never an offer. Calculator forms, buyer pricing and success-fee advisors compared on what each asks. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/company-data-valuation-service Published: 2026-09-15 Updated: 2026-10-14 ## The short answer Three kinds exist. Calculators turn headcount and years into a range. Buyers set price after intake. Success-fee advisors take a percentage, agreed in writing. All return estimates, not offers. No outcome promised. [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) says buyers rarely start from a rate card, so any outside number opens a conversation, and that matches how I'd read one. Facts below are self-reported. ## What kinds of valuation service exist? **Calculator forms.** [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) asks for headcount, years and country, and shows $383,083 to $896,969 for 100 staff and 10 years. [Troveo's scope step](https://www.troveo.ai/business-data) gives a directional range and needs no access to your systems. The same forms collect your contact details, as the [price calculator page](/answers/company-data-price-calculator) shows. **Program offers.** micro1's David Revland, who works on human data, said in an undated recorded forum talk that it sends a payment proposal after a data manifest form. [Mercor's page](https://www.mercor.com/data/) says compensation depends on data volume, the tools you connect and the depth of your data. [Handshake AI says](https://joinhandshake.com/ai/data-partnerships/) its payout depends on the data, its due diligence and your acceptance of its terms. **Success-fee advisors.** An advisor usually runs a fit check and a discovery call, then charges a percentage of what you receive, agreed in writing. Ask for the percentage and when it is due before the first introduction. The [advisor page](/answers/data-licensing-advisor) has the rest of the questions. ## What does a valuation service leave out? Rights, most often. A calculator works from a few typed answers, so it can't inspect your systems or confirm which records can be licensed. Whether you may license anything at all is a lawyer's question, so I'd run the [rights check](/rights-check) first. ## What do we do? The fit check, a discovery call, the tools, the guides and introductions are free to your company. The [fit check](/business) scores your answers about your records and, when your answers allow one, shows micro1's own published range with its source. It does not estimate your payout. The company you license to sets the figure. If you want help with the file, [managed readiness](/managed-readiness) is an optional paid service. It produces five pieces: a buyer one-pager, a systems inventory, questions for your counsel, a buyer shortlist with each buyer's current criteria, and a term-question checklist. We build them from descriptions and counts, never records, and deliver in 2 to 3 weeks with two rounds of revisions. It can still end in a no from every buyer. We never take a percentage of your deal, and we give no legal advice. ## What should you ask any valuation service? - What the number is built from. - Whether it asks about your rights. - Who receives your contact details. - What it costs and when you pay. - Whether a buyer has agreed to the figure. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three kinds of company data valuation service: Calculator form (Headcount and years), Buyer pricing (emphasized: The buyer sets the price, Set after intake), Success-fee advisor (Share of payout). Buyer pricing is emphasized because the buyer is the one who sets the price. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [Troveo's scope step](https://www.troveo.ai/business-data) - [Mercor's page](https://www.mercor.com/data/) --- # License Dropbox data to AI: reports, terms and buyers > Looking to sell Dropbox data to AI? What you sign is a license. Troveo names Dropbox, two admin reports size it, and Dropbox's terms say Your Stuff is yours. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-dropbox-data-to-ai Published: 2026-09-15 Updated: 2026-10-14 ## The short answer License Dropbox data to AI: start by measuring. Troveo names Dropbox. Use Dropbox's Team Storage Report to size by folder. Terms say your files are yours, with no mention of AI training. Shared files may belong to clients or vendors. File storage holds whatever a company saved, so the first job is finding out how much there is and whose it is. ## Which companies name Dropbox? [Troveo](https://www.troveo.ai/business-data) names Dropbox with Google Drive, OneDrive and SharePoint under documents and files. [Mercor's data page](https://www.mercor.com/data/) lists Drive and does not name Dropbox. [micro1](/buyers/micro1)'s data partnerships page does not name it either. [Troveo](/buyers/troveo)'s listing is its own statement (self-reported). For the Google equivalent, see [Google Drive data](/answers/sell-google-drive-data-to-ai) and [micro1 and Drive](/answers/micro1-google-drive-data). ## How do you measure Dropbox storage? [Dropbox's admin reports page](https://help.dropbox.com/account-access/admin-console-reports) describes a Team Storage Report. It breaks storage down by folder, with the path, folder type, owner, size in MB and file count. A Member Data Report lists each member with storage used and the space limit. Reports save as CSV to a "Dropbox Business reports" folder in the admin's account, and Dropbox sends a notice when one is ready. Summing the folder sizes gives a total you can put in an intake form. micro1's current pages state no data-size threshold, and [1 TB](/answers/does-my-company-have-1-tb-of-data) was an earlier figure from an undated micro1 forum talk. ## What do Dropbox's terms say? The [Terms of Service](https://www.dropbox.com/terms) say Your Stuff is yours and that the terms give Dropbox no rights to it except the limited rights needed to offer the services. The terms describe those rights as hosting, backing up and sharing files when you ask. I found no sentence on AI training or machine learning in the Terms. I did not read Dropbox's privacy policy or AI pages, so this page makes no claim about them. ## What needs a rights check? A shared folder can hold files from clients, vendors and former staff. That is my reading of how teams use file storage. Every file has its own owner and its own contract. The [rights check](/rights-check) and [what you cannot license](/answers/what-data-can-i-not-sell-to-ai) sort them. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two Dropbox admin reports for sizing a corpus: Team Storage Report (emphasized: Size and file count per folder, Size by folder), Member Data Report (Storage by member). The Team Storage Report gives size and file count per folder, which a corpus estimate needs. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Mercor's data page](https://www.mercor.com/data/) - [Dropbox's admin reports page](https://help.dropbox.com/account-access/admin-console-reports) - [Terms of Service](https://www.dropbox.com/terms) --- # micro1 data partnership process, one line per step > The micro1 data partnership process as its own page lists it today, in four stages, plus the longer seven-step account from an undated micro1 forum talk. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-data-partnership-process Published: 2026-09-15 Updated: 2026-10-14 ## The short answer micro1's data partnerships page lists four stages: a short assessment, a review by its team, a discovery call, then the partnership agreement. In an undated recorded forum talk, micro1's David Revland described an earlier, longer seven-step version. No total timeline is published. This page lists the steps. The [full guide](/guides/micro1-data-partnership) adds eligibility, privacy and questions to ask. ## What does micro1's page say today? The [data partnerships page](https://www.micro1.ai/data-partnerships) lists four stages: 1. **Get started** with a short assessment. 2. **Evaluation.** micro1's team reviews your submission to decide whether you fit. 3. **Discovery.** micro1 asks for more information and schedules a call. 4. **Partnership.** If approved, micro1 finalizes the agreement and data requirements, and the partnership begins. ## What did the earlier, undated account add? In an undated recorded forum talk, David Revland, who works on human data at micro1, described seven steps. Treat them as history and confirm the current steps on your first call. 1. **Start.** A referral, a peer introduction or organic contact. 2. **First call** with a data partnership manager. 3. **Data manifest form.** Which services you use and a rough size for each. See [what a data manifest form is](/answers/what-is-a-data-manifest-form). 4. **A payment proposal** from [micro1](/buyers/micro1). 5. **Contract language.** 6. **Transfer,** with micro1's forward-deployed engineering team walking your IT team through it. 7. **Verification, then payment.** ## Who does the work on your side? micro1's CFO estimated, in the same talk, about 10 hours from one or two of your IT people over a week or two (self-reported). A micro1 referral partner said in a micro1 video that no IT team is needed. [How long a data transfer takes](/answers/how-long-does-a-data-transfer-take) prints both. ## Who will you deal with at micro1? The undated recorded talk named a data partnership manager, and the video named an enterprise client partner, engineers and account reps. To reach micro1, the host said to email any panelist at their first name at micro1.ai or use the landing page on micro1's website. No URL was read out (self-reported). ## How long does the whole thing take? No micro1 page or recorded-talk remark gives a total. The video partner said two to three weeks from interested to finished (self-reported). I found no stated time for the evaluation or the contract, so ask for a schedule on the first call. See [the payment timeline](/answers/micro1-data-partnership-payment-timeline). ## When does the money arrive? After micro1 verifies the delivered data. The amount is set per deal, and [what micro1 pays](/answers/how-much-does-micro1-pay-for-company-data) lists its self-reported ranges (see also micro1's [referral page](https://www.micro1.ai/company-referral)). No outcome is promised, and micro1 may decline any company. Run the [rights check](/rights-check) before the call, because the agreement puts your warranties about the data in writing. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Intro or referral, first call -> Manifest form, payment proposal, contract -> Transfer, check, payment. In an undated talk, Revland of micro1 described a path that ends in a verified transfer and payment. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [referral page](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # AI labs buying startup archives: who, why, how much > AI labs buying startup archives want realistic workplace records for agent training. Reported payouts run $10,000 to $300,000, per company and press claims. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/ai-labs-buying-startup-archives Published: 2026-09-14 Updated: 2026-10-14 ## The short answer AI labs buy startup archives to train agents on real workplace records. SimpleClosure processed nearly 100 deals in a year at $10,000 to $100,000 per company, and Mercor made offers up to $300,000. All figures are company claims or press reports, not guaranteed payouts. So who is actually writing the checks? Mostly data vendors and agent builders. The press names few labs outright. ## Why do labs want a dead startup's records? [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) that buyers build "RL gyms." These are simulated workplaces where an AI agent practices tasks such as planning a birthday celebration for a coworker. [Futurism reported](https://futurism.com/artificial-intelligence/employer-selling-emails-train-ai) that the data is valued for its realistic workplace noise. That noise makes agent tests look like a real company. [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) wrote that AI companies call the record of steps in a workflow a trajectory. My page on [what AI labs do with company data](/answers/what-do-ai-labs-do-with-company-data) explains the uses Epoch lists. [Why labs want real data](/answers/why-ai-labs-want-real-company-data) covers the synthetic alternative. ## Who is buying? [Mercor](/buyers/mercor) approached Warmly, an AI agent startup, about eight days after Warmly announced its acquisition by HubSpot in late June 2026. Warmly's founder declined ([BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). BigGo says Mercor targets Slack logs, GitHub records, Asana content, Google Drive files and meeting transcripts. Bloomberg, relayed by [Yahoo Finance](https://finance.yahoo.com/technology/ai/articles/spacex-discusses-buying-data-ai-154235416.html), reported that SpaceX's AI unit was weighing purchases. SpaceX did not respond to a request for comment. Gizmodo reported that Anthropic leadership discussed spending up to $1 billion on RL gyms. I found no archive purchase by Anthropic named. ## How do founders license their data? There are three routes: - a shutdown service such as SimpleClosure's [Asset Hub](/answers/simpleclosure-asset-hub) ([launch post](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/)) - a listing board such as [BuyMyDeadStartup](/answers/buymydeadstartup) - approaching a vendor directly My page on [licensing startup data](/answers/sell-startup-data-to-ai) compares the routes. It also lists the buyers that take a company still operating. The [shutdown checklist](/guides/startup-shutdown-checklist-ai-data) puts the data decision before you close accounts, and I'd keep it there. ## What do critics say? Marc Rotenberg of the Center for AI and Digital Policy told [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) the privacy issues are "quite substantial." Futurism reported that privacy experts question anonymization claims. They say employee data stays identifiable. See [re-identification risk](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages). ## What is not shown? [Epoch's review of the market](https://epoch.ai/gradient-updates/state-of-rl-envs) prices a website clone near $20,000, a clone of a product like Slack near $300,000 and a task at $200 to $2,000. It doesn't say real company data fills those environments. So the link from a startup archive to a training run is a stated plan from buyers. I'd keep that gap in mind with every number above. Talk to a corporate or privacy lawyer in your state before you sign. The [rights check](/rights-check) and [risk map](/risks) list where deals break. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Figure: scale, Reported deals and offers, per startup: Top SimpleClosure deal $100K, A reported Mercor offer $300K (emphasized). One reported Mercor offer ran three times the top SimpleClosure deal. Source: Gizmodo and BigGo, self-reported and press-reported. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Futurism reported](https://futurism.com/artificial-intelligence/employer-selling-emails-train-ai) - [Fortune](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Yahoo Finance](https://finance.yahoo.com/technology/ai/articles/spacex-discusses-buying-data-ai-154235416.html) - [launch post](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [Epoch's review of the market](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # What is a trajectory in AI? > What is a trajectory in AI? The record of steps an agent took on a task, per Fortune. Why micro1 and Fortune say labs want paths like it from real company data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-trajectory-in-ai Published: 2026-09-14 Updated: 2026-10-13 ## The short answer A trajectory in AI is the record of steps an agent took while working on a task. A report shows the answer. A trajectory shows the work, with mistakes and recoveries. Company records create them too: a request, decision and approval across tools. The links must survive intact. This entry follows [Fortune's](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) usage, the one dated source I found that defines the word inside a company data sale. AI21's [glossary](https://www.ai21.com/glossary/ai-agent/what-is-an-agentic-trajectory/) gives the general definition: the complete sequence of actions, observations and decisions an agent produces while working through a task. ## How is a trajectory different from a finished document? A finished report shows the answer. A trajectory shows the work that led to it, including any mistakes and recoveries. Fortune's example from the Spirit Airlines archive is an IT ticket linked to a Teams discussion, a code change and an operational result. The article says such records could help test whether an agent reaches the right outcome. ## Where do trajectories come from? Two places. An agent produces one each time it attempts a task in an environment. Our entry on [RL environments](/answers/what-is-an-rl-environment) explains how that works. The second kind sits in a company's own tools, left behind by people at work. [micro1](/buyers/micro1)'s CFO gave a marketing budget request as the example, where the value sits in the path through spreadsheets, email and approvals rather than in names. A ticket, its thread and the change that closed it show a person's path, as long as the links between them survive. ## Which part of a micro1 deal involves them? The workflows track. An employee gives a general-purpose agent a real task and grades the result, and micro1 receives the grade plus the trajectory. The [workflows track page](/answers/micro1-workflows-track) has the details. micro1's CFO said in an undated recorded forum talk that workflows pay $700 to $800 per completed task (self-reported). The captions leave the low end unconfirmed. ## Why do the links between records matter? A trail only reads as a trajectory when the request, the discussion and the result stay connected. Keeping those joins is also why privacy review matters. See [referential integrity](/answers/what-is-referential-integrity-in-data). ## What should a company ask before it licenses them? Ask which of your systems hold a connected trail, and who is named inside each one. The [rights check](/rights-check) lists the questions, and the free [fit check](/business) scores how your records fit. No outcome is promised. We give no legal advice. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Choose an action, use a tool -> Read the result -> Recover from a mistake. Fortune says an agent's trajectory records steps such as choosing actions, using tools and recovering from mistakes. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Fortune's](https://fortune.com/2026/09/14/micro1-tries-to-beat-googles-bid-to-buy-bankrupt-spirit-airlines-data-for-12-5-million-highlighting-value-of-data-to-ai-companies/) - [glossary](https://www.ai21.com/glossary/ai-agent/what-is-an-agentic-trajectory/) --- # What is data licensing and how does it pay? > Data licensing lets a buyer use your data on stated terms. Whether you keep ownership depends on the contract. How it differs from a sale. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-licensing Published: 2026-09-14 Updated: 2026-10-13 ## The short answer Data licensing lets a buyer use your data on stated terms, usually for a fee. The contract decides who owns what and whether it pays once, per use or on a schedule. Companies license emails, tickets and CRM history to labs. Prices are mostly self-reported. Rights come before price. The phrase means one thing in data marketplaces and a newer thing in AI. Both come down to permission, on terms. ## What does a license cover in a data deal? A license gives a buyer the right to use a defined set of data in defined ways. The terms are the product. A contract can set which systems and years are in scope, how long the license runs, whether the buyer gets exclusivity and what the buyer may do with the data or resell. Bring your questions to a lawyer before you sign anything. The [contract checklist](/guides/how-to-sell-company-data-to-ai-companies) in our pillar guide lists them. ## How is a license different from an outright transfer? [Troveo](/buyers/troveo)'s guide puts it in one line: "A sale pays once. A license pays every time the data is used, and you keep ownership" ([Troveo](https://www.troveo.ai/resources/data-monetization-examples)). In practice micro1, Troveo and Protege mix the words. [micro1](/buyers/micro1) pays under an agreed data partnership and says companies keep ownership, though its CFO called the corpus track a one-time sale in an undated recorded forum talk (self-reported). Troveo describes a revenue share on every sale to buyers, and Protege a revenue share on qualified deals. [Pricing models](/answers/data-monetization-pricing) covers each one. ## What does data licensing mean for AI? AI labs and agent builders license records of real work. A support ticket is a good example, because it shows a problem, the steps and the result. micro1's CFO described the prize as the whole chain from a request to a finished deliverable. micro1's David Revland, who works on human data, gave a Slack message asking for a report, then the report in a spreadsheet (self-reported, undated recorded forum talk). Epoch AI estimates that the useful stock of public human-written text could be fully used between 2026 and 2032 (80% interval), which is one reason private data gets attention ([Epoch](https://epoch.ai/publications/will-we-run-out-of-data-limits-of-llm-scaling-based-on-human-generated-data)). Epoch AI's review of RL environments describes app replicas and lab partnerships with product companies, and does not discuss real company archives ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). So the demand story is real, and the proof that archives feed training is still thin. The [AI data licensing guide](/guides/ai-data-licensing) goes through who pays and what an owner needs first. ## What does Frankfurt Kurnit say comes before a data license? Rights. Your email and chat hold other people's words, often under NDAs. Counsel flags trade secrets, privilege and employee talk that US labor law protects ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Run the seven questions on the [rights check](/rights-check), then read the [risk map](/risks). Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Sale versus license, as Troveo defines them: Sale (Paid once), License (emphasized: Pays on each use of the data, Paid per use). A sale pays once. A license pays each time the data is used. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/resources/data-monetization-examples) - [Epoch](https://epoch.ai/publications/will-we-run-out-of-data-limits-of-llm-scaling-based-on-human-generated-data) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # Data licensing pros and cons for company data > Data licensing pros and cons: revenue and AI fluency on one side, privacy, rights, liability and thin price evidence on the other. Dated sources, self-reported. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-licensing-pros-and-cons Published: 2026-09-13 Updated: 2026-10-14 ## The short answer Upside: revenue from stored records. micro1's Enterprise Data Partnership listing says $100K-$2M+ for approved data packages, its own claim. Downside: rights, privacy law, confidentiality and partner security are your risks. Payment evidence is thin and self-reported. Have counsel read the contract. Every claim below comes from a dated source. When that source is a company selling the service, I say so, because it changes how much weight the claim gets. ## What are the upsides? **Revenue from stored records.** Three companies put numbers on it, and all three are talking about themselves. [micro1](/buyers/micro1)'s [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says "$100K-$2M+ for approved data packages," and its data partnerships page lists tiers of $100K+, $500K+ and $1M+. [Handshake AI](/buyers/handshake-ai) says [$100K to $4M+](https://joinhandshake.com/ai/data-partnerships/). [SimpleClosure](/buyers/simpleclosure) reported [nearly 100 deals at $10,000 to $100,000 per company](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916). Read those as what the companies say, not as a rate card. **Repeat income.** [Troveo says](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) it pays you each time it licenses your data, not only the first time. A license can go to more than one buyer if the contract allows it. Exclusivity can pay more, and [Troveo](/buyers/troveo) says it's time-limited and has to be earned. **AI fluency.** micro1's workflows track has employees use an AI agent on real tasks and grade it. micro1 says that makes teams more AI native. That's micro1's claim about its own program. **Ownership can stay with you.** [micro1's pages](https://www.micro1.ai/data-partnerships) say companies retain ownership of their underlying data, and Troveo says you grant a defined right and keep ownership. [SimpleClosure's terms](https://simpleclosure.com/tos/) say title vests in the acquirer. Same word, different deals. ## What are the downsides? **Rights.** Your email and chat hold other companies' confidential information under NDAs. Counsel flags trade secrets, waived privilege and employee talk protected under the National Labor Relations Act ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). **Privacy law.** California's CCPA [covers employee data](https://oag.ca.gov/privacy/ccpa), and a transfer for money can count as a sale. See [is licensing data to an AI lab a sale under CCPA](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa). **De-identification limits.** Swapping names for stand-ins keeps the links across records. The [UK ICO position](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) is that pseudonymised data is still personal data. The [Spirit flight attendants' union objected](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) on exactly that point. **Buyer-side security.** Somebody on a buyer's or marketplace's team handles your data at some stage. Mercor [confirmed a March 2026 supply-chain incident](https://www.mercor.com/blog/update-on-mercor-security-incident/), and reports say contractor data was involved. Our page on [who is liable if the buyer is hacked](/answers/who-is-liable-if-the-data-buyer-is-hacked) covers the contract question. **Precedent.** The [FTC announced an action on 30 Mar 2026](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-takes-action-against-match-okcupid-deceiving-users-sharing-personal-data-third-party) against Match Group and OkCupid over sharing user photos with a third party. Deleting files doesn't reverse training, and [can I delete my data after an AI company trains on it](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it) explains why. **Thin price evidence.** No public per-record price list exists. Epoch AI's January 2026 review of RL environments describes app replicas and lab partnerships with product companies, and does not discuss real company archives. ## How do you weigh them? Rights first, price second. Rights decide what's on the table at all. Run the [rights check](/rights-check), read the [risk map](/risks) and compare routes in [where to license company data](/answers/where-to-sell-company-data). Then talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Two sides of licensing company data: Upside (Revenue, AI fluency), Risk (emphasized: Rights set the ceiling, Rights, privacy, security). Risk gets the emphasis because rights set the ceiling. A record you can't license stays out of the deal. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [$100K to $4M+](https://joinhandshake.com/ai/data-partnerships/) - [nearly 100 deals at $10,000 to $100,000 per company](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Troveo says](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - [micro1's pages](https://www.micro1.ai/data-partnerships) - [SimpleClosure's terms](https://simpleclosure.com/tos/) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [covers employee data](https://oag.ca.gov/privacy/ccpa) - [UK ICO position](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [Spirit flight attendants' union objected](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [confirmed a March 2026 supply-chain incident](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [FTC announced an action on 30 Mar 2026](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-takes-action-against-match-okcupid-deceiving-users-sharing-personal-data-third-party) --- # Is SimpleClosure legit? What the public record shows > Is SimpleClosure legit? A named company with $20M+ raised and published terms. Fees and the consent duty are the open questions. The evidence. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-simpleclosure-legit Published: 2026-09-12 Updated: 2026-10-14 ## The short answer SimpleClosure looks real. It has a named CEO, Dori Yona, more than $20M raised and published terms. Trustpilot shows 4.1 of 5 from 27 reviews. Its Asset Hub fees are not public. Gizmodo reported the Center for AI and Digital Policy's founder calling employee privacy a key concern. ## So, is SimpleClosure legit? The company checks out. It has a named entity, named people, named investors and public terms. Two things stay open: what Asset Hub charges, and who must hold the consent of the people inside your data. Under the terms, that duty is yours. ## What can be checked about SimpleClosure? | Check | What the record shows | |---|---| | Entity | "Simple Closure Inc." on its site and in its terms. | | People | Dori Yona, founder and CEO, quoted in the [launch release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html). | | Funding | "Over $20 million" from TTV Capital, Infinity Ventures, Anthemis, Vera Equity, The LegalTech Fund and Carta (release). | | Terms | Terms of service at [simpleclosure.com/tos](https://simpleclosure.com/tos/) cover Asset Hub. | | Fees | Terms point to "Fees" in a separate order form. Its [AssetHub page](https://simpleclosure.com/product/assethub/) says it takes a percentage only on a completed deal and publishes no rate. | | Deals | Nearly 100 deals at $10,000 to $100,000 per company ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), citing Forbes). | | Security | No claim found. Terms put the duty to hold individuals' consents on the company that submits the data. | | Reviews | [Trustpilot](https://www.trustpilot.com/review/simpleclosure.com) 4.1 of 5 from 27 reviews. Comments concern shutdown services, including pricing clarity. | | Objections | [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) quoted Marc Rotenberg, founder of the Center for AI and Digital Policy, calling the privacy issues "quite substantial" and employee privacy "a key concern." It reported that the Center wrote to the Senate Commerce Committee urging stronger FTC oversight of AI companies. | ## What is Asset Hub? It lets a founder who is closing a company sell or license source code, workspace data and other assets to vetted buyers. Its [AssetHub page](https://simpleclosure.com/product/assethub/) now says operating companies can license too. Source code launched first. Workspace data, covering email, Slack, Notion and Drive, was in beta at launch ([Yahoo Finance](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html)). Figure: range, Asset Hub deal, per company, $10K to $100K. Forbes reported Asset Hub deals that varied tenfold per company. Source: Forbes, as reported by Gizmodo. ## What do SimpleClosure's terms say about your data? SimpleClosure's license can include emails and messaging exports. The terms say [SimpleClosure](/buyers/simpleclosure) may sell or license the assets after a completed acquisition. They also ask you to state that you hold the consents from the people whose data is inside. > **The terms give SimpleClosure a broad license to use what you submit.** It's like renting out a room where the tenant may sublet. Read who can move in. That consent duty is the live issue in this market. Our [rights check](/rights-check) and [risk map](/risks) show what to confirm first. ## Who is SimpleClosure for? Startups that are winding down and want the shutdown handled with their assets licensed or sold. Its AssetHub page says operating companies can license too. To compare other routes, the [buyer directory](/buyers) lists them. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [launch release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) - [simpleclosure.com/tos](https://simpleclosure.com/tos/) - [AssetHub page](https://simpleclosure.com/product/assethub/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Trustpilot](https://www.trustpilot.com/review/simpleclosure.com) - [SimpleClosure Asset Hub announcement](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [SimpleClosure CEO post](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) --- # What are data partnerships in AI data licensing? > Data partnerships in AI explained: company data programs at micro1 and Handshake AI, lab programs like OpenAI's, who pays introducers, and stated figures. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-partnerships Published: 2026-09-12 Updated: 2026-10-13 ## The short answer Data partnerships let an AI company use a group's data. Company programs pay businesses for their records. Lab programs ask groups to help build datasets. Some firms pay introducers, so ask who pays yours. micro1 lists $100K+ to $1M+ tiers. Handshake AI states $100K to $4M+, self-reported. ## What do people mean by data partnerships? People use the phrase as if it were one product. It is two, and the terms differ in each. > **Data licensing means a buyer gets to use your records for a while, under rules.** It works like renting out a spare room. You keep the house. Figure: comparison of Two things people call a data partnership: Company data program (emphasized: Pays for records you already hold, You license records), AI lab program (Lab co-builds sets). Company data programs get the emphasis because they pay for records a business already holds. ## What is a company data program? [micro1](/buyers/micro1)'s CFO described its Company Data Partnerships in an undated recorded forum talk as a way to earn from data a company already stores. The CFO named two ways in for a company. One is a corpus deal covering stored records, and micro1's [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages. Another is a recurring workflows track, where employees use an AI agent on real tasks and grade it (forum recording). micro1 also pays people who introduce a company. Ask whoever introduces you whether micro1 pays them. micro1's pages state tiers of $100K+, $500K+ and $1M+ for companies with 30 or more employees ([micro1](https://www.micro1.ai/data-partnerships)). The current criteria also list mature operations and primarily English documentation, with US companies prioritized. The undated talk gave a lower, earlier staff figure, which is history. [Handshake AI](/buyers/handshake-ai) states $100K to $4M+. The first steps are a form, a chat and a scoping call ([Handshake AI](https://joinhandshake.com/ai/data-partnerships/)). [Troveo](/buyers/troveo), a marketplace, covers business data too ([Troveo](https://www.troveo.ai/business-data)). See [Handshake AI data partnerships](/answers/handshake-ai-data-partnerships). ## What is an AI lab partnership program? OpenAI announced Data Partnerships in November 2023. It wanted to work with outside groups on large public and private datasets that are hard to find online. It asked especially for data that "expresses human intention", such as long writing and conversations ([TechCrunch](https://techcrunch.com/2023/11/09/openai-wants-to-work-with-organizations-to-build-new-ai-training-data-sets)). The announcement describes teamwork. It states no price. ## Who pays the person who introduces you? Some data companies pay whoever introduces a company to them. If someone introduces you to a data company, ask them in writing whether that company pays them, how much and when. A fee from that company can shape where they point you. _Two jobs, one name. Somebody in marketing had a good day._ ## Which kind should you look at? If you have years of Slack, email, tickets or CRM records, the first kind is your lane. First confirm you hold the rights to license them. Run the [rights check](/rights-check), read the [risk map](/risks) and compare firms in our guide to [which AI data buyers to compare](/guides/best-ai-data-brokers). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [micro1](https://www.micro1.ai/data-partnerships) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [Troveo](https://www.troveo.ai/business-data) - [TechCrunch](https://techcrunch.com/2023/11/09/openai-wants-to-work-with-organizations-to-build-new-ai-training-data-sets) --- # Is data licensing income taxable? What IRS texts say > Is data licensing income taxable? 26 U.S.C. 61(a) counts all income from any source, and Pub 525 taxes royalties as ordinary income. No IRS text names data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-data-licensing-income-taxable Published: 2026-09-11 Updated: 2026-10-13 ## The short answer In general, yes. 26 U.S.C. 61(a) defines gross income as all income from any source. IRS Publication 525 says royalties from copyrights and patents are taxable as ordinary income. No IRS text I read names data licenses. A sole proprietor with net earnings of $400 or more files Schedule SE. I found no IRS rule written for AI data deals. So here is what the general texts say, and you can see for yourself how far they stretch. ## What does the Internal Revenue Code count as income? [Section 61(a)](https://www.law.cornell.edu/uscode/text/26/61) opens: "Except as otherwise provided in this subtitle, gross income means all income from whatever source derived." Among the listed items are compensation for services, including fees, commissions and similar items (61(a)(1)), gross income derived from business (61(a)(2)) and royalties (61(a)(6)). ## What does the IRS say about royalty income? [Publication 525](https://www.irs.gov/publications/p525) for 2025 returns says "Royalties from copyrights; patents; and oil, gas, and mineral properties are taxable as ordinary income." In most cases they go on Schedule E. A person in business as a self-employed writer, inventor or artist reports them on Schedule C. The same page describes copyright and patent royalties as amounts paid for the right to use your work over a specified period, generally based on units sold. The [2025 instructions for Schedule E](https://www.irs.gov/instructions/i1040se) list oil, gas and mineral royalties, copyrights, name, image and likeness rights and patents. ## Does any IRS text name data? Not in the texts I read. The Pub 525 royalty passage, the Schedule E instructions and the Form 1099-MISC instructions name copyrights, patents, trade names and trademarks. Whether a license of a company's records fits one of those labels is not stated. [Section 1221(a)(3)](https://www.law.cornell.edu/uscode/text/26/1221) names patents, inventions, secret formulas or processes and copyrights among property not treated as a capital asset in the hands of its creator. It does not contain the word "data." ## What about a sale instead of a license? Pub 525 has a rule for a sale of a complete interest in mineral rights, which it treats as sale of section 1231 property, and a rule for a retained royalty. Both are written for minerals. The text does not say they apply to data. ## What about business income? [IRS Topic 407](https://www.irs.gov/taxtopics/tc407) says business income "may include income received from the sale of products or services." A sole proprietor with net earnings of $400 or more from Schedule C files Schedule SE. Our [pay page](/answers/how-are-you-paid-for-company-data) lists how buyers describe their payments. Our [1099 page](/answers/1099-data-licensing) covers the forms a payer may send. Talk to a tax professional about your own situation. Figure: comparison of IRS income labels a data license payment could meet: Royalties (emphasized: Named in Sec 61 and Pub 525, Copyrights, patents), Fees and commissions (Services), Business income (Products or services). Section 61(a) and Pub 525 name royalties, and no IRS text I read says a data license is one. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Section 61(a)](https://www.law.cornell.edu/uscode/text/26/61) - [Publication 525](https://www.irs.gov/publications/p525) - [2025 instructions for Schedule E](https://www.irs.gov/instructions/i1040se) - [Section 1221(a)(3)](https://www.law.cornell.edu/uscode/text/26/1221) - [IRS Topic 407](https://www.irs.gov/taxtopics/tc407) --- # License source code to AI companies: prices and checks > Want to sell source code to AI companies? You license it. Troveo cites a $5,000 per-repo baseline, shutdown deals reach $100,000, and labs want history. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-source-code-to-ai-companies Published: 2026-09-11 Updated: 2026-10-14 ## The short answer Troveo's guide says AI companies want full code history: commits, pull requests and code reviews. It cites an unnamed platform's $5,000 baseline per repository. Shutdown deals run $10,000 to $100,000 per company. Google bid $10 million for Spirit Airlines' archive, with 30 million lines of code. Our [legal page on source code](/answers/can-i-sell-source-code-to-ai) covers licenses and export rules. This page covers what buyers want and what has been reported. ## What does Troveo say labs want with source code? A snapshot of source code is worth little to a lab, [Troveo says](https://www.troveo.ai/resources/sell-code-to-ai-companies), because there's already a lot of code in the world. In Troveo's account, labs pay for production history: full commit history, pull requests and code review, linked tickets, design docs and incident notes, and the configuration that lets a buyer run the code. [Troveo](/buyers/troveo) calls the trail around the code workflow data. Troveo sells this service, so read the list as its view of what labs ask for. ## What have sales reported? - **An unnamed platform's baseline:** $5,000 per repository, adjusted up or down after grading, as Troveo's guide reports it. The guide doesn't name the platform. - **SimpleClosure:** about $10,000 to $100,000 per shutting-down company, nearly 100 deals in a year, per [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916). - **A single founder:** hundreds of thousands of dollars for a complete company dataset including code, as Troveo reports it. - **Spirit Airlines:** Google's [$10 million bid](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) covered about 30 million lines of code with the emails and chats, and the court has not approved it. ## What do owners clear first? Troveo's checklist has three parts. Confirm that every contributor, including contractors and agencies, assigned their work to the company. Inventory open-source dependencies and flag copyleft code. Remove secrets, credentials and customer data from the history. Code written for clients may belong to the client. ## Is a source code deal a license or an outright sale? Troveo says an operating company usually licenses and keeps ownership, and that an outright sale is common in a shutdown. See [shutting down and licensing workspace data](/answers/can-a-shutting-down-company-sell-its-slack-to-ai) for that route. Talk to a commercial lawyer in your state before you sign. Our [rights check](/rights-check) asks about customer contracts, NDAs and who can sign, and our free [fit check](/business) asks whether code repositories are among your systems. Neither reviews open-source licenses. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Figure: scale, Reported figures for code deals: Unnamed platform's baseline, per repository $5,000, Shutdown deals, per company $10K to $100K (emphasized). An unnamed platform's per-repository baseline sits below what shutdown deals pay. Source: Troveo guide, citing an unnamed platform, and Gizmodo. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo says](https://www.troveo.ai/resources/sell-code-to-ai-companies) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [$10 million bid](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) --- # Vermont data broker law: definition and penalties > Vermont data broker law (9 V.S.A. 2430 and 2446): who counts as a broker, the $100 fee, the 31 January deadline and the $50 a day penalty with its yearly cap. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/vermont-data-broker-law Published: 2026-09-11 Updated: 2026-10-14 ## The short answer The Vermont data broker law (9 V.S.A. 2430 and 2446) defines a broker as a business that sells personal information of people it has no direct relationship with. Brokers register by 31 January for $100 per year. Failing to register costs $50 per day, capped at $10,000 per year. Vermont's text matters for a company with its own archive. The direct-relationship list names employees and customers. Legally, a "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers. It keeps "data broker" for the legal term. ## Who counts as a data broker in Vermont? The [definition](https://legislature.vermont.gov/statutes/section/09/062/02430) has three parts. It needs a business that knowingly collects and sells or licenses brokered personal information. The information must be about a consumer with whom the business has no direct relationship. Each part has to be met. Brokered personal information covers computerized data elements. Examples are names, addresses, birth dates, biometric data and Social Security numbers. ## Does licensing my own staff and customer data make me a broker? On the text, the direct-relationship list covers three groups: - Past and present employees, contractors and agents. - Past and present customers, clients, subscribers and users. - Investors and donors. A sale limited to those people doesn't fit "no direct relationship." Mixed archives are less settled. A person who appears only inside a customer's email thread isn't obviously on that list. I found no Vermont guidance or case on archive licensing. ## What does registration cost, and when is it due? [Section 2446](https://legislature.vermont.gov/statutes/section/09/062/02446) sets an annual fee of $100. Registration is due on or before 31 January. That is the January after a year in which a person meets the definition. ## What is the penalty? According to section 2446, a broker that fails to register faces a civil penalty. It is $50 for each day, up to $10,000 for each year. ## What should I gather first? Note whether any list in your archive was bought, imported or enriched from another source. Those people may sit outside the direct-relationship list. Your lawyer decides whether the definition fits your facts. ## How does Vermont compare with Texas? [Texas](/answers/texas-data-broker-law) drops the direct-relationship wording. It asks whether data was collected directly. The [register or not page](/answers/do-i-need-to-register-as-a-data-broker-to-sell-my-own-data) lays the states side by side. Our [state map](/answers/are-data-brokers-legal) covers the rest. Figure: steps Meet the definition in a year -> Register by 31 January after -> Pay the $100 fee. Vermont's registration clock starts after a year in which a business met the broker definition. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [definition](https://legislature.vermont.gov/statutes/section/09/062/02430) - [Section 2446](https://legislature.vermont.gov/statutes/section/09/062/02446) --- # How much does micro1 pay companies for their data? > How much does micro1 pay companies? Tiers of $100K+ to $1M+, and $100K-$2M+ on its Enterprise Data Partnership listing. Self-reported, no fixed rate card. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-much-does-micro1-pay-for-company-data Published: 2026-09-10 Updated: 2026-10-14 ## The short answer micro1's data partnerships page lists tiers of $100K+, $500K+ and $1M+, set per deal. Its Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. Both are micro1 describing itself. It publishes no rate card, and I found no company that confirms a payout. The amount depends on the deal, and [micro1](/buyers/micro1) says so. Here is what it has put on the record, and [how micro1's data partnership works](/guides/micro1-data-partnership) covers the rest of the program. ## What are micro1's three published figures? - **[Data partnerships page](https://www.micro1.ai/data-partnerships):** $100K or more for qualified enterprise partnerships, $500K or more for large datasets or multi-team participation, and $1M or more for highly unique proprietary operational data. - **[Enterprise Data Partnership listing](https://www.micro1.ai/company-referral):** "$100K-$2M+" for approved data packages. - **CFO, in an undated recorded forum talk:** deals near $2 million are real (self-reported, date not stated). ## What sets the amount? Three micro1 sources name the factors, and none gives a formula. The page ties the tiers to size, multi-team participation and uniqueness. micro1's David Revland, who works on human data, said in the undated recorded talk that micro1 sends proposed payment terms after the data manifest form, so the number follows your tool list and sizes. A micro1 referral partner said in a micro1 video that the amount depends on the company's employee count and data sizes (self-reported, about 2:34). That video gives no figures. The [process page](/answers/micro1-data-partnership-process) shows where the proposal sits. ## How does that compare with other reported prices? [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) reported that SimpleClosure's Asset Hub had nearly 100 deals at $10,000 to $100,000 per company. Google's $10M winning bid for Spirit Airlines' archive in August 2026, pending court approval ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)) is the largest public price we found. Those are different owners and different data, so none of them predicts your number. ## Is any of it confirmed? No. I found no company testimonial and no public partner contract for micro1. The [evidence table on micro1](/answers/is-micro1-legit) lists what can be checked and what cannot. ## What should you ask first? Ask what the payment covers, whether the contract names the AI labs that receive the data, and whether a [top-up](/answers/micro1-data-top-up) is paid separately. Run the [rights check](/rights-check) first, since the payment assumes you hold the rights. The [deals tracker](/deals) logs public prices as they appear. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: range, Corpus deal, per company, $100K to $2M, marker Top tier, or more at $1M. micro1's top tier sits in the upper half of its stated range. Source: micro1's Enterprise Data Partnership listing and data partnerships page, self-reported. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Data partnerships page](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Mercor vs Handshake AI for your company's data > Mercor vs Handshake AI compared as company-data programs: minimum size, pay range, payment timing, de-identification claims and the incidents on record. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/mercor-vs-handshake-ai Published: 2026-09-10 Updated: 2026-10-14 ## The short answer Both license company records to AI labs. Handshake AI states $100K to $4M+ per partnership and asks for 20+ staff and three years in operation. Mercor states no minimum size and wires payment after delivery, typically two to four weeks after signing. Mercor disclosed a March 2026 breach. ## How do their company-data programs differ? [Mercor](/buyers/mercor) says it takes data from ["100+ supported tools,"](https://www.mercor.com/data/) wires payment after delivery, typically within two to four weeks of signing, and states no minimum company size. It claims SOC 2 Type II certification. [Handshake AI](/buyers/handshake-ai) [states $100K to $4M+ per partnership](https://joinhandshake.com/ai/data-partnerships/), starts with a form and a scoping call, and admits "no de-identification process eliminates that risk entirely." Its [referral page](https://joinhandshake.com/ai/data-partnerships/referral) asks for 20 or more full-time employees and three or more years in operation. **Mercor and Handshake AI company-data terms side by side** | Term | Mercor | Handshake AI | |---|---|---| | Minimum size | None stated | 20+ full-time staff, 3+ years | | Stated pay range | None published. Offers up to $300K reported | $100K to $4M+ | | Payment timing | Wire on delivery, typically 2 to 4 weeks after signing | Typically 30 to 60 days after dataset acceptance | | Fees to you | None, Mercor covers extraction | Not published | | How data moves | You link accounts from 100+ tools | You transfer data as it exists, Handshake prepares it | | Pick this when | You want payment soon after signing | You want a stated price range up front | See [Handshake AI data partnerships](/answers/handshake-ai-data-partnerships) and [Mercor data licensing](/answers/mercor-data-licensing) for what each says in full. ## What is on record about each? Mercor disclosed a March 2026 supply chain incident that it calls "very limited" in impact ([Mercor](https://www.mercor.com/blog/update-on-mercor-security-incident/)). The breach class actions were consolidated in May 2026 and stayed pending mediation on 21 Jul 2026 ([CourtListener](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/)). It also faces a proposed class action over how it classifies its contractors, *White v. Mercor.io Corp.* (N.D. Tex., filed 8 May 2026), and has moved to compel arbitration ([IC Legal News](https://www.independentcontractorcompliance.com/2026/06/09/artificial-intelligence-firms-continue-to-be-targeted-for-independent-contractor-misclassification-claims-may-2026-ic-legal-news-update/)). For Handshake AI, [Business Insider reported](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) suspended and unpaid contractors on OpenAI projects. Handshake declined to comment. These are reports and allegations, and none involve company records, but they are a fair read on how each firm handles a dispute. ## Where do you go from here? Read the full evidence on [is Mercor legit](/answers/is-mercor-legit) and [is Handshake AI legit](/answers/is-handshake-ai-legit). If you hold company records, confirm your rights with the [rights check](/rights-check) first, and compare options in [Mercor alternatives](/answers/mercor-alternatives). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - ["100+ supported tools,"](https://www.mercor.com/data/) - [states $100K to $4M+ per partnership](https://joinhandshake.com/ai/data-partnerships/) - [referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Mercor](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [CourtListener](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) - [IC Legal News](https://www.independentcontractorcompliance.com/2026/06/09/artificial-intelligence-firms-continue-to-be-targeted-for-independent-contractor-misclassification-claims-may-2026-ic-legal-news-update/) - [Business Insider reported](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) --- # micro1 vs Scale AI: what each one does > micro1 vs Scale AI: both run company-data programs. micro1 lists $100K+ tiers, Scale AI an illustrative $10K to $1M+, beside its labeling work. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-vs-scale-ai Published: 2026-09-10 Updated: 2026-10-14 ## The short answer micro1 and Scale AI both run company-data programs. micro1 states tiers of $100K+, $500K+ and $1M+ for companies with 30 or more employees. Scale AI prefers 40+ employees and states an illustrative $10K to $1M+ per partnership. Scale is better known for labeled training data. ## What does micro1 do? [micro1](/buyers/micro1) calls itself a data lab. Its data partnerships page looks for "operationally mature companies with 30+ employees, established documentation." That means SOPs, knowledge bases, CRM data, project histories, bug tracking and sales playbooks. It is "primarily looking for companies that operate in English" and prioritizes US companies, followed by other Western markets. It says companies keep ownership of their underlying data ([micro1](https://www.micro1.ai/data-partnerships)). It states tiers of "$100k+" for qualified enterprise partnerships, "$500k+" for large or ongoing work and "$1M+" for highly unique data. TechCrunch reported that an unnamed source put micro1's gross run rate at $500M. micro1 also offered $12.5M for Spirit Airlines' archive after Google's $10M winning bid ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). ## What does Scale AI do? TechCrunch describes Scale AI as a data-labeling company that "produces and labels data" used to train large language models. Scale AI's site sells a Data Engine to enterprises and governments. It lists customers such as NVIDIA, Mayo Clinic, BP, Meta and the US Department of Defense ([scale.com](https://scale.com)). **$14.3B** About what Meta paid for a 49% stake in Scale AI, confirmed 13 Jun 2025 ([source](https://techcrunch.com/2025/06/13/scale-ai-confirms-significant-investment-from-meta-says-ceo-alexandr-wang-is-leaving/)) Meta took the stake at a $29B valuation ([TechCrunch](https://techcrunch.com/2025/06/13/scale-ai-confirms-significant-investment-from-meta-says-ceo-alexandr-wang-is-leaving/)). Scale recruits contributors through Outlier and Remotasks. Scale also runs a [data partnership](https://scale.com/data-partnership) for companies. It says it turns de-identified workflow records into training data, and you approve each data package before it moves. Our [Scale AI profile](/buyers/scale-ai) keeps the record field by field. ## How do the micro1 and Scale AI company-data programs compare? micro1 and Scale AI both pay companies for operating records, on different floors. micro1 asks for 30+ employees and states tiers from $100K+. Scale AI prefers 40+ employees and calls its $10K to $1M+ range illustrative. **micro1 and Scale AI company-data programs side by side** | Term | micro1 | Scale AI | |---|---|---| | Stated size | 30+ employees, mature operations | 40+ employees preferred, case by case | | Stated pay | Tiers of $100K+, $500K+ and $1M+ | $10K to $1M+ per partnership, illustrative | | Records named | SOPs, knowledge bases, CRM data, project histories | Warehouses, chat, email, documents, work tools, business platforms | | Privacy step | PII removed when relevant, isolated pipelines | Anonymized inside your environment, approval per package | | Pick this when | You want stated tiers from $100K | You want approval on every data package | Both figures are each company's own. Neither names the labs that receive the data, so ask before any export. ## What do court records say about Scale? *McKinney v. Scale AI*, a California class action over how Scale classified its Outlier and Remotasks contributors, carries a $12.5M settlement with a final approval hearing on 30 Oct 2026 ([OpenClassActions](https://openclassactions.com/settlements/employment-law/scale-ai-contributor-misclassification-class-action-settlement.php)). The defendants deny wrongdoing. The case involves no company records. For micro1's record, see [how micro1's data partnership works](/guides/micro1-data-partnership) and [is micro1 legit](/answers/is-micro1-legit). Before any call, run the [rights check](/rights-check). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1](https://www.micro1.ai/data-partnerships) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [scale.com](https://scale.com/) - [TechCrunch](https://techcrunch.com/2025/06/13/scale-ai-confirms-significant-investment-from-meta-says-ceo-alexandr-wang-is-leaving/) - [data partnership](https://scale.com/data-partnership) - [OpenClassActions](https://openclassactions.com/settlements/employment-law/scale-ai-contributor-misclassification-class-action-settlement.php) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Data licensing audit: what it covers and who runs it > A data licensing audit reviews your records before licensing: inventory, rights, sensitive data, thresholds and buyer fit. No standard exists. Sources compared. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-licensing-audit Published: 2026-09-09 Updated: 2026-10-14 ## The short answer An audit reviews records before an AI license. No industry standard exists. Five parts: inventory of systems, rights check, sensitive records list, buyer threshold test and buyer match. Thresholds are self-reported. Rights questions go to counsel. The five parts below are my own structure. Each draws on a dated source, and the table says which. ## What do the companies check at intake? Each buyer runs its own light version of an audit. - **[micro1](/buyers/micro1).** micro1's David Revland, who works on human data, said in an undated recorded forum talk that a data manifest form asks which services you use and a rough size for each. He said micro1 supplies instructions for finding sizes (self-reported, talk date not stated). See [what a data manifest form is](/answers/what-is-a-data-manifest-form). - **[Handshake AI](/buyers/handshake-ai).** Its [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) runs an estimator that asks for headcount, years in operation and country, then describes a scoping call on data parameters, de-identification, terms and timeline. - **Troveo.** Its first step is [Scope](https://www.troveo.ai/business-data), which it describes as deciding what is in and what is out. Anonymizing follows, documented in a manifest. ## What does Frankfurt Kurnit say to check? [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) lists the review steps. Involve legal, privacy, security, HR and communications people. Inventory systems, record types, volume and timeframes. Review customer, partner, vendor and platform terms. Exclude categories such as privileged material, HR files, payroll, health information, union communications and customer confidential data. Document the review. ## What are the five parts of an audit? | Part | What it checks | Source behind it | |---|---|---| | Inventory | Systems, plan tier, who administers it, size, years covered | Revland (micro1), undated forum talk, FKKS | | Rights | Contracts, notices and third-party content that touch the records | FKKS | | Sensitivity | Categories to exclude before any transfer | FKKS | | Thresholds | Headcount, volume, years, language, location | Buyer pages above | | Buyer fit | Which buyer's published terms match the records | Buyer pages, our [buyer directory](/buyers) | The table rows for rights and sensitivity are fact-gathering. Whether a record may be licensed is a decision for counsel. The [rights check](/rights-check) asks seven questions on it. ## Where do the numbers come from? My [1 TB page](/answers/does-my-company-have-1-tb-of-data) and [inventory template](/answers/company-data-inventory-template) show the columns to fill in. The [readiness checklist](/answers/data-readiness-checklist) lists the published thresholds. ## Who runs the audit? You can. Start with the inventory and the thresholds, then hand the rights and sensitivity rows to counsel. Or use [managed readiness](/managed-readiness), our optional paid service. It builds a buyer one-pager, a systems inventory, questions for your counsel, a buyer shortlist with each buyer's current criteria and a term-question checklist from descriptions and counts, never records. It takes 2 to 3 weeks with two rounds of revisions, and every legal question goes to your lawyer in writing. The audit can end in a no. A company may fall outside every buyer's thresholds, and nothing here promises a buyer or a price. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Inventory and rights -> Mark records, test thresholds -> Match buyers. Our data licensing audit runs from an inventory of systems to a match with buyers. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) - [Scope](https://www.troveo.ai/business-data) - [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # How long does it take to license company data? > Wondering how long it takes to sell company data? No program gives a full licensing clock. Mercor says 2 to 4 weeks after signing. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-long-does-it-take-to-sell-company-data Published: 2026-09-09 Updated: 2026-10-14 ## The short answer Stated clocks run from about 2 weeks to 60 days, and none is a full clock. Mercor says payment comes 2 to 4 weeks after signing. A micro1 referral partner said 2 to 3 weeks from interest to finish and about 60 days to payout. All are self-reported. None of these times is a promise to you, and a review can end in a no. ## What does each company say about timing? | Route | Stated clock | Clock starts at | Source | |---|---|---|---| | Mercor | Wire payment typically within 2 to 4 weeks | Signed agreement | [Mercor data page](https://www.mercor.com/data/) | | micro1, per its CFO in an undated talk | About 10 hours of IT work over 1 to 2 weeks. No total | Transfer step | Recorded forum talk, date not stated | | micro1, per a referral partner | Form under 10 minutes. Payment proposal in a few days. Interested to finished in 2 to 3 weeks. Payout about 60 days after engagement | "Engaged," not defined | micro1 video, about 2:20 to 11:30 | | Handshake AI | Team follow-up, then a scoping call on data, de-identification, terms and timeline. Payment typically 30 to 60 days after dataset acceptance | Acceptance of the de-identified dataset | [Its data partnerships page](https://joinhandshake.com/ai/data-partnerships/) | | Troveo | "A fast first sale." No clock | Not stated | [Its business data page](https://www.troveo.ai/business-data) | Ask for the full schedule on the first call. These rows won't add up to one. ## Why do the clocks not add up? They count from different events. An engagement, a signed agreement and a transfer are three separate starting lines. A two-week figure from one cannot be laid end to end with a four-week figure from another. 1. **Engagement** A micro1 partner counts about 60 days to payout from here. 2. **Signed agreement** Mercor counts 2 to 4 weeks from here. 3. **Transfer step** micro1 counts about 10 hours of IT work over 1 to 2 weeks. The [micro1](/buyers/micro1) partner's 2 to 3 weeks and 60 days almost certainly count different endpoints, delivery and payment. The video does not reconcile them. The figures also leave out work on your side. In an undated recorded forum talk, David Revland, who works on human data at micro1, listed seven steps for a corpus deal, and the talk gave a time only for the transfer. Our [process page](/answers/micro1-data-partnership-process) lists them and [the transfer page](/answers/how-long-does-a-data-transfer-take) has the detail. ## How long can a court-supervised sale take? Longer. Spirit Aviation Holdings' business data went to auction in mid-August 2026. [Google won the auction](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/), and the sale is pending court approval. The approval hearing was moved from 14 Oct to 6 Nov 2026 ([Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data), 9 Oct 2026). No sale order as of 10 Oct 2026. See [the Spirit Airlines data sale](/answers/spirit-airlines-data-sale). A working company licenses under a contract with a buyer, so a bankruptcy court is not part of its clock. ## What shortens your side? The steps you control come before the first call. List your systems. Size each tool. Finish the [rights check](/rights-check). Name the IT person who can run exports. _No clock covers the hours spent finding the person who knows where the Drive export lives._ Counsel's review of your contracts takes the time it takes. It belongs before any signature. The [pillar guide](/guides/how-to-sell-company-data-to-ai-companies) walks through the sequence. Figure: range, Mercor: signed agreement to wire payment, 14 days to 28 days. Mercor says payment typically arrives two to four weeks after a signed agreement. Source: Mercor data page, self-reported. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor data page](https://www.mercor.com/data/) - [Its data partnerships page](https://joinhandshake.com/ai/data-partnerships/) - [Its business data page](https://www.troveo.ai/business-data) - [Google won the auction](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Travel Weekly](https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data) --- # Mercor alternatives for licensing company data > Mercor alternatives and competitors for a company licensing its records: micro1, Handshake AI, Troveo, Replay, Polyshares and SimpleClosure, on their own terms. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/mercor-alternatives Published: 2026-09-09 Updated: 2026-10-14 ## The short answer Mercor runs a data arm that licenses company records to AI labs. Alternatives that take the same records are micro1 and Handshake AI, which post payment ranges, Troveo and Replay, which share revenue, Polyshares, which pays per license, and SimpleClosure for startups that are closing. All figures are self-reported. ## Who are Mercor's competitors for company data? [Mercor](/buyers/mercor)'s data arm licenses records a business already holds, such as Slack, email, tickets and CRM. Its competitors on that side are micro1, Handshake AI, Troveo, Replay, Polyshares and SimpleClosure, each on its own terms. Mercor's competitors for expert labor, the other half of its business, are a different list, which [Scale AI alternatives](/answers/scale-ai-alternatives) covers. **Mercor alternatives, side by side** | Buyer or program | Minimum size | Stated range | Pay model | Payment timing | What you keep | |---|---|---|---|---|---| | [micro1](https://vaultfish.com/buyers/micro1) | 30+ employees, US first | Tiers of $100K+, $500K+, $1M+ | Paid under the agreed partnership | Not published | Companies keep ownership | | [Handshake AI](https://vaultfish.com/buyers/handshake-ai) | 20+ full-time staff, 3+ years | $100K to $4M+ | License fee | 30 to 60 days after dataset acceptance | Not published | | [Troveo](https://vaultfish.com/buyers/troveo) | None stated, estimator from 20 | Six figures, per its page | Revenue share on each sale | On each sale | You own it, ownership stays | | [Replay](https://vaultfish.com/buyers/replay) | Bands start at 20 employees | $10K to $1M+ by headcount | Upfront plus revenue share | Upfront, then on each license | License only, nothing transferred | | [Polyshares](https://vaultfish.com/buyers/polyshares) | None stated | $100K to $2M+ | License fee, no commission | Net 30 to 60 after approval | You keep data, exclusive by default | | [SimpleClosure Asset Hub](https://vaultfish.com/buyers/simpleclosure) | None stated, closing or operating | $10K to $100K per company, press | A percentage on a sale or license | Not published | Perpetual license to SimpleClosure | _Every figure is the company's own claim unless marked press. Terms change, so confirm on each company's page._ ## How do Mercor alternatives pay compared with Mercor? Mercor wires one payment on delivery, typically 2 to 4 weeks after signing, and charges no fees ([Mercor](https://www.mercor.com/data/)). Polyshares also pays once per license, net 30 to 60 after approval. Replay pays upfront plus a revenue share, and Troveo shares revenue on each sale. Handshake AI says payment typically comes 30 to 60 days after it accepts the dataset. Figure: comparison of Three kinds of Mercor alternative: Direct programs (emphasized: Closest to Mercor's data arm, Paid per deal), Marketplaces (Share of each sale), Shutdown sales (Startup archives). Direct programs pay a business per deal for its own records, which is how Mercor's data arm works. ## Which Mercor alternatives fit a startup that is closing? SimpleClosure's AssetHub is built for it, with deals reported at $10,000 to $100,000 per company. Mercor itself has approached shuttered startups with offers reported up to $300,000. The two are side by side in [Mercor vs SimpleClosure](/answers/mercor-vs-simpleclosure). ## How does a company pick between Mercor and its competitors? 1. **Start with what you hold** Count your systems and years of records. 2. **Pick how you want to be paid** Per deal, as a revenue share or as part of a shutdown. 3. **Check each firm** Read its terms, its named entity and its published fees. Our guide to [how to choose an AI data broker](/guides/how-to-choose-an-ai-data-broker) turns that into a checklist. Which tools each firm connects to is in the [connector matrix](/answers/ai-data-company-connectors). ## Do Mercor's competitors name the AI labs that get the data? Most do not. Their pages say "frontier AI labs" and similar. The [buyer directory](/buyers) and the [deals tracker](/deals) record what is public, and the [rights check](/rights-check) covers what you need to hold before any call. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor](https://www.mercor.com/data/) - [Mercor security incident update](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [CourtListener docket, Deboni v. Mercor.io Corp.](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) --- # How to export Google Workspace data for a data license > Looking to export Google Workspace for a data sale? For a license, a super admin runs Google's Data Export tool, which takes 72 hours to 14 days. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-to-export-google-workspace-data-for-a-data-sale Published: 2026-09-08 Updated: 2026-10-14 ## The short answer The main route is the Data Export tool in the Admin console. A super administrator account at least 30 days old, with 2-Step Verification on, must run it. Expect about 72 hours, and up to 14 days. The export is not ready before 48 hours. Takeout covers one user. Both [micro1](/buyers/micro1) partnership videos talk about "the export" and never say what it involves. So I went to Google's own help pages for the steps. ## Which Google route fits a data license? Google gives you three, and they cover very different amounts of data. The [Data Export tool](https://knowledge.workspace.google.com/admin/migrate/export-all-your-organizations-data) sends an organization's data to a Cloud Storage archive. Google Takeout lets one person download their own data in archives of up to 50 GB that expire in about 7 days, and an admin can restrict it for managed accounts. [Vault](https://knowledge.workspace.google.com/vault/exports/export-data-from-vault) searches by matter and exports the results, and it needs the Manage Matters, Manage Searches and Manage Exports privileges. ## Who can run the Data Export tool? A super administrator account that is at least 30 days old, with 2-Step Verification on and Google Cloud turned on for the admin who will open the files. If your organization has more than 1,000 users, Google asks you to contact support first. ## What does the export include and leave out? It covers Gmail, Drive including shared drives, Chat rooms created by users, Calendar, Contacts, Groups, Keep, Tasks, Voice and Vault-retained data, among others. Suspended and archived accounts come along in a full export. It leaves out accounts created in the 24 hours before the start, and deleted data unless Vault held it. Meet is not in the tool's list, though Vault's page says Meet recordings sit in Drive. Vault can also export files that outside parties own and shared with your users, if they are reachable at the time. ## How long does it take, and where does it go? Files land in a Google-provided Cloud Storage bucket in the United States, Europe or with no location preference. You download folders with the gcloud command line tool. Higher editions can filter by user or group, as [our partial-license page](/answers/can-i-sell-only-part-of-my-company-data-to-ai) explains. Packets expire 60 days from the start, so download first and think later. ## How big is a Google Workspace export? micro1's partner gave 3 TB for Google Workspace as an example of a size to type into its intake form (self-reported, illustration only). To get your own number, start with [the Drive storage page](/answers/how-to-check-google-drive-storage-used-by-organization) and [the 1 TB question](/answers/does-my-company-have-1-tb-of-data). ## Who runs the export in a micro1 partnership? Both [micro1](/buyers/micro1) videos mention "the export" without the steps above. micro1's CFO said in an undated recorded forum talk that its forward-deployed engineers help your IT people with the transfer (self-reported). I'd still read [how long a transfer takes](/answers/how-long-does-a-data-transfer-take) so you know what they will ask of you. Drive holds your partners' files too, so run the [rights check](/rights-check) first. [Licensing Google Workspace data](/answers/sell-google-workspace-data-to-ai) covers Google's API terms. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three Google routes to export Workspace data: Data Export tool (emphasized: Covers the whole domain, Whole organization), Takeout (One user's account), Vault (One matter's search). Google's Data Export tool covers a whole organization, Takeout covers one account and Vault covers one matter's search. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Data Export tool](https://knowledge.workspace.google.com/admin/migrate/export-all-your-organizations-data) - [Vault](https://knowledge.workspace.google.com/vault/exports/export-data-from-vault) --- # License contracts to AI: whose terms are inside > Want to sell contracts to AI? A license carries each counterparty's confidential terms. Troveo and micro1's partnership page list contracts. What an NDA says. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-contracts-to-ai Published: 2026-09-08 Updated: 2026-10-14 ## The short answer Before you license contracts to AI, know that each signed agreement holds a counterparty's confidential terms. Troveo and micro1's data partnership page list contracts. A standard NDA limits use to a stated purpose. Common Paper's 2026 benchmark found 14% of cloud agreements bar AI training on customer data. Each signed agreement holds two parties' words, and only one of them is yours. ## Who lists contracts? [Troveo's page](https://www.troveo.ai/business-data) names contracts as a data type beside ledgers and invoices. [micro1](https://www.micro1.ai/data) lists contract workflows and governance documentation. These are the companies' own descriptions, and none gives a price for contracts alone. ## What does a standard NDA say? [Common Paper's Standard Mutual NDA, version 1.0](https://commonpaper.com/standards/mutual-nda/1.0/), is a template and not your agreement. It says the receiving party may use confidential information solely for the stated purpose, and may share it only with people who need to know and are bound by equivalent duties. On request, the recipient must stop using the information and destroy or return it, with an exception for standard backups. Obligations survive for a stated term, and the default is one year from the effective date. ## What does the trade-secret statute add? The Defend Trade Secrets Act, [18 U.S.C. 1839(5)(B)(ii)(II)](https://www.law.cornell.edu/uscode/text/18/1839), reaches disclosure or use by someone who knew or had reason to know the information was acquired under a duty to limit its use. [Does my NDA let me license data to AI](/answers/does-my-nda-let-me-sell-data-to-ai) covers the checklist. ## How common are AI-training bans? [Common Paper's 2026 SaaS contract benchmark](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/) of 16,140 signed agreements found 14% of cloud service agreements prohibit AI training on customer data. That figure covers vendor agreements, and it says nothing about your customers' contracts. ## What about privileged documents? Contracts drafted or annotated by counsel can carry privilege. See [whether licensing emails waives attorney-client privilege](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) and [what customer contracts allow](/answers/do-customer-contracts-allow-selling-data). List which contracts have confidentiality, data-use or AI clauses. The [rights check](/rights-check) asks what your customer contracts allow, and the [risk map](/risks) lists the limits. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three clauses in a standard mutual NDA: Use limit (emphasized: Limits use to the purpose, Stated purpose only), Third parties (Need to know, bound), End of the deal (Destroy or return). The use limit is emphasized because it restricts a recipient to the stated purpose. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's page](https://www.troveo.ai/business-data) - [micro1](https://www.micro1.ai/data) - [Common Paper's Standard Mutual NDA, version 1.0](https://commonpaper.com/standards/mutual-nda/1.0/) - [18 U.S.C. 1839(5)(B)(ii)(II)](https://www.law.cornell.edu/uscode/text/18/1839) - [Common Paper's 2026 SaaS contract benchmark](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/) --- # micro1 data partnership requirements, side by side > micro1 data partnership requirements: 30+ employees, mature operations, primarily English, US first. Current pages beside an earlier, undated talk. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-data-partnership-requirements Published: 2026-09-08 Updated: 2026-10-14 ## The short answer micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Its pages state no data-size threshold. Acceptance depends on micro1's review and current demand. An undated micro1 forum talk gave different, earlier figures. micro1's pages are the current source. micro1's undated recorded forum talk gave different figures, so I keep them beside the pages as history. ## What does micro1 ask for? | Requirement | micro1 pages (current) | Undated micro1 forum talk (historical) | |---|---|---| | Employees | "30+ employees" on the [data page](https://www.micro1.ai/data-partnerships) and the [referral page](https://www.micro1.ai/company-referral) | Earlier figure: 20 full-time | | Operations | Mature operations with established documentation | Not named | | Data volume | No size threshold stated | Earlier figure: about 1 TB across the corpus | | Language | "Primarily English" on its Enterprise Data Partnership listing, no percentage | Earlier figure: about 80% English | | Industry | No restriction stated | Any | | Place | US prioritized, then other Western markets | US and Canada preferred, others welcome | | Company age | No age rule stated | No age rule named | | Number of companies | Not stated | No cap, at least for now | ## Which number should you plan around? The pages. They are what [micro1](/buyers/micro1) publishes now, and they say 30+. The talk carries no date, so I treat its figures as history. A micro1 referral partner also said 25 to 30 and then 30 plus in a micro1 video. If you sit below 30, confirm any exception directly with micro1 and keep the answer in writing. The [minimum employees page](/answers/micro1-data-partnership-minimum-employees) covers the gap in detail. ## Does company age matter? A micro1 referral partner said in a micro1 video that she looks for companies that have been around at least a few years, with a sizable amount of data (self-reported, about 4:40). The talk named no age rule and neither do the pages. That makes it a company-age screen from a partner, and micro1 has not listed it as a data-depth requirement. ## Is there a data-size threshold? micro1's pages state no data-size threshold. micro1 staff named an earlier figure of about 1 TB in an undated recorded forum talk, which is history. A storage count still helps you describe your records on the first call, and the [Google Drive page](/answers/micro1-google-drive-data) shows where Google reports your Drive size. ## What else do the pages describe? The pages say micro1 wants mature operations with documentation, knowledge bases, CRM data, project histories and QA processes. The undated talk added that any industry can apply. Language has its own page, [micro1 English data requirement](/answers/micro1-english-data-requirement), and so does place, [micro1 data partnership Canada](/answers/micro1-data-partnership-canada). ## What comes after you meet them? The first step is a call, and the [process page](/answers/micro1-data-partnership-process) lists every step. Meeting the criteria says nothing about whether you hold the rights to license your records. The [rights check](/rights-check) covers that, and the [full guide](/guides/micro1-data-partnership) puts it in context. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Talk to a privacy or commercial lawyer in your state before you sign. Figure: scale, micro1 staff figures, by source: Undated micro1 talk, historical 20 employees, micro1 pages, current 30 or more (emphasized). micro1's current pages say 30 or more. The lower figure comes from an earlier, undated talk. Source: micro1.ai/data-partnerships and micro1.ai/company-referral, plus an undated recorded micro1 forum talk. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data page](https://www.micro1.ai/data-partnerships) - [referral page](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # micro1 GitHub data: what code adds to a corpus > micro1 GitHub data: GitHub is on micro1's manifest list. How big repos run next to other tools, what Spirit's code archive shows, and what to check. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-github-data Published: 2026-09-08 Updated: 2026-10-14 ## The short answer In an undated recorded forum talk, micro1 said its data manifest form asks which services a company uses, and GitHub is on that list. micro1's pages name neither GitHub nor a code payment. GitHub recommends repositories under 1 GB, so code is usually a small line in a storage count. Code sits in the [micro1 data partnership](/guides/micro1-data-partnership) manifest beside documents and chat. The size rule and the rights rule both work differently for it. ## What did micro1 say about GitHub? Only that GitHub is one of the services the data manifest form asks about, with a rough size for each (self-reported, recording, date not stated). The talk gave no code-specific rule or price. ## How big is code next to your other records? In the same undated talk, [micro1](/buyers/micro1) staff named about 1 TB across the corpus as an earlier figure. Its current pages state no data-size threshold. GitHub recommends repositories under 1 GB and strongly recommends under 5 GB, and blocks files over 100 MiB ([GitHub Docs](https://docs.github.com/en/repositories/working-with-files/managing-large-files/about-large-files-on-github)). At 5 GB a repository, 1 TB would take 200 of them. For most companies the manifest total will come from other tools, and GitHub is a smaller line. ## Why would a lab want code at all? A repository holds more than the latest files. Commits, reviews and issues show how people worked, which is the trail labs describe. The Spirit archive carried around 30 million lines of code beside 100 million emails and 500 million Teams messages ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). Our [Spirit page](/answers/micro1-spirit-airlines) covers the case. ## Do you own the code? That depends on your employment and contractor agreements, your customers' contracts and the open source licenses in your dependencies. I found no verified figure for a single repository, and micro1 published none. Our [source code page](/answers/can-i-sell-source-code-to-ai) lists the questions to take to counsel. ## What should you do first? Ask whoever administers your GitHub organization for a repository count and a rough total size. Then run the [rights check](/rights-check) on code separately from documents. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: scale, GitHub's repository size guidance: Recommended under 1 GB, Strongly recommended under 5 GB (emphasized). GitHub sets a soft size limit for repositories and a firmer one above it. Source: GitHub Docs, About large files on GitHub. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [GitHub Docs](https://docs.github.com/en/repositories/working-with-files/managing-large-files/about-large-files-on-github) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [micro1 data partnerships](https://www.micro1.ai/data-partnerships) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # How to check Slack workspace size > How to check Slack workspace size: Slack's analytics give message and file counts, not gigabytes. What the help pages show, and what an export measures. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-to-check-slack-workspace-size Published: 2026-09-07 Updated: 2026-10-13 ## The short answer Slack analytics give message and file counts, not gigabytes. The dashboard shows messages sent and files uploaded across channels and DMs. JSON exports hold file links, not the files, so an export measures message text only. For a buyer's form, give analytics counts plus what an export shows. Slack publishes activity counts. I found no page that publishes a total size. ## What does the analytics dashboard show? [Slack's help article on the Overview tab](https://slack.com/help/articles/360057638533) lists membership counts, active and posting people by day, week and month, messages sent by members, files uploaded, and two percentage splits, where people read and where messages are sent, across public channels, private channels and direct messages. Any member can see a high-level Overview by default. Detailed Channels and Members views go to Workspace Owners, Admins and members with permission. Pro and Business+ add more tabs, and Enterprise has organization-level dashboards. ## Does Slack show storage used? Neither the dashboard article nor the "View your workspace analytics" article mentions storage used or total size. Slack's pricing page and its Free plan help article did not give file storage figures per plan either. I did not find another Slack page that does, so we state no figure. ## What does an export measure? An export is a second way to size the message side. Each conversation gets a folder of [date-stamped JSON files](https://slack.com/help/articles/220556107), so the size of the export folder reflects message text. Using it as a size is our method, not one Slack publishes. It leaves files out, because JSON exports carry links to files. It also covers only what your plan lets you export. Free and Pro cover public channels, and Business+ adds private channels and direct messages on approval. See [how to export Slack data](/answers/how-to-export-slack-data). ## What does the Free plan hide? [Slack says](https://slack.com/help/articles/27204752526611-Feature-limitations-on-the-free-version-of-Slack) Free workspaces can view and search the last 90 days of messages and files, and that older content is hidden. Its help article adds that content past one year is permanently deleted. An export from a Free workspace cannot show more than Slack still holds. ## What size details does micro1 ask for? [micro1](/buyers/micro1)'s David Revland, who works on human data, said in an undated recorded forum talk that its data manifest form asks for a rough size per tool and that it supplies instructions for finding them (self-reported, recording undated). I haven't seen those instructions. See [what a data manifest form is](/answers/what-is-a-data-manifest-form) and [micro1 and Slack data](/answers/micro1-slack-data). Run the [rights check](/rights-check) next, since size does not say what you may license. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Three ways to size a Slack workspace: Analytics counts (Messages and files), Export folder (emphasized: Measures what exports hold, Message text only), File storage (No Slack figure found). The export folder gets the emphasis because it measures message text, and Slack's pages I read give no total size. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Slack's help article on the Overview tab](https://slack.com/help/articles/360057638533) - [date-stamped JSON files](https://slack.com/help/articles/220556107) - [Slack says](https://slack.com/help/articles/27204752526611-Feature-limitations-on-the-free-version-of-Slack) --- # License manufacturing company data to AI: defense work > Trying to sell manufacturing company data to AI? A license meets DFARS 252.204-7012 for defense data, with 72-hour reporting. Mercor lists manufacturing. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-manufacturing-company-data-to-ai Published: 2026-09-07 Updated: 2026-10-16 ## The short answer License manufacturing data to AI only after checking for defense work. Some defense contract files carry strict security rules. One clause also sets a 72 hour limit to report a cyber incident to DoD. Mercor lists manufacturing. No source gives a price. Ask a lawyer which files may go. This page reports what the clause and the buyer pages say. It is research, not legal advice. > **Some files from a defense contract count as covered defense information. The contract and its markings decide which ones.** Think of the attic. A few boxes carry a government label. Leave those sealed until a lawyer reads the contract. ## Which companies list manufacturing? [Mercor's data page](https://www.mercor.com/data/) names manufacturing among eight sectors (self-reported). [micro1](https://www.micro1.ai/data-partnerships) lists "operations and logistics" among six areas. [Troveo's business-data page](https://www.troveo.ai/business-data) names SAP, NetSuite, ServiceNow and Dynamics among its tools. Our [industry page](/answers/does-industry-matter-for-selling-company-data) puts the lists side by side. ## What manufacturing records might buyers want? [Mercor](/buyers/mercor)'s data page is the only one that names manufacturing data types: work orders, QA logs and spec sheets. The other pages talk about everyday work records, such as tickets, contracts, invoices, project boards and standard operating procedures. No page names bills of materials or sensor data. No source publishes a price for manufacturing records, so any figure you read lacks a published basis. [Polyshares](/buyers/polyshares)' [case studies](https://polyshares.com/track-record) price operational records from other sectors, such as a general contractor's, covered on the [construction page](/answers/sell-construction-company-data-to-ai). ## What does the DFARS clause say? [DFARS 252.204-7012](https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting%2E) is the defense-contract safeguarding clause. Three parts matter here: - Covered defense information is controlled technical information that is not classified. It can also be other information in the CUI Registry. DoD marks and provides it. Or the contractor collects, develops, receives, sends, uses or stores it while doing the contract. - Paragraph (b) requires adequate security on contractor systems. For systems not run for the government, that means NIST SP 800-171. - Paragraph (c) requires the contractor to report a cyber incident to DoD at dibnet.dod.mil "within 72 hours of discovery." The clause is about safeguarding. _The label on the box decides. Read the label._ ## What about export controls on manufacturing data? Releasing technology to a foreign person in the United States can count as an export under [15 CFR 734.13(a)(2)](https://www.law.cornell.edu/cfr/text/15/734.13). Our [source code page](/answers/can-i-sell-source-code-to-ai) explains the text. The same question applies to engineering files, CAD and process documents. We didn't research export law further. ## What can a manufacturer gather first? List which systems hold which records. List which contracts carry defense or customer-confidentiality terms. List which files are marked controlled. The [rights check](/rights-check) asks the contract and NDA questions and lists what to settle with counsel. Figure: steps Covered data, NIST SP 800-171 -> Cyber incident discovered -> Report to DoD within 72 hours. DFARS 252.204-7012 requires a report to DoD within 72 hours of discovering a cyber incident. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's data page](https://www.mercor.com/data/) - [micro1](https://www.micro1.ai/data-partnerships) - [Troveo's business-data page](https://www.troveo.ai/business-data) - [case studies](https://polyshares.com/track-record) - [DFARS 252.204-7012](https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting%2E) - [15 CFR 734.13(a)(2)](https://www.law.cornell.edu/cfr/text/15/734.13) --- # License Discord data to AI: terms and buyers > Searched how to sell Discord data to AI? Licensing it is unclear. No buyer we read names Discord, and its Terms give the license to Discord. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-discord-data-to-ai Published: 2026-09-06 Updated: 2026-10-14 ## The short answer License Discord data to AI? I found no buyer that names Discord. Discord's Terms say your content is yours and give Discord a broad license. The Terms say nothing about AI training. You have no clear license to members' messages, only to your own posts. Discord holds a different kind of record from a company's own tools. The messages are written by members, and many of them are not employees. ## Do any of the companies name Discord? I checked three company pages. [Troveo](https://www.troveo.ai/business-data) lists Slack, Teams, Google Chat and Zoom under chat and messaging. [Mercor](https://www.mercor.com/data/) lists Slack and MS Teams. micro1's page does not name Discord either. That is a negative finding from public pages, and a buyer may still take a private community's archive if asked. My [Slack data page](/answers/sell-slack-data-to-ai) shows what buyers say about workplace chat they do name. ## What do Discord's Terms say about content? [Discord's Terms](https://discord.com/terms) say your content is yours, and that you give Discord a license to it. The license covers using, reproducing, distributing, creating derivative works of, displaying and performing the content, for providing, developing and improving Discord's services. It is worldwide, non-exclusive, royalty-free, sublicensable and transferable. The Terms contain no sentence on AI training or machine learning, in my reading. ## Who holds rights in Discord members' messages? Under Discord's Terms, each person keeps ownership of what they post. The license in the Terms runs to Discord. I found no clause giving a server owner a license to members' messages. That is my reading of one document, and counsel decides what it means for a given server. The same question comes up for [shared Slack channels](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai) and for [a shutting-down company's Slack](/answers/can-a-shutting-down-company-sell-its-slack-to-ai). ## What did I not verify? I could not open Discord's Developer Policy, which governs bots and API use, because the page blocked my fetch. I did not find a rule for how a server owner exports server history. Discord's data request page also blocked my fetch. Talk to a privacy or commercial lawyer in your state before you sign. The [rights check](/rights-check) lists the first questions. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of What Discord's Terms say about content: Ownership (Stays with the user), Discord's license (Broad, to Discord), AI training (emphasized: Silent in the Terms, Not mentioned). Discord's Terms say nothing about AI training, though they give Discord a broad license to user content. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Mercor](https://www.mercor.com/data/) - [Discord's Terms](https://discord.com/terms) --- # Should you license direct to an AI lab or through a broker? > Deciding whether to sell direct to an AI lab or through a broker? Most licensing runs through a marketplace, since no lab publishes an intake for company data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-direct-to-ai-lab-or-through-a-broker Published: 2026-09-05 Updated: 2026-10-14 ## The short answer License through a marketplace or direct program, since no lab publishes a company-data intake. micro1's partnership, Handshake AI and Troveo are visible routes. Google, the only named lab-side bidder, won Spirit Airlines' archive with a $10M bid, pending court approval. Marketplaces add matching and privacy review, often with unpublished fees. Legally, a "data broker" resells consumer data and must register in some states. So this site calls the companies in between marketplaces and buyers. ## Do AI labs buy company data directly? OpenAI announced a Data Partnerships effort in November 2023. It aimed to collect large-scale datasets from outside groups, with a focus on data that "expresses human intention" ([TechCrunch](https://techcrunch.com/2023/11/09/openai-wants-to-work-with-organizations-to-build-new-ai-training-data-sets)). It targets large datasets and does not describe company records. I found no equivalent intake page from other labs. Epoch reported that labs are doing "substantially more in-housing" of environment building. It named [Mercor](/buyers/mercor), Surge, [Handshake](/buyers/handshake-ai) and Turing as vendors ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). Public reporting I read names no enterprise AI vendor buying company email or support records, outside bankruptcy sales. ## What did the one public lab-side deal look like? Spirit Airlines' archive went to a bankruptcy auction. Google won the auction with $10M, and the sale is pending court approval. Mercor bid $7.5M. [micro1](/buyers/micro1) offered $12.5M after the auction closed ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). Google said a third party would scrub personal information first. A flight attendants' union objected that the data would keep "referential integrity." Figure: comparison of Three routes from company data to an AI lab: Direct to a lab (No intake found), Direct data program (emphasized: Publishes tiers you can check, Published tiers), Marketplace (Fee often unpublished). Direct data programs like micro1 are emphasized because they publish tiers a company can check. ## What does a marketplace add? [Troveo](/buyers/troveo)'s own guide says licensing on your own means "finding buyers, negotiating terms, and handling packaging and privacy yourself, which is why most owners go through a marketplace" (a marketplace's view, [Troveo](https://www.troveo.ai/resources/sell-data-to-ai-companies)). Handshake AI says it de-identifies and cleans data on its side before delivery to labs ([Handshake AI](https://joinhandshake.com/ai/data-partnerships/)). ## What does a marketplace cost? Troveo charges owners no fees and shares revenue on each sale. The split is unpublished. A success-fee advisor takes a percentage of what you receive, agreed in writing. micro1 pays companies directly under data partnerships, so the question there is the amount it pays. It states tiers of $100K+, $500K+ and $1M+ (self-reported). Ask each one for the figure in writing. A marketplace also becomes a second place your data sits. Ask who holds it and when it is deleted, using [how to choose an AI data broker](/guides/how-to-choose-an-ai-data-broker). ## What should you do first? Confirm you hold the rights to the records with the [rights check](/rights-check). Then compare [who handles company data](/guides/best-ai-data-brokers). The [buyer directory](/buyers) lists public terms. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [TechCrunch](https://techcrunch.com/2023/11/09/openai-wants-to-work-with-organizations-to-build-new-ai-training-data-sets) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Troveo](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) --- # Can a small business license data to AI? > Wondering if a small business can sell data to AI? It can license some. Staff floors run from none to 30+, with a 20-person scenario by program. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-a-small-business-sell-data-to-ai Published: 2026-09-04 Updated: 2026-10-14 ## The short answer Yes, at some programs. Handshake AI's referral page asks for 20+ full-time staff and 3+ years. The micro1 data partnership starts at 30+ employees. Troveo and Mercor state no minimum, and SimpleClosure's Asset Hub takes data from closing companies. Each is the company's own claim, and none promises a deal. Headcount is usually the first rule a program states, when it states one. Each program below publishes its own staff floor, or none, and every one of them is the company's own claim. ## Which staff minimums do AI data programs state? Published floors run from none to 30 employees. [micro1](/buyers/micro1)'s data partnership asks for 30+ employees and mature operations. [Handshake AI](/buyers/handshake-ai) looks for 20+ full-time staff and 3+ years in operation. [Troveo](/buyers/troveo) and [Mercor](/buyers/mercor) state no staff minimum. - **Handshake AI:** Its 20+ floor appears on its page for people who introduce companies. Its page for companies states none. - **Troveo:** Its [business data page](https://www.troveo.ai/business-data) states no minimum. The value estimator's headcount slider starts at 20, which is a form setting. - **Mercor:** Its [data page](https://www.mercor.com/data/) states no size minimum. It names target industries instead, such as legal, healthcare, finance, logistics and real estate. - **The micro1 data partnership:** Its [data partnerships page](https://www.micro1.ai/data-partnerships) is for "operationally mature companies with 30+ employees" that operate in English, with demand strongest in the US, UK and Canada. micro1 states no data-size minimum. It runs this as a partnership and says companies keep ownership of their data. A separate [micro1 post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) asks for 30 to 200 employees, well-defined workflows and significant internal documentation. Figure: scale, Published staff floors at two programs: Handshake AI 20 or more (emphasized), micro1 30 or more. Handshake AI's stated floor is ten employees below micro1's 30. Source: joinhandshake.com/ai/data-partnerships/referral and micro1.ai/data-partnerships, self-reported. ## Does Handshake AI have a staff minimum? Yes, though it sits on a separate page. Handshake AI's [page for people who introduce companies](https://joinhandshake.com/ai/data-partnerships/referral) asks for 20+ full-time employees and 3+ years in operation. Its [data partnerships page](https://joinhandshake.com/ai/data-partnerships/), the one written for companies, states no minimum. The introductions page says Handshake AI is "looking for companies with 20+ full time employees & 3+ years in operation." The company page's estimator asks for headcount, years in operation and country. I treat that as the floor Handshake AI applies, since its company page never says otherwise. Confirm it with Handshake AI before you plan around it. ## Can a 20-person company license data to AI? A 20-person company can at some programs. If it has run for three years or more, it meets Handshake AI's stated floor. It falls short of micro1's 30+ floor. Troveo and Mercor publish no floor, so fit comes down to the records. ### The 20-person scenario, program by program **A 20-person company against each program's stated size rule. Checked means I read the source on that date.** | Program | What it says about size | Source | A 20-person company | |---|---|---|---| | micro1 data partnership | 30+ employees, operationally mature, operates in English. No data-size minimum | micro1 data partnerships page | Below the floor | | micro1 Enterprise Data Partnership post | 30 to 200 employees, well-defined workflows, significant internal documentation | micro1 post (undated) | Below the floor | | Handshake AI data partnerships | No staff minimum. The estimator asks headcount, years and country | Handshake AI data partnerships page | No floor on this page | | Handshake AI introductions page | 20+ full-time employees and 3+ years in operation | Handshake AI page for people who introduce companies | Meets it at 3+ years old | | Troveo | No minimum. The estimator's headcount starts at 20 | Troveo business data page | No stated floor | | Mercor | No size minimum. Names target industries | Mercor data page | No stated floor | | SimpleClosure Asset Hub | No staff minimum. Built for wind-downs, open to operating companies | SimpleClosure AssetHub page (undated) | Closing or operating | micro1's numbers have moved. In an undated recorded forum talk, micro1 staff named 20 full-time employees and about 1 TB of data, and David Revland of micro1 about 80% English. In an undated micro1 video, a micro1 referral partner put the screen at about 25 to 30 employees and up. micro1's written pages say 30+ today, so both remarks are history and decide nothing. The [micro1 minimum employees page](/answers/micro1-data-partnership-minimum-employees) tracks each figure, and the [micro1 guide](/guides/micro1-data-partnership) covers the program. _The count is full-time staff. The dog that joins every call does not qualify._ ## Does micro1 set a data size or language rule? micro1 sets a language rule only. Its data partnerships page says micro1 is primarily looking for companies that operate in English, and it states no data-size minimum. Handshake AI, Troveo and Mercor publish no size or language floor. A size count by tool still helps, since micro1 lists dataset size among the factors that set compensation. In the same undated talk, micro1's David Revland said the data manifest form asks for rough sizes per tool. The [data manifest form page](/answers/what-is-a-data-manifest-form) shows how to find those sizes. ## How do the Troveo and Handshake AI estimators work? Troveo and Handshake AI both run estimators on their own pages, and each returns that company's own range, not an offer. Troveo's asks for headcount and years in operation among its questions, and Handshake AI's for headcount, years in operation and country. Enter your own counts for a number. Handshake AI's page calls its figure "an indicative estimate only", and Troveo's calls its own "a directional estimate". Years in operation are an input in both. The [years page](/answers/how-many-years-of-data-do-ai-labs-want) compares what programs ask for. ## What if you have fewer than 20 people? Smaller firms still have routes, and the published prices for them run lower. [A Troveo guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) says "value comes from uniqueness, history, and context more than company size." Its [price guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) adds that a 40-person firm with a decade of specialized operational records can hold more training value than a 4,000-person company with generic data. Troveo licenses data, so read that as its view. I found no published deal that tests it. On price, the same guide says "A 60-person software company isn't going to see that figure", meaning Google's $10 million winning bid for Spirit Airlines' archive, which still needs court approval. The guide also points to reporting on closure platforms: about $5,000 for a single code repository, and roughly $10,000 to $100,000 for a shut-down startup's code and workspace archive. Those figures come from companies winding down, which is the next route. ## What about a company that is closing? [SimpleClosure](/buyers/simpleclosure) [launched its Asset Hub in April 2026](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) for founders closing their companies. Its [AssetHub page](https://simpleclosure.com/product/assethub/) now says operating companies can license too. It states no staff minimum. [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), citing Forbes, that SimpleClosure had processed nearly 100 such deals over the past year, with payouts of $10,000 to $100,000 per company. My pages on [shutting down and licensing Slack data](/answers/can-a-shutting-down-company-sell-its-slack-to-ai), [SimpleClosure's cost](/answers/how-much-does-simpleclosure-cost) and [SimpleClosure vs Troveo](/answers/simpleclosure-vs-troveo) cover that route. ## What can a small business license? A small business can license records of real work, with their history kept. Troveo lists chat, email, documents, tickets, wikis, CRM, support, ledgers and code. Mercor asks companies to connect tools such as Slack, Gmail, Salesforce, GitHub and Notion. Rights come before any of it. A record that holds customers' words, an NDA's subject matter, privileged advice or employee conversations may not be yours to license. Start with the [rights check](/rights-check) and the [risk map](/risks). The [guide to licensing company data](/guides/how-to-sell-company-data-to-ai-companies) lists what qualifies and what to exclude. ## How does data monetization for small business work? [MIT Sloan research](https://mitsloan.mit.edu/press/data-everybodys-business-fundamentals-data-monetization) (October 2023) found most data monetization returns come from using data yourself: 51% from improving operations and 31% from wrapping data into products, against 18% from selling information. The research does not single out small businesses. See [what is data monetization](/answers/what-is-data-monetization) and the [monetize company data guide](/guides/monetize-company-data). ## What should a small company do first? A small company should first count full-time staff and years in operation, add up data size by tool, and note the main language of each tool's records. The four answers cover most program questions. The free [fit check](/business) and the [rights check](/rights-check) collect them. Optional, paid [managed readiness](/managed-readiness) does the counting with you, quoted in writing first. We work from descriptions and counts and never receive your records. Figure: steps Count staff, years, size, language -> Compare program floors -> Choose a route. The counts and a comparison with each program's floor come before the route. micro1's post takes applications from companies with 30 to 200 employees. [See micro1's post for 30 to 200 employees (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [business data page](https://www.troveo.ai/business-data) - [data page](https://www.mercor.com/data/) - [data partnerships page](https://www.micro1.ai/data-partnerships) - [micro1 post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) - [page for people who introduce companies](https://joinhandshake.com/ai/data-partnerships/referral) - [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) - [A Troveo guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [price guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [launched its Asset Hub in April 2026](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [AssetHub page](https://simpleclosure.com/product/assethub/) - [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [MIT Sloan research](https://mitsloan.mit.edu/press/data-everybodys-business-fundamentals-data-monetization) --- # Does Slack allow AI companies to use exported data? > Does Slack allow AI companies to use my exported data? The API terms bar apps from LLM training and bulk export. They do not address a customer's own export. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/does-slack-allow-ai-companies-to-use-my-exported-data Published: 2026-09-04 Updated: 2026-10-14 ## The short answer Slack's API terms bar app developers from training language models on API data or bulk exporting messages without agreement. Those limits cover apps. The text does not say what happens when a customer exports data and gives it to a buyer. Other contracts and laws still apply. Which Slack text applies depends on how the data gets out. Two routes matter. ## What do the API terms say? The [API terms of service](https://slack.com/terms-of-service/api) limit anyone who distributes an app beyond a single organization. Under "Data Usage by Third Parties," that developer may not: - use API data to train a large language model - bulk export Slack message and file data, except where an additional agreement allows it - use one organization's data to directly benefit a different organization or any third party Another section bars persistent copies, archives, indexes or long-term data stores of other organizations' API data. [Hunton](https://www.hunton.com/insights/legal/salesforce-locks-down-slack-data-time-to-review-your-slack-api-terms), a law firm, wrote about the change. It notes Salesforce can change the terms on notice. ## Does that cover a buyer that connects to my workspace? A buyer that connects through OAuth or the API is an app provider in the sense the text uses. That's my reading, because the text describes developers and their apps. A buyer that asks you to run an export yourself uses a different route. ## What about my own admin export? Slack's [help page](https://slack.com/help/articles/201658943-Export-your-workspace-data) says Free and Pro workspace owners and admins can export public channels. On Business+ and Enterprise plans, owners can use tools to export all channels and conversations. That includes private channels and direct messages. Slack's [guide to import and export tools](https://slack.com/help/articles/204897248-Guide-to-Slack-import-and-export-tools) gives the owner two duties. The owner must have the right employment agreements and company policies in place. The owner must also make sure every use of the export is legal. Slack's [privacy principles](https://slack.com/trust/data-management/privacy-principles) say customers own their customer data. They also say Slack will not use Customer Data to train generative AI models without clear opt-in consent. Neither statement covers a customer handing its own export to a third party. ## What if the channels are shared with other companies? [Slack Connect exports](https://slack.com/help/articles/115004152843) include messages from members outside the exporting organization. Slack says external content is kept under the outside organization's settings. Nothing I read says the exporter may relicense the other company's messages. Treat shared channels as a rights question for counsel. The [rights check](/rights-check) asks whose records these are and whether staff messages are included. The [risks page](/risks) covers the other limits on Slack licensing, such as contracts and employee rules. Figure: comparison of Two ways Slack data leaves a workspace: Admin export (Customer terms apply), Buyer app via API (emphasized: API terms bind the app provider, API terms apply). The API terms bind the app provider, which is why the extraction route decides which Slack text applies. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [API terms of service](https://slack.com/terms-of-service/api) - [Hunton](https://www.hunton.com/insights/legal/salesforce-locks-down-slack-data-time-to-review-your-slack-api-terms) - [help page](https://slack.com/help/articles/201658943-Export-your-workspace-data) - [guide to import and export tools](https://slack.com/help/articles/204897248-Guide-to-Slack-import-and-export-tools) - [privacy principles](https://slack.com/trust/data-management/privacy-principles) - [Slack Connect exports](https://slack.com/help/articles/115004152843) --- # License QuickBooks data to AI: what is verified > Want to sell QuickBooks data to AI? You license it. Troveo names QuickBooks, Intuit's export is a zip of Excel files, and its partners may not train on it. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-quickbooks-data-to-ai Published: 2026-09-04 Updated: 2026-10-14 ## The short answer Export QuickBooks reports and lists to license the data to AI. Troveo lists it. Intuit says customer data is not shared with its AI partners to train their models. I didn't read Intuit's own terms on its use. Financial records are among a company's most sensitive. This page lists only what I could check at the source. Where a fact is missing, it says so. ## Which companies name QuickBooks? [Troveo](https://www.troveo.ai/business-data) lists QuickBooks with Stripe, NetSuite, Pigment and Shopify under finance and operations. [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) lists finance and accounting among six areas. Mercor's data page doesn't name QuickBooks. All of it is self-reported. See [financial data](/answers/can-i-sell-health-or-financial-client-data-to-ai) for the federal rules on client financial records. ## How does a QuickBooks Online export work? [Intuit's help article](https://quickbooks.intuit.com/learn-support/en-us/help-article/list-management/export-reports-lists-data-quickbooks-online/L1xleDrLp_US_en_US) says an admin opens Settings, picks Export data under the Tools column, and chooses reports and lists to download as Excel files in one zip. The data types include invoices, receipts, bills, estimates, purchase orders, the chart of accounts, and products and services. Attachments download as a zip. ## What does Intuit say about AI and customer data? [Intuit's blog post](https://www.intuit.com/blog/innovative-thinking/ai-principles-openai-anthropic-partnerships/) says customer data is not shared with its OpenAI and Anthropic partners to train their models, and that its agreements prohibit that use. The post covers those partners. It doesn't cover Intuit's own use of customer data, and I didn't find that statement at the source. It doesn't cover what you may do with an export either. ## Whose records are in the QuickBooks file? A company's books name its customers, vendors and staff. If the file is an accountant's or bookkeeper's, the books belong to clients. [The FTC's Safeguards Rule](https://www.law.cornell.edu/cfr/text/16/314.2) lists an accountant or tax preparer as a financial institution, and [the tax-return rules](https://www.law.cornell.edu/uscode/text/26/7216) come with criminal penalties. The [accounting firm page](/answers/sell-accounting-firm-data-to-ai) sets out the texts. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Settings, Export data in Tools -> Pick reports and lists -> Download one zip of Excel files. A QuickBooks Online admin exports reports and lists as Excel files in one zip. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Intuit's help article](https://quickbooks.intuit.com/learn-support/en-us/help-article/list-management/export-reports-lists-data-quickbooks-online/L1xleDrLp_US_en_US) - [Intuit's blog post](https://www.intuit.com/blog/innovative-thinking/ai-principles-openai-anthropic-partnerships/) - [The FTC's Safeguards Rule](https://www.law.cornell.edu/cfr/text/16/314.2) - [the tax-return rules](https://www.law.cornell.edu/uscode/text/26/7216) --- # Does my company have 1 TB of data? How to check your storage > Does my company have 1 TB of data? Where Google and Microsoft admin reports show your storage, and why micro1's pages state no data-size threshold. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/does-my-company-have-1-tb-of-data Published: 2026-09-03 Updated: 2026-10-13 ## The short answer Admin reports from Google and Microsoft show your current storage, in megabytes. micro1's pages state no data-size threshold. 1 TB was an earlier figure from an undated micro1 forum talk. A storage count still helps you describe your records to any program. Storage is the easy number to find, and it helps you describe your records on a first call. Whether the stored files can be licensed is a separate question. ## How big is 1 TB in the reports? The reports use megabytes. One terabyte is about 1,000,000 MB, or 1,000 GB. The figure is a convenient yardstick. In an undated recorded forum talk, [micro1](/buyers/micro1) staff named about 1 TB as an earlier expectation, and micro1's current pages state no size threshold. A micro1 referral partner walking through the form in a micro1 video gave Google Workspace at about 3 TB and Slack at about 300 GB as example sizes (self-reported, about 2:30). They illustrate the form. They aren't thresholds, and they aren't your numbers. ## Where do I find the numbers? - **Google Drive:** Admin console, Reporting, User Reports, Apps usage, column "Drive storage used (MB)". Google says user reports for Drive don't include changes made in shared drives, so the total can run low ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/user-reports-apps-usage)). - **SharePoint:** Microsoft 365 admin center, Reports, Usage, SharePoint, Site usage tab, column "Storage used (MB)" ([Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/sharepoint-site-usage-ww?view=o365-worldwide)). - **OneDrive:** the same Usage page, OneDrive, Usage tab, same column name. Microsoft says the report only includes users who have a valid OneDrive license ([Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww?view=o365-worldwide)). - **Slack:** the export page lists file links, and gives no size report (Slack Help Center). The [Drive page](/answers/micro1-google-drive-data) walks through the Google report in detail. ## What does the total leave out? Storage counts everything, including duplicates, personal files and client documents. micro1 has not said how it measures a corpus, whether before or after cleaning, so ask. The [inventory template](/answers/company-data-inventory-template) gives you a row per tool for the sizes. ## What if I am under 1 TB? micro1's data partnerships page states no size threshold. Its current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. See the [requirements table](/answers/micro1-data-partnership-requirements). Other buyers publish different gates, and the [readiness checklist](/answers/data-readiness-checklist) lines them up. ## Does size set what micro1 pays? [micro1's page](https://www.micro1.ai/data-partnerships) lists tiers of $100K or more, $500K or more and $1M or more, tied to size, workflow complexity, quality, domain expertise and uniqueness. It publishes no rate per terabyte, and no outcome is promised. See [what micro1 pays](/answers/how-much-does-micro1-pay-for-company-data). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Pull admin storage reports -> Note size per tool -> Bring the totals to a first call. A storage count describes your records. micro1's pages set no size threshold. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/user-reports-apps-usage) - [Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/sharepoint-site-usage-ww?view=o365-worldwide) - [Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww?view=o365-worldwide) - [micro1's page](https://www.micro1.ai/data-partnerships) --- # Handshake AI alternatives for licensing company data > Handshake AI alternatives and competitors for a company licensing its records: micro1, Mercor, Troveo, Replay, Polyshares and SimpleClosure, on their own terms. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/handshake-ai-alternatives Published: 2026-09-03 Updated: 2026-10-14 ## The short answer Handshake AI alternatives for a company with records to license are micro1, Mercor, Troveo, Replay, Polyshares and SimpleClosure. Handshake AI states $100K to $4M+ and asks for 20+ staff and 3+ years. The others differ on size floor, pay model and payment timing. All figures are self-reported. [Handshake AI](/buyers/handshake-ai) runs a company-data program, and six other companies take the same kinds of records on different terms. Each row below comes from that company's own pages. ## What does Handshake AI's data program offer? Handshake AI's [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) states $100K to $4M+ per company. Its calculator example gives $383,083 to $896,969 for 100 employees and 10 years. Another of its [pages](https://joinhandshake.com/ai/data-partnerships/referral) asks for 20+ full-time staff and 3+ years. Its FAQ says payment typically comes 30 to 60 days after it accepts the de-identified dataset. It publishes no ownership terms. See [Handshake AI data partnerships](/answers/handshake-ai-data-partnerships) for what it says in full. ## Which companies compete with Handshake AI for company data? Mercor, Troveo, Replay, Polyshares and SimpleClosure take records such as Slack, email, tickets and CRM history. micro1 lists SOPs, knowledge bases, CRM data and project histories. They split on size floor and pay. **Handshake AI alternatives, side by side** | Buyer or program | Minimum size | Stated range | Pay model | Payment timing | What you keep | |---|---|---|---|---|---| | [micro1](https://vaultfish.com/buyers/micro1) | 30+ employees, US first | Tiers of $100K+, $500K+, $1M+ | Paid under the agreed partnership | Not published | Companies keep ownership | | [Mercor](https://vaultfish.com/buyers/mercor) | None stated | Up to $300K, press report | One wire, no fees to you | 2 to 4 weeks after signing | Not published | | [Troveo](https://vaultfish.com/buyers/troveo) | None stated, estimator from 20 | Six figures, per its page | Revenue share on each sale | On each sale | You own it, ownership stays | | [Replay](https://vaultfish.com/buyers/replay) | Bands start at 20 employees | $10K to $1M+ by headcount | Upfront plus revenue share | Upfront, then on each license | License only, nothing transferred | | [Polyshares](https://vaultfish.com/buyers/polyshares) | None stated | $100K to $2M+ | License fee, no commission | Net 30 to 60 after approval | You keep data, exclusive by default | | [SimpleClosure Asset Hub](https://vaultfish.com/buyers/simpleclosure) | None stated, closing or operating | $10K to $100K per company, press | A percentage on a sale or license | Not published | Perpetual license to SimpleClosure | _Every figure is the company's own claim unless marked press. Terms change, so confirm on each company's page._ ## Which Handshake AI alternatives take a company with fewer than 20 staff? Mercor and Polyshares state no minimum, and Troveo's estimator starts at 20. Replay's first band covers 20 to 50 employees. micro1 asks for 30+, so it fits a larger company than Handshake AI's floor. Every floor and its source is in [do you qualify for an AI data program](/answers/ai-data-program-minimums). ## Which Handshake AI alternatives state when they pay? Mercor typically wires payment within 2 to 4 weeks of signing, per its [data page](https://www.mercor.com/data/). Polyshares pays net 30 to 60 after approval. Replay pays upfront, then shares each later license, and Troveo shares revenue on each sale. Our [Mercor vs Handshake AI](/answers/mercor-vs-handshake-ai) page compares those two programs line by line. ## How should a company choose between Handshake AI and its alternatives? Match the program to what you hold and how you want to be paid. Years of Slack, email, tickets or CRM records fit the direct programs. A startup that is closing fits [SimpleClosure](/answers/is-simpleclosure-legit). Confirm you hold the rights first with the [rights check](/rights-check). Then compare entity, terms and fees with the checklist in [how to choose an AI data buyer](/guides/how-to-choose-an-ai-data-broker). The [buyer directory](/buyers) records each firm's public terms. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) - [pages](https://joinhandshake.com/ai/data-partnerships/referral) - [data page](https://www.mercor.com/data/) - [Business Insider via AOL](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) --- # How do you license business data to AI? > Searching how to sell business data to AI? You license a defined set of records, through a marketplace or direct program, once your rights are confirmed. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-business-data-to-ai Published: 2026-09-03 Updated: 2026-10-14 ## The short answer License business data to AI only after confirming your rights to every record. micro1's partnership page lists SOPs, knowledge bases and CRM data, and Troveo names chat and CRM. Shutdown startups see $10K to $100K. Handshake AI states $100K to $4M+. Count your rights before any data leaves. The market is young, and most of the figures come from the firms selling the service. ## Who buys business data? Google placed the [$10M winning bid](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) for Spirit Airlines' archive, pending court approval. [Troveo](/buyers/troveo) runs a marketplace that licenses business data to buyers, and [Handshake AI](/buyers/handshake-ai) and Mercor's data arm run direct programs. Names are covered in [who buys company data for AI](/buyers). ## Where does micro1 fit? [micro1](/buyers/micro1) runs company-data partnerships for AI development. It pays compensation under the agreed data partnership, and it says companies keep ownership of their data (self-reported). ## What qualifies? Stated minimums differ by source, so check yours against each (all self-reported): - **[micro1 pages](https://www.micro1.ai/data-partnerships):** 30 or more employees, mature operations and primarily English documentation, with US companies prioritized. No data-size threshold stated. - **[Handshake AI referral page](https://joinhandshake.com/ai/data-partnerships/referral):** 20 or more full-time employees and 3 or more years in operation. - **[Troveo business-data page](https://www.troveo.ai/business-data):** no minimum stated. Records you lack the right to license stay out. Email and chat hold other companies' information, often under NDAs, and counsel flags trade secrets, privilege and employee talk the US labor law protects ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). ## What do the published figures show? No public price list exists. [Handshake AI says](https://joinhandshake.com/ai/data-partnerships/) partnerships range from $100K to $4M+ depending on the data shared, and micro1's pages list $100K+, $500K+ and $1M+ tiers, with its Enterprise Data Partnership listing saying $100K-$2M+ for approved data packages. SimpleClosure reported nearly 100 deals at [$10,000 to $100,000](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916). All are self-reported or press figures, and every public deal so far is a distressed company or a company's published headline. The [value guide](/guides/how-much-is-your-business-data-worth-to-ai) covers what moves a number. ## What is the first step? Write a block per system: the tool, the oldest record, the approximate count, whose words are in it and any restrictions. The ten-minute sheet is in the [value guide](/guides/how-much-is-your-business-data-worth-to-ai). Then run the [rights check](/rights-check) and take the free [fit check](/business). The full process is in the [pillar guide](/guides/how-to-sell-company-data-to-ai-companies). Talk to a privacy or commercial lawyer in your state before you sign. Figure: range, Data partnership range, stated, $100K to $4M. Handshake AI states a wide range for data partnerships, open at the top. Source: Handshake AI Data Partnerships page, self-reported. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [$10M winning bid](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [micro1 pages](https://www.micro1.ai/data-partnerships) - [Handshake AI referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Troveo business-data page](https://www.troveo.ai/business-data) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Handshake AI says](https://joinhandshake.com/ai/data-partnerships/) - [$10,000 to $100,000](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) --- # How do you license company data to AI? > To license company data to AI, pick a payment model: a direct partnership (micro1) or a revenue share (Troveo, Protege). Terms to settle first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/license-company-data-to-ai Published: 2026-09-03 Updated: 2026-10-14 ## The short answer To license company data to AI, pick which records to include and how you want to be paid, then sign terms with an AI data company or marketplace. micro1 pays under an agreed data partnership, and Troveo and Protege pay a revenue share. Settle terms in writing. Buyers use "sale" and "license" loosely. The payment model is the part to compare. > **A sale pays once. A license pays each time the data is used, in Troveo's wording.** It's like renting out a room. You keep the house, and the rent comes back around. ## Which payment models are on offer? - **Direct partnership.** [micro1](/buyers/micro1) pays compensation under the agreed data partnership, and it says companies keep ownership of their underlying data. Its data partnerships page lists $100K+, $500K+ and $1M+ tiers, and its CFO said in an undated recorded forum talk that deals run $100K to $2M per company. The same undated talk mentioned a possible top-up about six months later for new data (self-reported). - **Revenue share.** [Troveo](https://www.troveo.ai/business-data) says you share in the revenue on every sale. The split is unpublished. - **Revenue share on qualified deals.** [Protege](/buyers/protege) says owners receive revenue-share payments when their content enters qualified deals. The split is not published ([Protege](https://withprotege.ai/data-provider/video)). [Pricing models](/answers/data-monetization-pricing) shows the public figures for each. Figure: comparison of Three payment models in public sources: Direct partnership (emphasized: Clearest public payment tiers, micro1, stated tiers), Revenue share (Troveo, split unpublished), Deal revenue share (Protege, qualified deals). micro1 publishes tiers for its partnerships, so that model has the clearest public figures. ## What does a license contract need to settle? Bring these questions to a lawyer: 1. **Scope.** Which systems and date range are in, and what is out. 2. **Exclusivity.** How long, for which buyers, and at what premium. Epoch's interviews put exclusive RL environment deals at roughly 4x to 5x the non-exclusive price ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). 3. **De-identification.** Who does it, to what standard, and whether you may scrub first. See [data de-identification](/answers/data-de-identification). 4. **Deletion.** Whether data must be deleted when the license ends. [Troveo](/buyers/troveo)'s guide says a license defines this at expiry. It also says models already trained survive the license ending ([Troveo](https://www.troveo.ai/resources/ai-data-licensing-deals)). 5. **Liability.** Who carries the cost if a record leaks or a rights claim lands. The split is not public for the buyers checked. _Every item above is easier to settle before you sign than after._ ## Which companies offer which licensing model? micro1 and [Handshake AI](/buyers/handshake-ai) run direct data partnerships. Troveo and Protege license onward, and the end user is rarely named. Your choice also depends on how much control you want over repeat use, and how clearly you can see the payment. The [buyer directory](/buyers) lists each player. ## What comes first? Rights. Your archive holds other people's words. Run the [rights check](/rights-check) and read the [risk map](/risks) before a buyer call. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Protege](https://withprotege.ai/data-provider/video) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Troveo](https://www.troveo.ai/resources/ai-data-licensing-deals) --- # What is an enterprise data partnership at micro1? > An enterprise data partnership is micro1's corpus track: tiers of $100K+ to $1M+, and you keep ownership of the data. How it differs from workflows. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/enterprise-data-partnership Published: 2026-09-03 Updated: 2026-10-13 ## The short answer An enterprise data partnership is micro1's corpus track: a company-data partnership for AI development, paid under the agreed terms. micro1 says companies keep ownership of their underlying data. micro1's pages list tiers of $100K+, $500K+ and $1M+. Its Enterprise Data Partnership listing says $100K-$2M+ for approved packages. Both are self-reported. The phrase appears on [micro1](/buyers/micro1)'s data partnerships page and in the forum recording. The recording has no date and only automatic captions. ## What does the track cover? A company's data corpus. That means the records its tools hold, such as Google Workspace, Slack, project management tools and GitHub. In the undated talk, micro1's CFO said the value is the path from a request to a deliverable across tools. The product is context. Names and vendor line items matter less. micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. The undated forum talk gave earlier figures for staff, size and language, which are history. micro1 says companies keep ownership of their underlying data. Confirm licensed uses, duration, exclusivity and payment structure in the proposed agreement. ## What do the three tiers mean? Per [micro1's page](https://www.micro1.ai/data-partnerships), $100K+ covers qualified enterprise data partnerships. $500K+ covers large-scale operational datasets or ongoing multi-team participation. $1M+ covers highly unique proprietary data. Tiers are set per deal, and the page names no AI labs. In the undated talk, David Revland, who works on human data at micro1, said micro1 may also come back for a top-up about six months after a corpus deal, covering newer data. It promises no outcome to you. ## How does it differ from the workflows track? A corpus deal is one transfer. In the workflows track, employees use a general-purpose AI agent on their real daily work and grade the result. micro1 receives the grade and the agent's trajectory. In the undated talk, the CFO described pay per completed task in the high hundreds of dollars for a couple of hours of work. We could not confirm that figure word for word in the captions. A company can do both. _One transfer covers what you hold today. Your Slack keeps writing new messages anyway._ ## What is the process? In the undated recorded forum talk micro1's David Revland described a sequence of steps, shown here as five stages. In that undated talk, micro1's CFO estimated about 10 hours of work from one or two of your IT people over a week or two. 1. **First call** With a data partnership manager. 2. **Manifest form** Lists your tools and rough sizes. 3. **Terms and contract** A payment proposal, then contract language. 4. **Transfer** micro1's engineers help your IT team. 5. **Verification and payment** Our [micro1 data partnership guide](/guides/micro1-data-partnership) walks each step. [How long a data transfer takes](/answers/how-long-does-a-data-transfer-take) covers timing. ## What does micro1's partner post add? micro1 also runs a public [Enterprise Data Partnership post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710), and the post carries no date. It asks for companies with 30 to 200 employees. micro1's main pages say 30+ with no upper limit, so a company over 200 should confirm the program with micro1. It wants mature workflows, written processes and modern software tools. It lists SOPs, playbooks, knowledge bases, project workflows, internal messages, CRM and workflow metadata and task histories. Industries named include technology, finance, consulting, legal, healthcare administration and logistics. The post gives no per-company amount and no tiers, though it cites totals for micro1 as a whole. It says pay is "significant" and depends on five things: - Dataset size - Workflow complexity - How unique the knowledge is - Data quality - The domain expertise it shows That is micro1's own claim. Nobody can promise you a number from it. To apply, you fill in a form of about two minutes. micro1 says it handles coordination and anonymization. The post gives no timeline. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [See the enterprise partner post (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ ## What about privacy? micro1's CFO said in an undated recorded forum talk that every corpus goes through a scrubbing step. Revland said it swaps names for consistent stand-ins across tools. micro1 staff said companies cannot pre-scrub, because redacting first would remove the trail it needs. Ask who holds the name mapping and for how long. See [data de-identification](/answers/data-de-identification). Figure: comparison of micro1's two company-data tracks: Enterprise partnership (emphasized: A single transfer, One transfer), Workflows (Repeats by task). The enterprise partnership gets the emphasis because it is a single transfer, while workflows repeat. Run the [rights check](/rights-check) before you apply. ## Their FAQ, in plain words The post has no FAQ list. Its "Security" and "Why partner with us" blocks answer the usual questions, so we restate them in our words. ### Who can join? The undated post asks for 30 to 200 employees, steady workflows and written processes. micro1's main pages say 30+ with no upper limit, so a company over 200 should confirm the program with micro1. micro1 picks the partners. ### What happens to our data? micro1 says it keeps the original files only to process them, scrubs sensitive details and removes confidential items. It says "Original datasets are deleted after processing." It also says nothing is shared publicly, no customer information is exposed and you keep ownership. The contract is not public, so ask to read it first. ### How does micro1 pay us? micro1 says selected partners get significant pay based on the five factors above. It gives no figure on this post. ### How much work is it for our team? micro1 says it handles coordination, anonymization and program management so your team has little disruption. The CFO's undated recorded forum talk, noted above, put IT time at about 10 hours. ### Why does micro1 want this? It says real company workflows help it train and test AI in realistic business settings. It says it does not aim to copy your business or customers. Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's page](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # BuyMyDeadStartup: how the listing site works > BuyMyDeadStartup is a listing board where closed startups advertise code and records to AI labs. Free for sellers, $1,500 a month for buyers, no escrow. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/buymydeadstartup Published: 2026-09-02 Updated: 2026-10-14 ## The short answer BuyMyDeadStartup is a listing board where closed-startup founders describe code, Slack and email. It's free for sellers, takes no commission, and charges buyers $1,500 a month for access. The site holds no escrow and settles all terms between buyer and seller. [BuyMyDeadStartup](https://buymydeadstartup.com) has a Show HN post on Hacker News titled "Sell your IP to AI labs." In my search it was the only seller-intent item there, which tells you how new this corner is. ## What does BuyMyDeadStartup do? A founder submits a text description of what exists: Git repositories, issue trackers, Slack, company email, Drive and wikis, with rough sizes. The site says it uploads nothing and takes no custody of any data. Figure: steps You submit a listing -> Site checks, buyer contacts you -> You negotiate terms. BuyMyDeadStartup publishes your listing, and the negotiation happens between seller and buyer. The site verifies the company email address and reads each listing by hand before publishing. Listings show the company and a contact address, with no individual names. Its sample listing is a placeholder with an example address. ## What does it cost, and what does it say things are worth? Listing is free, with no fee and no cut of a sale. Buyers pay $1,500 a month for access to every listing, which is how the site funds itself. The seller's asking price is optional, and a blank price reads "Open to offers." Its worth section says companies have been paid $10,000 to $100,000 across roughly 100 reported deals in a year, and $100,000 or more for one company with 13 years of code, tickets and email. It credits Forbes. The [Gizmodo report](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) of that coverage says nearly 100 deals, so the site's "roughly 100+" runs a little above it. ## Who runs it, and who carries the risk? I found no legal entity, address or founder name on the site, and the contact is team@buymydeadstartup.com. The domain was registered in Aug 2026. The site says it makes no claim about the legality or compliance of any transaction. It says price, terms, legal questions and privacy questions are handled between buyer and seller. Slack messages and email contain other people's words, so the [rights check](/rights-check) lists what to confirm first. See also [can a shutting-down company license its Slack to AI](/answers/can-a-shutting-down-company-sell-its-slack-to-ai). ## How does it compare with other options? [SimpleClosure](/buyers/simpleclosure) manages the sale and scrubs the data, per [its launch release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html). BuyMyDeadStartup says it takes no part in the sale. The options sit side by side in [SimpleClosure alternatives](/answers/simpleclosure-alternatives). Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [BuyMyDeadStartup](https://buymydeadstartup.com/) - [Gizmodo report](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [its launch release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) --- # Is micro1 legit? The evidence > Is micro1 legit for a company licensing its records? The entity, published terms, security claims, payout claims and press record, with our plain read. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-micro1-legit Published: 2026-09-01 Updated: 2026-10-14 ## The short answer micro1 Inc. is a real company. It publishes referral terms and a company-data page, and press reported a $500M gross annual run rate. Its data-partnership payouts are self-reported and no partnership contract is public. Read the terms, and have a lawyer read the contract, before you sign. If [micro1](/buyers/micro1) has asked for a call about a [data partnership](/guides/micro1-data-partnership) with your company, the table below is what I would check first. ## So, is micro1 legit? A real company with published terms, wide press coverage and a large review record. Its data-partnership payouts are its own claims and no partnership contract is public, so read the terms, and have your lawyer read the contract, before you sign. ## What can you check about micro1? | Check | What I found | Source | |---|---|---| | Entity named | "micro1 Inc." appears in the referral terms and site footer. State of incorporation not found. | [Referral terms](https://www.micro1.ai/legal/referral-terms) | | Terms published | Referral terms published, under California law with San Francisco courts. No partnership contract for data deals is public. | Same | | Security claims | The data page says personal data is removed "when relevant," access is limited, pipelines are isolated and retention is limited. It names no certification. I cannot verify these from outside. | [Data partnerships](https://www.micro1.ai/data-partnerships) | | Labs named | Described as frontier AI developers. Not named. | Same | | Payout claims | Tiers of $100K or more, $500K or more and $1M or more. Its Enterprise Data Partnership listing says $100K to $2M+ for approved data packages. Self-reported. No testimonial from a partner company found. | [Data partnerships](https://www.micro1.ai/data-partnerships) and [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) | | Press | $500M gross run rate, per a person familiar with the company. Founder named as Ali Ansari. | [TechCrunch](https://techcrunch.com/2026/08/20/ai-data-startup-micro1-reaches-500m-gross-run-rate-amid-ai-training-boom/) | | Reviews | Trustpilot 4.7 from 10,684 reviews, profile claimed. The reviewers are mostly people micro1 interviewed for contract work, so the record says little about data deals. | [Trustpilot](https://www.trustpilot.com/review/micro1.ai) | ## What does micro1's own channel claim? A micro1 referral partner made these claims in a micro1 video (self-reported, promotional, not verified by me). She earns from referrals. - micro1 is an "extremely reputable venture-backed company" (about 12:46). Check funding in press and filings. - micro1 trains all the frontier AI models with the data, with no lab named (about 1:50). - A few months earlier a handful of companies were interested, and now hundreds a day are (about 19:12). micro1 has published no accepted-company count. - Asked for the first question a company should ask before signing, her rapid-fire answer was who micro1 is (about 22:31). ## What should a company check? Start with the entity and the contract, because no partnership contract is public. Ask who de-identifies the data. In the Spirit Airlines case, the court's ombudsman noted that micro1 proposed to de-identify the data itself and not use an independent party ([Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). Fortune reported micro1's $12.5M offer. micro1's current pages say 30 or more employees. An undated micro1 forum talk gave a lower, earlier figure, which is history. See our [data licensing services page](/answers/ai-data-licensing-services) and the [Spirit page](/answers/spirit-airlines-data-sale). ## Is the person introducing me paid by micro1? They may be. micro1 runs a [company referral program](https://www.micro1.ai/company-referral), so ask anyone who introduces you whether micro1 pays them. Our [company directory](/buyers) lists micro1 beside its peers. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Run the [rights check](/rights-check) before any call. Talk to a privacy or commercial lawyer in your state before you sign. Figure: range, Corpus deal, per company, $100K to $2M. micro1 states a wide range for approved data packages. Source: micro1's Enterprise Data Partnership listing, self-reported. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Referral terms](https://www.micro1.ai/legal/referral-terms) - [Data partnerships](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [TechCrunch](https://techcrunch.com/2026/08/20/ai-data-startup-micro1-reaches-500m-gross-run-rate-amid-ai-training-boom/) - [Trustpilot](https://www.trustpilot.com/review/micro1.ai) - [Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) --- # License support tickets to AI: what to know first > Trying to sell support tickets to AI? Companies license them. Troveo and Mercor list ticket systems, resolved tickets rate best, and customer data sets limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-support-tickets-to-ai Published: 2026-09-01 Updated: 2026-10-14 ## The short answer Buyers value resolved support tickets that show the outcome. The customers named in them set the limits. Troveo lists Zendesk and other ticket systems. Troveo says 1,000 resolved tickets with full context beat a million log lines. No per-ticket price is published. Tickets are structured. Each one has an opener, a thread of replies and an ending. That shape makes them useful to a buyer. ## Which ticket systems do buyers name? [Troveo](https://www.troveo.ai/business-data) lists these: - Salesforce, HubSpot, Intercom and Zendesk for support. - ServiceNow for IT and HR tickets. - Jira and Asana for project tickets. Mercor's [data page](https://www.mercor.com/data/) lists GitHub issues next to its other systems. ## What makes a ticket valuable? [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) says a ticket alone is a data point. It can be linked to other records: - The Slack thread where it was diagnosed. - The Jira issue that tracked it. - The pull request that fixed it. - The follow-up to the customer. Then it becomes a complete example of real work. [Troveo](/buyers/troveo)'s guide adds that a recorded outcome, resolved or escalated, adds signal. Both guides come from a marketplace that licenses data, so read them as its pitch. ## What does a ticket export carry? Customer names, email addresses and account details. Sometimes it also holds what a customer said about a third party. IT and HR tickets can hold employee information, which belongs with the [HR records page](/answers/can-i-sell-hr-or-payroll-records-to-ai). Zendesk's [customer agreement](https://www.zendesk.com/company/agreements-and-terms/main-services-agreement/) says the customer keeps ownership of its service data. The customer must give notices to agents and end users, and get consents from them. Zendesk's data processing terms apply to the extent the data holds personal data. See [customer consent](/answers/do-i-need-consent-to-sell-customer-data-for-ai-training) for the notice side. ## Who removes the names from support tickets? Troveo says it scrubs names, contact details, credentials and client identities to a documented standard. micro1 says it removes personal information when relevant. A scrubbed ticket can keep a stable label for each customer, and that keeps the thread. Our [re-identification page](/answers/re-identification-risk-emails) covers that trade. ## How does this differ from transcripts? Tickets are written records. Transcripts of calls and chats add recording questions. See [customer service transcripts](/answers/sell-customer-service-transcripts-to-ai). Talk to a privacy or commercial lawyer in your state before you sign. Our [rights check](/rights-check) covers the contract and personal-data questions, and the free [fit check](/business) asks where the work happens. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Customer opens a ticket -> Agent works the case -> Resolved or escalated. Troveo says the recorded outcome at the end of a ticket is what adds signal for a buyer. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [data page](https://www.mercor.com/data/) - [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [customer agreement](https://www.zendesk.com/company/agreements-and-terms/main-services-agreement/) --- # Can I license my members' posts to AI? > Can I license my members' posts to AI? For a business that runs a paid community, Skool's terms leave posts with members and give admins no license. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-license-my-members-posts-to-ai Published: 2026-08-31 Updated: 2026-10-13 ## The short answer No. Skool's terms give Skool a limited license, not admins. Copyright vests in the author under 17 U.S.C. 201(a). Circle's terms differ. Member consent is required and likely, so ask each member or update your paperwork. A paid community can hold years of members' advice, questions and stories, and the business that runs it may see that archive as an asset. The platform's terms decide what the platform may do, and each member's rights decide the rest. ## What do Skool's terms say about member content? The [Skool terms](https://www.skool.com/legal?t=terms) say your content is yours, and that using Skool grants Skool a license to use, reproduce, distribute, create derivative works of, display and perform it. The license is for the limited purpose of providing, developing and improving the services, and it is non-exclusive. The same sentence explains that non-exclusive means you can still license your content to others. I read the full page and found no mention of AI or machine learning. ## Do group admins get any rights to members' posts? Not in the Skool terms I read. The admin provisions I found cover admin earnings and authorization to use the services on behalf of your organization. No clause I found gives an admin a license to what other members wrote. I found no public case of a business licensing its community's archive, so the question is untested. ## What does Circle say? [Circle's terms](https://www.circle.so/terms) give Circle a non-exclusive, worldwide, royalty-free, sublicensable and irrevocable license to process member content. Circle may also use it in a form that does not identify the source to develop and improve its products. The terms point to separate Community Terms for community rules, and I didn't read those. Whichever platform your community runs on, read its terms yourself. ## Who owns the copyright in a member's post? The author, unless a contract says otherwise. Section 201(a) of the [Copyright Act](https://www.law.cornell.edu/uscode/text/17/201) says copyright vests initially in the author of a work. Section 201(b) makes the employer the author of a work made for hire. That rule can cover posts your staff write as part of their jobs. Paying members aren't your employees, so their posts start with them. Counsel can say how that applies to a given archive. ## What does member consent look like? Consent for a new use is a separate question for each member. [AIPodcast's guest model](https://www.aipodcast.io/solutions/podcast-audio-licensing) shows what documented consent looks like for voices, with a signed release and a log (self-reported). See [podcast guests and AI licensing consent](/answers/podcast-guests-ai-licensing-consent). The [guide to licensing your business's content](/guides/license-your-business-content-to-ai) covers members, clients and guests together. The [rights check](/rights-check) and the [risk map](/risks) list the questions. Talk to a privacy or commercial lawyer in your state before you sign. No outcome is promised. Figure: comparison of Who holds rights to a post in a Skool community: Member who wrote it (emphasized: Author owns by default, Owns the post), Skool (Limited license), Community admin (No license in terms). Skool's terms leave a post with its author, give Skool a limited license and give admins none. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Skool terms](https://www.skool.com/legal?t=terms) - [Circle's terms](https://www.circle.so/terms) - [Copyright Act](https://www.law.cornell.edu/uscode/text/17/201) - [AIPodcast's guest model](https://www.aipodcast.io/solutions/podcast-audio-licensing) --- # Exclusive vs non exclusive data license price > Exclusive vs non exclusive data license price: Epoch's interviews put exclusive RL environment deals at 4x to 5x. No public price exists for company data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/exclusive-vs-non-exclusive-data-license-price Published: 2026-08-31 Updated: 2026-10-14 ## The short answer The exclusive data license price gap has one public number. Epoch's interviews found exclusive deals are roughly 4x to 5x the non-exclusive price. That comes from RL environments, not company archives. Troveo says non-exclusive licenses often earn more over time because the same records can go to many buyers. Exclusivity is the clause that decides how many buyers can pay you for the same records. Here's what the public sources say about its price. ## What is the difference between an exclusive and a non-exclusive data license? An exclusive license promises one buyer that nobody else gets the data for the term. A non-exclusive license lets you license the same records to other buyers while the first deal runs. In both cases the owner keeps ownership. [Troveo](/buyers/troveo)'s guide says a license is permission, and that ownership changes hands only in an outright sale, which it sees mostly when a company shuts down ([Troveo](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license)). ## Does an exclusive license pay more? For RL environments, yes. Epoch wrote that exclusive deals are roughly 4x to 5x more expensive than non-exclusive ones, and it put website replicas near $20,000 each and Slack-grade clones near $300,000 ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). Those prices are what labs pay vendors who build simulated software. Epoch's article describes app replicas and lab partnerships with product companies and does not discuss real company archives, so the multiple is a signal about the market and no quote for your archive. For company records, Troveo's page says "there's no public price list" ([Troveo](https://www.troveo.ai/resources/sell-data-to-ai-companies)). ## What does Troveo's math say about repeat licenses? Troveo's worked example uses units and no dollars. A dataset worth 100 non-exclusively might draw an exclusive offer of 150, or 200 if the data is rare. If four buyers each license it at 100 over three years, the non-exclusive path returns 400. That is an illustration from a marketplace whose model is repeat licensing, so read it as one side of the argument. The guide itself says exclusivity can win when data is scarce enough that one buyer wants to keep it from rivals. ## When does exclusivity make sense? Troveo names three limits that make an exclusive deal safer: a term, so the data returns to market, a scope, so it covers a category or use, and a performance trigger, so exclusivity falls away if the deal underdelivers. Buyers also ask whether the data was licensed before. The guide says never to promise exclusivity while a prior non-exclusive license is still running. Terms vary. Polyshares says two years is standard ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). No other source we read gives a length. See [what an exclusivity term is](/answers/what-is-an-exclusivity-term-in-a-data-license). micro1's data partnerships page states its payment tiers of $100K+, $500K+ and $1M+ and says nothing about exclusivity. Ask any buyer whether exclusivity is part of the offer and what it adds to the price. If an acquisition is possible, an exclusive term binds the acquirer too. How that plays out in the LOI and the data room is in [licensing company data before an acquisition](/answers/license-company-data-before-selling-your-business). ## What should you ask before you sign? 1. Is the license exclusive, and for how long? 2. Does exclusivity cover all uses or one category? 3. What ends it early if the buyer underuses the data? 4. What earlier licenses must you disclose? Our [data licensing agreement guide](/guides/data-licensing-agreement) maps the other clauses, and [license or license company data to AI](/answers/license-or-sell-company-data-to-ai) covers the label question. The broader pricing picture is in [how much your business data is worth to AI](/guides/how-much-is-your-business-data-worth-to-ai) and [what an RL environment is](/answers/what-is-an-rl-environment). Run the [rights check](/rights-check) first, because rights decide what you can license at all. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Two license types for one dataset: Exclusive (One buyer), Non-exclusive (emphasized: Can repeat across buyers, Many buyers). Troveo says non-exclusive licenses add up across buyers, so its guide favors them. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Troveo](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [X article](https://x.com/RyanLockAI/status/2107864069105389717) --- # Startup wind down service: SimpleClosure, Sunset > Startup wind down service options compared: SimpleClosure, Sunset and Carta's retired service. What each does, what is published, and who places your data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/startup-wind-down-service Published: 2026-08-31 Updated: 2026-10-14 ## The short answer A startup wind down service handles legal filings, payroll tax closures and stakeholder coordination. SimpleClosure runs these and added an Asset Hub on 16 Apr 2026 to sell source code and workspace data. Gizmodo reported nearly 100 deals at $10,000 to $100,000 per company. Closing a company means filings, tax closures and a decision about who gets the assets. These services bundle that work. ## What does a wind down service do? [SimpleClosure's site](https://simpleclosure.com) describes legal filings, payroll tax closures, stakeholder coordination and asset sales through its Asset Hub. It says the founders built it from their own closure experience. Sunset is reported to offer dissolution consulting for venture-backed startups. That comes from [TechCrunch](https://techcrunch.com/2024/02/27/vcs-back-wind-down-failed-startups/) coverage of its February 2024 seed round. I couldn't open its site, so treat that description as unconfirmed. ## What happened to Carta's service? [TechCrunch](https://techcrunch.com/2025/05/07/carta-abandons-startup-shutdown-business-instead-backs-simpleclosures-15m-series-a) reported that Carta revealed Carta Conclusions in February 2024. Carta decided to retire it by December 2024. Carta then joined [SimpleClosure](/buyers/simpleclosure)'s $15 million Series A, which TTV Capital led. Carta told TechCrunch it made more sense to invest and partner than to build in-house. It offered its customers a free consultation and a 10% discount on SimpleClosure. ## Which service sells the data? Only SimpleClosure's [Asset Hub](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) came up in my reading. It covers source code and workspace data. Workspace data was in beta at launch. [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) reported nearly 100 deals at $10,000 to $100,000 per company. I found no data-sale program for Sunset or Carta. Not finding one in my search doesn't prove none exists, so ask each service directly. ## What should you compare? - The fee for the wind down, and the fee or revenue share on a data license - Whether the license it takes over your data is perpetual and irrevocable - Which buyers see the data and who holds the name mapping - What the terms say if a buyer is breached [How much SimpleClosure costs](/answers/how-much-does-simpleclosure-cost) lists what is published. [Whether SimpleClosure is legit](/answers/is-simpleclosure-legit) sets out the evidence and our plain read. The [Slack licensing guide for closing companies](/answers/can-a-shutting-down-company-sell-its-slack-to-ai) covers the Delaware steps. [Startup data routes](/answers/sell-startup-data-to-ai) shows the choices. Talk to a corporate or insolvency lawyer in your state before you sign. Figure: steps Carta service Feb to Dec 2024 -> Carta backs SimpleClosure May 2025 -> Asset Hub launched Apr 2026. Carta left the shutdown business in 2024 and backed SimpleClosure, which added an Asset Hub in April 2026. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [SimpleClosure's site](https://simpleclosure.com/) - [TechCrunch](https://techcrunch.com/2024/02/27/vcs-back-wind-down-failed-startups/) - [TechCrunch](https://techcrunch.com/2025/05/07/carta-abandons-startup-shutdown-business-instead-backs-simpleclosures-15m-series-a) - [Asset Hub](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [SimpleClosure terms](https://simpleclosure.com/tos/) - [SimpleClosure CEO post](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) - [SimpleClosure AssetHub](https://simpleclosure.com/product/assethub/) Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) --- # Troveo vs Mercor: two ways company data reaches a lab > Troveo vs Mercor for company data: a marketplace that shares each sale against a firm that pays by wire on delivery. Terms, systems, security claims. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/troveo-vs-mercor Published: 2026-08-30 Updated: 2026-10-14 ## The short answer Troveo pays a revenue share on every sale, with the split unpublished, and says full-company deals start at six figures. Mercor connects to 100+ tools, says it anonymizes the data and pays by wire in two to four weeks, reportedly up to $300,000. Neither names its end buyers. Both firms take company data. Neither names its end buyers on the pages I read. ## How does each one pay? [Troveo](https://www.troveo.ai/business-data) says you share in the revenue on every sale. It says an exclusive license [commands a premium](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license). It publishes no split and charges no upfront fee. Its [guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) cites about $5,000 for a single repository as an unnamed platform's baseline, and puts shut-down startup archives at $10,000 to $100,000. [Mercor's data page](https://www.mercor.com/data/) says payment is a wire transfer on delivery of the anonymized dataset to the buyer. That is typically within two to four weeks of the signed agreement. Pay depends on data volume, tools connected and depth. The page says connecting more tools generally pays more. It states no figure. ## What do they ask you to connect? [Troveo](/buyers/troveo)'s calculator asks for employee count, years in operation and the systems you use. It groups the systems into eight named categories, from chat and email to finance and code. A catch-all covers internal and custom systems. It says you start with an estimate, and an assessment follows. [Mercor](/buyers/mercor) lists 100+ supported tools, including Slack, Teams, Gmail, GitHub, Confluence, Salesforce and Notion. You connect accounts. Mercor says it extracts and de-identifies the data. ## What do they say about security and de-identification? Mercor claims SOC 2 Type II certification, encryption in transit, per-session credentials and AWS KMS keys. It says no data leaves your systems until you approve it. All of that is self-reported. A March 2026 supply-chain attack [hit its contractor data](https://www.mercor.com/blog/update-on-mercor-security-incident/), as covered in [Mercor data breach](/answers/mercor-data-breach). Troveo says it scrubs names, contact details, credentials and client identities under one documented standard. It says it never names your company publicly. The standard isn't published. ## What is the role of each in the chain? Troveo describes itself as handling buyer matching, packaging and privacy review. Mercor's role is less fixed. Its page speaks of delivery to a separate buyer. Press reports show it bidding for archives itself, including [$7.5M for Spirit Airlines' data](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf). Ask each firm whether it is the buyer or the seller's agent in your deal. Figure: comparison of Two ways company data reaches an AI lab: Troveo (emphasized: Pays again on every sale, Pays on each sale), Mercor (One wire payment). Troveo is emphasized because its pay repeats on every sale, while Mercor pays by wire on delivery. Compare both with other routes in [where to license company data](/answers/where-to-sell-company-data). Run the [rights check](/rights-check) first. Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [commands a premium](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - [guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [Mercor's data page](https://www.mercor.com/data/) - [hit its contractor data](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [$7.5M for Spirit Airlines' data](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [CourtListener docket, Deboni v. Mercor.io Corp.](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) - [Troveo: AI data licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Troveo content owners](https://www.troveo.ai/content-owners) --- # Is Mercor legit? A review of its company data program > Is Mercor legit or a scam for a company licensing its records? A review of its data arm: funding, terms, the March 2026 breach and where the lawsuits stand. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-mercor-legit Published: 2026-08-29 Updated: 2026-10-14 ## The short answer Mercor is a real, funded company with a published company-data page: no stated minimum, no fees to you and a wire 2 to 4 weeks after signing. A March 2026 breach exposed contractor and applicant data. The class actions were consolidated in May and stayed for mediation in July 2026. This review covers [Mercor](/buyers/mercor)'s data arm, the program that licenses company records such as Slack, email and CRM history to AI labs. Mercor's expert marketplace is a separate business with its own record. The table is what I would check before handing Mercor an export. ## Is Mercor legit for a company licensing data? Yes, on the public record. Mercor.io Corporation was founded in 2023, raised a $350M Series C at a $10B valuation in October 2025, and publishes a company data page with its payment terms. No contract for companies is public. ## Is Mercor a scam? Nothing in the public record points to a scam. Mercor names its entity, its investors and how it pays. Its serious mark is a March 2026 security incident and the lawsuits filed after it, and they concern contractor and applicant data. ## What does the evidence show? | Item | What the sources show | Source | |---|---|---| | Entity | Mercor.io Corporation, founded January 2023. $350M Series C led by Felicis at a $10B valuation, October 2025. Sacra estimates $2B in annualized gross revenue in June 2026 | [Sacra](https://sacra.com/c/mercor/) | | Terms published | No fees to the company. Wire on delivery of the anonymized dataset, typically 2 to 4 weeks after the signed agreement | [mercor.com/data](https://www.mercor.com/data/) | | Security claim | SOC 2 Type II, encryption in transit, keys in AWS KMS. Self-reported, with no scope, auditor or period shown | [mercor.com/data](https://www.mercor.com/data/) | | Reported offers | Offers to shuttered startups reported up to $300,000. A $7.5M bid for Spirit Airlines' archive finished second to Google's $10M | [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d). [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) | | Breach | A poisoned LiteLLM release hit Mercor in March 2026. Its 25 Jun update says the forensic investigation is complete and only "a very limited subset" of nearly five million experts had sensitive data affected | [Mercor update](https://www.mercor.com/blog/update-on-mercor-security-incident/) | | Breach, as reported | About four terabytes exposed, per The Next Web. Meta paused work and OpenAI said it was investigating | [TNW](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) | More on the incident is in [Mercor data breach](/answers/mercor-data-breach). ## Where does the Mercor class action stand? The Mercor breach suits in the Northern District of California sit before Judge William H. Orrick, per CourtListener on 14 Oct 2026. On 19 May 2026 he related *Ananthula v. Mercor.io Corp.* to *Deboni v. Mercor.io Corp.*, No. 3:26-cv-02821, and consolidated them. On 21 Jul 2026 he granted a joint stipulation to stay the case pending mediation and vacated the case management conference. No later entry appears on the [docket](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/). No court has ruled on the claims. A separate proposed class action, *White v. Mercor.io Corp.* (N.D. Tex.), is about how Mercor classifies its contractors. An amended complaint was filed on 25 Jun 2026. Neither case concerns company archives. ## What did the 17 Aug 2026 report say about Mercor's startup offers? BigGo reported that Mercor was approaching failed and acquired startups for Slack, GitHub, Drive and meeting records, with offers up to $300,000. Warmly's founder turned Mercor down. BigGo names no source of its own, and the report describes solicitations. It names no completed deal. How that route compares with a shutdown service is in [Mercor vs SimpleClosure](/answers/mercor-vs-simpleclosure). ## How does Mercor's data program work for a company? You pick the tools to share and link the accounts. Mercor names nine, including Slack, Teams, Gmail, Salesforce and GitHub, and says it supports 100+. Its platform extracts and de-identifies the data, and it says no lab or vendor sees the raw records. Pay depends on data volume, the tools you connect and the depth of the data. Every tool each company names is in the [connector matrix](/answers/ai-data-company-connectors). ## What should a company ask Mercor before signing? - **The SOC 2 report.** Ask for its scope, auditor and period. - **What you keep.** Mercor publishes no ownership, term or exclusivity terms for companies. - **Who receives the data.** The page says AI buyers and names none. The firms that take the same records on other terms are in [Mercor alternatives](/answers/mercor-alternatives). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Sacra](https://sacra.com/c/mercor/) - [mercor.com/data](https://www.mercor.com/data/) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Mercor update](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [TNW](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [docket](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) --- # What is data de-identification in a company data license? > Searching for de-identification before a data sale? In a license, it removes or swaps details that tie a record to a person. The legal tests and who does it. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-de-identification Published: 2026-08-29 Updated: 2026-10-14 ## The short answer Data de-identification means taking names and details out of records. It does not settle who owns the rights. In California, the data must not link back to a person. The business must publicly promise to keep it that way. Every buyer must sign on too. Search results for this phrase are mostly health-privacy pages and software vendors. We're covering it for an owner with an email, chat or ticket archive to license. > **De-identification removes or swaps the details that point to a person.** It's like pulling the name tags off the boxes in the attic. A name written inside a box still points to someone. ## What do the laws mean by de-identified? The tests differ by law, and each has its own text. **California.** Under the CCPA, deidentified information "cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer." The business must also take reasonable measures, publicly commit not to re-identify, and bind recipients by contract (Civil Code 1798.140(m)). Without that, a transfer of personal information for money or other valuable consideration counts as a sale. **Health information under HIPAA.** The rule offers two methods. One is an expert determination. The other is a safe harbor that removes 18 types of identifier ([45 CFR 164.514](https://www.law.cornell.edu/cfr/text/45/164.514)). **UK.** The ICO says pseudonymised data is personal data in the hands of anyone who holds the additional information. It marks its guidance as under review ([ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/)). **FTC.** In July 2024 the FTC wrote that hashes "aren't 'anonymous'" and can still identify users ([FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous)). ## Why isn't de-identification enough by itself? Daniel Goldberg, a partner at Frankfurt Kurnit, wrote that removing identifying details from millions of emails and chats is "much harder than removing names from structured fields." He added that de-identification speaks to whether a record can be linked to a person. It does not speak to whether the content is confidential. He advised excluding high-risk data instead of relying on it ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). [Handshake AI](/buyers/handshake-ai)'s own page says a third party may be able to re-identify personal information in combination with other data. ## Who does the de-identifying in a deal? It varies by firm. [micro1](/buyers/micro1) staff said in an undated recorded forum talk that the company transforms the data itself. The same talk said redacting first would destroy the cross-tool trail it needs. This is self-reported. In the Spirit sale, the court-appointed privacy ombudsman's report says the debtors hired Tonic.ai to de-identify unstructured data. Before each transfer Tonic.ai is to deliver a certification, filed with the court, that the approved procedures ran. The ombudsman did not examine risks to employees or third parties ([ombudsman report, Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf)). The sale agreement asks for de-identification that preserves "referential integrity across the data set." The flight attendants' union challenged that ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). In the same talk micro1's David Revland, who works on human data, said micro1 swaps each name for the same stand-in every time, which keeps the links between records. A union made the same point about the Spirit sale, so ask any buyer how it handles links. Figure: comparison of Two ways to treat a name in free text: Redaction (Trail removed), Name swap (emphasized: What Revland (micro1) says it uses, Trail kept). micro1's David Revland said in an undated recorded forum talk that it swaps names for stand-ins, which keeps the trail across tools. _Redaction is a black marker. A name swap is a costume party where everyone wears the same costume all night._ ## What should an owner ask? 1. Who does the de-identification, and who pays for it? 2. To what standard, and does anyone certify it? 3. Do links between records survive, and why? 4. May we scrub first? Run the [rights check](/rights-check) and read the [risk map](/risks) before a buyer call. Talk to a privacy or commercial lawyer in your state before you sign. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [45 CFR 164.514](https://www.law.cornell.edu/cfr/text/45/164.514) - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [ombudsman report, Doc 1684](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1684.0.pdf) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) --- # Can you license data to Anthropic? What is public > Searching how to sell data to Anthropic? We found no public intake for licensing. Its privacy policy lists commercial datasets, and Epoch relays reported spend. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-data-to-anthropic Published: 2026-08-28 Updated: 2026-10-14 ## The short answer License data to Anthropic? I found no public program or form. Anthropic's privacy policy says it obtains datasets through commercial agreements with third parties, but lists no intake. The Information reported Anthropic discussed $1B spending on RL environments. Epoch's review of those environments does not discuss real company archives. This is a short page because the public record is short. It reflects searches and page reads. ## Does Anthropic have a public data purchase program? I found none. I searched for a data partnership or intake form. I also read Anthropic's public news and privacy pages. None had an intake for companies to license datasets. ## What does Anthropic say about its data sources? Anthropic's privacy policy lists the sources of personal data used to train its models. One source is "datasets that we obtain through commercial agreements with third party businesses" ([Anthropic privacy policy](https://www.anthropic.com/legal/privacy)). That confirms such agreements exist. It does not say who the businesses are or what they sell. It does not say how a company reaches them. ## What is the reported spending signal? Epoch AI's review of RL environments relays a report from The Information. The report says Anthropic discussed spending over $1B on RL environments in the year ahead. Epoch's interviews with vendors give these prices: - A website-clone environment costs near $20,000. - A Slack-grade clone costs near $300,000. - Tasks cost $200 to $2,000. The source is [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs). Epoch's review does not say whether real company data fills those environments. Treat the spending figure as a discussion reported by a news outlet. It is no commitment to buy your records. ## Where does a company with records go instead? Marketplaces and direct buyers run the programs you can apply to today. [Who buys company data for AI](/buyers) compares the named buyers. [License data to AI labs](/answers/sell-data-to-ai-labs) covers who sits between companies and labs. I have no evidence that any marketplace's buyer is Anthropic. Marketplaces rarely name their buyers. Run the [rights check](/rights-check) before any call. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Ways company data could reach Anthropic: Direct license (No public intake), Via vendors (emphasized: The only visible route, Reported spend). I found no public Anthropic intake, so vendors are the visible route. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Anthropic privacy policy](https://www.anthropic.com/legal/privacy) - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # License call center data to AI: whose calls are they? > Trying to sell call center data to AI? Licensing starts with whose calls they are. California's all-party consent law and your client contracts come first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-call-center-data-to-ai Published: 2026-08-28 Updated: 2026-10-14 ## The short answer Before licensing call center data to AI, ask whose calls they are and who consented. Client contracts usually decide what you can license. California Penal Code 632 bars recording without all parties' consent, with damages of $5,000 per violation. A lawyer reads your contracts first. This page reports what the texts and buyer pages say. It is not legal advice. ## Who lists call center data? [micro1's page](https://www.micro1.ai/data-partnerships) lists customer support among six areas. [Troveo's business-data page](https://www.troveo.ai/business-data) names Zendesk and Intercom among its tools. My [transcripts page](/answers/sell-customer-service-transcripts-to-ai) covers support text. This page covers the voice side. ## Whose recordings does a call center hold? A call center often records calls for a client, such as a retailer or insurer. A vendor in that role can be a processor under the GDPR or a service provider under the CCPA, and my [SaaS page](/answers/can-a-saas-company-sell-its-customers-data-to-ai) explains how those rules limit licensing. Which role you hold turns on each client contract. A center that records its own sales calls to its own customers sits on the other side of that line. Counsel reads the contracts, one client at a time. ## What does California require for recorded calls? [Penal Code 632(a)](https://california.public.law/codes/ca_penal_code_section_632) bars intentionally recording a confidential communication without the consent of all parties. It sets a fine of up to $2,500 per violation, or up to $10,000 after a prior conviction. Section 632(c) defines a confidential communication as one carried on in circumstances that reasonably indicate a party wants it confined to the parties. [Section 632.7(a)](https://california.public.law/codes/ca_penal_code_section_632.7) covers communications involving cellular or cordless phones with the same penalty ranges. [Section 637.2](https://california.public.law/codes/ca_penal_code_section_637.2) gives an injured person a civil claim for the greater of $5,000 per violation or three times actual damages, and says actual damages are not a prerequisite. ## What do the federal and biometric rules add? Federal law is covered on my [call recordings page](/answers/can-i-sell-call-recordings-to-ai): the one-party consent exception in [18 U.S.C. 2511(2)(d)](https://www.law.cornell.edu/uscode/text/18/2511) fails when the interception serves a criminal or tortious purpose, the Otter.ai ruling, Illinois voiceprint damages and Spirit Airlines' sale schedule, which lists 30,865,471 call recordings as "Not Included" ([Doc 1463](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1463.0.pdf)). I found no case holding a company liable for licensing its own lawfully recorded calls. ## What can a call center gather first? List the clients whose calls you record, the recording notices each caller hears, the states your callers are in and whether any tool stores voiceprints. The [rights check](/rights-check) asks about personal data and customer contracts and lists what to settle with counsel. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: scale, California fine per violation, Penal Code 632(a): First offense Up to $2,500, After a prior conviction Up to $10,000 (emphasized). California fines rise after a prior conviction. Source: California Penal Code 632, text via public.law. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's page](https://www.micro1.ai/data-partnerships) - [Troveo's business-data page](https://www.troveo.ai/business-data) - [Penal Code 632(a)](https://california.public.law/codes/ca_penal_code_section_632) - [Section 632.7(a)](https://california.public.law/codes/ca_penal_code_section_632.7) - [Section 637.2](https://california.public.law/codes/ca_penal_code_section_637.2) - [18 U.S.C. 2511(2)(d)](https://www.law.cornell.edu/uscode/text/18/2511) - [Doc 1463](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1463.0.pdf) --- # What is an RL environment? > What is an RL environment? A simulated workplace where an AI agent practices a task and gets scored. Epoch's dated prices, and why labs want company data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-an-rl-environment Published: 2026-08-28 Updated: 2026-10-13 ## The short answer An RL environment is a simulated workplace where an AI agent practices a task and gets scored on the result. Website clones cost near $20,000, Slack-grade clones near $300,000. Epoch's review does not say whether real company data goes into them. ## How does an RL environment work? An agent gets a task, such as "reconcile this invoice" or "reply to this customer," inside a copy of the software it would use at work. It takes actions, like clicking, searching or running code. A grader then scores the attempt, and the model learns from the score. Epoch AI's FAQ on reinforcement learning environments describes the environment as the set of actions the model can take and the context that determines their effects ([Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs)). Press coverage, including [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), calls the simulated workplaces "RL gyms." Yes, really. ## What do RL environments cost? Epoch reports, from interviews with vendors, that website replicas run near $20,000 each and complex product replicas like Slack near $300,000. Tasks mostly price at $200 to $2,000 each, and $20,000 for a task is rare but possible. Two founders told Epoch that exclusive deals cost roughly 4x to 5x as much as non-exclusive ones. All of these are vendor statements and not audited prices. ## Where does company data come in? Synthetic workplaces can look thin. A real company's tickets, threads and spreadsheets show how work moves from a request to a result. Time quoted an expert saying Google's $10M winning bid for Spirit Airlines' archive, pending court approval, makes sense if you believe agents will generalize across the economy ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). Epoch's review does not say whether real company data is used in today's environments. Marketplace marketing leaves buyers unnamed. The demand story is plausible, and I haven't seen it show up in public prices yet. ## What does it mean if you hold company data? Records of real work show a chain from request to deliverable, the path an agent's practice follows. Fortune calls the record of steps an agent takes a trajectory. Our [Spirit Airlines page](/answers/spirit-airlines-data-sale) shows one of the largest public bids in this market. Before any record reaches an environment, you need the right to license it. Start with the [rights check](/rights-check) and the free [fit check](/business). We give no legal advice, so talk to a privacy or commercial lawyer in your state before you sign. Figure: scale, RL environment build price: Website clone About $20K, Slack-grade clone About $300K (emphasized). A Slack-grade clone costs about fifteen website clones to build. Source: Epoch AI interviews with vendors, self-reported. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Epoch](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) --- # Does Slack sell your data? What its policy says > Does Slack sell your data? Its privacy policy says it does not sell personal information as the CCPA defines it. AI training and ad sharing are separate. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/does-slack-sell-your-data Published: 2026-08-27 Updated: 2026-10-14 ## The short answer Does Slack sell your data? Slack's privacy policy says it does not sell personal information under the CCPA. It may share identifiers and web activity with advertisers for ad targeting outside Slack. Slack will not train generative AI models on your messages unless you opt in. The question mixes three things: the messages, the facts about the people who use Slack, and AI training. Slack's pages treat them separately, so I will too. ## Does Slack sell what is in your messages? Slack's [privacy policy](https://slack.com/trust/privacy/privacy-policy) splits information in two. Customer Data means messages and files. The organization that created the workspace controls it. Slack acts as a processor and follows that organization's instructions. The policy says the organization sets the rules for it. The [privacy principles](https://slack.com/trust/data-management/privacy-principles) add that customers own their own Customer Data. Neither page says Slack sells it. I can't tell you what Slack does in practice, only what its published text says. ## Does Slack sell information about people who use it? The policy says Slack does not sell the personal information it collects, as the CCPA or otherwise defines "sell." It also says Slack may share identifiers and internet activity with third-party advertisers. These are used for targeted ads on non-Slack sites. That second sentence concerns marketing data about visitors and users. The page does not tie it to message content. The policy lists nine categories of collected information, including identifiers, commercial information and professional or employment data. ## Does Slack train AI on your messages? Slack's privacy principles say it will not use Customer Data to train generative AI models unless the customer gives clear opt-in consent. They also say Slack does not build broadly used models in a way that could reproduce part of Customer Data. A workspace owner can opt out of use in Slack's global models. To do so, email feedback@slack.com with the subject line "Slack Global model opt-out request." In May 2024, [TechCrunch](https://techcrunch.com/2024/05/17/slack-under-attack-over-sneaky-ai-training-policy/) reported a backlash over a version of this page that required an email opt-out. Slack said at the time that its platform machine learning used customer data for features like search and channel recommendations. It said Slack AI's LLMs were not trained on customer data. The principles page I read carries the opt-in rule for generative AI. ## Does this change what happens if your company licenses its own export? Slack's pages describe Slack's own conduct. A separate document, its API terms, bars outside apps from using API data to train a large language model. Those terms do not address a customer's own export. See [what Slack allows](/answers/does-slack-allow-ai-companies-to-use-my-exported-data). Whether your company may license Slack messages depends on NDAs, shared channels, employee privacy law and customer contracts. Start with [who owns Slack messages](/answers/who-owns-slack-messages) and [is it legal to license company Slack data](/answers/is-it-legal-to-sell-company-slack-data). Talk to a privacy or commercial lawyer in your state before you sign. This page is research and not legal advice. Figure: comparison of Three Slack data questions and where Slack's text answers them: Messages (Customer owns its data), Personal information (emphasized: Matches the query's word sell, Says it does not sell), AI training (Opt-in for generative AI). Slack's privacy policy says it does not sell personal information, and its principles set an opt-in rule for generative AI training. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [privacy policy](https://slack.com/trust/privacy/privacy-policy) - [privacy principles](https://slack.com/trust/data-management/privacy-principles) - [TechCrunch](https://techcrunch.com/2024/05/17/slack-under-attack-over-sneaky-ai-training-policy/) --- # License Microsoft 365 data to AI: sizes, exports, terms > Want to sell Microsoft 365 data to AI? The deal is a license. Troveo and Mercor name Teams, Outlook and SharePoint, and admin reports size a tenant. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-microsoft-365-data-to-ai Published: 2026-08-27 Updated: 2026-10-14 ## The short answer You export Microsoft 365 data from Teams, Outlook, SharePoint and OneDrive. Troveo and Mercor list these tools. Google's Spirit Airlines bid covered 100 million emails and 500 million Teams messages at $10 million, but the court has not approved it. Admin center reports size a tenant. Microsoft 365 spreads one company's records over several services. SharePoint and mailboxes have admin center size reports, and Teams chats leave through an export API. ## Who names Microsoft tools? [Troveo's page](https://www.troveo.ai/business-data) lists Teams under chat and messaging, Outlook under email, OneDrive and SharePoint under documents, and Dynamics under business platforms. [Mercor](https://www.mercor.com/data/) names MS Teams and Outlook. micro1's page names none of these tools. All of this is self-description. ## How do you size SharePoint and mailboxes? In the Microsoft 365 admin center, go to Reports, then Usage, then SharePoint, then the Storage tab. It shows total usage, quota and a usage trend. [Microsoft says](https://learn.microsoft.com/microsoft-365/admin/activity-reports/sharepoint-storage-reports?view=o365-worldwide) it refreshes every 48 to 72 hours. For mail, choose Exchange, then the Email activity tab, View More, and Exchange then Mailbox usage. [The per-mailbox table](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/mailbox-usage?view=o365-worldwide) lists storage used in MB and item count, and it exports to CSV. The Storage chart leaves out archive mailboxes. ## How does the data leave? Teams chats and channel messages come out through the Teams Export APIs, covered on [licensing Teams data to AI](/answers/sell-microsoft-teams-data-to-ai). I didn't confirm limits on Purview eDiscovery exports for mail and files, so I state none. ## What do Microsoft's terms say? [Microsoft's APIs Terms of Use](https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use) bar an app from building databases or copies of API data beyond what its scenario needs, and from redistributing or reselling it. I found no sentence about AI training in that text. An app a buyer connects through Graph is the kind of app those terms describe. That's my reading. I didn't read Microsoft's product terms. ## What should you check first? Mail holds employees' words and outsiders' words. See [licensing employee emails to AI](/answers/can-i-sell-employee-emails-to-ai) and [licensing company emails to AI](/answers/sell-company-emails-to-ai). The [rights check](/rights-check) asks whose records these are and whether staff messages are included. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two Microsoft 365 reports that size a tenant: SharePoint storage (emphasized: One tenant-wide total, Used, quota, trend), Mailbox usage (MB per mailbox). The SharePoint report is emphasized because it shows one tenant-wide total, where the mailbox report lists each mailbox. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's page](https://www.troveo.ai/business-data) - [Mercor](https://www.mercor.com/data/) - [Microsoft says](https://learn.microsoft.com/microsoft-365/admin/activity-reports/sharepoint-storage-reports?view=o365-worldwide) - [The per-mailbox table](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/mailbox-usage?view=o365-worldwide) - [Microsoft's APIs Terms of Use](https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use) --- # Do I need to register as a data broker to license my data? > Wondering if selling your own data makes you a data broker? For a license, staff and customer data sits outside several state tests. No authority decides it. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/do-i-need-to-register-as-a-data-broker-to-sell-my-own-data Published: 2026-08-26 Updated: 2026-10-14 ## The short answer On plain text, Vermont and Oregon treat staff and customers as direct relationships, so you may not be a broker. Texas and California leave more room for mixed archives. No regulator guidance or ruling settles the question. Ask counsel in your state. Every state data broker law starts from the same idea. A broker sells or licenses personal data about people it has no direct relationship with. The states differ on who counts as a direct relationship. Legally, a "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers. It keeps "data broker" for that legal term. ## What do Vermont and Oregon say about staff and customers? [Vermont](https://legislature.vermont.gov/statutes/fullchapter/09/062) defines a data broker in two steps. The business knowingly collects and sells or licenses brokered personal information to third parties. The consumer must be someone it has no direct relationship with. Vermont's list of direct relationships includes these: - a past or present customer, client, subscriber or user - a past or present employee, contractor or agent [Oregon](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) excludes a business that collects information about a resident who is or was a customer, subscriber, user, employee, agent, contractor, investor or donor. Its registration section has a second rule. A broker can skip registering in one case. The sale involves only business assets, sold "a single time, or only occasionally," as part of a transfer of control. ## What do Texas and California add? [Texas](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.509.htm) drops the relationship wording. Its definition covers a business that collects, processes or transfers personal data. The business must not have collected it directly from the individual. The chapter applies in two cases: - the business gets more than half its revenue from that activity in 12 months - the business gets any revenue from the data of more than 50,000 individuals Someone named in an email thread never handed the company that data directly. How the wording meets an archive license is my reading of the text. No source settles it. [California](https://cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20260101.pdf) defines a broker as a business that knowingly collects and sells personal information. The consumers must be ones it has no direct relationship with. The text has no test for how often a sale happens. ## What about New Jersey? New Jersey [signed its broker law in June 2026](https://www.hunton.com/privacy-and-cybersecurity-law-blog/new-jersey-adopts-new-data-broker-registration-regime-and-sensitive-data-sale-and-licensing-restrictions). It defines a data collector as an entity that collects personal data from consumers it has a direct relationship with. The collector then sells or licenses it to a data broker. So it matters there whether your buyer counts as a data broker. The state plans to open its registry in spring 2027. ## Does a finder who never touches the data register? A finder neither receives nor discloses personal data. On the plain text, that does not fit the verbs in the definitions. I found no guidance on finders either. That is why we never take samples, credentials or data-room access. ## What should I gather first? Note where each person in your archive came from. Also note whether any lists were bought, imported or enriched. The [rights check](/rights-check) and the [risks page](/risks) cover that inventory. The [Texas](/answers/texas-data-broker-law) and [Vermont](/answers/vermont-data-broker-law) pages give each state's details. Figure: comparison of Three state tests for a first-party archive: Vermont (Staff are direct), Oregon (Staff are excluded), Texas (emphasized: Asks only if you collected it, Direct collection). Vermont and Oregon name staff and customers, while Texas asks only whether the data was collected directly. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Vermont](https://legislature.vermont.gov/statutes/fullchapter/09/062) - [Oregon](https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html) - [Texas](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.509.htm) - [California](https://cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20260101.pdf) - [signed its broker law in June 2026](https://www.hunton.com/privacy-and-cybersecurity-law-blog/new-jersey-adopts-new-data-broker-registration-regime-and-sensitive-data-sale-and-licensing-restrictions) --- # What does data monetization pricing look like? > Data monetization pricing for company data runs on four models: sale, license, revenue share and royalty. Public prices are few and come from vendors. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-monetization-pricing Published: 2026-08-26 Updated: 2026-10-14 ## The short answer Data monetization runs on four payment models: a one-off transfer, a license, a revenue share on repeat deals, or a royalty per use. Few figures are public. Handshake AI states $100K to $4M+, and micro1's data partnership page lists $100K+ to $1M+ tiers. None sets a per-record rate. Prices for company data come from deals, bids and what buyers say about themselves. Every figure below carries its source and its date. None of them is a rate you can multiply by your headcount, and no public source offers one. ## Which payment models do companies get? Four show up in public sources. **One-off sale.** You hand over a defined set of records and get paid once. [SimpleClosure](/buyers/simpleclosure)'s terms give the buyer all right and title. [micro1](/buyers/micro1)'s CFO described its corpus track this way in an undated recorded forum talk, but micro1's current page says companies keep ownership of their underlying data, so confirm the terms in the proposed agreement. **License.** [Troveo](/buyers/troveo)'s guide puts the contrast in one line: "A sale pays once. A license pays every time the data is used, and you keep ownership" ([Troveo](https://www.troveo.ai/resources/data-monetization-examples)). **Revenue share.** Troveo says it pays owners a share of every sale to buyers and publishes no split. Its page says owners share in the revenue on every later sale of the same data. **Royalty per use.** [EO Magazine](https://www.eomag.io/article/protege-bobby-samuels) described Protege's model as a royalty-based share paid each time data is used. Protege's own [data-provider page](https://withprotege.ai/data-provider/video) describes revenue-share payments when your content enters qualified deals, so go by that. > **A sale pays you once. A license pays you each time the buyer uses the data.** It's like renting out a room you never use. You keep the house, and the rent keeps coming. ## What do the published figures show? - **micro1:** tiers of $100K+, $500K+ and $1M+ on its [data partnerships page](https://www.micro1.ai/data-partnerships), and $100K-$2M+ for approved data packages on its [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral). Its CFO said in an undated recorded forum talk that deals near $2M are real. - **[Handshake AI](/buyers/handshake-ai):** partnerships "from $100K to $4M+" depending on the data shared (its page). - **SimpleClosure:** nearly 100 deals in a year at $10,000 to $100,000 per shut-down startup ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)). - **[Mercor](/buyers/mercor):** offers to shuttered startups reported at up to $300,000 ([BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). - **Spirit Airlines:** a $10M winning bid from Google, with Mercor at $7.5M and micro1 later at $12.5M. The sale was still before the bankruptcy court ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). Each of these is a whole archive or a company's published headline. None is a per-record figure. The [deals tracker](/deals) follows each public figure as it changes. ## What do marketplaces charge owners? Marketplaces for data products take a cut or a fee. That is a different price from a sale to a buyer. AWS lists a 3% fee on public offers for AWS Data Exchange products. Private offers cost 3%, 2% or 1.5%, depending on deal size ([AWS](https://aws.amazon.com/about-aws/whats-new/2024/01/aws-marketplace-simplified-reduced-listing-fees/)). Snowflake deducts a transaction fee and does not publish the percentage. One summary quotes Datarade's commission as 30%. Another quotes it in tiers. Check its current terms. These marketplaces sell data products to enterprises. They don't buy company archives. ## Can a monetization calculator tell me what my data is worth? No. A data company's calculator works from a few inputs and returns that company's own range, not a price for your records. Handshake AI's estimator gives $383,083 to $896,969 for 100 staff and 10 years ([Handshake AI](https://joinhandshake.com/ai/data-partnerships/)). Troveo's slider defaults to $800K on a $0 to $1M scale ([Troveo](https://www.troveo.ai/business-data)). Both come from the companies themselves. The [value guide](/guides/how-much-is-your-business-data-worth-to-ai) goes through what moves the number. Treat a calculator number as the start of a conversation. _Two calculators, two answers. Your own counts beat both._ Then run your [rights check](/rights-check). Talk to a privacy or commercial lawyer in your state before you sign. Figure: range, Corpus deal, per company, $100K to $2M. micro1 states a wide range for approved data packages. Source: micro1's Enterprise Data Partnership listing, self-reported. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/resources/data-monetization-examples) - [EO Magazine](https://www.eomag.io/article/protege-bobby-samuels) - [data-provider page](https://withprotege.ai/data-provider/video) - [data partnerships page](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [AWS](https://aws.amazon.com/about-aws/whats-new/2024/01/aws-marketplace-simplified-reduced-listing-fees/) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [Troveo](https://www.troveo.ai/business-data) --- # Mercor data breach: what happened and what to ask > The Mercor data breach of March 2026 came through a poisoned LiteLLM release. What was reported, what Mercor says, and what a company owner should ask. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/mercor-data-breach Published: 2026-08-25 Updated: 2026-10-14 ## The short answer The Mercor data breach of March 2026 started with a bad update to LiteLLM, a free open-source tool. The bad code stole login keys. The Next Web reported about 4 TB taken and said thousands of companies were hit. Mercor says harm to customer information was very limited. [Mercor](/buyers/mercor) hires experts to train AI models. Its data arm buys workplace data. Its breach is the best-documented security incident at an AI data buyer so far, which is why owners keep asking about it. The reported data was about contractors and applicants. No company-archive data was reported exposed. > **Once you share records, they sit inside the buyer's systems.** It's like renting out a room. You keep the house, but you still ask who else has a key. ## What happened in the Mercor breach? Someone spread bad versions of LiteLLM, an open-source library. The code was built to pull credentials from any system that installed it, according to Mercor's own [incident update](https://www.mercor.com/blog/update-on-mercor-security-incident/). [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) reported that a group called TeamPCP made the first break-in. Lapsus$ claimed responsibility and tried to auction the data. [Hausfeld](https://www.hausfeld.com/what-we-do/current-claims/mercor-data-breach), a law firm, dates the incident to about 24 Mar 2026. The Next Web, citing court filings and the hackers' own claims, put the haul at about 4 TB. That included roughly 939 GB of source code, a 211 GB user database and about 3 TB of video and identity-verification data. TNW counted over 40,000 current and former contractors and customers. Names and Social Security numbers were among the data. Treat the sizes and counts as reports. Mercor confirms the poisoned release hit it. It says the impact was "very limited." ## What does Mercor say it did? Mercor says it audited third-party dependencies, rotated credentials and access keys, and applied stricter cloud security policies. It also added 24/7 managed detection and response. It hired Google Mandiant and Latacora for forensics. It offered affected people TransUnion identity protection. Mercor also says experts saw only a small subset of exposure, customer information impact was very limited and employees were unaffected (Mercor, incident update, self-reported). ## What came after? A putative class action, *Ananthula v. Mercor.io Corp.*, No. 3:26-cv-03362, was filed on 21 Apr 2026 in the Northern District of California. It alleges failure to implement reasonable security and violations of privacy law ([Hausfeld](https://www.hausfeld.com/what-we-do/current-claims/mercor-data-breach)). None of it is proven. The breach suits were consolidated before Judge William H. Orrick on 19 May 2026 and stayed pending mediation on 21 Jul 2026, per the [CourtListener docket](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/). Where it stands now is in [is Mercor legit](/answers/is-mercor-legit). TNW reported that Meta paused its work with Mercor indefinitely and that OpenAI was investigating. Figure: steps Poisoned LiteLLM release -> Credentials taken, about 4 TB reported -> Class action filed 21 Apr 2026. Mercor traces its March 2026 breach to a poisoned LiteLLM release, and a class action followed in April. ## What does it mean for a company licensing data? The case shows how much a buyer's pipeline can hold in one place. Put these questions in writing before you share a record: - Does the buyer connect to your accounts, or do you export the files? Mercor's [data page](https://www.mercor.com/data/) describes 100+ connectors. Troveo says it needs no OAuth into your systems (its own page). - What does the SOC 2 claim cover? Ask for the scope, the auditor, the test period and the date. Jackson Lewis, a law firm, advises reading those details instead of accepting the label. - Who sees raw data, and how long does the buyer keep it? - If a breach reaches your records, who notifies and who pays? See [who is liable if the data buyer is hacked](/answers/who-is-liable-if-the-data-buyer-is-hacked). _Security questions are free. Ask all of them. Buyers hear them every day._ More on the company is in [is Mercor legit](/answers/is-mercor-legit) and [Mercor data licensing](/answers/mercor-data-licensing). The [rights check](/rights-check) and the [risks page](/risks) cover the rest of the owner's side. Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [incident update](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [Hausfeld](https://www.hausfeld.com/what-we-do/current-claims/mercor-data-breach) - [CourtListener docket](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) - [data page](https://www.mercor.com/data/) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) --- # Mercor data licensing: what it buys and what it pays > Mercor data licensing: it buys workplace data through 100+ connectors and pays by wire after delivery. Reported offers reach $300,000. The terms, dated. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/mercor-data-licensing Published: 2026-08-25 Updated: 2026-10-14 ## The short answer Mercor data licensing is how Mercor buys work data from businesses. It pays by wire after delivery, usually in two to four weeks. Reported offers reach $300,000 for shut-down startups. Its security claims are its own. A March 2026 breach hit its contractor data. [Mercor](/buyers/mercor) is best known for hiring experts. Its data arm is a second business. It is one of the few buyers with named, reported offers for company archives. > **Data licensing means Mercor gets to use your records for a fee, under rules.** It works like renting out a spare room. You keep the house. ## What does Mercor buy? Mercor's [data page](https://www.mercor.com/data/) says it wants the workflow data your business generates. It lists 100+ connectors, including Slack, Microsoft Teams, Gmail, Confluence, Salesforce, Outlook, GitHub, Google Drive and Notion. The page names no minimum company size. It says Mercor covers the cost of extraction, anonymization and transfer. Press reports add a second stream. Mercor reportedly approached acquired and shuttered startups for Slack chat logs, Google Drive files, email and Zoom recordings. Individual offers reached as high as $300,000 ([BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). ## What are Mercor's payment terms? The data page says pay depends on data volume, the tools connected and data depth. Payment is a wire transfer on delivery, usually within two to four weeks of agreement. No price list is published. _Wire on delivery. Your finance team will want that in writing._ Mercor bid $7.5 million for Spirit Airlines' archive of about 100 million emails, 500 million Teams messages and 30 million lines of code. Google won the auction with $10 million, pending court approval. [micro1](/buyers/micro1) offered a higher $12.5 million after the auction closed ([Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/)). ## What does Mercor say about security? The page claims SOC 2 Type II certification, encryption in transit, keys held in AWS KMS and credentials isolated per session. It says no AI lab buyer or third-party vendor sees your raw data. All of that is self-reported, and I could not verify the audit's scope. The incident that exposed contractor data in March 2026 is in [Mercor data breach](/answers/mercor-data-breach). ## How does it compare? [micro1](/answers/what-is-micro1) and [Handshake AI](/buyers/handshake-ai) run direct data partnerships with published tiers. Troveo shares revenue on repeat sales. The [buyers directory](/buyers) lays them out side by side. [Reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) shows what any of them will ask you to promise. The evidence on the company is in [is Mercor legit](/answers/is-mercor-legit). Run the [rights check](/rights-check) before you connect any account. Figure: steps Scope tools, connect accounts -> Mercor says it de-identifies -> Wire after delivery. Mercor describes a company data deal that ends in a wire after delivery. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data page](https://www.mercor.com/data/) - [BigGo Finance](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [Mercor security incident update](https://www.mercor.com/blog/update-on-mercor-security-incident/) - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [CourtListener docket, Deboni v. Mercor.io Corp.](https://www.courtlistener.com/docket/73129103/deboni-v-mercorio-corporation/) --- # Podcast guests AI licensing consent: what to check > Podcast guests AI licensing consent for a company podcast turns on the words in each release. What releases cover, how AIPodcast re-clears guests, a checklist. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/podcast-guests-ai-licensing-consent Published: 2026-08-25 Updated: 2026-10-14 ## The short answer Podcast guests AI licensing consent turns on your release's exact words. A typical release covers recording, editing, publishing and the guest's name, image and voice, but not licensing to AI buyers. Ask counsel whether yours reaches it. AIPodcast re-clears guests in writing and drops episodes without consent. A company podcast's back catalog looks like one asset. Each episode is really a stack of permissions, one per voice. ## What does a typical guest release cover? A podcast guest release is written permission to record a guest and use the recording. A [Content Allies guide](https://contentallies.com/learn/podcast-guest-release) lists audio and video recording, editing, publishing and distribution, promotional use, name, image and voice, social clips, and transcripts and captions. The same guide says a release should exclude synthetic voice cloning or misleading AI-generated replicas without separate consent. Its list of covered uses does not include licensing to AI buyers. ## How does an AI podcast licensor handle guests? [AIPodcast](https://www.aipodcast.io/solutions/podcast-audio-licensing) says it runs retroactive guest re-clearance for older episodes, so that every voice in a licensed recording has a signed release. It says new guests sign on arrival. It also says it excludes any episode where a guest cannot be reached or declines, and that it keeps per-episode consent receipts and a guest clearance log. Show owners receive a revenue share on each licensed hour, paid quarterly, with no rates published (self-reported). ## Why does the guest's voice matter? Tennessee's ELVIS Act expanded that state's right of publicity to cover a person's voice, including a simulation of it ([Manatt summary](https://manatt.com/insights/newsletters/client-alert/tennessees-elvis-act-expands-publicity-rights-for)). I can tell you what the law says. I can't tell you how it applies to your catalog. Rules differ by state, and a lawyer can tell you which ones reach your guests. ## What should you check in each release? Use this list when you read your own paperwork: - Does it name AI, machine learning or training data anywhere? - Does it allow licensing to third parties, and for what purposes? - Does it limit the media or the time period? - Who signed, and can you prove it? - Does anyone on the episode lack a release, such as a co-host, a staff member or a caller? I never judge a specific contract here. Any answer on a given release belongs to counsel. ## What if a guest cannot be reached? AIPodcast's published answer is to leave the episode out. Ask any buyer or marketplace how it handles unclear episodes and who bears the risk. The [rights check](/rights-check) and the [risk map](/risks) list the questions, and the [guide to licensing your business's content](/guides/license-your-business-content-to-ai) covers members and clients as well. For community posts, see [licensing members' posts](/answers/can-i-license-my-members-posts-to-ai). For the video side, see [licensing videos to AI companies](/answers/sell-videos-to-ai-companies). Talk to a privacy or commercial lawyer in your state before you sign. No outcome is promised. Figure: steps Find every guest, get a release -> Log each answer -> Leave out episodes with no yes. AIPodcast says it re-clears guests in writing and drops any episode without a yes. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Content Allies guide](https://contentallies.com/learn/podcast-guest-release) - [AIPodcast](https://www.aipodcast.io/solutions/podcast-audio-licensing) - [Manatt summary](https://manatt.com/insights/newsletters/client-alert/tennessees-elvis-act-expands-publicity-rights-for) --- # What is operational data? > What is operational data? Live transaction records in database terms. In AI deals it means the chat, tickets and files a company makes while working. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-operational-data Published: 2026-08-25 Updated: 2026-10-13 ## The short answer Operational data in AI deals is the records a company produces while working, like chat, email, tickets, documents and CRM entries. It shows the trail from request to approval across tools. In database terms it is live system data. Human data differs, since paid contractors make it on request. Two meanings share the phrase. One comes from databases and the other from the AI data market. ## What does operational data mean in a database? An operational database is the one an operational system uses for an organization's regular work. It updates data in real time. That is why such databases are also called OLTP systems, short for online transaction processing. In data warehouse terms, the operational database is the source for the warehouse. Analysts study combined history there ([Wikipedia](https://en.wikipedia.org/wiki/Operational_database)). ## What does micro1 mean by operational data? They mean the trail left by work. [micro1](/buyers/micro1)'s CFO gave a marketing budget request as the example in an undated recorded forum talk. The value is the path from request to analysis to approval across tools, and the names and vendor line items matter less (self-reported). micro1's [referral page](https://www.micro1.ai/company-referral) lists high-quality operational data as SOPs, documentation and CRM metadata. It prefers mostly English. The Spirit Airlines archive is the largest public example. It has about 100 million emails and 500 million Teams messages, per [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/). See [the Spirit Airlines page](/answers/spirit-airlines-data-sale). ## Is operational data the same as human data? No, they are different products. Human data is made on request by people who are paid to write, grade or demonstrate. Operational data already exists in a company's tools. Our page on [human data](/answers/what-is-human-data) covers the first, and [RL environments](/answers/what-is-an-rl-environment) shows where labs use the second. ## What does a company need to know before licensing it? Know these three things: - Who owns each record. - Which contracts cover it. - Whose messages sit inside it. Our [rights check](/rights-check) lists the questions. The [business page](/business) explains how the fit check works. The [data readiness checklist](/answers/data-readiness-checklist) covers what to prepare. micro1's [page](https://www.micro1.ai/data-partnerships) says personally identifiable information is removed when relevant, and its CFO said in an undated recorded forum talk that it does not want personal information. Whether removal holds is a separate question. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Request -> Analysis -> Approval. micro1's CFO described operational data as the path from a request to an approved budget. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Wikipedia](https://en.wikipedia.org/wiki/Operational_database) - [referral page](https://www.micro1.ai/company-referral) - [Time](https://time.com/article/2026/08/25/google-spirit-airlines-ai-data-RL/) - [micro1.ai](https://www.micro1.ai/data-partnerships) --- # micro1 workflows track: graded AI tasks, paid per task > The micro1 workflows track pays employees per completed task to grade an AI agent on real work, about $700 to $800 per task. Self-reported. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-workflows-track Published: 2026-08-24 Updated: 2026-10-14 ## The short answer micro1 workflows track lets employees grade AI agents on real daily work. The agent attempts a task, the employee grades and corrects it, and micro1 gets the grade and the agent's steps. Its CFO said in an undated recorded forum talk that pay is about $700 to $800 per task. The workflows track sits beside the one-time corpus deal, and a company can run both. [micro1](/buyers/micro1)'s [referral page](https://www.micro1.ai/company-referral) treats workflow partnerships and corpus partnerships as separate kinds of deal. ## What does an employee do in micro1's workflows track? In micro1's workflows track, an employee hands the AI agent a task from their real day, then reviews the result. The review says how well the agent did and how the task should have gone. David Revland, who works on human data at micro1, in the undated recorded forum talk called the employee's part "brief feedback," which sounds lighter than the CFO's grade-and-correct description. micro1 keeps two things from each task: the evaluation and the agent's trajectory. A [trajectory](/answers/what-is-an-rl-environment) is the sequence of actions the agent took. ## What does micro1 pay per task? The CFO's figure in the undated recorded talk is about $700 to $800 per completed task, each taking a couple of hours (self-reported, recording, date not stated). I couldn't confirm the low end word for word in the automatic captions. The talk did not say whether micro1 pays the company or the employee. Ask that on the first call. No outcome is promised. ## Who decides how much work is done? The company does, according to micro1's CFO. It chooses how many employees take part and how often. That is the difference from a corpus deal, which is one transfer. Workflows repeat task by task. ## How big can it get? The CFO said some companies have dozens of employees doing workflow tasks. The CFO's illustration was a company choosing 1, 2 or 15 employees at about five tasks a week, which the CFO said can add up, with no total given (self-reported, about 20:00 to 20:50). The next bit is my arithmetic on that illustration, not micro1's claim. 15 employees at 5 tasks a week is 75 tasks. At $700 to $800 per task, that is $52,500 to $60,000 a week. Five tasks also take at least 10 hours of an employee's week. Ask who receives the money before you use any weekly figure. No outcome is promised. ## Why would a company run it? micro1 gave two reasons. The track steers models toward a company's own tasks, and it makes teams more fluent with AI, "more AI native" in micro1's phrase. ## What rights questions come with it? The work an employee gives the agent is real company work, so the same questions apply as in a licensing deal: customer contracts, confidentiality terms and what employees may share. The [rights check](/rights-check) asks about customer contracts, NDAs and staff messages. Talk to a privacy or commercial lawyer in your state before you sign. The [full guide](/guides/micro1-data-partnership) places the track beside the other two ways in, and the [forum recap](/answers/micro1-data-partnership-forum) lists what else micro1 said. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Employee assigns a real task -> Agent tries, employee grades, fixes -> micro1 gets grade and trajectory. In the workflows track, an employee's grade and the agent's trajectory both go to micro1. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [referral page](https://www.micro1.ai/company-referral) - [micro1 data partnerships](https://www.micro1.ai/data-partnerships) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # What happens to my data after I license it to AI? > Wondering what happens to your data after you sell it to AI? The license sets retention and deletion, and micro1 says PII is removed when relevant. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-happens-to-my-data-after-i-sell-it-to-ai Published: 2026-08-24 Updated: 2026-10-14 ## The short answer After a deal, the data is transferred and checked. micro1's data partnership page says PII is removed when relevant, and micro1's David Revland described swapping names for consistent stand-ins. The contract decides retention and deletion. Troveo says models outlast the license. Five things happen to a corpus after the deal, and the sources describe each one differently. ## Who moves the data? [micro1](/buyers/micro1)'s CFO said in an undated recorded forum talk that its forward-deployed engineers help your IT people with the transfer. The CFO estimated about 10 hours over a week or two from one or two of your IT people (self-reported, recording undated). Our page on [how long a transfer takes](/answers/how-long-does-a-data-transfer-take) has the detail. ## Who checks it before payment? David Revland, who works on human data at micro1, said in the same talk that micro1 verifies the delivered data and then pays. That check is micro1's own step. Ask what it tests and what happens when part of the delivery fails. ## What happens to the names? micro1's page says PII "is removed when relevant." In an undated recorded forum talk, micro1's David Revland said micro1 swaps each name for a consistent stand-in across every tool. The CFO said micro1 samples the result at several points before use, and micro1 staff said companies cannot scrub first. Swapped names can still count as personal data in some regimes, so ask who holds the mapping. See [micro1 PII transformation](/answers/micro1-pii-transformation). ## How is the data used? Time tied Google's Spirit Airlines bid to reinforcement learning environments, and Google told Time the data "can be helpful in improving our products and AI models." Fortune, reporting on micro1's offer, wrote that an agent learns to choose actions, use tools and recover from mistakes. [Epoch AI](https://epoch.ai/gradient-updates/state-of-rl-envs)'s review of the market doesn't say real company data fills today's environments. Our page on [what AI labs do with company data](/answers/what-do-ai-labs-do-with-company-data) lays out the three uses Epoch lists. ## Is the data kept, and can it be deleted? [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) says data is retained only for agreed periods and that deletion requests are honored according to the terms of the engagement. It also says access is limited to a small number of authorized team members. Deleting files doesn't undo training. Troveo's [guide](https://www.troveo.ai/resources/ai-data-licensing-deals) says models already trained survive the license ending, because nothing can be untrained. The [deletion page](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it) covers what a regulator can order. ## What belongs in writing? The retention period, the deletion trigger, who sees the data, whether the buyer can resell derived products and who holds the name mapping. Our [buyers page](/buyers) records what each buyer publishes. The [rights check](/rights-check) lists what to settle before you talk to counsel, and our [managed readiness service](/managed-readiness) lines up the terms from each draft. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Transfer, micro1 verifies -> Names swapped -> Training, deletion per contract. After a deal the data moves from transfer to training, and deletion follows whatever the contract sets. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Epoch AI](https://epoch.ai/gradient-updates/state-of-rl-envs) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [guide](https://www.troveo.ai/resources/ai-data-licensing-deals) --- # Where to license company data > Searching where to sell company data? You license it through a direct program, a marketplace, a shutdown service or a referral site. What each one publishes. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/where-to-sell-company-data Published: 2026-08-24 Updated: 2026-10-14 ## The short answer Company data reaches AI through four routes. Direct programs like micro1 pay under a data partnership and post payment tiers. Marketplaces like Troveo pay a share of each deal and keep the split private. Shutdown services take only firms winding down. Referral sites pass your details to a partner. Four routes exist today. Each trades price clarity, speed and control differently. Facts below are self-reported unless a source is named. > **A direct program pays you under a partnership or license. A marketplace pays you a share each time it resells.** One is a yard sale. The other is renting out a room. ## Is a direct program the clearest route? [micro1](/buyers/micro1) and [Handshake AI](/buyers/handshake-ai) pay companies directly, under their own partnerships. micro1 lists $100K+, $500K+ and $1M+ tiers. Its Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. Handshake AI says $100K to $4M+. In an undated recorded forum talk, David Revland, who works on human data at micro1, said its engineers walk your IT team through the transfer and that micro1 checks the data before paying. In the same talk, micro1's CFO put the company's side at about 10 hours of work from one or two IT people. micro1 staff also said in the same talk that micro1 does the de-identification itself and that companies cannot pre-scrub. [De-identification](/answers/data-de-identification) covers why that matters. ## What does a data marketplace like Troveo offer? [Troveo](https://www.troveo.ai/business-data) says it pays a revenue share on every sale to buyers and takes no OAuth access to your systems. It has not published the split, and the buyer is usually unnamed. You get repeat sales. You give up price clarity. ## What about a shutdown service? SimpleClosure's Asset Hub sells data for startups winding down. It reported nearly 100 deals at $10,000 to $100,000 per company in its first year ([Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916)). Its [AssetHub page](https://simpleclosure.com/product/assethub/) says operating companies can license too. It takes a percentage only on a completed deal and publishes no rate. Sunset runs a similar service, and its terms are not published. ## What is a data referral front end? A referral front end is a site that collects your details, often through a calculator, and passes them to a partner it may not name. It gets paid when the introduction lands. The buyer is named late or not at all, so ask who it is before you share anything. Our [red flags page](/answers/ai-data-broker-red-flags) lists the other checks. Figure: comparison of Routes for licensing company data: Direct program (emphasized: Publishes the clearest tiers, Partnership or license), Marketplace (Shares each sale), Shutdown service (Startups winding down). A direct program pays you under a partnership or license, so it publishes the clearest price tiers. ## How do I choose? Ask each route four things. Who pays whom? What do you hand over, and when? Who de-identifies? What can you still read in the contract? Compare routes on what each publishes about price, custody of your data and fees. The [buyer directory](/buyers) lists the buyers we track side by side. _Four routes, four ways to say "it depends." Ask each one for the numbers in writing._ micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Run the [rights check](/rights-check) before any call. Talk to a privacy or commercial lawyer in your state before you sign. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [AssetHub page](https://simpleclosure.com/product/assethub/) --- # What is data monetization? > What is data monetization? Using data to create value by improving work, wrapping products or selling. MIT's split of returns, and where AI licensing fits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-data-monetization Published: 2026-08-23 Updated: 2026-10-14 ## The short answer Data monetization is using data to produce measurable economic value. MIT's study sorts it three ways: improving work with data (51% of returns), wrapping products with data (31%), and selling information (18%). Licensing records to an AI lab sits in that third group. Public prices are scarce and self-reported. ## What are the three ways to monetize data? **Improving.** You use data to run the business better, such as keeping the right products in stock. MIT's example is using purchase data to stock shelves. **Wrapping.** You add data to a product so it does more, such as recommendations that help a customer find and buy something. **Selling.** The third group is information that solves a problem for someone else. MIT's example is a healthcare company sharing spending patterns with hospitals. The authors note that selling is more than selling raw datasets ([MIT Sloan](https://mitsloan.mit.edu/press/data-everybodys-business-fundamentals-data-monetization)). ## Which way earns the most? In the MIT research, improving did, at 51% of returns on average, with wrapping at 31% and selling at 18%. These are averages across studied firms and not a forecast for yours. That makes the cheapest data monetization an internal project more often than not. A company with records buyers want can still add licensing on top. ## Where does licensing data to AI companies fit? It is one route, with a short public record. micro1's [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages (self-reported). [Troveo](/buyers/troveo) says first sales run to six figures and pays a revenue share on repeat sales ([Troveo](https://www.troveo.ai/resources/data-monetization-examples), self-reported). Our [guide to monetizing company data](/guides/monetize-company-data) ranks the routes by how much evidence supports them. The [pillar guide](/guides/how-to-sell-company-data-to-ai-companies) covers the licensing process. ## What should you check before licensing data? Rights. A sale of personal information for money can count as a sale under [California law](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), and customer contracts can restrict secondary use. Run the [rights check](/rights-check) and read the [risk map](/risks). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Talk to a privacy or commercial lawyer in your state before you sign. Figure: scale, Three ways to monetize data, by share of returns: Improving 51% (emphasized), Wrapping 31%, Selling 18%. On average across MIT's studied firms, improving work with data produced the largest share of returns. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [MIT Sloan](https://mitsloan.mit.edu/press/data-everybodys-business-fundamentals-data-monetization) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [Troveo](https://www.troveo.ai/resources/data-monetization-examples) - [California law](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) --- # License Zoom recordings to AI: consent and terms > Searched how to sell Zoom recordings to AI? A license starts with consent. Zoom's terms put recording-law duties on you. The Otter.ai ruling shows the claims. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-zoom-recordings-to-ai Published: 2026-08-22 Updated: 2026-10-14 ## The short answer To license Zoom recordings to AI, start with Zoom's terms. They put recording-law compliance and third-party consent on the customer. A 2026 federal court let wiretap claims against Otter.ai go forward. Ask counsel whether your call notices cover this use. A Zoom recording holds voices, faces and whatever each person said on the call. The consent questions come ahead of the market ones. ## Who owns a Zoom recording? [Zoom's terms](https://www.zoom.com/en/trust/terms/) say you retain ownership of your Customer Content. You grant Zoom a license for its own permitted uses, such as running the service and meeting legal duties. The license runs to Zoom, and the terms don't make Zoom a buyer. ## Does Zoom train AI on your recordings? Section 10.2 of Zoom's terms says Zoom does not use your audio, video, chat, screen sharing, attachments or similar communications content to train Zoom or third-party AI models. That's a statement about Zoom. It says nothing about what a company may license to a lab. ## Who has to get consent? Section 7 says you are responsible for compliance with all laws governing monitoring or recording of conversations as the host, and that a participant who does not consent can leave the session. Section 10.4 adds the duty to get third-party consent to use or license the content and to give notices of third-party rights. A meeting holds customers, partners and staff. Whether the notice they heard at the start of the call covers licensing is a question for counsel. ## What did the Otter.ai court decide? In re Otter.AI Privacy Litigation (N.D. Cal., Judge Eumi K. Lee, [order of 13 Aug 2026](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf)) concerned a notetaker that joined meetings on platforms like Zoom and Microsoft Teams. The court denied most of Otter's motion to dismiss. These are allegations at the pleading stage, and the defendant was a vendor. Our [call recordings page](/answers/can-i-sell-call-recordings-to-ai) walks through the wiretap and voiceprint claims. ## What do buyers say they take? [Troveo](/buyers/troveo)'s [business-data page](https://www.troveo.ai/business-data) lists Zoom under chat and messaging. It doesn't price a meeting recording, and I found no buyer page that does. Troveo is a vendor describing its own program. ## What about a transcript alone? A transcript keeps the words and drops the voice. The people in it are still people, so the consent and notice questions stay. See [customer service transcripts](/answers/sell-customer-service-transcripts-to-ai) for the support case. Talk to a privacy or commercial lawyer in your state before you sign. Our [rights check](/rights-check) asks about personal data and customer contracts and lists what to settle with counsel. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three forms of a Zoom meeting record: Video (Faces and voices), Audio (Voices), Transcript (emphasized: Words only, no voice, Words only). A transcript keeps the words and drops the voice, and the people in it still matter. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Zoom's terms](https://www.zoom.com/en/trust/terms/) - [order of 13 Aug 2026](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) - [business-data page](https://www.troveo.ai/business-data) --- # What is the micro1 video data partner program? > micro1 video data partner program: hands-on businesses with 20+ staff film first-person work video. Who qualifies and what pay it states. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-commercial-video-data-partner Published: 2026-08-22 Updated: 2026-10-14 ## The short answer The micro1 video data partner program asks business owners to record first-person video of hands-on work. It needs a company with at least 20 employees, like a farm, repair shop or building crew. Staff film with a phone on a wearable mount. micro1 states no pay amount. Most [micro1](/buyers/micro1) programs cover words: SOPs, knowledge bases and ticket workflows. This one covers footage of people doing physical work, and it is separate from the company-data program. micro1 says the video trains robotics AI models ([micro1's partner post](https://req.micro1.ai/post/acd4e6e5-0afb-4b83-bcb0-fc6a81904063)). > **Staff wear a phone, and the phone films what their hands do.** Think of a dashcam, but for a shift instead of a drive. The robot watches your work the way a new hire shadows a veteran. ## Who qualifies? The post names construction, manufacturing, auto repair, agriculture, warehousing, hotels and field services. It also lists retail, healthcare, logistics, education, fitness, transportation, property services and beauty. The hard line is size. The post asks for companies with at least 20 employees. The owner, or someone with real authority, applies. micro1 also prefers a leader who can manage large groups doing practical tasks. Experience with process documents or data projects helps. Past pilots help but are not required. ## What video does micro1 want? First-person video of manual work, from the worker's point of view. The post calls it POV or egocentric video. It asks for high volume from daily work in a real commercial setting. The post lists three requirements: eligible smartphones, a wearable phone mount and a real commercial setup. It does not say which phones count. Ask before you buy mounts. ## What does the partner actually do? The post frames the job as a contractor role, remote, for a customer project that micro1 does not name. The post lists seven tasks. We group them in five. 1. **Collect** Get POV video of manual work. 2. **Coordinate** Handle high-volume submissions from staff. 3. **Advise and guide** Flag safety issues and pass micro1's rules to your people. 4. **Report** Give regular progress feedback to micro1's team. 5. **Stay compliant** Meet privacy and consent standards. ## How does micro1's pay work? The post says only that selected partners are compensated. It gives no rate per hour of footage, no flat fee and no payment date. Treat any number you hear elsewhere as unconfirmed until micro1 puts it in writing. We can't promise income from this program. Plan as if the first month could pay nothing, and ask for the terms before you buy equipment or film anyone. _A phone mount is cheap. Unpaid hours of filming are not._ ## What about the people on camera? The post puts privacy on the partner: collect all video under privacy, consent and ethical standards. It calls the footage anonymized. It does not say how faces, voices or screens get anonymized, or who holds the raw files. Here is our checklist, which is ours and not from the post: - Get written consent from every worker before they film. - Keep customers, patients, students and bystanders out of frame. - Avoid screens, ID badges, license plates and paperwork. - Ask whether footage of employees changes their job duties or pay. Local law varies by country and state. Have a lawyer read the consent form and the micro1 contract first. We give no legal advice. ## Where is it open? The post lists North America, Latin America, Australia and New Zealand, Japan, Taiwan, South Korea, Indonesia, Qatar, Saudi Arabia, South Africa and the UAE. Other regions are not listed. ## How do you apply? You fill in a short form of about two minutes. It asks for company name, your name, role, email, phone, country and website. The post names no timeline for a reply. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [See the video partner post (paid link)](https://req.micro1.ai/post/acd4e6e5-0afb-4b83-bcb0-fc6a81904063?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own video partner post](https://req.micro1.ai/post/acd4e6e5-0afb-4b83-bcb0-fc6a81904063) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ Before you apply, run the [rights check](/rights-check) and read [what micro1 is](/answers/what-is-micro1) and [whether micro1 is legit](/answers/is-micro1-legit). For micro1's company-records program, see the [enterprise data partnership](/answers/enterprise-data-partnership) and [how micro1's data partnership works](/guides/micro1-data-partnership). ## Their FAQ, in plain words The post has no FAQ list. Its "Why partner with us" block answers four questions, so we put them here in our words. ### Does micro1 pay us? micro1 says selected partners are compensated for their expertise. It gives no amount. Get the rate in writing. ### How much work is this for our team? micro1 says it designed the program to be low-overhead. It says it handles coordination, anonymization and program management. The partner still runs filming, consent and safety on site. ### What does micro1 get out of it? It says it wants real-world work to train and test frontier AI. For this post that means robotics models. ### Can any business join? Not any. For the video program, it must have 20 or more employees, work in a hands-on trade and sit in a listed region. micro1 picks the partners. Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's partner post](https://req.micro1.ai/post/acd4e6e5-0afb-4b83-bcb0-fc6a81904063) - [micro1 data partnerships](https://www.micro1.ai/data-partnerships) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Can a SaaS company license its customers' data to AI? > Wondering if a SaaS company can sell its customers' data to AI? Even a license is hard. GDPR holds a processor to the customer's instructions. Ask counsel. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-a-saas-company-sell-its-customers-data-to-ai Published: 2026-08-21 Updated: 2026-10-14 ## The short answer Usually not, on the text of the rules. GDPR Article 28 limits a processor to documented instructions. CCPA requires a service provider's contract to prohibit selling customer data. Customers have sued vendors over AI training. Ask counsel whether your contracts make you a processor. A software vendor stands on the other side of this question from a company licensing its own archive. The rules for the two differ. ## What is a GDPR processor, and what limits a SaaS vendor? Under the GDPR, a processor handles data for a controller. [Article 28(3)(a)](https://gdpr-info.eu/art-28-gdpr/) says the processor processes personal data "only on documented instructions from the controller." [Article 28(10)](https://gdpr-info.eu/art-28-gdpr/) says a processor that determines the purposes and means of processing is considered a controller for that processing. The CCPA reaches the same place by contract. Its [definition of a service provider](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) requires a written contract. The contract must prohibit the provider from selling or sharing the personal information. ## Have customers sued over this? Yes, though the cases are about vendors. None involves a company licensing its own archive. In re Otter.AI Privacy Litigation (N.D. Cal., Judge Eumi K. Lee, [order of 13 Aug 2026](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf)) let several claims go forward. They were Wiretap Act, California privacy-act and Illinois biometric claims. The target was a meeting-notes vendor accused of training its models on recorded conversations. These are allegations at the motion-to-dismiss stage. Khan v. Figma (N.D. Cal., filed 21 Nov 2025) alleges breach of contract and trade-secret misappropriation over AI training on customer designs. [Bloomberg Law reported](https://news.bloomberglaw.com/litigation/startup-founder-must-arbitrate-ai-training-claims-against-figma) that the court compelled arbitration. ## What do SaaS contracts say about AI training? [Common Paper's 2026 benchmark](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/) looked at 16,140 signed agreements. It found 14% of cloud service agreements prohibit AI training on customer data, against under 1% in 2024. Its default clause lets the vendor train on aggregated, de-identified data. That carve-out covers the vendor's own use. My reading is that it doesn't authorize a sale to a third party. If you're a customer, take the vendor's terms and your own contracts to counsel before anyone licenses the data. If you're the vendor, talk to a privacy or commercial lawyer in your state before you sign. For the company-side view, see [licensing customer data](/answers/is-it-legal-to-sell-customer-data). Figure: steps Customer sets the purpose -> Vendor processes on instructions -> Sale makes vendor a controller. Under GDPR Article 28, a processor that sets its own purposes is treated as a controller. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Article 28(3)(a)](https://gdpr-info.eu/art-28-gdpr/) - [definition of a service provider](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [order of 13 Aug 2026](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) - [Bloomberg Law reported](https://news.bloomberglaw.com/litigation/startup-founder-must-arbitrate-ai-training-claims-against-figma) - [Common Paper's 2026 benchmark](https://commonpaper.com/resources/2026-saas-contract-benchmark-report/) --- # Is Handshake AI legit? A review of its company data program > Is Handshake AI legit or a scam for a company licensing its records? A review of its data program: the firm, its stated terms, its privacy warning and disputes. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-handshake-ai-legit Published: 2026-08-21 Updated: 2026-10-14 ## The short answer Handshake AI's company data program is run by Handshake, a real company whose domain dates to 2014. It publishes its terms: $100K to $4M+ per partnership, 20+ full-time staff and 3+ years. It warns re-identification risk never reaches zero. Press reported contractor pay disputes, so get payment terms in writing. This review covers the [Handshake AI](/buyers/handshake-ai) company data program, which licenses business records to AI labs. Handshake's AI fellowship for individual experts is a separate program with its own record. I checked the data program the way I would before sending it a single export. ## Is Handshake AI legit for a company sharing its data? Yes, on the public record. Handshake is a career network whose domain was registered in 2014, and its AI arm publishes a company data partnerships page with a price range, a calculator and a process. No partnership contract is public, so the contract you are offered is the one to read. ## Is Handshake AI a scam? Nothing in the record points to a scam on the company data side. Handshake AI publishes who it is, what it says it pays and how it handles data. The marks against it are contractor pay disputes on the worker side, reported by Business Insider in March 2026. ## What does the evidence show? | Item | What the sources show | Source | |---|---|---| | Entity | Handshake, domain registered in 2014. Sacra estimates $1.1B in annualized gross revenue in April 2026, and a $3.5B valuation at its last raise in 2022 | RDAP. [Sacra](https://sacra.com/research/handshake-indeed-for-data-labelers/) | | Company data terms | $100K to $4M+ per partnership, self-reported. The page says "no de-identification process eliminates that risk entirely" | [Data partnerships](https://joinhandshake.com/ai/data-partnerships/) | | Who qualifies | "20+ full time employees & 3+ years in operation" | [Referral page](https://joinhandshake.com/ai/data-partnerships/referral) | | Reported totals | Two of its pages give different totals paid out, $250M and $500M+. Neither says what it covers | [joinhandshake.com](https://joinhandshake.com/ai/data-partnerships/referral). [Fellowship](https://joinhandshake.com/ai/) | | Contractor disputes | Five contractors on OpenAI projects suspended and four unpaid. A separate unpaid-wages case ended with a court ruling that the contractor be paid $6,475 | [Business Insider via AOL](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) | Handshake declined to comment to Business Insider. _None of the disputes involve company records. They do show how Handshake handles a payment disagreement._ ## What is the current status of Handshake AI's data program? On 14 Oct 2026 the data partnerships page was live and stated $100K to $4M+ "depending on the data shared." Its calculator showed $383,083 to $896,969 for a 100-person, 10-year US company, labelled "an indicative estimate only and is not an offer." One Handshake AI page states $250M paid out to partners. The fellowship page now states $500M+, where earlier reads showed $100M. A growing total is no forecast for one company, so treat both as marketing figures. Business Insider's report is dated 4 Mar 2026, and the court ruling it describes came in the previous October. Neither concerns a company data deal. ## How does Handshake AI's data program work for a company? You submit an intake form about your company and the tools you use. A team member follows up, and if there is a fit, a scoping call covers data parameters, de-identification, terms and timeline. Handshake says it removes identifying details, cleans and formats the records, and delivers them to frontier AI labs under contractual confidentiality. Its page adds that partner companies are never identified. The full read is in [Handshake AI data partnerships](/answers/handshake-ai-data-partnerships). ## Who sees a company's data at Handshake AI? Handshake AI says access is limited to authorized teams, and the prepared dataset goes to frontier AI labs under contractual confidentiality. It says partner companies are never identified, and the data is used only for training and evaluation, never published. It also says it documents its de-identification method for each dataset. Ask for that record for yours, because the same page warns a third party may still re-identify people by combining sources. ## How does Handshake AI set the price of a data partnership? Its calculator takes three inputs: headcount, years in operation and country, with the USA, Canada, Europe and other as the choices. The page says the final figure turns on your data sources, volume and quality, its due diligence and your acceptance of its licensing terms. So the calculator gives a starting range. The offer comes after the scoping call. Every stated floor beside Handshake AI's is in [do you qualify for an AI data program](/answers/ai-data-program-minimums). ## What should a company ask Handshake AI before signing? - **When and how you are paid.** The page says payments follow delivery milestones, typically 30 to 60 days after dataset acceptance. The contractor disputes are about payment, so put the date, the method and a dispute process in the contract. - **Who carries privacy risk.** Its page says partners stay responsible for making the transfer legal. - **What the calculator left out.** It says pay depends on data sources, volume, quality and due diligence. Handshake AI sits beside six other programs in [micro1 alternatives](/answers/micro1-alternatives) and against Mercor in [Mercor vs Handshake AI](/answers/mercor-vs-handshake-ai). Figure: range, Handshake AI company data deals, $100K to $4M. Handshake AI states a wide range for company data deals, open at the top. Source: Handshake AI data partnerships page, self-reported. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Sacra](https://sacra.com/research/handshake-indeed-for-data-labelers/) - [Data partnerships](https://joinhandshake.com/ai/data-partnerships/) - [Referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Fellowship](https://joinhandshake.com/ai/) - [Business Insider via AOL](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) --- # Is it legal to license company data to AI? > Googling whether it's legal to sell company data to AI? We found no general rule on licensing it. Contracts, privacy law, staff rules and the buyer set limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-it-legal-to-sell-company-data-to-ai Published: 2026-08-21 Updated: 2026-10-14 ## The short answer It depends on the data, others' rights in it and the buyer. We found no federal or state permit a company needs to license its own records. HIPAA limits health records, and a DOJ rule limits bulk data sent to countries of concern. Ask counsel which rules reach your archive. Almost every "can I license it" question has the same shape. The transfer is the regulated act, and the data decides which rules apply. We mapped the layers below and pointed each one to its own page. We found no federal or state permit that a company needs to license its own records. Several rules still limit sales of particular data: [health records](/answers/can-i-sell-health-or-financial-client-data-to-ai), [call recordings](/answers/can-i-sell-call-recordings-to-ai) and data going to countries of concern. The live test case is the Spirit Airlines bankruptcy sale, where a flight attendants' union objected in court. The sale has no approval. > **Holding data does not always mean you can license it.** Think of the attic. Some boxes are yours. Others belong to a neighbor, or hold letters from other people. Sort the boxes before you license. ## What does Frankfurt Kurnit say to check before a data deal? Start with who else holds rights in the records. The law firm Frankfurt Kurnit Klein and Selz (FKKS) lists competing ownership claims first. They come from NDAs, licensed material, open source and vendor-generated records. FKKS says holding data does not automatically give the right to license it ([FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). Our pages on [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai), [who owns company emails](/answers/who-owns-company-emails) and [attorney-client privilege](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) take those one at a time. ## What does privacy law add? California's CCPA defines a sale as disclosing personal information to a third party for "monetary or other valuable consideration" ([Civ. Code 1798.140(ad)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). A sale carries notice, opt-out and contract duties. The statute treats data as deidentified only if reasonable measures, a public commitment and recipient contracts are all in place. California's attorney general said General Motors sold driving data to data brokers without consumers' knowledge or consent. GM settled for $12.75 million on 8 May 2026, and a settlement is not a court finding ([California AG](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general)). Our [CCPA sale page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) and [customer data page](/answers/is-it-legal-to-sell-customer-data) go deeper. ## What about employees? California's attorney general says the employment and business-to-business exemptions expired. So employee data has been covered since 1 Jan 2023 ([CCPA FAQ](https://oag.ca.gov/privacy/ccpa)). Other states vary. Federal labor law and union contracts apply either way. See [licensing employee emails](/answers/can-i-sell-employee-emails-to-ai) for what your staff may object to. ## Which data do lawyers say to leave out? FKKS recommends excluding these: - privileged material - HR and personnel files - payroll and tax records - health and benefits information - union-related communications - customer and partner confidential information - licensed data and regulated-system data FKKS also says not to rely on de-identification for them. The pages on [HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai), [call recordings](/answers/can-i-sell-call-recordings-to-ai) and [health or financial data](/answers/can-i-sell-health-or-financial-client-data-to-ai) cover the highest-risk categories. _Lawyers love a labeled box. Start labeling._ ## Has anyone been stopped from licensing company data? We found no lawsuit, regulator action or NLRB charge against a company for licensing its own email or chat archive to an AI buyer. An empty search is not clearance. Don't read it as one. The Spirit Airlines sale is the closest event. The flight attendants' union filed a limited objection on 18 Aug 2026. It asked the court to exclude all flight attendant information, or add protections ([Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)). Our [union objection page](/answers/spirit-airlines-data-union-objection) reads the filing. ## Does the buyer matter? Yes. A Department of Justice data security rule turns on who owns the buyer, so an owner needs to know. Our page on [the DOJ bulk data rule](/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data) reads the text. Figure: steps Who holds rights, what it holds -> What people were told, who buys -> Counsel reads it. A company's archive passes checks on rights, contents, notice and buyer before counsel reads the result. ## What is the next step? Run the [rights check](/rights-check) and read the [risk map](/risks) before a buyer call. The [licensing guide](/guides/how-to-sell-company-data-to-ai-companies) covers the whole process. A [managed readiness review](/managed-readiness) collects the facts for your lawyer. Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Civ. Code 1798.140(ad)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [California AG](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general) - [CCPA FAQ](https://oag.ca.gov/privacy/ccpa) - [Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) --- # What is a data lab? > What is a data lab? micro1's own term for a company that supplies the data AI models learn from. How it differs from an AI lab and a finder. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-data-lab Published: 2026-08-21 Updated: 2026-10-14 ## The short answer A data lab is micro1's term for a company that supplies training data to AI models, sitting between data holders and AI labs. A data lab supplies and transforms the data. micro1's Enterprise Data Partnership listing says $100K-$2M+ for approved data packages, its own claim. A finder only introduces parties. Three roles get mixed up in this market. A data lab is one of them. ## How is a data lab different from an AI lab? An AI lab builds and trains models. A data lab supplies what those models learn from, such as expert-written answers, grading and real company records. [micro1](/buyers/micro1)'s [human data page](https://www.micro1.ai/human-data) says its work uses domain specialists across 100+ fields (self-reported). It also runs company-data partnerships, where companies keep ownership of their data. Our page on [human data](/answers/what-is-human-data) covers the first kind, and [what micro1 is](/answers/what-is-micro1) covers both. ## How is a data lab different from a finder? A finder introduces owners to buyers and may never hold the data. A data lab takes in, transforms and delivers the data. micro1's David Revland said in an undated recorded forum talk that its team swaps names for consistent stand-ins. micro1 staff said companies cannot scrub the data first, so micro1 transforms each corpus itself. That puts the lab inside the data's path. Our page on [data brokers](/answers/what-is-a-data-broker) covers the finder role. ## Does micro1 pay companies directly? [micro1 says](https://www.micro1.ai/forum/turn-existing-workflows-into-revenue) it does. Its Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. [TechCrunch](https://techcrunch.com/2026/08/20/ai-data-startup-micro1-reaches-500m-gross-run-rate-amid-ai-training-boom/) reported that micro1 reached a $500 million gross annualized run rate, per a person familiar with the company. Both are self-reported or sourced to insiders. A marketplace such as Troveo works differently. Its [business-data page](https://www.troveo.ai/business-data) says it pays owners on every sale after the first as well, and it publishes no split. ## What should a company ask a data lab? Ask who sees the raw data, where it is stored, whether it is a sale or a license, and what happens at deletion. Our [risk map](/risks) lists the contract points, and the [rights check](/rights-check) lists what you need to know about your own data first. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Three roles between company data and a trained model: AI lab (Trains the model), Data lab (emphasized: Supplies the data, Supplies the data), Finder (Makes introductions). The data lab is emphasized because it supplies the data, which is how micro1 describes its own role. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [human data page](https://www.micro1.ai/human-data) - [micro1 says](https://www.micro1.ai/forum/turn-existing-workflows-into-revenue) - [TechCrunch](https://techcrunch.com/2026/08/20/ai-data-startup-micro1-reaches-500m-gross-run-rate-amid-ai-training-boom/) - [business-data page](https://www.troveo.ai/business-data) --- # Who owns Slack messages? > Who owns Slack messages? Slack says customers own their data. Copyright law, shared channels and the people in the messages add claims. What the sources say. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/who-owns-slack-messages Published: 2026-08-21 Updated: 2026-10-14 ## The short answer Slack says customers own their data, so the company holds the workspace. Four parties can still have a claim: the company, the employee who wrote it, another organization for shared channels, and people mentioned. Slack's text doesn't say who owns shared-channel content. Ownership comes in layers. Each layer has a different source, and none of them settles whether you may license the messages. ## Who owns the messages, the company or Slack? [Slack's privacy principles](https://slack.com/trust/data-management/privacy-principles), which carry no date, say customers own their own Customer Data. They also say Slack will not use Customer Data to train generative AI models unless the customer gives affirmative opt-in consent. [Slack's privacy policy](https://slack.com/trust/privacy/privacy-policy) adds that the organization that created the workspace controls its Customer Data and Slack acts as a processor following its instructions. The same policy says Slack is the controller of usage and device information it collects about people. See [does Slack sell your data](/answers/does-slack-sell-your-data). ## Who owns them, the employer or the employee? The copyright statute has a default rule. Under [17 U.S.C. 201(b)](https://www.law.cornell.edu/uscode/text/17/201), for a work made for hire the employer is considered the author and owns the rights, unless the parties agreed otherwise in a written instrument they signed. [Section 101](https://www.law.cornell.edu/uscode/text/17/101) defines a work made for hire as a work prepared by an employee within the scope of employment, or a specially commissioned work in one of nine listed categories with a signed writing. The statute text does not say whether a short chat message is a copyrightable work, and I found no court decision on workplace chat. Employment agreements and handbooks may also say something, and a lawyer reads those. ## What about messages from another organization? A shared-channel export carries the other organization's messages. [Slack's help page](https://slack.com/help/articles/115004152843-How-data-management-features-apply-to-Slack-Connect) says your retention settings apply only to messages and files sent by your own members. It does not say who owns shared-channel content. Partners and customers may also hold contract claims over what they posted. Our [Slack Connect page](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai) covers that case. ## Do the people in the messages have a say? Ownership of a message and rights over the personal details in it are separate questions. A person named in a thread can have privacy rights whoever holds the copyright. [Licensing employee emails](/answers/can-i-sell-employee-emails-to-ai) covers what your staff may object to and where that dispute has surfaced. [Licensing Slack in a shutdown](/answers/can-a-shutting-down-company-sell-its-slack-to-ai) covers the duties that stay in place after a company closes. ## Does owning Slack messages let you license them? Ownership and the right to license differ. The limits sit in NDAs, customer contracts, privacy law and shared channels. See [is it legal to license company Slack data](/answers/is-it-legal-to-sell-company-slack-data) and our [rights check](/rights-check). Talk to a privacy or commercial lawyer in your state before you sign. We gather facts and give no legal advice. Figure: comparison of Three sources of claims on one Slack message: Slack's terms (emphasized: Slack says customers own it, Customer owns its data), Copyright law (Employer if for hire), Shared channels (Slack's text is silent). Slack says customers own their Customer Data, while copyright law and shared channels add other claims. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Slack's privacy principles](https://slack.com/trust/data-management/privacy-principles) - [Slack's privacy policy](https://slack.com/trust/privacy/privacy-policy) - [17 U.S.C. 201(b)](https://www.law.cornell.edu/uscode/text/17/201) - [Section 101](https://www.law.cornell.edu/uscode/text/17/101) - [Slack's help page](https://slack.com/help/articles/115004152843-How-data-management-features-apply-to-Slack-Connect) --- # Company data price calculator: what each one assumes > A company data price calculator turns headcount and years into a range. Troveo and Handshake AI compared on inputs, outputs and ceilings. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/company-data-price-calculator Published: 2026-08-20 Updated: 2026-10-14 ## The short answer Calculators take headcount and years and return a range. The ranges run wide: for 100 staff and 10 years, Handshake AI shows $383,083 to $896,969. Neither inspects your systems or checks rights. Use one to start a conversation, nothing more. Calculators are how most buyers collect a lead. Here's what each one asks, what it returns and where it tops out. ## What do company data calculators ask for? Almost the same three things. Headcount, years of history, and in some cases country or region. [Troveo](/buyers/troveo)'s slider takes employees (20, 100, 250, 500 or 1,000+) and years of operation (under 3, 3 to 7, 8 to 15, 15+), and its text says value also scales with your systems. It prints a range on a $0 to $1M scale and defaults to $800K ([Troveo](https://www.troveo.ai/business-data)). [Handshake AI](/buyers/handshake-ai) takes headcount, years in operation and country ([Handshake AI](https://joinhandshake.com/ai/data-partnerships/)). ## What numbers come out? | Calculator | Example input | Output shown | |---|---|---| | Handshake AI | 100 staff, 10 years | $383,083 to $896,969 | | Troveo | Slider default | $800K, on a $0 to $1M scale | All figures are the buyers' own and unverified, and neither is a signed offer. ## Where do the ranges stop? Troveo's slider prints on a $0 to $1M scale and its top employee choice is 1,000+, so the picture stops at $1M whatever you enter. If any buyer's headline runs higher than its own calculator can print, that gap is the first thing I'd ask about. A calculator works from a few inputs. It cannot see your systems or confirm which records can be licensed, so a buyer's real proposal can land outside the range. ## Do buyers value data with a formula? Some do. Ryan Lock of [Polyshares](/buyers/polyshares) wrote that some buyers use headcount and size alone, and that Polyshares values on quality ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). That is a buyer's account, and it fits the caution above. ## What does the calculator leave out? Rights. Neither calculator asks whether your contracts, NDAs or employee rules allow licensing, and that question decides whether any figure applies. The [rights check](/rights-check) asks it first. Calculators like these usually sit in front of a lead form that asks for your name, email and company, because the range is how they collect your details. Our free [fit check](/business) returns a readiness score and, when your answers allow one, micro1's published range with its source. It is not a valuation. I'd treat any number you see, ours included, as an opener for a conversation and no offer. The [value guide](/guides/how-much-is-your-business-data-worth-to-ai) lists what moves the number, and [how much AI labs pay](/answers/how-much-do-ai-labs-pay-for-company-data) lists the public prices. Talk to a privacy or commercial lawyer in your state before you sign. Figure: range, Handshake AI estimate, 100 staff, 10 years, $383.1K to $897K. One calculator, one company, a top figure more than twice the bottom. Source: Handshake AI data partnerships estimator, self-reported. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [X article](https://x.com/RyanLockAI/status/2107864069105389717) --- # Datarade marketplace: how it works for data providers > The Datarade marketplace lists data products from 2,700+ providers and charges providers a commission, 30% in one dated source. Where it fits, what to ask. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/datarade-marketplace Published: 2026-08-20 Updated: 2026-10-14 ## The short answer The Datarade marketplace is a site where data providers list their data and buyers ask for samples and prices. It claims 2,700+ providers. Providers pay a cut. A ZoomInfo page says it is a flat 30%, so get the rate in writing. Datarade does not buy company records. [Datarade](/buyers/datarade) turns up in searches about selling data because it's one of the best-known general data marketplaces, and it calls itself number one. It sits in a different lane from the AI-lab buyers. ## What is the Datarade marketplace? Datarade, run by Monda Labs GmbH, calls itself a global data marketplace with 2,700+ providers. Its categories include financial data, B2B data, geospatial data, healthcare data and AI training datasets ([datarade.ai](https://datarade.ai/), self-reported). Its pitch to providers is reach. It advertises [120,000 monthly visitors](https://datarade.ai/). It was founded in Berlin in 2018. It raised about EUR 1 million in seed funding from HTGF in 2019 ([HTGF](https://www.htgf.de/en/berlin-based-startup-datarade-raises-e1m-seed-investment-from-htgf-to-help-companies-source-external-data-more-efficiently/)). G2 showed 4.5 of 5 from 21 reviews in 2026. ## What does a provider pay? [Datarade's homepage](https://datarade.ai/) says buyers use it free and that it is "paid by the provider" when a purchase is made. The rate is where sources split. A [ZoomInfo page](https://pipeline.zoominfo.com/sales/datarade-pricing) says Datarade charges a flat 30% commission on transactions. It adds that Monda's provider plans are quote-based with no public prices. An earlier version of the same page listed 30% on a free plan, 20% on a $6,000 yearly plan and 15% on a $12,000 yearly plan. Datarade's own pricing page returned a not-found error when we tried it. Figure: comparison of Two sources on Datarade's provider commission: Earlier ZoomInfo version (30, 20 or 15 percent), ZoomInfo, newer version (emphasized: The newer source, 30 percent flat). The newer ZoomInfo page says 30% flat. ## Does Datarade buy company data for AI labs? No. Datarade lists products and introduces buyers. Then the buyer and provider settle terms between them. We found no Datarade program aimed at a company's internal Slack, email or ticket archive. > **Datarade sells finished products off a shelf. It does not buy raw records.** It's a shop for tidy, labeled jars. The dusty boxes in your attic are a different kind of sale. ## Where does it fit a company with data? Datarade fits when you already package a dataset as a product. Think of a cleaned industry dataset, a company list or a feed. You write the listing, set the license and answer buyer requests. The commission comes out of the sale. If your asset is the working record of your company, do the [rights check](/rights-check) first. A listing puts your name on the sale, and the promises in [reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) apply to you. Programs for workplace records sit elsewhere. [micro1](/answers/what-is-micro1), [Mercor](/answers/mercor-data-licensing), [Handshake AI](/buyers/handshake-ai) and Troveo run them, and the [program directory](/buyers) compares them. _Yes, it calls itself number one. Ask for the rate in writing._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [datarade.ai](https://datarade.ai/) - [HTGF](https://www.htgf.de/en/berlin-based-startup-datarade-raises-e1m-seed-investment-from-htgf-to-help-companies-source-external-data-more-efficiently/) - [ZoomInfo page](https://pipeline.zoominfo.com/sales/datarade-pricing) micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) --- # micro1 data partnership payment timeline: the facts > The micro1 data partnership payment timeline: micro1's pages give no day count. A micro1 referral partner said about 60 days after engagement, self-reported. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-data-partnership-payment-timeline Published: 2026-08-20 Updated: 2026-10-14 ## The short answer The micro1 data partnership payment timeline has an order but no day count on its pages. In an undated recorded forum talk, micro1's David Revland said micro1 verifies delivered data, then pays. A referral partner said payouts arrive about 60 days after the company engages. It leaves engaged undefined. Payment is the last step of the [micro1 data partnership](/guides/micro1-data-partnership). The [seven-step process](/answers/micro1-data-partnership-process) shows the order. ## When does micro1 pay a data partner? After micro1 checks the data you delivered: transfer, then verification, then payment. That order comes from David Revland, who works on human data at micro1, in an undated recorded forum talk. micro1 has not said how long verification takes or what happens when data fails it. See our [verification page](/answers/data-verification-before-payment-ai) and [how much micro1 pays](/answers/how-much-does-micro1-pay-for-company-data). ## What did a micro1 referral partner say about the number of days? In a micro1 video, a micro1 referral partner was asked how many days until a company is paid. She said payouts typically arrive about 60 days after the company engages with micro1 (self-reported, about 2:54 in). She earns from referrals, and the video is promotional. It does not say what "engaged" means, such as a first call or a signed agreement. The same video says interested to finished takes two to three weeks, so "finished" most likely means data delivered and not yet paid (inferred). ## How do micro1 and the other companies describe timing? Each row is the company or its partner describing itself. | Company | What it says about timing | Terms page behind it | |---|---|---| | micro1 (David Revland, recorded forum talk) | Verifies delivered data, then pays. No day count. | Referral terms only | | micro1 (referral partner, video) | About 60 days after the company engages, "engaged" undefined | None, a partner's statement | | [Mercor](https://www.mercor.com/data/) | Wire on delivery of the anonymized dataset, typically 2 to 4 weeks after the signed agreement | None found for owners | Polyshares says it pays in 30 to 60 days after approval (its [terms page](https://polyshares.com/data-licensing)). That is a second 60-day figure, also self-reported. The clocks start at different events, so they do not compare directly. See [Mercor's data program](/answers/mercor-data-licensing). ## What should you ask micro1 to put in writing? - What event triggers payment: delivery, verification passing, or something else? - When does the clock start, and does "engaged" mean the first call or the signed contract? - How many days does verification take, and what happens if it fails? - Is payment one sum or in parts, and who pays any fees? The payment proposal and contract language arrive before the transfer, so the answers can sit in the contract. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Contract signed, data transferred -> micro1 verifies it -> Payment. micro1's David Revland said in an undated recorded forum talk that micro1 verifies the delivered data, then pays. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor](https://www.mercor.com/data/) - [terms page](https://polyshares.com/data-licensing) - [micro1 data partnerships](https://www.micro1.ai/data-partnerships) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Can I license HR or payroll records to AI? > Looking to sell HR or payroll records to AI? Leave them out of any license. Frankfurt Kurnit lists both as exclusions, and Spirit's union wanted that too. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-hr-or-payroll-records-to-ai Published: 2026-08-19 Updated: 2026-10-14 ## The short answer The law firm Frankfurt Kurnit (FKKS) says to leave them out. It lists HR files, payroll, health and benefits, and union communications as categories to exclude outright. The Justice Department's bulk-data thresholds count payroll and health data even if de-identified. Ask counsel how both apply to your records. HR records hold the most sensitive facts in a company. Every one is tied to a named person. ## What do lawyers recommend? [FKKS's memo](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) recommends leaving out these categories: - privileged material - HR and personnel files - payroll and tax records - health and benefits information - union-related communications - customer or partner confidential data It says sensitive content stays sensitive without a name attached. Examples are disciplinary matters and pay complaints. ## What did employees agree to? FKKS says most employee handbooks and privacy policies do not cover licensing data for AI training. It repeats the [FTC's warning](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) about quiet changes after the fact. So I would pull the handbook and monitoring notices as they read when each employee started. ## What happened at Spirit? The flight attendants' union says Spirit's Assets Schedule listed three groups as "Included" ([Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)): - 3,426,618 payroll records - 1,092,000 time card records - 175,658 employee records The union said nearly every consumer-facing category was marked "Not Included." Nearly every "Team Member" category was marked "Included." The union did not ask to unwind the auction. It asked the court to exclude flight attendant records. The other option it offered was an employee-confidentiality review with enforceable limits on onward transfer. See [employee emails](/answers/can-i-sell-employee-emails-to-ai). ## What does the Justice Department's data rule add? The DOJ Data Security Program ([28 CFR Part 202](https://www.ecfr.gov/current/title-28/chapter-I/part-202)) sets bulk thresholds. The line is more than 10,000 US persons for personal financial or health data. It is more than 100,000 for covered personal identifiers. Section 202.206 says the thresholds apply "regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted." The rule restricts data brokerage with countries of concern and covered persons. So an owner needs to know who owns the buyer. Whether your HR mail crosses a threshold is my reading of the rule. A lawyer has to confirm it. Talk to an employment lawyer in your state before you sign. The [rights check](/rights-check) asks about staff messages and personal data and flags both for counsel. Figure: comparison of Spirit's sale schedule, as the union read it: Consumer data (Nearly all out), Team member data (emphasized: Nearly all of it was in the sale, Nearly all in). The union objected because nearly all team member data was in the sale and nearly all consumer data was out. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [FKKS's memo](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [FTC's warning](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) - [Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) - [28 CFR Part 202](https://www.ecfr.gov/current/title-28/chapter-I/part-202) --- # Can I license employee emails to AI? > Searching how to sell employee emails to AI? You'd license them, and state law decides a lot. California treats email contents as sensitive data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-employee-emails-to-ai Published: 2026-08-18 Updated: 2026-10-14 ## The short answer It depends on location. California covers employee email since 2023 and counts it as sensitive unless you're the recipient. Virginia excludes employment context. The law firm Frankfurt Kurnit lists HR files, payroll, health and benefits, and union communications as categories to exclude outright. Ask counsel. Employee email carries four layers at once. They are privacy law, labor law, privilege and partner contracts. Here is what the primary sources say, one layer at a time. ## Does privacy law cover employee email? In California, yes. The [state attorney general's CCPA page](https://oag.ca.gov/privacy/ccpa) says the exemptions for employment-related and business-to-business information expired on 31 Dec 2022. So employee data has been covered since 1 Jan 2023. [The statute](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) lists "the contents of a consumer's mail, email, and text messages" as sensitive personal information. The one exception is when the business is the intended recipient. It is unclear how that applies to a company that holds employee threads with outsiders. I found no authority on the point. ## What about states outside California? [Virginia](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) defines a consumer to exclude a person acting in a commercial or employment context. It also counts a sale only when money changes hands. Other states differ. I'd check each state where your employees sit. ## What do federal law and contracts add? [Section 7 of the National Labor Relations Act](https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/interfering-with-employee-rights-section-7-8a1) protects employees' right to engage in concerted activity, which means acting together on work issues. Section 8(a)(1) bars employers from interfering with it. [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) notes that messages about pay and working conditions can fall inside it. The mailbox also holds privileged material. That is covered in [attorney-client privilege](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege). It holds partner NDAs too. Those are covered in [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai). HR and payroll threads have their own page: [HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai). For the archive as a whole, with buyers, exclusions and a sample mailbox inventory, see [licensing company emails to AI](/answers/sell-company-emails-to-ai). ## Has anyone been fined or sued for licensing employee email? I found no lawsuit, regulator action or NLRB charge over a company licensing its own employee email archive to an AI buyer. An empty search is no clearance. The closest event is the Spirit Airlines bankruptcy sale. The flight attendants' union filed a [limited objection](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) on 18 Aug 2026. The data set holds about 100 million emails. It asked the court to set aside flight attendant records. It also asked for a review of employee confidentiality. Talk to a privacy or commercial lawyer in your state before you sign. The [rights check](/rights-check) and [risks page](/risks) list the questions to bring. Figure: comparison of How three layers treat employee email: California CCPA (Covers employees), Virginia (Employment excluded), NLRA and contracts (emphasized: Apply where privacy law stops, Beyond privacy law). Contracts and the NLRA sit outside state privacy statutes, so they matter where those statutes stop. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [state attorney general's CCPA page](https://oag.ca.gov/privacy/ccpa) - [The statute](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [Virginia](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) - [Section 7 of the National Labor Relations Act](https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/interfering-with-employee-rights-section-7-8a1) - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [limited objection](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) --- # Data as an intangible asset accounting: the texts > Data as an intangible asset accounting: IAS 38 does not recognise self-made customer lists, and Treas. Reg. 1.197-2 names customer bases. US GAAP not read. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-as-an-intangible-asset-accounting Published: 2026-08-18 Updated: 2026-10-13 ## The short answer IAS 38 does not recognize self-made customer lists as intangible assets. Treasury Regulation 1.197-2 names customer information bases as intangibles but excludes those created by the taxpayer from amortization. This page reports text only, not tax or accounting advice. These texts treat data a company built for itself differently from data it bought. That split is the whole question. ## What does IAS 38 say about an intangible asset? IAS 38 is the international accounting standard for intangible assets. The [IFRS Foundation's page](https://www.ifrs.org/issued-standards/list-of-standards/ias-38-intangible-assets/) says it covers two kinds. One kind can be separated out. The other arises from contractual or other legal rights. The page says internally generated goodwill is not recognised as an asset. It says the same for these self-made items: brands, mastheads, publishing titles, customer lists and similar items. Development spending that meets set criteria can be recognised as an intangible asset. Research spending is not. It is expensed. I read the IFRS Foundation summary page. I skipped the full standard, which is sold. ## Does IAS 38 count a data corpus as a customer list? The IAS 38 wording names customer lists. It does not name a corpus of emails, tickets or chat. I found no source that puts such a corpus on either side of that line. Whether a given dataset counts as a similar item to a customer list is an accounting judgment. The company's auditor makes that call. ## What does the US tax regulation say? [Treasury Regulation 1.197-2(a)](https://www.law.cornell.edu/cfr/text/26/1.197-2) allows a deduction over 15 years. It applies to the capitalized cost of an amortizable section 197 intangible. Amortization means spreading that cost over the years. Paragraph (b)(4) defines an information base. It includes business books and records, operating systems and other information bases. The customer-related kind covers lists or other facts about current or future customers. As a rule, the regulation excludes a section 197 intangible that the taxpayer created. Three exceptions are named: - licenses, permits and governmental rights - covenants not to compete - franchises, trademarks and trade names ## Does it matter whether the data was bought or built? My reading is that it does. The IAS 38 wording speaks of internally generated items. The tax exclusion speaks of intangibles created by the taxpayer. No source I read applies either text to bought data. I did not research how bought data is treated. My [sale-in-acquisition page](/answers/sell-data-in-acquisition) covers the deal side. ## What does a company that licenses data out need to know? The texts above cover how a company records data it holds. Revenue from licensing it out is a separate question. My [revenue page](/answers/how-to-record-data-licensing-revenue) covers it. My [valuation page](/answers/data-valuation-for-ai) covers what buyers say data is worth. None of it is an accounting valuation. Talk to a tax professional about your own situation. Figure: comparison of Two texts read on customer lists as assets: IAS 38 (emphasized: Names customer lists directly, Self-made lists excluded), Treas. Reg. 1.197-2 (Information base named). IAS 38 bars recognising self-made customer lists, and Treas. Reg. 1.197-2 names customer information bases. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [IFRS Foundation's page](https://www.ifrs.org/issued-standards/list-of-standards/ias-38-intangible-assets/) - [Treasury Regulation 1.197-2(a)](https://www.law.cornell.edu/cfr/text/26/1.197-2) --- # How are you paid for company data? Three models > How are you paid for company data? A data partnership payment (micro1), a revenue share on every deal (Troveo) or a fee per task. Self-reported, dated. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-are-you-paid-for-company-data Published: 2026-08-18 Updated: 2026-10-13 ## The short answer Company data pays out under three models. A direct partnership pays under the agreed terms, and micro1's page lists tiers of $100K+ to $1M+. A revenue share pays on every deal. A per-task payment ran about $700 to $800, per micro1's CFO in an undated talk. All figures are self-reported. The three models differ in who carries the risk of a later sale and when the money arrives. ## How is a direct partnership structured? [micro1](/buyers/micro1) describes compensation under the agreed data partnership, and it says companies keep ownership of their underlying data. Confirm licensed uses, duration, exclusivity and payment structure in the proposed agreement. In an undated recorded forum talk, David Revland, who works on human data at micro1, described the corpus track as one transfer, then verification, then payment. Revland also raised a possible top-up about six months later for data created since the first transfer, with no amount or terms stated. See the [top-up page](/answers/micro1-data-top-up) and the [verification page](/answers/data-verification-before-payment-ai). [Mercor's page](https://www.mercor.com/data/) says it licenses the data, packages it and pays you: a wire on delivery, typically within 2 to 4 weeks of the signed agreement. ## How does a revenue share pay for company data? [Troveo's business data page](https://www.troveo.ai/business-data) says you are paid "on every sale, not just the first," and that the first sale is the floor. It does not publish the percentage. Our [Troveo revenue share page](/answers/troveo-revenue-share) lists what to ask about the split and the meaning of "net." ## How does micro1's per-task pay work? In micro1's workflows track, employees use a general-purpose AI agent on real work and grade it. micro1's CFO said in an undated recorded forum talk that a completed task pays about $700 to $800 and takes a couple of hours. The recording's captions read "seven to even $800," so the low end is unconfirmed. See the [workflows page](/answers/micro1-workflows-track). ## What else do buyers promise? [Handshake AI's page](https://joinhandshake.com/ai/data-partnerships/) gives an indicative range of $100K to $4M or more depending on the data shared, and says it is an estimate and not an offer. ## What should you ask about payment? - Is it one payment, repeat payments or per task? - When is it due, and what must happen first? - Who deducts what before the money reaches you? Talk to a privacy or commercial lawyer in your state before you sign. Our [deals page](/deals) tracks dated reports, and the [pricing page](/answers/data-monetization-pricing) compares the models. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three ways companies get paid for their data: Direct partnership (emphasized: Largest stated figure, Paid under the agreement), Revenue share (On every deal), Per task (Each task done). A direct partnership pays under its agreement, a revenue share pays on every deal, and a workflows task pays per task. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's page](https://www.mercor.com/data/) - [Troveo's business data page](https://www.troveo.ai/business-data) - [Handshake AI's page](https://joinhandshake.com/ai/data-partnerships/) --- # Can I license health or financial client data to AI? > Wondering if you can sell health or financial client data to AI? Licensing meets HIPAA and GLBA. HIPAA bars selling health information without authorization. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-health-or-financial-client-data-to-ai Published: 2026-08-17 Updated: 2026-10-14 ## The short answer Two federal rules apply. HIPAA bars selling protected health information without authorization. GLBA requires notice and an opt-out opportunity before disclosing financial data to third parties. A lawyer decides application to your clients. Neither rule mentions AI training. Wording written long before AI does all the work. Each rule turns on how the transfer is described, and on whether the right paperwork came first. HIPAA talks about a sale. GLBA talks about a disclosure. ## What does HIPAA say about licensing health data? The [sale rule](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) starts with a flat statement. A covered entity or business associate "may not sell protected health information" except as the authorization rule allows. A sale means a disclosure where the entity receives payment, directly or indirectly, from or on behalf of the recipient in exchange for the information. The listed exceptions are: - public health - research at a cost-based fee - treatment and payment - a sale or merger of the entity itself - work a business associate does on the entity's behalf A vendor that holds health information for a health-care client can be a business associate. The rule names business associates alongside covered entities. ## Does removing names make health data safe to license? HIPAA has its own de-identification test, and it asks for more than names. The safe harbor in [164.514(b)(2)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) lists 18 identifier types. They cover the person and also relatives, employers and household members. The list includes these: - geographic units smaller than a state - all date elements except the year - phone and fax numbers - email addresses - account numbers - device identifiers - URLs and IP addresses - biometric identifiers such as voice prints - full-face photos - any other unique identifying number, characteristic or code The entity must also have no actual knowledge that what remains could identify someone. A [law firm checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) published by Frankfurt Kurnit Klein and Selz lists health and benefits information among the categories to exclude outright. It does not rely on de-identification. ## What does the financial rule say? Regulation P, [12 CFR 1016.10](https://www.ecfr.gov/current/title-12/chapter-X/part-1016/section-1016.10), sets four conditions. They apply before a financial institution discloses nonpublic personal information to a nonaffiliated third party. - It must have given the initial notice. - It must have given an opt-out notice. - It must have allowed a reasonable time to opt out. - The consumer must not have opted out. The regulation's own mail example treats 30 days as reasonable. [Section 1016.11](https://www.ecfr.gov/current/title-12/chapter-X/part-1016/section-1016.11) limits what a recipient can do next. A recipient that got information under an exception may reuse it only within that exception. Whether your business counts as a financial institution is a legal question of its own. The definition reaches beyond banks. ## What can I gather before I talk to a lawyer? Facts speed up that conversation. I would write down which clients are health-care or financial firms. I would also list which systems hold their records, and which notices and agreements those clients signed with you. The [rights check](/rights-check) walks through those questions. The [risks page](/risks) lists where company-data sales have drawn fines. The [managed readiness service](/managed-readiness) assembles the same file and hands every legal call to your counsel. Figure: comparison of Two federal rules in front of client data: HIPAA (emphasized: Authorization before any sale, Authorization first), GLBA (Notice, then opt-out). HIPAA puts an authorization ahead of any sale, where GLBA asks for notice and a chance to opt out. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [sale rule](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) - [164.514(b)(2)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) - [law firm checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [12 CFR 1016.10](https://www.ecfr.gov/current/title-12/chapter-X/part-1016/section-1016.10) - [Section 1016.11](https://www.ecfr.gov/current/title-12/chapter-X/part-1016/section-1016.11) --- # License Asana data to AI: export, terms and programs > Googling how to sell Asana data to AI? Owners license it. Troveo names Asana, and Asana's terms bar training generative AI on customer data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-asana-data-to-ai Published: 2026-08-17 Updated: 2026-10-14 ## The short answer You export Asana projects and tasks as a trail of who did what and when, and Troveo names Asana among its tools. But Asana's terms bar training generative AI models on your data. Rights in task content stay separate from export terms. A task history shows an assignee, a due date and a series of notes. That is the shape of a workflow, and workflows are what several buyers say they want. ## Which companies name Asana? [Troveo](https://www.troveo.ai/business-data) lists Asana under work and knowledge. [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) lists project histories. In an undated recorded forum talk, [micro1](/buyers/micro1) said the manifest form asks about project management tools (date not stated, self-reported). Mercor's data page does not name Asana. See [what labs want](/answers/what-data-do-ai-labs-want-from-companies) for how each firm describes it. ## How does an Asana export work? [Asana's own CSV article](https://asana.com/inside-asana/export-to-csv) says to open Project Actions and choose Export, then CSV. The file carries task ID, created, completed and modified dates, name, assignee, due date, tags, notes, project name and the parent task for subtasks. A third-party guide, which says it checked Asana's documentation, reports that project exports come as CSV or JSON on any plan. It says a whole-organization export is JSON only and open to Enterprise+ super admins. Asana's help center did not render when I fetched it, so confirm the steps there. ## What do Asana's terms say? The [Asana Product-Specific Terms](https://asana.com/terms/asana-product-specific-terms) include an "Improving Asana AI" section. It says Asana does not use or permit third-party AI partners to use customer data to train generative AI models used to provide Asana AI. That covers Asana's use. It says nothing about what you may do with an export. ## What sits inside tasks? Task notes name colleagues, clients and vendors, and comments can quote customers. That is my reading of how teams use Asana. Rights follow your [customer contracts](/answers/do-customer-contracts-allow-selling-data) and any [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai). The [rights check](/rights-check) lists the questions for counsel. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Asana export scopes, by who can run them: Project CSV (Any plan), Project JSON (Any plan), Organization JSON (emphasized: Covers the whole organization, Enterprise+ admins). Only the organization export covers everything, and it is JSON for Enterprise+ super admins. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Asana's own CSV article](https://asana.com/inside-asana/export-to-csv) - [Asana Product-Specific Terms](https://asana.com/terms/asana-product-specific-terms) --- # License Confluence data to AI: Atlassian's terms > Want to sell Confluence data to AI? It's a license deal. Mercor names Confluence, and Atlassian says customers own their data. New settings apply 17 Aug 2026. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-confluence-data-to-ai Published: 2026-08-17 Updated: 2026-10-14 ## The short answer Export your Confluence spaces as a record of how work happens. Mercor names Confluence among tools it connects to. Atlassian's Customer Agreement says you own the data. Data contribution settings vary by plan: off by default on Premium and Enterprise, on by default for Free and Standard. Two Atlassian texts matter here. One says who owns the pages. The other says what Atlassian may do with them. ## Who names Confluence? [Mercor's page](https://www.mercor.com/data/) lists Confluence among nine named tools and says buyers can choose from "100+ supported tools". Troveo's page does not name Confluence. micro1 lists knowledge bases, internal documentation and project histories. See [licensing a company knowledge base to AI](/answers/sell-company-knowledge-base-to-ai). I found no price for Confluence content alone. ## What does Atlassian say about ownership? The [Atlassian Customer Agreement](https://www.atlassian.com/legal/customer-agreement) says the customer owns all intellectual property and other rights in Customer Data. The agreement contains no direct sentence about AI training. It sends AI features to separate AI Terms, which I did not read. ## What is Atlassian's data contribution setting? [Atlassian's support page](https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/) says it will use data according to the data contribution settings from 17 Aug 2026. It covers metadata and in-app data, and in-app data includes Confluence page content. Per that page: metadata is always contributed on Free, Standard and Premium, and Enterprise can change it. In-app data is on by default for Free and Standard and off by default for Premium and Enterprise, and any plan can adjust it. Settings can include or exclude specific apps and spaces. The [Register](https://www.theregister.com/2026/04/18/atlassians_new_data_collection_policy/) reported the same split, plus metadata retention of up to seven years and removal of opted-out data within 30 days. ## How do you export a Confluence Cloud space? A Space admin opens Space settings, then General, then [Export space](https://support.atlassian.com/confluence-cloud/docs/export-content-to-word-pdf-html-and-xml/), and picks PDF, CSV, HTML or XML. Only content visible to the exporter is included. PDF exports leave out blog posts and comments, HTML leaves out blog posts, and Team Calendars never export. ## What should you check first? Wiki pages hold staff words, customer names and pasted contract terms. The [rights check](/rights-check) asks whose records these are, and [licensing Jira data to AI](/answers/sell-jira-data-to-ai) covers the ticket side of the same vendor. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Atlassian in-app data contribution, by plan: Free and Standard (emphasized: In-app data on by default, On by default), Premium (Off by default), Enterprise (Off by default). Free and Standard are emphasized because in-app data contribution is on by default there and off by default on Premium and Enterprise. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's page](https://www.mercor.com/data/) - [Atlassian Customer Agreement](https://www.atlassian.com/legal/customer-agreement) - [Atlassian's support page](https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/) - [Register](https://www.theregister.com/2026/04/18/atlassians_new_data_collection_policy/) - [Export space](https://support.atlassian.com/confluence-cloud/docs/export-content-to-word-pdf-html-and-xml/) --- # What is synthetic data? > What is synthetic data? Data generated by an algorithm from real data. The UK ICO and Troveo definitions, and where synthetic data meets company records. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-synthetic-data Published: 2026-08-17 Updated: 2026-10-14 ## The short answer Synthetic data is made by an algorithm that copies patterns from real data. The UK ICO says a model trained on the original generates it. Whether it's anonymous depends on whether personal information can be inferred. The more it copies real data, the more useful and revealing it gets. The term shows up in AI training, privacy law and data licensing. I'm keeping each source's definition separate here. ## How is synthetic data made? The [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/privacy-enhancing-technologies/what-pets-are-there/synthetic-data) describes two kinds. Partially synthetic data swaps out some variables of the original, such as location and admission time in a hospital dataset. It keeps the rest. Fully synthetic data swaps out all of them. Either way, the generator needs real data first. So the original records are still processed once, even when the output holds none of them. ## Is synthetic data anonymous? The ICO says it depends on one thing. Can the personal information behind the synthetic set be inferred from the output? It adds that the more closely synthetic data mimics real data, the more useful it is. It is also more likely to reveal someone's details. The ICO also notes that judging re-identification risk for synthetic data is still a young field. Its guidance is under review after the Data (Use and Access) Act. This is UK guidance, so your state's law may differ. ## Where does synthetic data fit in AI training? [Troveo](/buyers/troveo)'s guide lists four situations: - edge cases - privacy-sensitive domains - labeling - balancing underrepresented classes It also names risks. One is model collapse, when models train heavily on model output. Another is a gap between generated and real-world texture. Troveo sells real data, so it argues from a vendor's seat. Our [real data vs synthetic data page](/answers/real-data-vs-synthetic-data-for-ai-agents) sets that against Epoch AI's review of environments. ## How does it connect to licensing company data? Epoch AI describes using environments to generate data for supervised training, with successful trajectories as examples ([Epoch AI](https://epoch.ai/gradient-updates/state-of-rl-envs)). Licensed company records can feed the same kind of generation. So a license can reach beyond the raw records. Ask whether it lets the buyer generate synthetic data from yours. Ask what the agreement says about that output. Our [RL environment page](/answers/what-is-an-rl-environment) shows one place such data gets used. Start with the [rights check](/rights-check), and talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Start with real data -> Train a model, generate records -> Check privacy and bias. The ICO says synthetic data comes from a model trained on real data, so it still needs privacy and bias checks. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/privacy-enhancing-technologies/what-pets-are-there/synthetic-data) - [Epoch AI](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # What data can I not license to AI? A category list > Wondering what data you can't sell to AI? Some never belongs in a license. Frankfurt Kurnit lists exclusions. HIPAA and FERPA cover health and school records. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-data-can-i-not-sell-to-ai Published: 2026-08-16 Updated: 2026-10-14 ## The short answer No single rule lists what data you can't license to AI. Daniel Goldberg, a partner at Frankfurt Kurnit, advises excluding privileged material, HR and payroll, health information, union communications and confidential client data. HIPAA bars covered entities from selling protected health information, and FERPA requires signed consent for student records. This page reports what the sources say. It isn't legal advice. ## Which categories do lawyers say to leave out? [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) advises companies to consider excluding: - privileged material - HR and personnel files - payroll and tax records - health and benefits information - union-related communications - customer and partner confidential information - licensed data - data from regulated systems It is the only law-firm checklist on this topic that I found. The same article makes a second point. De-identification addresses whether a record can be linked to a person. It says nothing about whether the content is confidential. So it doesn't rescue a category from the list. Our pages on [HR and payroll records](/answers/can-i-sell-hr-or-payroll-records-to-ai) and [privileged email](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) cover two of them in full. ## Which rules put text behind those categories? - **HIPAA.** [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502) says a covered entity or business associate may not sell protected health information. The exception is an authorization that meets 164.508(a)(4). A sale means a disclosure where the entity receives payment in exchange. - **Regulation P.** [12 CFR 1016.10(a)(1)](https://www.law.cornell.edu/cfr/text/12/1016.10) lets a financial institution disclose nonpublic personal information to a nonaffiliated third party only after four things. It must give an initial notice and an opt-out notice. It must allow a reasonable chance to opt out. And the person must not opt out. - **FERPA.** [34 CFR 99.30(a)](https://www.law.cornell.edu/cfr/text/34/99.30) requires signed, dated written consent before a school discloses personally identifiable information from education records, unless an exception applies. The [health and financial data page](/answers/can-i-sell-health-or-financial-client-data-to-ai) walks through the first two. ## What about other people's data in your archive? Email and chat hold other companies' confidential information, often under NDAs. Other data can carry competing ownership claims: - licensed data - open source and vendor code - third-party copyrighted material in attachments - data generated by vendor tools See [your NDA](/answers/does-my-nda-let-me-sell-data-to-ai), [shared Slack channels](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai) and [source code](/answers/can-i-sell-source-code-to-ai). ## Do recordings and EU staff data need separate care? Yes, each has its own page. A federal court let wiretap claims against [Otter.ai](https://uctoday.com/productivity-automation/otter-ai-fails-to-dismiss-core-privacy-claims-in-u-s-court/) go forward on 13 Aug 2026, as our [call recordings page](/answers/can-i-sell-call-recordings-to-ai) explains. [EU employee data](/answers/can-i-sell-eu-employee-data-to-ai) runs on different law. Our [rights check](/rights-check) asks about each category and lists what to settle with counsel. Your answers stay in your browser. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Three records on the do-not-license list: HR and payroll (Leave out), Health records (emphasized: Text bars sale without consent, Sale needs authorization), Bank clients (Opt-out first). HIPAA is filled because its text bars a sale of health information without authorization. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502) - [12 CFR 1016.10(a)(1)](https://www.law.cornell.edu/cfr/text/12/1016.10) - [34 CFR 99.30(a)](https://www.law.cornell.edu/cfr/text/34/99.30) - [Otter.ai](https://uctoday.com/productivity-automation/otter-ai-fails-to-dismiss-core-privacy-claims-in-u-s-court/) --- # What is a data asset? > What is a data asset? An accounting term with strict recognition rules, and a marketplace word for records a buyer can license. How the two differ. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-data-asset Published: 2026-08-15 Updated: 2026-10-14 ## The short answer A data asset has two meanings. In accounting, IAS 38 defines it as an identifiable non-monetary asset without physical substance, but internally generated customer lists aren't recognized. In AI data licensing, it means records you can license. Rights matter: who wrote each record and whose contracts cover it. Two jobs share these two words. Check which one a page means before you compare any figure. ## What does data asset mean in accounting? Under [IAS 38](https://www.ifrs.org/issued-standards/list-of-standards/ias-38-intangible-assets/), the international standard for intangible assets, an item has to be identifiable. It counts as identifiable when it is separable or arises from contractual or other legal rights. Recognition also needs two conditions. Future economic benefits must be probable, and the cost must be reliably measurable (IFRS Foundation). ## Does a data asset you built appear on the balance sheet? Often it doesn't. Paragraph 63 of IAS 38 says internally generated brands, mastheads, publishing titles, customer lists and similar items are not recognized as intangible assets. The standard's reason is that spending on those items can't be told apart from the cost of developing the business as a whole. That is the IFRS rule, so ask your accountant how your own books treat data. ## What do AI data buyers and marketplaces mean by a data asset? They mean records a buyer might license or acquire. [SimpleClosure](/buyers/simpleclosure)'s Asset Hub launched in Apr 2026 with source code live and workspace data (email, Slack, Notion, Google Drive) in beta, per its [release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html). See [SimpleClosure Asset Hub](/answers/simpleclosure-asset-hub). Buyer sites use the word loosely, for whatever records you hold that someone might pay for. Our entry on [operational data](/answers/what-is-operational-data) covers a neighboring term. ## What does an owner need before data counts as an asset in a deal? Rights. Who wrote each record, which contracts cover it and whose messages sit inside it all decide whether you can license it. The [rights check](/rights-check) lists those questions. An asset sale also moves ownership, which a license does not. [License versus sale](/answers/license-or-sell-company-data-to-ai) compares the two, and [selling data in an acquisition](/answers/sell-data-in-acquisition) covers the deal setting. ## How do you put a number on it? Our [valuation page](/answers/data-valuation-for-ai) shows what five companies' calculators count, and the free [fit check](/business) shows micro1's published range when your answers allow one. Every figure in this market is self-reported by the company that publishes it. We give no legal or accounting advice. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two uses of the phrase data asset: Accounting (Needs recognition), AI data licensing (emphasized: How marketplaces list owners, Records offered). Marketplaces use data asset to mean records a buyer can license, which is a different test from accounting recognition. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [IAS 38](https://www.ifrs.org/issued-standards/list-of-standards/ias-38-intangible-assets/) - [release](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) --- # What is a rights holder in AI licensing? > What is a rights holder in AI licensing? The party with authority to license data to an AI company. How Troveo, Protege and micro1 name that party. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-rights-holder-in-ai-licensing Published: 2026-08-15 Updated: 2026-10-13 ## The short answer A rights holder in AI licensing is the party with authority to license content or data to an AI company. Troveo describes a chain from creator to licensor to buyer. The hard part is who holds rights in each record: a mailbox mixes your writing with clients' material. Every AI data company and marketplace picks its own word for the rights holder. The legal question underneath stays the same. ## What do the companies call the rights holder? [Troveo's business page](https://www.troveo.ai/business-data) says "Paid to Licensors," and its glossary uses "rights holder" for the party who agrees to exclusivity. [Protege](https://withprotege.ai/) speaks of "data holders" and promises clear rights protections and provenance. [micro1](/buyers/micro1) calls accepted companies "Qualified Enterprise Data Partnerships" (all). The words differ, and each one points at whoever can grant the license. ## Who counts as the rights holder for company data? No single answer covers a whole archive. Our [who owns company emails](/answers/who-owns-company-emails) page splits it into three groups: what your company wrote, what you hold for customers and what partners or guests posted. The Spirit Airlines sale shows the split in practice. A software vendor, Springshot, argued that part of the archive was data generated by its software under its contract. An engine maker, International Aero Engines, pointed to confidentiality agreements ([The Next Web](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google)). ## Does a license move ownership? The sources say no. [Troveo](/buyers/troveo) says it licenses your data on your behalf and ownership never transfers. micro1 says companies [retain ownership](https://www.micro1.ai/data-partnerships) of their underlying data. Troveo's [deals guide](https://www.troveo.ai/resources/ai-data-licensing-deals) says the owner keeps the data and grants a defined right to use it. Both are self-reported. ## What does a buyer ask a rights holder to promise? [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data), a law firm, says a data provider should expect to give representations that it has sufficient rights to license the dataset, with indemnification for third-party claims. That promise is hard to give for a mailbox where the three groups mix. Our [reps and warranties page](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) lists what buyers ask. ## How do you find out which records you hold rights to? Start with the documents that bind you: customer contracts, NDAs, employee agreements and tool terms. The [rights check](/rights-check) asks about customer contracts, NDAs and staff policies, and the [risk map](/risks) shows where disputes have landed. We give no legal advice and never judge a specific contract. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Creator -> Licensor -> Buyer. In Troveo's chain of rights the licensor sits between creator and buyer and needs the authority to grant what it grants. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's business page](https://www.troveo.ai/business-data) - [Protege](https://withprotege.ai/) - [The Next Web](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google) - [retain ownership](https://www.micro1.ai/data-partnerships) - [deals guide](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) --- # GDPR and company data for AI training > GDPR company data AI training: the rules apply when an archive holds data on identifiable people. EDPB Opinion 28/2024 sets two tests. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/gdpr-company-data-ai-training Published: 2026-08-14 Updated: 2026-10-14 ## The short answer Article 4 covers any information about an identifiable person, and work emails and customer contacts hold it. The EDPB describes a three-step test for a buyer citing legitimate interest, and says a model trained on personal data may not be anonymous. Ask counsel how it reaches your archive. The GDPR says nothing about company archives or AI licensing. The opinion here is [Opinion 28/2024](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf) of the European Data Protection Board (EDPB). Below is what the text and the opinion say, and what a buyer is likely to ask. > **Personal data is any fact about a person you could identify.** Think of your archive as an attic. Some boxes hold your own things. Others hold letters from other people. The GDPR cares about the letters. ## Does the GDPR apply to company data? It applies to the personal data inside. A price list is outside the regulation. A thread between named colleagues and customers is inside it. [Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) says personal data is "any information relating to an identified or identifiable natural person." Territory is a separate question under [Article 3](https://gdpr-info.eu/art-3-gdpr/). The rules reach a company with an EU establishment. They also reach a company outside the EU that sells to people in the Union or monitors their behaviour there. Counsel settles it for any company with EU staff, customers or an EU establishment. ## What legal basis could cover an AI license? [Article 6](https://gdpr-info.eu/art-6-gdpr/) lists the legal bases. The EDPB opinion recalls that no basis ranks above another. For legitimate interest, it describes a three-step test. Name the interest. Test whether the processing is necessary for it. Balance it against the rights of the people involved. Reasonable expectations count in that balance. The opinion lists the relationship with the person, the context of collection and the source of the data as factors. It also says meeting transparency duties is not enough on its own to show people expect the processing. ## What does the opinion say about buyers of data or models? The opinion looks at one case. A different controller deploys a model that retains personal data. Regulators should check whether that controller made an appropriate assessment that the model was not built by unlawfully processing personal data. The assessment covers the source of the data and any finding of infringement. The opinion addresses AI models and not raw dataset licensing, so it applies to an owner by analogy. A buyer in a similar spot has reason to ask where the data came from and on what basis. Our [reps and warranties page](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) shows how public terms for owners phrase it. Figure: steps Find personal data, territory -> Legal basis, anonymity claims -> Counsel reviews. The GDPR questions for an archive run from personal data to territory, legal basis and anonymity. ## When is the data anonymous? For a model to count as anonymous, the opinion says two chances should both be insignificant. One is the chance of pulling out personal data directly. The other is the chance of getting it from queries. The test counts all the means reasonably likely to be used. That test is written for models. For a dataset, our [pseudonymization page](/answers/pseudonymization-vs-anonymization) covers the [UK ICO's position](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) that pseudonymised data stays personal data for anyone holding the additional information. _A nickname in place of a name is still a name to anyone who holds the key._ ## What about employee records and next steps? Employee records add national rules, covered on our [EU employee data page](/answers/can-i-sell-eu-employee-data-to-ai). Run the [rights check](/rights-check), which asks whether GDPR or UK GDPR data subjects are in the records. Read the [risks page](/risks) before a buyer call. Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Opinion 28/2024](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf) - [Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) - [Article 3](https://gdpr-info.eu/art-3-gdpr/) - [Article 6](https://gdpr-info.eu/art-6-gdpr/) - [UK ICO's position](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) --- # micro1 Google Drive data: how to check your size > micro1 Google Drive data: its pages set no data-size threshold, but a Drive count helps. Where an admin finds Drive storage in Google's report. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-google-drive-data Published: 2026-08-14 Updated: 2026-10-14 ## The short answer micro1's pages state no data-size threshold, but a Drive count helps you describe your records. To check your size, an admin can open the Admin console: Reporting, User Reports, Apps usage. It lists Drive storage in MB per user. One terabyte is about a million megabytes. The data manifest form in the [micro1 data partnership](/guides/micro1-data-partnership) asks for a rough size per tool. Drive is often the biggest one. ## Why does Drive size matter to micro1? In an undated forum talk, [micro1](/buyers/micro1) staff named about 1 TB across the corpus as an earlier figure. The current pages give no size threshold. See the [requirements page](/answers/micro1-data-partnership-requirements) for the current criteria. ## How does an admin find the Drive size? Google's help page for the Apps usage report gives the path: in the Admin console, open the menu, then Reporting, then User Reports, then Apps usage. The report lists "Drive storage used (MB)" for each user, described as megabytes consumed with Drive data ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/user-reports-apps-usage)). Google notes that some reports depend on your Workspace edition. ## How do you turn that into a total? Add the per-user figures. One terabyte is about a million megabytes, which gives you a sense of scale for the total. The manifest form wants rough sizes, so a rounded total is the right level of detail. Follow micro1's own instructions where they differ from this page. ## What is in a Drive total? Everything stored there, including files that are not the company's to license: client documents, personal files and shared folders. A big total says nothing about what you may license. Sort the contents by who owns them before you count. ## Does bigger mean a bigger payment? micro1 said the amount is set per deal and the [data page](https://www.micro1.ai/data-partnerships) ties its tiers to size, multi-team participation and uniqueness. See [what micro1 pays](/answers/how-much-does-micro1-pay-for-company-data). No outcome is promised. For the form itself, see [what a data manifest form is](/answers/what-is-a-data-manifest-form). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Admin console, Reporting, User Reports -> Open Apps usage -> Read Drive storage per user. Google's Apps usage report lists Drive storage used for each user in megabytes. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/user-reports-apps-usage) - [data page](https://www.micro1.ai/data-partnerships) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Can I license call recordings to AI? > Searching whether you can sell call recordings to AI? Recordings are the riskiest archive to license. The Otter.ai ruling and voiceprint law urge caution. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-call-recordings-to-ai Published: 2026-08-13 Updated: 2026-10-14 ## The short answer Recordings are the highest-risk archive category. A court let Wiretap Act, California privacy and Illinois biometric claims go forward against Otter.ai because training conversations for profit could be tortious. Spirit Airlines excluded 30.9 million recordings from its sale. Ask counsel before licensing. Recordings carry the voices of customers, partners and staff, and that's why I'd treat them as their own category. Three laws come up in the cases. ## What did the Otter.ai court decide? [In re Otter.AI Privacy Litigation](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) (N.D. Cal., Judge Eumi K. Lee, Dkt 68, 13 Aug 2026) denied most of Otter's motion to dismiss. On the Wiretap Act, the court said the one-party consent exception doesn't apply when an interception has a criminal or tortious purpose. The plaintiffs alleged Otter used conversation data to train its models "for its own pecuniary gain," and the court wrote that "committing a tort and seeking a profit are not mutually exclusive." The court also let a California Penal Code 631(a) claim go forward, treating Otter as a possible third-party eavesdropper. The case is at the pleading stage. ## What about voiceprints? The Illinois Biometric Information Privacy Act covers voiceprints. The court let the voiceprint claims go forward because plaintiffs alleged Otter captured and stored voiceprints to identify the same people in later meetings. BIPA sets [liquidated damages](https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57) of $1,000 for a negligent violation and $5,000 for an intentional or reckless one, or actual damages if greater. For the same person and the same method, the statute allows one recovery. ## What did Spirit do? Spirit's sale schedule lists call recordings, 30,865,471 of them, as "Not Included" ([Doc 1463](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1463.0.pdf)). The [flight attendants' union](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) pointed out that nearly every consumer-facing category was excluded while employee records were included. ## Does a company's own call archive face the same claims? I found no holding either way. The Otter reasoning is the analogy a plaintiff would reach for. That's my inference and no ruling. Talk to a privacy or commercial lawyer in your state before you sign. The [rights check](/rights-check) asks about personal data and customer contracts and lists what to settle with counsel. Figure: scale, Illinois BIPA damages per violation: Negligent violation $1,000, Intentional or reckless $5,000 (emphasized). Illinois charges five times more when a violation is intentional or reckless. Source: 740 ILCS 14/20, Illinois General Assembly. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [In re Otter.AI Privacy Litigation](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) - [liquidated damages](https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57) - [Doc 1463](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1463.0.pdf) - [flight attendants' union](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) --- # Data broker commission: what it costs your company > Data broker commission, from the owner's side: which fees come out of your proceeds, which the buyer pays, and what to get in writing first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-broker-commission Published: 2026-08-13 Updated: 2026-10-13 ## The short answer It depends who pays the broker. A marketplace or success-fee adviser takes a cut of your proceeds. Datarade reportedly takes 30% of marketplace sales. A finder paid by the buyer costs you nothing directly but has a reason to steer you. Get every fee in writing. Before you agree to anything, ask one question of every intermediary: who pays you, and out of whose money? The answer tells you what the deal costs you and whose side the intermediary is on. People search for "data broker" when they mean an AI data company, but legally a data broker resells consumer data and must register in some states. This site calls AI data companies buyers. ## Which fees come out of your proceeds? Two kinds of intermediary are paid from the money you receive. **A marketplace takes a cut of the deal.** A ZoomInfo pricing page says data providers on [Datarade](/buyers/datarade)'s Monda platform pay a 30% commission on marketplace-facilitated transactions, with quote-based annual plans on top ([ZoomInfo](https://pipeline.zoominfo.com/sales/datarade-pricing)). An earlier summary reported 30%, 20% and 15% by plan. The sources conflict, so check Datarade's current terms. Datarade lists data products for enterprises and buys no company archives. **An adviser on a success fee takes a share of what you receive.** Get the rate in writing, along with the base it applies to and whether it's due only when you're paid. [What a data licensing advisor does](/answers/data-licensing-advisor) lists the conflict questions. A buyer's revenue split is a different thing. [Troveo](/buyers/troveo) says it pays you "on every sale, not just the first" and publishes no split ([Troveo](https://www.troveo.ai/business-data)). Ask for the split in writing before you compare it with a commission. ## Which fees does the buyer pay? Some intermediaries are paid by the buyer, so nothing comes out of your price. **Some buyers charge you nothing.** [Polyshares](/buyers/polyshares) says the company pays "no fee and no commission" because it buys the data itself rather than acting for you ([Polyshares](https://polyshares.com/data-licensing)). That's its own statement. **A finder may be paid by the buyer.** A finder introduces you to a buyer and never handles your data. Several data companies publish referral programs for introductions, usually paid once a deal closes or the data is accepted. You don't pay that fee, but it gives the finder a reason to steer you to the buyer that pays and to push for a close. The FTC's Endorsement Guides ask for a paid connection behind an endorsement to be disclosed clearly ([16 CFR 255.5](https://www.law.cornell.edu/cfr/text/16/255.5)). A private introduction may fall outside them, so ask directly. ## Should you pay a finder fee yourself? The finder programs I read are paid by the buyer, so a finder who also asks you for a fee is asking to be paid twice. If you agree to one anyway, put the rate, the base, the trigger and what happens if the deal unwinds in writing before the introduction. "Finder's fee" also has a meaning in securities law, where paying for introductions can raise broker registration questions. The SEC proposed a conditional exemption for certain finders on 7 Oct 2020 ([Sidley](https://www.sidley.com/en/insights/newsupdates/2020/10/sec-proposes-exemptive-order-for-certain-activities-of-finders)), and I could not confirm it was adopted. A plain data license is a different transaction. A deal that includes equity changes the picture, so take that one to counsel. ## Why does the percentage alone mislead? Each one applies to a different base. Datarade's 30% comes out of a sale made through its marketplace. An adviser's success fee comes out of what you receive. A finder's fee from the buyer sits outside your price. A low percentage on a big base can cost more than a high one on a small base. ## What should you ask before you agree? 1. Who pays you, and how much? 2. Is the fee a percentage, and of what: the gross price, net sales or the buyer's own fee? 3. Is any of it due if the deal fails or unwinds? 4. Do you work for me or for the buyer? 5. Will you send my files to anyone? An introduction needs a description, never your records. Before any introduction, run the [rights check](/rights-check) on your own records. The [pricing models page](/answers/data-monetization-pricing) explains how deals pay, and [what a value-add data broker does](/answers/what-does-a-value-add-data-broker-do) covers the work a broker should do for its fee. We facilitate introductions and we aren't lawyers. If you need a lawyer or accountant who knows this, we can point you to one. Figure: steps Ask who pays them -> Ask what it is a share of -> Get it in writing. Who pays the intermediary, and from which pocket, decides what it costs you. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [ZoomInfo](https://pipeline.zoominfo.com/sales/datarade-pricing) - [Troveo](https://www.troveo.ai/business-data) - [Polyshares](https://polyshares.com/data-licensing) - [16 CFR 255.5](https://www.law.cornell.edu/cfr/text/16/255.5) - [Sidley](https://www.sidley.com/en/insights/newsupdates/2020/10/sec-proposes-exemptive-order-for-certain-activities-of-finders) --- # License meeting transcripts to AI: what we could verify > Trying to sell meeting transcripts to AI? For licensing, no buyer we read names transcripts. What Teams stores, its export API and the consent setting. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-meeting-transcripts-to-ai Published: 2026-08-13 Updated: 2026-10-14 ## The short answer Export meeting transcripts as records of decisions to license them to AI. No buyer we read names transcripts. Troveo lists Zoom under chat. On Microsoft Teams, the export API lists transcript links, about 300 KB each. Participant consent and the Otter.ai ruling are the legal questions. [Microsoft's averages](https://learn.microsoft.com/en-us/microsoftteams/export-teams-content) put a transcript at about 300 KB and a recording at about 350 MB for a 30 to 60 minute meeting. A transcript also names every speaker, which matters more than the file size. ## Does any buyer name transcripts? Not in the pages I read. [Troveo](https://www.troveo.ai/business-data) lists Zoom under chat and messaging. That's as close as any source gets, and it's a marketplace's self-description. Our page on [sales call recordings](/answers/sell-sales-call-recordings-to-ai) covers that side. ## Where does Teams keep a transcript? [Microsoft says](https://learn.microsoft.com/en-us/MicrosoftTeams/meeting-recording) a Teams meeting recording is saved to the organizer's OneDrive for private meetings, or to SharePoint for channel meetings. Channel recordings and transcripts go to a Recordings folder in the channel's SharePoint site. Purview and normal file permissions apply to the recording files. ## How does the export API return one? Microsoft's Teams Export APIs return transcript links for scheduled online meetings where a named user is the organizer. The API supports private scheduled meetings only. Transcripts come as VTT by default, or DOCX with an Accept header. An app needs the OnlineMeetingTranscript.Read.All application permission, which only an administrator can approve (Microsoft Learn). ## What does the consent setting do? `ExplicitRecordingConsent` can require participants to agree before a meeting is recorded or transcribed. [Microsoft also says](https://learn.microsoft.com/en-us/microsoftteams/tmr-meeting-recording-change) that when organizers turn off Copilot in Teams meetings, recording and transcription turn off too. ## What are the legal questions? Participants include customers, partners and staff, so [what counts as PII](/answers/what-counts-as-pii-in-company-data) applies to speaker names. The [Otter.ai order](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) is summarized on [can I license call recordings to AI](/answers/can-i-sell-call-recordings-to-ai). [Licensing Teams data to AI](/answers/sell-microsoft-teams-data-to-ai) covers chats. The [rights check](/rights-check) asks about personal data and staff messages in the records. Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Organizer's meeting is transcribed -> Export API lists links by organizer -> Each link downloads one transcript. Microsoft's export returns transcript links by meeting organizer, and each link downloads one transcript. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Microsoft's averages](https://learn.microsoft.com/en-us/microsoftteams/export-teams-content) - [Troveo](https://www.troveo.ai/business-data) - [Microsoft says](https://learn.microsoft.com/en-us/MicrosoftTeams/meeting-recording) - [Microsoft also says](https://learn.microsoft.com/en-us/microsoftteams/tmr-meeting-recording-change) - [Otter.ai order](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) --- # micro1 English data requirement: what its pages say > The micro1 English data requirement: its pages ask for companies that operate primarily in English. They give no percentage. An earlier forum talk named one. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-english-data-requirement Published: 2026-08-12 Updated: 2026-10-14 ## The short answer micro1's pages ask for companies that operate primarily in English, with English documentation and workflows. They give no percentage. An undated micro1 forum talk named about 80%, which is historical context. I found nothing on how micro1 measures the share. Language is one of several criteria in the [micro1 data partnership](/guides/micro1-data-partnership). The [requirements page](/answers/micro1-data-partnership-requirements) lists the rest. ## What does micro1 say about language? The [data partnerships page](https://www.micro1.ai/data-partnerships) describes companies that operate in English and maintain their documentation, workflows and knowledge bases in English. The [referral page](https://www.micro1.ai/company-referral) says "primarily English". Neither page gives a percentage. In an undated recorded forum talk, David Revland, who works on human data at micro1, gave an earlier figure of about 80% or more in English. Treat that as history and go by the pages. ## How does micro1 count "primarily English"? I don't know. Nothing I read says whether the share is counted by volume, by file count or by message. Ask micro1 on the first call. ## Which records does the language rule cover? The data page names SOPs, knowledge bases, internal documentation, CRM data, project histories and QA processes as the kinds of data it seeks. Whether the share counts every message or only documents like these is not stated. ## What if your records mix languages? Work out the rough split in your main tools before you apply. The [data manifest form](/answers/what-is-a-data-manifest-form) asks for tools and rough sizes, so a language estimate per tool fits naturally beside it. If you sit near the line, ask micro1 how it counts and keep the reply in writing. ## Will the language rule change? micro1's David Revland said in the undated talk that other languages may come later. He gave no date and no list. The current pages still say primarily English, so plan around that. ## Does language interact with the other criteria? Yes, in the sense that all of them apply together. micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. See the [minimum employees page](/answers/micro1-data-partnership-minimum-employees) for the staff side. Run the [rights check](/rights-check) before applying, since a language fit says nothing about whether you may license the records. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of micro1 language criteria, by source: micro1 pages (emphasized: The current written criteria, Primarily English), Undated micro1 forum talk (About 80%, historical). micro1's pages are the current source, and they give no percentage. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [referral page](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Are data brokers legal? A state-by-state map > Are data brokers legal? Yes, and six states regulate them through registration and fines. A dated map of the state laws and what regulators have done. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/are-data-brokers-legal Published: 2026-08-11 Updated: 2026-10-14 ## The short answer Yes, data brokers are legal. Six states now regulate them. California, Vermont, Oregon and Texas run registries, and Connecticut and New Jersey enacted laws in 2026. California fined Datamasters $45,000 and S&P Global $62,600 for registration failures. Some sales are barred, such as bulk data to countries of concern. Each of the six state laws is a registration law with its own definition, deadline and penalty. The California fines below all cite failures to register. Legally, a "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers. It keeps "data broker" for that legal term. ## Which states regulate data brokers? [California](https://cppa.ca.gov/data_broker_registry/), Vermont, Oregon and Texas run registries today. Two more states have signed laws: - Connecticut [signed in May 2026](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260731-connecticut-amends-its-data-privacy-act-to-increase-data-protections). Brokers must register with the Department of Consumer Protection by 1 January 2027. - New Jersey [signed in June 2026](https://www.faegredrinker.com/en/insights/publications/2026/7/new-jersey-enacts-sweeping-data-broker-and-data-collector-registration-law). It plans to open its registry in spring 2027. The states define a broker in different ways. Most focus on a business that sells data about people it has no direct tie to. [Vermont](/answers/vermont-data-broker-law) and [Texas](/answers/texas-data-broker-law) have their own pages. ## What have regulators done about data brokers? California's privacy agency announced a Data Broker Enforcement Strike Force on 19 November 2025. Its [8 January 2026 actions](https://cppa.ca.gov/announcements/2026/20260108.html) hit two firms for failing to register as brokers. Its [11 August 2026 action against LocateSmarter](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/) came next. It was the first against a broker under both the CCPA and the Delete Act. In [June 2024, Texas told more than 100 companies](https://www.conroetoday.com/npps/story.cfm?nppage=10354) they had apparently failed to register. It [sued Allstate and Arity in January 2025](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250121-texas-ag-brings-first-ever-lawsuit-under-a-state-comprehensive-privacy-law). The complaint includes a failure-to-register allegation. I haven't confirmed how that case ended. ## Is selling any kind of data barred? Yes, in narrow cases. The Justice Department's rule at [28 CFR 202.301](https://www.law.cornell.edu/cfr/text/28/202.301) bars a US person from knowingly engaging in data brokerage with a country of concern or a covered person. HIPAA bars selling protected health information [without authorization](https://www.law.cornell.edu/cfr/text/45/164.502). The [bulk data page](/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data) and the [health and financial data page](/answers/can-i-sell-health-or-financial-client-data-to-ai) cover each. ## Does a company licensing its own data count? The state definitions mostly turn on direct relationships. On the text, a company licensing only its own staff and customer data may sit outside those definitions. Mixed archives are less clear. No authority decides it. The [register or not page](/answers/do-i-need-to-register-as-a-data-broker-to-sell-my-own-data) goes through the tests. Figure: scale, States with a data broker registry law: Registries today 4 states, With Connecticut and New Jersey 6 states (emphasized). Four states run a broker registry today, and Connecticut and New Jersey bring the count to six. Source: State statutes and WilmerHale summaries. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [California](https://cppa.ca.gov/data_broker_registry/) - [signed in May 2026](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260731-connecticut-amends-its-data-privacy-act-to-increase-data-protections) - [signed in June 2026](https://www.faegredrinker.com/en/insights/publications/2026/7/new-jersey-enacts-sweeping-data-broker-and-data-collector-registration-law) - [8 January 2026 actions](https://cppa.ca.gov/announcements/2026/20260108.html) - [11 August 2026 action against LocateSmarter](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/) - [June 2024, Texas told more than 100 companies](https://www.conroetoday.com/npps/story.cfm?nppage=10354) - [sued Allstate and Arity in January 2025](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250121-texas-ag-brings-first-ever-lawsuit-under-a-state-comprehensive-privacy-law) - [28 CFR 202.301](https://www.law.cornell.edu/cfr/text/28/202.301) - [without authorization](https://www.law.cornell.edu/cfr/text/45/164.502) --- # California data broker registration: does it apply? > California data broker registration covers businesses that sell personal data of people they have no direct relationship with. What the law says. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/california-data-broker-registration Published: 2026-08-11 Updated: 2026-10-14 ## The short answer California data broker registration applies to a business that knowingly collects and sells personal data about people it has no direct relationship with. Brokers register each January. Missing it costs $200 a day plus fees. Whether your own email or CRM archive counts depends on whose data it holds. A "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers and keeps "data broker" for the legal term. ## What does the definition say? The Delete Act defines a data broker as a business that "knowingly collects and sells" the personal information of a consumer it has no direct relationship with. The sale must be to third parties. Some groups are excluded. Examples are those covered by the federal Fair Credit Reporting Act and the Gramm-Leach-Bliley Act ([statute text](https://cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20260101.pdf)). Registration runs through the California Privacy Protection Agency, which goes by CalPrivacy. The registration window is 1 to 31 January each year. ## What counts as a direct relationship? A consumer has one when they intentionally interact with a business in the past three years. They do it to get information about, use or buy its products or services. A business with a direct relationship can still be a data broker. That holds for personal information it sells but did not collect straight from that consumer ([regulation text, section 7601](https://www.cppa.ca.gov/regulations/pdf/20241226_dbr_final.pdf)). ## Could licensing your own archive trigger registration? Maybe, if the archive is mixed. Your customers and employees plausibly have a direct relationship with you. An email archive also holds messages from vendor staff, prospects and people who never used your product. A CRM may hold imported or enriched lists. The statute and the regulation do not say whether those people count. I found no guidance or enforcement on archive sales. That is my reading of the text, not legal advice. The answer for your records belongs to a lawyer. ## What happens to brokers that skip registration? **$200 a day** Fine for each day a broker fails to register, plus the fees due CalPrivacy's Data Broker Enforcement Strike Force settled with Rickenbacher Data (Datamasters) for $45,000 and S&P Global for $62,600 in Jan 2026. Both cases were about failing to register. On 11 Aug 2026 it fined LocateSmarter $116,490. That was its first action under both the CCPA and the Delete Act ([CalPrivacy](https://cppa.ca.gov/announcements/2026/20260108.html), [CalPrivacy](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/)). _Put 1 to 31 January in your calendar. Brokers who forget pay by the day._ ## Why does the form ask about AI? The registration form asks if the broker shared or sold consumer data to a generative AI developer in the past year. The statute defines that developer as an entity that designs, codes, produces or substantially modifies such a system. ## What about deletion requests? From 1 Aug 2026, brokers must check the state's deletion mechanism at least once every 45 days. They must process requests within 45 days. A consumer files one request to reach every registered data broker. ## Do other states have rules? Yes. Vermont, Texas, Oregon and others run their own regimes. Definitions and penalties differ. I'd read each statute for the states you operate in. My [data broker glossary entry](/answers/what-is-a-data-broker) explains the two meanings of the term. The [risk map](/risks) lists the other exposures in a data deal. Have a privacy lawyer in your state read this before you act. They like that. Figure: steps Collects and sells personal data -> About people with no relationship -> Registers by 31 January. California's definition of a data broker leads to registration by 31 January. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [statute text](https://cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20260101.pdf) - [regulation text, section 7601](https://www.cppa.ca.gov/regulations/pdf/20241226_dbr_final.pdf) - [CalPrivacy](https://cppa.ca.gov/announcements/2026/20260108.html) - [CalPrivacy](https://privacy.ca.gov/2026/08/calprivacy-brings-first-action-against-a-data-broker-under-both-the-ccpa-and-delete-act/) --- # Data broker companies: consumer brokers and AI buyers > Data broker companies fall into two groups: consumer brokers that sell people profiles, and AI buyers and marketplaces for company records. Names in each. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-broker-companies Published: 2026-08-11 Updated: 2026-10-13 ## The short answer Data broker companies fall into two groups. Consumer data brokers sell profiles of people. The FTC's 2014 study named nine. AI data companies are newer. They license, place or take company records such as emails, tickets and CRM history, through marketplaces, referral programs and direct data partnerships. The same two words describe two different businesses. Mixing them up sends owners to the wrong pages and the wrong laws. A "data broker" resells consumer data and must register in some states. AI data companies work with company records, which is a different business under different laws. > **Consumer brokers sell facts about people. AI buyers want records of how work gets done.** One sells the phone book. The other borrows the how-to shelf at the library. ## What is a consumer data broker? California's privacy agency says a data broker "collects personal information about consumers from various sources and sells that information to other companies" ([CPPA registry page](https://cppa.ca.gov/data_broker_registry/)). The Delete Act covers a business that sells personal information about people it has no direct relationship with. The FTC's May 2014 study looked at nine data brokers ([FTC](https://www.ftc.gov/news-events/news/press-releases/2014/05/ftc-recommends-congress-require-data-broker-industry-be-more-transparent-give-consumers-greater)). They were Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf and Recorded Future. Their product is information about people. Buyers use it for marketing, identity checks and fraud detection. California residents have been able to file one deletion request to every registered data broker through its DROP platform. Brokers must process those requests from 1 Aug 2026 (same CPPA page). ## What are AI data companies? People sometimes call these companies AI data brokers. They license company data, place it with AI labs or run data partnerships with companies. The labs want records of real work. A support ticket or a finance report request would count. A marketplace or referral front end sits between you and them. Here are two that sit between you and the labs, from our review of this market. All terms are self-reported unless noted. - **Troveo:** marketplace that added business data in 2026, with a revenue share and an unpublished split. - **SimpleClosure Asset Hub:** shutdown service that sold nearly 100 startups' data at $10,000 to $100,000. micro1, Handshake AI and Mercor deal with companies directly. Our [buyer directory](/buyers) covers each one the same way. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two kinds of data company: Consumer data brokers (People profiles), AI data buyers (emphasized: They deal in company records, Company records). AI data buyers deal in company records, while consumer data brokers sell people profiles. ## Why does the difference matter to a company owner? Your records hold people's words. Consumer privacy law reaches you even though you are not a consumer data broker. California treats a transfer of personal information for money or other valuable consideration as a sale. The exception is data that meets the statute's deidentified test (Civ. Code 1798.140). _Buyer or broker, the label on the door does not change your rights questions. The paperwork does._ Run the [rights check](/rights-check) and read the [risk map](/risks). Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [CPPA registry page](https://cppa.ca.gov/data_broker_registry/) - [FTC](https://www.ftc.gov/news-events/news/press-releases/2014/05/ftc-recommends-congress-require-data-broker-industry-be-more-transparent-give-consumers-greater) --- # Is Troveo legit? An evidence table > Is Troveo legit? An evidence table on founders, funding, payout totals, revenue share, buyers and terms pages, and our plain read. Self-reported By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-troveo-legit Published: 2026-08-11 Updated: 2026-10-14 ## The short answer Troveo has a named CEO, Marty Pesis, a $4.5M seed round and a release saying it has paid over $20M to content owners. Its pages give two payout totals. Its revenue share is unpublished. Real company, real funding on record. Get the revenue share in writing first. ## Is Troveo legit? Troveo is a real company with a named CEO, a funding round on record and payouts it reports itself. Its revenue share is unpublished and its terms page returned 404, so get the split and the terms in writing before you sign. ## What can be checked about Troveo? [Troveo](/buyers/troveo) started with video and audio licensing and added business data in 2026, so some totals cover work other than business data. | Check | What I found | |---|---| | Entity named | The business-data page footer reads "Troveo 2026" and names no legal entity. | | People named | Marty Pesis, founder and CEO, and Trent Krupp, chief revenue officer ([NetInfluencer](https://www.netinfluencer.com/troveo-launch-content-license-ai-reddit-zynga-founders/)). | | Funding | $4.5M seed led by Seven Seven Six, with angels including Mark Pincus ([NetInfluencer](https://www.netinfluencer.com/troveo-launch-content-license-ai-reddit-zynga-founders/)). | | Terms and privacy | troveo.ai/terms and troveo.ai/privacy returned 404. The footer links a privacy policy and support hub. Ask for the owner agreement. | | Totals it claims | "$20M+" on the [business-data page](https://www.troveo.ai/business-data) and in a [release](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html), "$50M+" on the [content-owners page](https://www.troveo.ai/content-owners) with no date. | | Revenue share | You "share in the revenue" on each sale, with no upfront fees. The split is not published. | | Buyers | "Frontier AI lab," "AI startup" and "Mag 7 company." No named buyers. | | Privacy claim | Names, contact details, credentials and client identities are scrubbed "under one documented standard." The standard is not published, so it cannot be checked. | | Reviews | Its Trustpilot page is unclaimed with no reviews. I found no lawsuit. | ## How big are the payout claims? The $20M+ figure covers all of Troveo's licensing, which includes many video and audio rights holders, not only business-data owners. Its content-owners page says "$50M+" and shows no date. The pages I read do not reconcile the two. Its guide states "typical deals start at six figures" for full company data and cites reporting on unnamed shutdown platforms for about $5,000 per repository and $10,000 to $100,000 per startup archive ([Troveo guide](https://www.troveo.ai/resources/how-much-is-company-data-worth)). The six-figure line is Troveo's own claim. ## How does Troveo describe its process? Figure: steps Scope and agree -> Package -> Get paid. Troveo's process runs from scoping the data to getting paid. ## What should you ask before sharing anything? Request the owner agreement and the written scrubbing standard. Ask what share of each sale you keep, who the buyer category is and whether exclusivity applies. Troveo says [exclusivity is time-limited and has to be earned](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license). Our [rights check](/rights-check) and [risk map](/risks) list what to confirm on your side. Talk to a privacy or commercial lawyer in your state before you sign. For how buyers compare, see [how to choose an AI data broker](/guides/how-to-choose-an-ai-data-broker). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [NetInfluencer](https://www.netinfluencer.com/troveo-launch-content-license-ai-reddit-zynga-founders/) - [business-data page](https://www.troveo.ai/business-data) - [release](https://finance.yahoo.com/sectors/technology/articles/troveo-accelerates-ai-model-development-130500935.html) - [content-owners page](https://www.troveo.ai/content-owners) - [Troveo guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [exclusivity is time-limited and has to be earned](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - [Troveo: AI data licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) --- # License AI training data? Start with your company records > Looking to sell AI training data? A company licenses the records it already keeps: email, chat, tickets and CRM. Who takes them, on what terms. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-ai-training-data Published: 2026-08-10 Updated: 2026-10-14 ## The short answer To license AI training data as a company, start with the records you already keep: email, chat, tickets, CRM history and documents. micro1 and Handshake AI run company-data programs with stated payment ranges, and Troveo licenses records as a marketplace. Check your rights to the records before any call. Search this phrase and you get pages about photo licensing, gig work and phone apps. For a business, the training data is the records it already keeps. ## Which company records count as AI training data? Email, chat, tickets, CRM history, documents and code from a working business. [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) lists tiers of $100K+, $500K+ and $1M+ for companies with 30 or more employees, and [Troveo's business page](https://www.troveo.ai/business-data) runs a four-step process that starts with a directional valuation range and needs no access to your systems. Both are self-reported. My guide to [where to license company data](/answers/where-to-sell-company-data) compares four routes, and the [buyer directory](/buyers) lists each buyer with its published terms. ## Which firms take company records? [Handshake AI](/buyers/handshake-ai) and [Mercor](/buyers/mercor) run company-data programs alongside micro1. The [Handshake AI evidence page](/answers/is-handshake-ai-legit) and [Mercor evidence page](/answers/is-mercor-legit) show what is checkable on each. Expert-labor platforms such as Outlier sell contractors' work to labs. As far as I found, none of them takes a company's archive. ## How do I know if my records are worth licensing? Ask what you can hand over and whether you have the right to. A business with years of records and a legal right to license them has something to offer. Run the [rights check](/rights-check) before any call, and read [how to license business data to AI](/answers/sell-business-data-to-ai) next. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two ways a company earns from its records: Direct programs (emphasized: Prices stated up front, Stated payment ranges), Marketplaces (Share of each deal). Direct programs state payment ranges up front, while a marketplace pays a share of each deal. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Troveo's business page](https://www.troveo.ai/business-data) --- # What is data exhaust? > What is data exhaust? The trail of data left as a by-product of activity. Forbes used a nearby phrase for startup Slack and Jira archives. The evidence is thin. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-data-exhaust Published: 2026-08-10 Updated: 2026-10-14 ## The short answer Data exhaust is data left as a by-product of online activity, behavior and transactions. Cookies, log files and clickstream records are examples. In AI deals, Forbes said labs treat startup Slack archives as premium training data. Evidence is thin, with no public price for log files alone. The phrase comes from data analysis and now turns up in AI licensing talk. The two uses overlap only partly. ## What counts as data exhaust? [Wikipedia's](https://en.wikipedia.org/wiki/Data_exhaust) example is a bank. The transaction amount and the parties are the primary data. Whether the transaction happened at a cash machine or a branch is secondary. That is the exhaust. Medical devices are another example in the entry. Pacemakers, dialysis machines and surgical cameras generate exhaust data while they run. It is typically discarded once a procedure ends. Per the same entry, companies combine and study exhaust to improve products, personalize content and spot trends. ## Is data exhaust the same as operational data? They overlap. AI buyers use "operational data" to mean the record of work: chat, tickets, email and documents. Exhaust is the by-product of using a system. A Slack message is work. The log of who opened which channel is exhaust. Our page on [operational data](/answers/what-is-operational-data) covers the buyer's meaning. ## Do AI labs buy data exhaust? The evidence is thin. [Forbes' report](https://www.forbes.com/sites/annatong/2026/04/16/ais-new-training-data-your-old-work-slacks-and-emails/), summarized in its own post on X, said labs treat startup Slack, Jira and email archives as premium training data. [Gizmodo's](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) report names workplace data, including documents, workflows and internal communications. It reports payouts of $10,000 to $100,000 per company. I found no published price or named buyer for log files or clickstream records alone. ## Is there a privacy issue? Wikipedia cites Shoshana Zuboff (2015). She describes turning behavioral data into predictive products as surveillance capitalism. Exhaust about people can still be personal information. An owner should ask counsel before any license. Our [rights check](/rights-check) lists the ownership questions. The [risk map](/risks) lists the privacy ones. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Primary data and exhaust in a bank transaction: Primary data (Amount and parties), Exhaust (emphasized: The by-product of a transaction, Cash machine or branch). Exhaust is emphasized because it is the by-product, such as whether a transaction happened at a cash machine rather than a branch. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Wikipedia's](https://en.wikipedia.org/wiki/Data_exhaust) - [Forbes' report](https://www.forbes.com/sites/annatong/2026/04/16/ais-new-training-data-your-old-work-slacks-and-emails/) - [Gizmodo's](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) --- # License Notion data to AI: export, terms and buyers > Trying to sell Notion data to AI? Owners license it. Troveo and Mercor name Notion, exports take up to 30 hours, and Notion trains no models on it by default. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-notion-data-to-ai Published: 2026-08-09 Updated: 2026-10-14 ## The short answer A workspace owner exports the files to license Notion data to AI. Troveo and Mercor list Notion as a tool buyers want. By default, Notion doesn't train on customer data. Check rights first, since workspaces often hold pages written for clients. No published price exists for Notion data. A Notion workspace holds specs, meeting notes and databases in one place. Troveo files it under work and knowledge tools. ## Which companies name Notion? [Troveo](https://www.troveo.ai/business-data) lists Notion under work and knowledge, next to Jira, Linear and Asana. [Mercor](https://www.mercor.com/data/) names Notion beside Slack, Confluence and GitHub. [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) lists knowledge bases and internal documentation without naming Notion. All three statements are the companies' own (self-reported). I found no price for Notion alone, and [what labs pay](/answers/how-much-do-ai-labs-pay-for-company-data) shows what the companies do publish. ## How does a Notion export work? [Notion's help page](https://www.notion.com/help/export-your-content) covers exporting a whole workspace as HTML, Markdown or CSV, plus uploaded files. It says exports can take up to 30 hours to process, depending on workspace size, and the download link expires after 7 days. On Enterprise, organization owners can schedule recurring exports through the Admin APIs. I found no Notion page that reports total workspace size, so the finished export is the measure. Buyers ask about volume early, and [the 1 TB question](/answers/does-my-company-have-1-tb-of-data) explains why. ## What does Notion say about training? [Notion's AI security page](https://www.notion.com/help/notion-ai-security-practices) says that by default Notion and its AI subprocessors do not use customer data to train any models. It adds that Notion has contracts with those subprocessors that bar training on customer data. That sentence describes Notion's own use. Licensing is a different act, and it turns on who holds rights in the pages. I didn't read Notion's terms of service on ownership, so this page makes no claim about it. ## What needs a rights check before an export leaves? Workspaces often hold pages written for clients and shared with contractors or guests. That's my reading of how teams use Notion, not a Notion statement. Client pages, signed-NDA material and personal data about staff or customers each carry a separate question. Our [rights check](/rights-check) asks whose records these are, and [what you cannot license](/answers/what-data-can-i-not-sell-to-ai) lists the categories lawyers tell owners to leave out. [Internal documents](/answers/sell-internal-documents-to-ai) covers what buyers say about wikis and SOPs. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Owner starts the export -> Processing takes up to 30 hours -> Link issued, expires after 7 days. A Notion workspace export can take up to 30 hours, and its download link expires after 7 days. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Mercor](https://www.mercor.com/data/) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Notion's help page](https://www.notion.com/help/export-your-content) - [Notion's AI security page](https://www.notion.com/help/notion-ai-security-practices) --- # micro1 data partnership minimum employees: 30 or more > micro1 data partnership minimum employees: its current pages say 30 or more. An earlier, undated forum talk said 20. What to do if you sit below 30. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-data-partnership-minimum-employees Published: 2026-08-09 Updated: 2026-10-14 ## The short answer micro1's current pages say 30 or more employees, with mature operations. An undated micro1 forum talk named an earlier figure of 20 full-time. Below 30, you sit under the published criteria, so confirm any exception directly with micro1. Several numbers circulate, and they come from different places. micro1's pages are the current source. This page keeps the others apart as history. ## Where does each number come from? All of these are [micro1](/buyers/micro1) or its partner describing itself. | Source | Number stated | Date stated | |---|---|---| | micro1 staff, undated recorded forum talk (no public link) | Earlier figure: 20 full-time employees | Not stated, historical | | [Data partnerships page](https://www.micro1.ai/data-partnerships) | 30+ employees | Undated | | [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) | 30+ employees | Undated | | [Enterprise Data Partnership post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) | 30 to 200 employees | Undated post | | Referral partner in micro1 video | About 25 to 30, then 30 plus, then at least 30 (captions uncertain) | Video undated, about 4:19 to 15:08 | ## Why do they differ? Neither source explains the gap. The recording has no date and its captions are automatic. The pages are what micro1 publishes now, so they govern on this site. The undated talk is history. The undated Enterprise Data Partnership post asks for 30 to 200 employees. micro1's main pages say 30+ with no upper limit. If you have more than 200 employees, confirm with micro1 which program fits you before you rely on either page. ## What if you have fewer than 30 employees? You sit below micro1's published floor. Acceptance depends on its review and current demand, so confirm any exception directly with micro1 and keep the answer in writing. A short note to a data partnership manager is enough. Other programs set lower floors or none. Each one, with its source, is in [every program's stated size and history minimum](/answers/ai-data-program-minimums). Have your headcount ready, and ask whether contractors and part-time staff count. The [requirements page](/answers/micro1-data-partnership-requirements) lists the other criteria you will be asked about, and [how micro1's data partnership works](/guides/micro1-data-partnership) shows what follows. ## What else counts besides headcount? The pages also ask for mature operations and primarily English documentation, with US companies prioritized. They state no data-size threshold. The undated forum talk named earlier figures for size and language, which are history. A company that meets the criteria still goes through micro1's evaluation. [micro1's process](/answers/micro1-data-partnership-process) shows where the evaluation sits. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Count staff against micro1's 30+ -> Below 30, ask micro1 about exceptions -> Keep the reply in writing. micro1's pages say 30 or more, so a smaller company confirms any exception in writing first. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Data partnerships page](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [Enterprise Data Partnership post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # License data in acquisition: AI buyers and diligence > Searching how to sell data in an acquisition? An AI license is another deal. California's merger exception covers a buyer taking control. What diligence asks. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-data-in-acquisition Published: 2026-08-08 Updated: 2026-10-14 ## The short answer List the data among the business assets. California's merger exception covers transfers where the buyer takes control of the business. An AI lab license leaves control with you, so the exception may not apply. Diligence will ask for prior data licenses, so keep the records. Data shows up in an acquisition in two ways. It goes with the business, or it was licensed to someone else before the deal. ## What does the merger exception cover? The [statute's text](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) says the business transfers a consumer's personal information as an asset in a transaction where the third party assumes control of all or part of the business. It adds a condition: the information must be used or shared consistently with the statute. If the buyer materially changes how it uses the data in a way that departs from the promises made at collection, it must give prior notice. The same subparagraph says it does not authorize material, retroactive privacy policy changes. My [CCPA page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) walks through the sale definition around it. ## Does licensing data to an AI lab fit the exception? On the text, a lab that licenses data does not take over the owner's business. That makes the license a separate question from the acquisition, which is my reading and not a holding. Whether the transfer in a given deal falls inside the exception is for counsel. ## What does diligence ask? [Frankfurt Kurnit's memo](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) says a prior data license will come up in diligence and buyers will expect to see the decision record. It also tells owners to review customer, partner, vendor and data license agreements first. A license granted without that review is the version an acquirer will question. Keep counsel's notes with the deal file, and run the [rights check](/rights-check) before a buyer call. How an existing license meets the LOI, the reps and warranties and the data room is in [licensing company data before an acquisition](/answers/license-company-data-before-selling-your-business). ## Do AI buyers approach acquired startups? Yes, per [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d). Mercor approached the AI startup Warmly eight days after its HubSpot acquisition announcement, with multiple solicitations that the founder declined. Offers for such datasets were reported up to $300,000. ## Will my M&A adviser be paid by anyone else? Ask your adviser in writing who pays them, how much and when, before they introduce you to anyone. An adviser can be paid by you and also by the firm or buyer they bring in. A written answer shows you whose interests each piece of advice serves. Talk to a corporate or privacy lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Inventory data, counsel review -> Decision record, diligence request -> Buyer takes the asset. A data license around an acquisition runs from an inventory to the buyer's diligence request, with a decision record in between. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [statute's text](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [Frankfurt Kurnit's memo](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) --- # License nonprofit data to AI: what the tax code says > Looking to sell nonprofit data to AI? For licensing, no company we read names them. 26 U.S.C. 513(h) covers donor-list swaps between qualifying organizations. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-nonprofit-data-to-ai Published: 2026-08-08 Updated: 2026-10-14 ## The short answer No company we read lists nonprofits. Tax code section 513(h) covers exchanging or renting donor names to another qualifying organization only, so a deal with a company is outside that text. Section 512(b)(2) excludes royalties from unrelated business taxable income. A tax professional applies the rules. This page reports what the statutes and buyer pages say. It isn't legal or tax advice. ## Does any company ask for nonprofit data? Not by name, on the pages I read. [micro1](https://www.micro1.ai/data-partnerships) lists six areas and [Mercor](https://www.mercor.com/data/) lists eight sectors. [Troveo's page](https://www.troveo.ai/business-data) names tools and no sector. That's a negative finding. No page I read rules out a nonprofit's operating records, and none invites them. Our [industry page](/answers/does-industry-matter-for-selling-company-data) shows what each names. ## What does the tax code say about donor lists? [26 U.S.C. 513(h)(1)](https://www.law.cornell.edu/uscode/text/26/513) applies to an organization described in section 501 with contributions deductible under section 170(c)(2) or (3). For such an organization, the term "unrelated trade or business" does not include a business that consists of exchanging with another such organization the names and addresses of its donors or members, or renting those names and addresses to another such organization. Both activities in the text run between qualifying organizations. The text I read doesn't mention a sale or license to a company. ## What does it say about royalties? [26 U.S.C. 512(b)(2)](https://www.law.cornell.edu/uscode/text/26/512) says unrelated business taxable income excludes "all royalties" measured by production or by gross or taxable income from the property, with the deductions directly connected to them. Whether a payment for a data license is a royalty isn't answered there. Our [tax page](/answers/is-data-licensing-income-taxable) lists what IRS texts say about royalties. ## What about donor expectations and state law? I didn't read the Donor Bill of Rights, because the Association of Fundraising Professionals' page blocked my fetch. I also didn't check whether the CCPA reaches a given nonprofit, or any state charity regulator's rules. Those are questions for counsel. The customer-data rules on our [consent page](/answers/do-i-need-consent-to-sell-customer-data-for-ai-training) and [CCPA page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) explain the notice question for customer records, and donor records raise the same one. ## What can a nonprofit gather first? List which records name donors, members or beneficiaries, what each was told when they gave, and which grant or vendor agreements limit use. The [rights check](/rights-check) asks the contract and personal-data questions and lists what to settle with counsel. Talk to a privacy or commercial lawyer in your state, and to a tax professional about your own situation, before you sign. Figure: comparison of What 26 U.S.C. 513(h) says about donor lists: Exchange (With a qualifying group), Rental (To a qualifying group), Sale to a company (emphasized: Not named in the text, Not in the text). Section 513(h)(1) names exchange and rental between qualifying organizations, and a sale to a company is not in its text. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1](https://www.micro1.ai/data-partnerships) - [Mercor](https://www.mercor.com/data/) - [Troveo's page](https://www.troveo.ai/business-data) - [26 U.S.C. 513(h)(1)](https://www.law.cornell.edu/uscode/text/26/513) - [26 U.S.C. 512(b)(2)](https://www.law.cornell.edu/uscode/text/26/512) micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) --- # Company data inventory template you can copy > A company data inventory template for an AI data deal: tool, admin, size, years, language and rights notes. Built from micro1's data manifest form description. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/company-data-inventory-template Published: 2026-08-07 Updated: 2026-10-14 ## The short answer An inventory needs one row per tool: tool, admin, rough size, years, language, rights note. micro1's David Revland described a manifest form in an undated forum talk that asks which services you use and rough sizes. Use this template and update it when a program sends its actual form. The goal is a sheet you can finish in an afternoon and hand to a buyer, a marketplace or your lawyer. It's a spreadsheet, and it's the least glamorous step in the whole process. ## What goes in each column? | Tool | Admin | Rough size | Years | Main language | Rights note | |---|---|---|---|---|---| | Google Workspace (example row) | Name of the admin | GB, from the Apps usage report | Oldest to newest year | English share, roughly | Who owns the files, any client terms | | Slack (example row) | Name of the owner | Ask the buyer how it sizes chat | Oldest to newest year | English share, roughly | Shared channels, notices to staff | Copy this line into a spreadsheet as the header row: ``` Tool,Admin,Rough size (GB),First year,Last year,Main language,English share (%),Rights note ``` [micro1](/buyers/micro1)'s David Revland, who works on human data, gave Google Workspace, Slack, project management tools and GitHub as examples of tools the manifest asks about, in an undated recorded forum talk. ## Where do the sizes come from? - **Google Drive:** in the Admin console, Reporting, User Reports, Apps usage shows "Drive storage used (MB)" per user. Google says the user reports for Drive leave out shared drives ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/user-reports-apps-usage)). - **SharePoint and OneDrive:** the Microsoft 365 admin center, Reports, Usage, has a [SharePoint site usage report](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/sharepoint-site-usage-ww?view=o365-worldwide) and a [OneDrive usage report](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww?view=o365-worldwide), both with "Storage used (MB)" (Microsoft Learn). - **Slack:** the export help page says who can export and which conversations each plan covers, and it gives no size figure ([Slack help](https://slack.com/help/articles/201658943-Export-your-workspace-data)). The [storage page](/answers/does-my-company-have-1-tb-of-data) turns these into a total, and the [Drive page](/answers/micro1-google-drive-data) goes deeper on Google. ## What do years and language add? micro1 asks about language, and the calculators from Troveo and Handshake AI ask about years. micro1's pages ask for primarily English documentation and give no percentage. History length gets its own column because those calculators weigh how far back each tool goes. My [years page](/answers/how-many-years-of-data-do-ai-labs-want) and [English page](/answers/micro1-english-data-requirement) carry the sources. ## Does a ready inventory speed up a valuation? Polyshares says so. Ryan Lock, a managing partner at Polyshares, wrote that a missing inventory is a common snag before a valuation ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). He asks owners to list each tool, the years they can export from it, and the total size in TB, messages or another unit. He also says a long history may earn less credit than it seems. In his example, a company that switched between Slack, WhatsApp and Discord over ten years got full credit for the last two. That is one buyer's account of its own method, so add a note for each tool switch and the date of the move. ## What belongs in the rights note? Record facts only: who created the files, whether clients or partners appear in them, which contracts cover them and which notices staff received. The [rights check](/rights-check) asks about the contracts and staff messages behind those facts, and the [readiness checklist](/answers/data-readiness-checklist) shows how the sheet fits. The [managed readiness service](/managed-readiness) can fill it in with you and never touches your data. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps List tools, name each admin -> Note sizes, years and language -> Write rights notes. The inventory sheet runs from your tools to rights notes, which come last. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/user-reports-apps-usage) - [SharePoint site usage report](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/sharepoint-site-usage-ww?view=o365-worldwide) - [OneDrive usage report](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww?view=o365-worldwide) - [Slack help](https://slack.com/help/articles/201658943-Export-your-workspace-data) - [X article](https://x.com/RyanLockAI/status/2107864069105389717) --- # Does licensing emails to AI waive privilege? > Asking if selling emails to AI waives privilege? A license discloses them, and third-party disclosure generally waives it. A 2026 ruling cited provider terms. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/does-selling-emails-to-ai-waive-attorney-client-privilege Published: 2026-08-06 Updated: 2026-10-14 ## The short answer The risk is real. The privilege belongs to the company, and voluntary disclosure to a third party generally waives it. In United States v. Heppner, Judge Rakoff held that chats with a consumer AI tool were not privileged, partly because the provider's policy allowed training. Spirit Airlines excluded privileged materials. Email archives hold legal advice, and licensing puts that advice in someone else's hands. The question is whether it stays protected. ## Who controls the privilege? The company does. In [CFTC v. Weintraub](https://www.law.cornell.edu/supremecourt/text/471/343) (1985) the Supreme Court said the power to waive a corporation's attorney-client privilege rests with its management. In bankruptcy, the trustee holds it. On that rule, waiver sits with your company's management. Ask counsel whether licensing the archive would count as one. ## Does disclosure to a buyer waive privilege? The general rule is that voluntary disclosure of privileged communications to a third party waives the privilege. The common-interest exception protects sharing among parties with a shared legal interest. Some courts, New York's among them, look for a litigation context. A buyer's commercial interest may not qualify. I did not find authority on a data buyer specifically. ## What did the Heppner ruling say? Judge Rakoff held, as [Manatt summarizes](https://www.manatt.com/insights/newsletters/client-alert/clicking-ask-ai-can-nix-privilege-court-warns), that chats between a defendant and a consumer Claude account were not privileged. His reasoning leaned on the provider's privacy policy. That policy allowed training on user data and disclosure to third parties. So the user had no reasonable expectation of confidentiality. He suggested enterprise tools that do not train on inputs might be treated differently. That case involved a person using a chatbot, not a licensing deal. My reading is that a buyer who trains on purchased email sits on the same side of the line as that provider. ## What did Spirit do? Its sale agreement excludes "Privileged Materials." Suppose some slip through by mistake. The agreement says the transfer does not cost the seller the protection. The buyer must return or destroy them when notified ([Doc 1463](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1463.0.pdf)). Talk to a lawyer who handles privilege in your state before you sign. Our [rights check](/rights-check) asks whether privileged material is in the records and flags it for counsel. [HR records](/answers/can-i-sell-hr-or-payroll-records-to-ai) are the next category to review. Figure: steps Company holds the privilege -> Emails disclosed to a buyer -> Waiver risk follows. A voluntary disclosure to a commercial buyer is the step that puts privilege at risk. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [CFTC v. Weintraub](https://www.law.cornell.edu/supremecourt/text/471/343) - [Manatt summarizes](https://www.manatt.com/insights/newsletters/client-alert/clicking-ask-ai-can-nix-privilege-court-warns) - [Doc 1463](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1463.0.pdf) --- # Is Polyshares legit? What the public record shows > Is Polyshares legit? A named company with two named partners and public terms. We found no outside review or named lab customer. The evidence. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-polyshares-legit Published: 2026-08-06 Updated: 2026-10-14 ## The short answer Polyshares names a company, Polyshares, Inc., and two managing partners. It licenses company data for a set scope and term, says you keep the data, and charges companies no fee. Its terms are public. We found no outside review, so check the points below first. Polyshares licenses company data to AI labs. Its homepage headline says "We buy your company's operational data", but its own pages say "A license is not a sale" and "You keep the business and the underlying data." This page lists what is public about it, and what is not. ## What is the bottom line? Polyshares looks like a real, named company with public terms. We found no outside review, court record or named lab customer. Every claim below comes from Polyshares itself. ## What does the evidence show? | Item | What the sources show | Source | |---|---|---| | Entity | Polyshares, Inc. | [polyshares.com](https://polyshares.com/) | | People | Two managing partners are named: Nathan Mathews and Ryan Lock | polyshares.com | | Model | Licenses Slack, email, CRM, ticket and file data for a defined scope and term, exclusive by default. You keep the data. Says it is the only counterparty, and buyers see de-identified listings in a buyer portal | polyshares.com, [terms page](https://polyshares.com/data-licensing), [data handling](https://polyshares.com/data-handling) | | Fee to the owner | Says "No fee, no commission. We pay you." Paid per license | polyshares.com | | Payment | Net 30 to 60, once data is approved, shared and anonymized | [Terms page](https://polyshares.com/data-licensing) | | Privacy | It says a specialist partner removes names, emails and phone numbers. Two Polyshares people can see an unmasked record | [Data handling](https://polyshares.com/data-handling) | | Buyers of the data | Does not say which labs take which data | Terms page | | Outside proof | No review, filing or customer named in what we read | Our check | _A page that says "trust us" is a start. A page a stranger can check is better._ ## Where do its statements differ? Ryan Lock wrote an [X article](https://x.com/RyanLockAI/status/2107864069105389717). He says third-party firms do the de-identification, so Polyshares never touches raw files. The data handling page says two people at Polyshares can see an unmasked record. They may describe different stages. Ask which one applies to you. Its [homepage](https://polyshares.com/) says "No marketplace, no listing." Its [data handling page](https://polyshares.com/data-handling) says buyers see de-identified listings in a buyer portal, under a code instead of your name. The article also says over 100 brokers work with Polyshares. The site names no broker program. ## What should you ask before you share data? - Who sees unmasked records, and at what step? - Which buyers can see your listing in the buyer portal? - Who is the anonymization partner? - What does the license allow, and for how long? - Which labs can receive the data? The same questions fit any buyer. See [is micro1 legit](/answers/is-micro1-legit) for a comparison. For the risks, read [is it safe to license company data to AI](/answers/is-it-safe-to-sell-company-data-to-ai). The [Polyshares directory record](/buyers/polyshares) lists the fields side by side. Figure: comparison of What is public about Polyshares: Its own pages (emphasized: This is what you can read today, Terms and data handling), Outside proof (None found). Polyshares publishes its terms, and we found no outside review to check them against. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [polyshares.com](https://polyshares.com/) - [terms page](https://polyshares.com/data-licensing) - [data handling](https://polyshares.com/data-handling) - [X article](https://x.com/RyanLockAI/status/2107864069105389717) - [Polyshares case studies](https://polyshares.com/track-record) --- # License Google Drive data to AI: size, rights, value > Googling how to sell Google Drive data to AI? A license starts with your Drive storage count. Troveo ranks the files buyers value. Google's terms set the route. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-google-drive-data-to-ai Published: 2026-08-05 Updated: 2026-10-14 ## The short answer To license Google Drive data to AI, start with size and contents. A storage count helps you describe your records to a buyer. Troveo says buyers value SOPs, runbooks, proposals and specs most. Google's terms say you keep your rights. Rights inside each file and export route need review. Drive is where a company's documents and sheets live. In [micro1](/buyers/micro1)'s account of its data partnerships, those are the deliverable half of a request-to-report chain. ## Does Drive size matter to micro1? In [micro1](/buyers/micro1)'s account, Drive documents and sheets are the deliverable half of a request-to-report chain. micro1's pages state no data-size threshold. A Drive total still helps you describe your records, and micro1's data manifest form is where you report the size. My [manifest form page](/answers/what-is-a-data-manifest-form) shows the step. ## Which Drive files does Troveo say labs value? [Troveo's guide](https://www.troveo.ai/resources/license-company-docs-to-ai) sorts folders by what they show a model. SOPs, runbooks, proposals, specs and postmortems rank as worth licensing. Client deliverables depend on your client contracts. Marketing PDFs add nothing a model cannot already find. HR, payroll and medical folders hold nothing you may license, in [Troveo](/buyers/troveo)'s words, and come out first. The same guide says folder structure and version history carry value, because a draft, its revisions and its follow-up show how work moved. Troveo is a licensing marketplace, so treat the ranking as its view. ## What do Google's terms say? [Google's Workspace terms of service](https://workspace.google.com/terms/premier_terms/) say in section 5.1 that the customer retains all intellectual property rights in customer data. [Google's Workspace API user data policy](https://developers.google.com/workspace/workspace-api-user-data-developer-policy) bars apps that use Google's APIs from transferring or selling user data to data brokers and from using it to train AI models beyond a user's own. My reading is that a service connecting to Drive through the APIs is the developer that policy addresses. I found no text on an administrator's own export, so counsel should read both documents. The [Slack export page](/answers/does-slack-allow-ai-companies-to-use-my-exported-data) shows the same question for another tool. ## What else sits in a shared Drive? Files that clients and partners shared with you can carry their confidentiality terms. My [NDA page](/answers/does-my-nda-let-me-sell-data-to-ai) covers that, and [internal documents](/answers/sell-internal-documents-to-ai) covers the sorting. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three kinds of Drive folder, as Troveo rates them: SOPs and runbooks (emphasized: Troveo rates them most valuable, Among the most valuable), Client deliverables (Contract decides), HR and payroll (Nothing to license). Troveo rates SOPs and runbooks among the most valuable Drive files, and client deliverables depend on contracts. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's guide](https://www.troveo.ai/resources/license-company-docs-to-ai) - [Google's Workspace terms of service](https://workspace.google.com/terms/premier_terms/) - [Google's Workspace API user data policy](https://developers.google.com/workspace/workspace-api-user-data-developer-policy) --- # SimpleClosure alternatives for a closing startup > SimpleClosure alternatives: Sunset, a retired Carta service, the BuyMyDeadStartup listing board and direct programs. What each is and what I could verify. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/simpleclosure-alternatives Published: 2026-08-05 Updated: 2026-10-14 ## The short answer SimpleClosure alternatives for a closing startup are few. Sunset is a wind-down service, but I could not verify its terms. Carta launched a shutdown service in February 2024 and retired it in December 2024. BuyMyDeadStartup is a free listing board where buyers contact you directly. [SimpleClosure](/buyers/simpleclosure) does two jobs. It handles the legal and administrative work of winding down, and its Asset Hub sells source code and workspace data. This page covers what else exists for the second job. For its own evidence, see [is SimpleClosure legit](/answers/is-simpleclosure-legit). ## What is Sunset? Sunset is a startup wind-down service. Its [Trustpilot profile](https://www.trustpilot.com/review/sunsethq.com) says it helps venture-backed startups wind down while helping founders monetize company data to offset costs, pay down liabilities and, in some cases, return capital. Trustpilot showed 4.7 of 5 from 35 reviews, and the reviews concern the wind-down work. Sunset's own site returned a bot-check page to me and the Fast Company article about it returned 403, so I could not verify its data-sale terms, fees or payouts. Figure: comparison of What each SimpleClosure alternative is: Sunset (Wind-down service), BuyMyDeadStartup (emphasized: No commission, holds no data, Listing board), Carta service (Retired in 2024). BuyMyDeadStartup is a listing board that says it takes no commission and holds no data. ## What happened to Carta's shutdown service? Carta launched Carta Conclusions in February 2024 and retired it in December 2024. A Carta spokesperson told TechCrunch it "made more sense to invest and partner" with a focused team, and Carta joined SimpleClosure's $15M Series A ([TechCrunch](https://techcrunch.com/2025/05/07/carta-abandons-startup-shutdown-business-instead-backs-simpleclosures-15m-series-a/)). Carta is now an investor in SimpleClosure, so it is no alternative. ## What is BuyMyDeadStartup? A [one-page board](https://www.buymydeadstartup.com/) where a founder describes what the closed company left behind and AI labs write to the founder. Listing is free, buyers pay $1,500 a month for access, and the site holds no money or data. See [BuyMyDeadStartup](/answers/buymydeadstartup). ## What if the company is still operating? Direct programs take company data from working businesses, including [micro1](/answers/what-is-micro1) and [Handshake AI](/answers/handshake-ai-data-partnerships). Their terms are in [Troveo alternatives](/answers/troveo-alternatives). SimpleClosure's own [AssetHub page](https://simpleclosure.com/product/assethub/) now says operating companies can explore licensing too. For a shutdown with no marketplace, see [licensing direct to an AI lab or through a marketplace](/answers/sell-direct-to-ai-lab-or-through-a-broker). ## What should a founder check first? Slack, email and Drive hold other people's words, and a closing company is still the party that signs the warranties. Run the [rights check](/rights-check) before you list anything, and read [the risk map](/risks). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Trustpilot profile](https://www.trustpilot.com/review/sunsethq.com) - [TechCrunch](https://techcrunch.com/2025/05/07/carta-abandons-startup-shutdown-business-instead-backs-simpleclosures-15m-series-a/) - [one-page board](https://www.buymydeadstartup.com/) - [AssetHub page](https://simpleclosure.com/product/assethub/) - [SimpleClosure terms](https://simpleclosure.com/tos/) - [SimpleClosure Asset Hub announcement](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [SimpleClosure CEO post](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) --- # What goes on a data readiness checklist? > A data readiness checklist for licensing company data to AI: eight lines, what micro1 and Handshake AI publish, and a fictional filled-in sample. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-readiness-checklist Published: 2026-08-05 Updated: 2026-10-14 ## The short answer Eight lines: headcount, usable history, systems and owners, work linked to results, rough volume, language, rights notes and personal data. Rights come first. micro1's pages ask for 30+ employees. Handshake AI's referral page asks for 20+ full-time staff. Neither floor sets a price. Run this list before you talk to any buyer. It takes an afternoon and nothing leaves the building. It can also end in a no, and a no on paper costs less than a no after three calls. Spoken remarks are marked undated and count as what was said then, not current written criteria. Figure: steps Confirm rights, list systems -> Size records, note language -> Plan personal data removal. The readiness checklist runs from rights to a plan for personal data. ## What are the eight lines of a data readiness checklist? Eight lines: headcount, usable history, systems and owners, work linked to its result, rough volume per tool, language, rights notes and personal data. micro1 and Handshake AI publish criteria for some of them. 1. **Headcount.** Full-time staff, with contractors counted apart. [micro1](/buyers/micro1)'s [data partnerships page](https://www.micro1.ai/data-partnerships) asks for 30 or more employees. [Handshake AI](/buyers/handshake-ai)'s [referral page](https://joinhandshake.com/ai/data-partnerships/referral) asks for 20 or more full-time employees. 2. **Usable history.** The oldest record in each system that still links to its outcome. Handshake AI's referral page asks for three or more years in operation, which is company age. Usable history is a different number, covered below. 3. **Systems and owners.** Every tool where work gets recorded, and who can export from it. In an undated recorded forum talk, David Revland of micro1's human data team named Google Workspace, Slack, project management tools and GitHub. 4. **Work linked to its result.** Whether a request ties to how it ended, like a ticket to its fix or a quote to a won deal. micro1's page lists project histories and QA processes among the data it wants. 5. **Rough volume per tool.** A size or a count per system, with the date you checked it. micro1's pages state no data-size threshold. In the same talk, Revland described a data manifest form that asks which tools you use and a rough size for each. 6. **Language.** The main language in each system. micro1's pages ask for companies that operate in English and give no percentage. 7. **Rights notes.** Contracts, NDAs and vendor terms that touch the data, and any policy on who owns staff messages. Mark what stays out, such as privileged material, HR files, payroll, health data and union communications ([Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)). 8. **Personal data.** What personal data the records hold, and who will remove it. Health, financial and education records carry their own rules and need specialist handling. Figure: scale, Published staff floors at two companies: Handshake AI referral page 20 or more, micro1 pages 30 or more (emphasized). micro1's published floor is 30 employees, and Handshake AI's referral page starts at 20. Source: joinhandshake.com/ai/data-partnerships/referral and micro1.ai/data-partnerships, self-reported. ## Which line on a readiness checklist matters most? Rights. The thresholds move from company to company and nobody publishes a pass mark. The rights work goes in order: bring in legal, privacy and HR, review your agreements, then set what stays out. Daniel Goldberg, a partner at [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), writing in October 2026, advises bringing in legal, privacy, security, HR and communications people first, so business development doesn't run the deal alone. He then puts a review of customer, partner, vendor and data license agreements before any deal. _Rights come first, so do not start with the spreadsheet._ The [rights check](/rights-check) asks seven questions, including whose records these are and who can sign a license. It lists what to settle with counsel. ## Does company age count as history on a readiness checklist? No. Usable history counts records whose links still work, and a founding date says nothing about that. System migrations break the context. A CRM exported to flat files during a move can lose which email belonged to which deal, and a chat tool you left behind may have taken its threads with it. Count usable history per system, from the oldest record that still ties to its outcome. A company founded 18 years ago that moved its CRM in 2022 has about four years of linked CRM history. ## Does a readiness checklist value your data? No. The headcount and storage on a readiness checklist are screening signals. AI data companies use them to decide whether to talk, and on their own they don't set what a deal would pay. micro1's page lists deal tiers from $100K+ and ties the higher tiers to how large and how unique the data is. Nobody publishes a price per employee or per gigabyte. Older figures still circulate, and they are not micro1's current written criteria. In an undated recorded forum talk, micro1 staff named about 1 TB of data and 20 full-time employees, and David Revland put the English share at 80% or more. That talk shows what was said then. [Troveo's business-data page](https://www.troveo.ai/business-data) states no minimum headcount. It says value scales with your systems, team size and years of history. ## What does micro1 publish as its criteria? micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. Confirm exceptions directly with micro1. An undated micro1 [Enterprise Data Partnership post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) lists 30 to 200 employees. micro1's [data partnerships page](https://www.micro1.ai/data-partnerships) adds that demand is strongest in the US, UK and Canada. Handshake AI's [data partnership estimator](https://joinhandshake.com/ai/data-partnerships/) asks for headcount, years of operation and country. In an undated recorded forum talk, micro1's David Revland said micro1 wants the chain from a request to a finished deliverable across tools. Records tied to an outcome, such as a won deal or a resolved ticket, show that chain. ## What does a filled-in data readiness checklist look like? A filled-in checklist gives one row per line: your answer, what it tells a buyer and the next step. Otterbrook Supply, a made-up 42-person plumbing wholesaler founded in 2008, shows how one reads, with descriptions and counts only. **Fictional readiness checklist for Otterbrook Supply, a made-up 42-person plumbing wholesaler. Descriptions and counts only, no records.** | Line | Otterbrook's answer | What it tells a buyer | Next step | |---|---|---|---| | Headcount | 42 full-time, 6 seasonal contractors | Above both published staff floors. Sets no price | List contractors apart | | Usable history | Email since 2013, chat since 2020, CRM since a 2022 move | Founded 18 years ago, about 4 years of linked CRM history | Ask whether the old CRM export kept deal links | | Systems and owners | Google Workspace and Slack (office manager), HubSpot (sales lead), Zendesk (support lead) | Four systems, three people who can export | Confirm admin access on each | | Work linked to its result | Tickets carry order numbers. Deals link to quotes since 2022 | A request-to-result chain from 2022 on | Note the gap before 2022 | | Rough volume | Drive about 600 GB, Slack about 40 GB, 1.4 million tickets | Describes the records. Sets no price | Screenshot each total with its date | | Language | English, with Spanish in about 1 in 10 support tickets | Primarily English | Note the share per tool | | Rights notes | Three distributor contracts with confidentiality clauses. Handbook silent on AI use | Open questions, so no buyer talk yet | Send both to counsel | | Personal data | Customer names and addresses in Zendesk. Payroll and HR files in one Drive folder | HR and payroll are on Frankfurt Kurnit's exclusion list | Exclude the folder, ask each company who de-identifies | Otterbrook ends the afternoon with two questions for counsel, one exclusion and one gap to explain. It gets no price and no promise of a deal. Being imaginary, it also found every admin login on the first try. ## Is a data readiness checklist the same as AI data readiness? Partly. A readiness checklist for licensing asks whether an AI data company can use your records and whether you can show they are yours to license. Most guides use "AI data readiness" for getting your own data fit to run your own AI. [Hiniduma, Byna and Bez's survey](https://arxiv.org/abs/2404.05779) (revised November 2024) treats it as whether a dataset is fit for AI training, judged by metrics still being standardized. > **Readiness means a company can use your records and you can show they are yours to license.** It's like renting out a spare room. First you check the lease lets you, then you clear out what isn't yours. ## Who removes the personal data a readiness checklist flags? Usually the company you license to, so ask who removes it, which method it uses and what it certifies. Handshake AI's [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) says the de-identification work happens on its side, and that no process removes the risk entirely. In an undated recorded forum talk, micro1 staff said personal data has to be transformed on micro1's side, because it swaps each name for the same stand-in in every tool. Data scrubbed beforehand would break that trail. Goldberg adds that de-identification addresses whether a record links to a person. A pay complaint stays sensitive without a name on it. The preparation guide covers [whether to scrub first](/guides/how-to-prepare-company-data-for-ai-licensing#should-you-scrub-the-data-first). ## How does the Vaultfish fit check use the checklist? The free Vaultfish [fit check](/business) asks about full-time employees, years of records, where the work happens, whether work ties to its outcome, how easily you can export, whether contracts allow this use and what personal data the records hold. That makes seven questions, plus an optional industry question it never scores. No upload, no login. You get a score, a band and a short list of what would raise it. Public reference points come with their source, and none of them estimates your payout. The [methodology page](/methodology) shows how the points are built, and the weights are our own design choices, with no market data behind them. Some answers set the band aside. If a contract bars this use, or the records are health, financial or education data, the result shows no band or range and sends you to counsel first. If you haven't checked your contracts yet, it shows no band and sends you to the [rights check](/rights-check). micro1's published range stays hidden until that check flags no blocker. The fit check doesn't review a contract, give legal advice or value your data. Our guide on [what your data is worth](/guides/how-much-is-your-business-data-worth-to-ai) shows why nobody publishes a price list. ## What comes after a data readiness checklist? You choose. Take your rights notes to counsel and work through the gaps yourself, ask us for an introduction, or hand the job over. The [data licensing audit](/answers/data-licensing-audit) page sets out a deeper review in five parts, and the [preparation guide](/guides/how-to-prepare-company-data-for-ai-licensing) turns this list into a one-page packet. Optional [managed readiness](/managed-readiness) builds a one-pager, a systems inventory, questions for your counsel, a shortlist of companies with current criteria and a term-question checklist. It works from descriptions and counts, never records, and it can end in a no. Clearing a threshold doesn't promise a deal or a price. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Frankfurt Kurnit](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Troveo's business-data page](https://www.troveo.ai/business-data) - [Enterprise Data Partnership post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) - [data partnership estimator](https://joinhandshake.com/ai/data-partnerships/) - [Hiniduma, Byna and Bez's survey](https://arxiv.org/abs/2404.05779) --- # Can I license EU employee data to AI? > Want to sell EU employee data to AI? A license still needs a GDPR lawful basis, a compatible purpose, advance notice and any Article 88 national rules. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-eu-employee-data-to-ai Published: 2026-08-04 Updated: 2026-10-14 ## The short answer The GDPR sets four checks: lawful basis, compatible purpose, notice of the new purpose, and national employee rules under Article 88. The EDPB says trained models cannot be considered anonymous in all cases. Fines reach EUR 20 million or 4% of turnover. Employee data in the EU falls under the same regulation as customer data. National employment law adds a second layer on top. That layer differs by country, and it is the one that catches people. ## Does the GDPR apply to my company? That is an [Article 3](https://gdpr-info.eu/art-3-gdpr/) question. The [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) applies to processing done in the context of an EU establishment. It also reaches a company outside the EU that offers goods or services to people in the Union, or monitors their behaviour there. If you have staff in the EU, a lawyer should settle this. ## What does purpose compatibility ask? [Article 6(4)](https://gdpr-info.eu/art-6-gdpr/) lists five factors. They test whether a new purpose fits the one the data was collected for. - The link between the two purposes. - The context, and the relationship between the people and the controller. The controller is the company that decides how the data is used. - The nature of the data. - The possible consequences for the people. - The safeguards in place. Licensing workplace messages to an AI lab is far from running a payroll or a project. A lawyer has to judge whether it is compatible on your facts. ## What notice does the GDPR require before employee data is reused? [GDPR Article 14(4)](https://gdpr-info.eu/art-14-gdpr/) covers a controller that plans to use data for another purpose. It must tell the person about that purpose before it begins. [Article 13(3)](https://gdpr-info.eu/art-13-gdpr/) says the same for data collected from the person. ## What does Article 88 add? [Article 88(1)](https://gdpr-info.eu/art-88-gdpr/) lets member states set more specific rules for employee data, by law or by collective agreement. Article 88(2) says those rules must include suitable measures to protect dignity and fundamental rights. So a national law or collective agreement can add duties beyond the general text. ## What has the EDPB said about training AI on employee and other personal data? The European Data Protection Board adopted [Opinion 28/2024](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf). It says models trained on personal data cannot, in all cases, be considered anonymous. It also says that meeting transparency duties does not, by itself, show that people reasonably expect the processing. The opinion addresses AI models. Raw dataset licensing falls outside it, so it applies to an owner only by analogy. The [privacy policy page](/answers/do-i-need-to-update-my-privacy-policy-before-licensing-data-to-ai) covers notice in the US. The [rights check](/rights-check) asks whether GDPR or UK GDPR data subjects are in the records. Figure: steps Lawful basis, compatible purpose -> Notice of the new purpose -> National employee rules. The GDPR text puts these checks in front of an employee-data license, and national rules under Article 88 come on top. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Article 3](https://gdpr-info.eu/art-3-gdpr/) - [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) - [Article 6(4)](https://gdpr-info.eu/art-6-gdpr/) - [GDPR Article 14(4)](https://gdpr-info.eu/art-14-gdpr/) - [Article 13(3)](https://gdpr-info.eu/art-13-gdpr/) - [Article 88(1)](https://gdpr-info.eu/art-88-gdpr/) - [Opinion 28/2024](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf) --- # SimpleClosure Asset Hub: what it sells and the terms > SimpleClosure Asset Hub, launched in Apr 2026 for closing startups, now takes operating ones. Code and workspace data, about 100 deals at $10K to $100K. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/simpleclosure-asset-hub Published: 2026-08-04 Updated: 2026-10-14 ## The short answer SimpleClosure Asset Hub is a marketplace for source code and workspace data like Slack and email. Built for closing startups, it now takes operating ones too. Gizmodo reported nearly 100 deals at $10,000 to $100,000 per company. The company must hold consents from people in the data. Asset Hub belongs to [SimpleClosure](/buyers/simpleclosure), a startup shutdown service. It suits companies that are closing. A working company with years of records has other buyers, compared in the [buyers directory](/buyers). ## What can a closing startup list on Asset Hub? The launch release ([Business Wire via Yahoo Finance](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html)) sorts assets into three groups: - **Live:** source code, meaning Git repositories and production code. - **Beta:** workspace data, meaning email, Slack, Notion, Google Drive and internal documents. - **In development:** domains, patents, trademarks and physical equipment. It names the buyers as AI labs, reinforcement learning researchers and enterprise AI companies. No individual buyer is named. ## How does a sale work? SimpleClosure's [AssetHub page](https://simpleclosure.com/product/assethub/) says every dataset is processed for PII before it is licensed. Its terms make no such promise. After an acquisition, its [terms](https://simpleclosure.com/tos/) give the buyer the right to use, modify, license and sell the assets. The buyer needs no further consent and owes no pay, unless a separate agreement says otherwise. Figure: steps List your assets -> SimpleClosure says it scrubs -> Buyer acquires, founders paid. SimpleClosure describes Asset Hub as a managed sale from listing to proceeds. ## How much does it pay? [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) wrote, citing Forbes, that SimpleClosure had processed nearly 100 deals in the past year. Payouts were $10,000 to $100,000 per company. The article doesn't say whether SimpleClosure takes a fee. The terms of service, leave fees to a separate order form. The full price discussion is in [how much does SimpleClosure cost](/answers/how-much-does-simpleclosure-cost). ## What do the terms ask of the seller? The terms ask you to confirm two things. You hold the rights to the assets. You have given notice to, and obtained consent from, any individuals whose personal information is inside them. You also indemnify SimpleClosure for claims that arise from those promises. Its own liability cap is the greater of six months of amounts you paid or $100. Marc Rotenberg of the Center for AI and Digital Policy told Gizmodo the records identify people. The consent promise is the clause to read closely. Run the [rights check](/rights-check) and read [reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) first. Evidence on the company is in [is SimpleClosure legit](/answers/is-simpleclosure-legit). Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Business Wire via Yahoo Finance](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) - [AssetHub page](https://simpleclosure.com/product/assethub/) - [terms](https://simpleclosure.com/tos/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [SimpleClosure Asset Hub announcement](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [SimpleClosure CEO post](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) --- # Can you license data to OpenAI? What we found > Want to sell data to OpenAI? We found no public program that pays to license company data. Its 2023 Data Partnerships call was reported unpaid. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-data-to-openai Published: 2026-08-03 Updated: 2026-10-14 ## The short answer Not through any program I found. OpenAI has none that pays companies for data, and its 2023 Data Partnerships call was reported unpaid. In 2026 Google and Mercor bid on company archives, and micro1 and Handshake AI run data partnerships. Check the date on each source. This page records what a search found. It is short because the public record is thin. ## Does OpenAI have a program that takes outside data? Yes, a call for data partners. In November 2023 OpenAI announced Data Partnerships, asking organizations for large datasets that reflect human society and are not already easy for the public to access. It named text, images, audio and video, with two models: open-source datasets and private datasets where the partner sets access controls ([The Decoder](https://the-decoder.com/openai-seeks-large-socially-relevant-datasets-for-future-ai-models/)). The first partners named were the Icelandic government and the Free Law Project. ## Does OpenAI pay for that data? Press coverage says no. Techzine wrote that apart from a possible later benefit, "there is nothing in it for partners" ([Techzine](https://www.techzine.eu/news/applications/113117/openai-seeks-online-unavailable-data-through-willing-third-parties/)). OpenAI's own page returned an access error when I fetched it, so I could not read its current wording or confirm whether the call is still open in 2026. ## Does OpenAI buy company data some other way? I found no public report of it. OpenAI does pay for content licensing. Yahoo Finance named Google and OpenAI as Reddit's top data licensing customers, and put Reddit's licensing-led "other revenue" at $43M in the second quarter of 2026 ([Yahoo Finance](https://finance.yahoo.com/media-advertising/articles/reddits-data-licensing-revenue-grew-125000998.html)). That is content licensing, a different product from your email and tickets. ## Where can a company place data instead? Google placed the $10M winning bid for Spirit Airlines' archive, pending court approval. micro1, Mercor and [Handshake AI](/buyers/handshake-ai) run direct programs or bids. [Who bid on Spirit Airlines' data](/answers/who-buys-company-data-for-ai) lists the named bidders with sources, and [where to license](/answers/where-to-sell-company-data) compares the routes. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Before you offer data to anyone, run the [rights check](/rights-check). Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Routes for a company with data to place: OpenAI Data Partnerships (Reported unpaid), Direct programs and marketplaces (emphasized: They publish payment terms, Published terms). Direct programs and marketplaces publish payment terms, and OpenAI's 2023 call was reported unpaid. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [The Decoder](https://the-decoder.com/openai-seeks-large-socially-relevant-datasets-for-future-ai-models/) - [Techzine](https://www.techzine.eu/news/applications/113117/openai-seeks-online-unavailable-data-through-willing-third-parties/) - [Yahoo Finance](https://finance.yahoo.com/media-advertising/articles/reddits-data-licensing-revenue-grew-125000998.html) --- # What is a data broker? > What is a data broker? Consumer data brokers aggregate and sell personal profiles. In AI the word is also used loosely for finders who match firms and buyers. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-data-broker Published: 2026-08-03 Updated: 2026-10-13 ## The short answer A data broker collects personal information from multiple sources and sells it. The FTC describes these companies as operating largely behind the scenes. In AI, the word also means a finder matching companies with AI buyers. The two meanings are different businesses with different rules and different registration requirements. ## What is the consumer meaning of data broker? This is the meaning in state law and in privacy news. The FTC's report, "Data Brokers: A Call for Transparency and Accountability," describes companies that operate largely behind the scenes, gathering and sharing personal information about consumers ([FTC](https://www.ftc.gov/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014)). California's registration law defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship ([Civ. Code 1798.99.80](https://cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20260101.pdf)). Brokers register each January and process deletion requests from 1 Aug 2026. ## What does data broker mean in AI? In AI, "data broker" and "data brokerage" are what people call it when they place company records with AI buyers. A finder spots a company with records buyers want and makes the introduction. On this site the folks on the other end are buyers, and the finders are advisors or referral front ends. Some get paid a success fee, a percentage of what you receive. Others are referral partners, paid by the buyer when an introduction reaches a milestone. Ask each one which model it uses and who pays it. ## Why do the consumer and AI meanings of data broker get mixed up? Searchers and journalists use one word for a seller of personal profiles and for a finder who matches companies with AI buyers, so a page that says "data broker" can mean either one. When someone tells you they are a data broker, ask which meaning they intend and what personal information, if any, passes through their hands. A finder who never receives or sells personal information doesn't obviously match California's verbs. That is my reading of the text, and I found no regulator guidance. [California data broker registration](/answers/california-data-broker-registration) walks through the statute. Counsel decides how it applies to you. ## How do you check a company that calls itself a data broker? Ask four things: the legal entity, the fee model, whether it ever holds your data, and who pays it. Then look for a published terms page and a disclosure of referral fees. The [data licensing advisor page](/answers/data-licensing-advisor) lists the conflict questions, and [data broker commission](/answers/data-broker-commission) covers who pays each kind of intermediary. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Two meanings of data broker: Consumer data broker (emphasized: State registration laws use it, Sells people's profiles), AI data broker (Introduces buyers). The consumer meaning comes first because state registration laws use it. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [FTC](https://www.ftc.gov/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014) - [Civ. Code 1798.99.80](https://cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20260101.pdf) --- # What is an acceptance period in a data deal? > An acceptance period in a data deal is the window when a buyer checks your delivered data. Polyshares' Ryan Lock says 30 days. No buyer publishes its pass test. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-an-acceptance-period-in-a-data-deal Published: 2026-08-03 Updated: 2026-10-14 ## The short answer An acceptance period is the window when a buyer checks delivered data before accepting it. A failed check can end the deal or change the price. Polyshares' Ryan Lock wrote that 30 days is standard. That is a single claim. No buyer publishes how its check works. An acceptance period sits between delivery and payment. It is the time the buyer has to say yes or no. ## What happens during the window? The buyer checks that the data matches what you described. If it does, the deal moves to payment. If it does not, the buyer may walk away or ask for a lower price. Ryan Lock of [Polyshares](/buyers/polyshares) wrote that 30 days is standard and that the buyer may back out in that window ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). He frames it as a guard against fake datasets, such as a Drive padded with movies. He is one buyer, and he cited no second source. ## What do other companies say about acceptance? David Revland, who works on human data at [micro1](/buyers/micro1), said in an undated recorded forum talk that micro1 verifies delivered data, then pays. Mercor says wire transfer on delivery of the anonymized dataset. [Handshake AI](/buyers/handshake-ai) says its due diligence affects pricing, and that payment typically comes 30 to 60 days after it accepts the de-identified dataset. None publishes pass criteria. See [data verification before payment](/answers/data-verification-before-payment-ai). Polyshares' own site says payment comes "Net 30 to 60" once data is approved, shared and anonymized ([terms](https://polyshares.com/data-licensing)). It gives no acceptance window. ## What should you ask before you transfer? - What does the check test, and who decides a pass? - If part fails, is the price cut or the deal ended? - How many days does the buyer have? - Does the payout clock start at acceptance? Put the answers in the contract. Compare payout clocks on the [micro1 payment timeline page](/answers/micro1-data-partnership-payment-timeline). _An open-ended "we are still checking" is not a term. Get a date._ Figure: steps Data delivered -> Buyer checks, accepts or backs out -> Payout clock runs. The acceptance period is the check-and-decide step between delivery and payment. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [X article](https://x.com/RyanLockAI/status/2107864069105389717) - [terms](https://polyshares.com/data-licensing) --- # What is the Protege AI data marketplace? > The Protege AI data marketplace sells licensed training data in health, video and audio, and pays partners a share. What is public, and what is not. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/protege-ai-data-marketplace Published: 2026-08-03 Updated: 2026-10-14 ## The short answer The Protege AI data marketplace is a site where AI builders license training data. Partners get a share of the money each time it is used. It lists health, video, audio, speech and spatial data. Its pages never mention workplace chat or email. The share is not public. ## What does the Protege AI data marketplace do? [Protege](/buyers/protege) (withprotege.ai) calls itself "a curated marketplace and compliance layer." Model builders "discover, request, filter and combine datasets" there ([SiliconANGLE](https://siliconangle.com/2026/01/08/protege-raises-30m-grow-governed-marketplace-ai-training-data/)). Its homepage tells owners to "monetize your existing data assets or content" while keeping "clear rights protections and provenance." The domains it names are healthcare, video, audio and speech, and spatial and physical data. It also lists pre-training, fine-tuning and evaluation sets. A SOC badge shows in its footer. > **Protege lets AI developers license data, and it pays the owner each time the data is used.** It's like a library that pays the author every time a book is borrowed. ## How does Protege pay its data partners? Its funding coverage says partners receive "revenue share payouts ... with each use." CEO Bobby Samuels told EO Magazine it uses a royalty-based structure: "You make money when we make money" ([EO Magazine](https://www.eomag.io/article/protege-bobby-samuels)). The share itself is not public. Its video provider page lists two case studies of what a broadcaster and a sports distributor received. Protege reports both itself. I leave the amounts out, because one company's result predicts nothing for yours. ## Who can license data to Protege? The video page says partners typically own content outright or hold "global all media or similarly broad rights." It states no minimum. Its process has four steps, from discovering a library to receiving payments. Figure: steps Discover and structure -> Prepare -> Monetize. Protege's process runs from a library review to revenue share payments. ## How much has Protege raised? SiliconANGLE reported a $30M Protege round led by Andreessen Horowitz in Jan 2026. It put the total at $55M, including a $25M Series A from August 2025. EO Magazine puts the total at $65M. The two press figures differ, so quote the one you can name. ## Is Protege an option for Slack, email or CRM records? Protege's pages that we read do not name workplace chat or company records. Ask Protege directly before you assume it covers yours. _A library that pays the author on every loan. The rest of us just get a late fee._ Our [buyer directory](/buyers) and [deals tracker](/deals) cover the players that do list company data. The [rights check](/rights-check) covers what you need to hold before you speak to any of them. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [SiliconANGLE](https://siliconangle.com/2026/01/08/protege-raises-30m-grow-governed-marketplace-ai-training-data/) - [EO Magazine](https://www.eomag.io/article/protege-bobby-samuels) - [Protege homepage](https://withprotege.ai/) - [Protege video data providers](https://withprotege.ai/data-provider/video) --- # How to check Google Drive storage used by org > How to check Google Drive storage used by organization: Admin console, Menu, Storage. It shows usage against your limit and the top users and shared drives. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-to-check-google-drive-storage-used-by-organization Published: 2026-08-02 Updated: 2026-10-13 ## The short answer In the Google Admin console, open Menu and choose Storage. You need the Storage administrator privilege. The page shows Workspace storage used against your limit, split across Drive, Gmail and Photos. It lists top users and shared drives. Changes take up to 24 hours to appear. The [Storage page](https://knowledge.workspace.google.com/admin/storage/review-storage-use-across-your-organization) is the quickest organization-wide view. ## What are the steps? Open the Admin console, click Menu, then Storage. The top of the page shows usage against your limit. Below it, a summary lists the users with the highest storage, and a "View all users" link opens a ranked list. A matching summary lists shared drives, with "View all shared drives" for the full ranking. ## What does the number include? Google Workspace storage is shared between Drive, Gmail and Photos. Pointing at a section of the usage bar gives each service's part. A mailbox-heavy company can show a large total with a small Drive. The total says nothing about what you may license. Shared drives hold files that clients and partners own. ## Where is a per-user Drive figure? [Google's Apps usage report](https://knowledge.workspace.google.com/admin/reports/user-reports-apps-usage) lists Drive storage per user in megabytes. [micro1 Google Drive data](/answers/micro1-google-drive-data) gives that path and the sum. ## Does storage size matter to micro1? [micro1](/buyers/micro1)'s pages state no data-size threshold. A storage total still helps you describe your records. See [how to check your storage](/answers/does-my-company-have-1-tb-of-data) and [micro1's requirements](/answers/micro1-data-partnership-requirements). No price follows from size alone, and no outcome is promised. ## Can an admin export the data? [Google's Data Export tool](https://knowledge.workspace.google.com/admin/migrate/export-all-your-organizations-data) needs a super administrator account at least 30 days old with 2-Step Verification on and Google Cloud activated. Exports usually take 72 hours and can take up to 14 days, after a 48-hour security wait. Files in the Google-provided bucket are deleted 60 days after the export starts. In a micro1 corpus deal, micro1's CFO said in an undated recorded forum talk that its engineers help your IT people with the transfer. See [what a data manifest form asks](/answers/what-is-a-data-manifest-form). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Admin console, Menu, Storage -> Read usage against limit -> Open top users and drives. Google's Storage page shows usage against your limit, then the users and shared drives using the most. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Storage page](https://knowledge.workspace.google.com/admin/storage/review-storage-use-across-your-organization) - [Google's Apps usage report](https://knowledge.workspace.google.com/admin/reports/user-reports-apps-usage) - [Google's Data Export tool](https://knowledge.workspace.google.com/admin/migrate/export-all-your-organizations-data) --- # License company knowledge base to AI: what AI data companies name > Looking to sell a company knowledge base to AI? Companies license it. Mercor names Confluence and Notion, and micro1's partnership page names knowledge bases. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-company-knowledge-base-to-ai Published: 2026-08-01 Updated: 2026-10-14 ## The short answer To license a company knowledge base to AI, export your wiki and documentation as a record of how the company works. Mercor names Confluence and Notion, and micro1's partnership page lists knowledge bases. Notion says it does not train models on your data by default. Atlassian's settings differ by plan. A knowledge base is the part of a company's data written to be read. Parts of it may also sit on a public help center. ## Who names knowledge bases? [micro1's data page](https://www.micro1.ai/data-partnerships) lists SOPs, knowledge bases, internal documentation, project histories and QA processes. [Mercor's page](https://www.mercor.com/data/) names nine tools, including Confluence and Notion. [Troveo's page](https://www.troveo.ai/business-data) names Notion under work and knowledge tools, next to Jira, Linear and Asana. All of this is buyer self-description. No page I read says how often a lab asks for wiki content or what it pays. ## What do the vendors say? [Notion's security page](https://www.notion.com/help/notion-ai-security-practices) says that by default Notion and its AI subprocessors do not use Customer Data to train any models. [Atlassian's Customer Agreement](https://www.atlassian.com/legal/customer-agreement) says the customer owns all intellectual property and other rights in Customer Data. Its data contribution settings are separate, so see [licensing Confluence data to AI](/answers/sell-confluence-data-to-ai). ## What sits inside a knowledge base? My reading: runbooks, policies, onboarding pages, product notes and pasted customer detail. Some of that was written by staff, some copied from vendors or clients, and some may already be on a public help center. I found no source on how buyers treat content that is already public. Ask any buyer before you assume. ## What should you check first? Sort pages by author and origin, and look for customer names, contract terms and credentials pasted into pages. The [rights check](/rights-check) asks whose records these are and what your contracts allow. Related pages are [licensing internal documents to AI](/answers/sell-internal-documents-to-ai) and [licensing Jira data to AI](/answers/sell-jira-data-to-ai). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Companies that name knowledge-base content: micro1 (emphasized: Names the data type itself, Names knowledge bases), Mercor (Names Confluence, Notion), Troveo (Names Notion). micro1 is emphasized because it names knowledge bases as a data type, where Mercor and Troveo name tools. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's data page](https://www.micro1.ai/data-partnerships) - [Mercor's page](https://www.mercor.com/data/) - [Troveo's page](https://www.troveo.ai/business-data) - [Notion's security page](https://www.notion.com/help/notion-ai-security-practices) - [Atlassian's Customer Agreement](https://www.atlassian.com/legal/customer-agreement) --- # License Google Workspace data to AI: what to know first > Looking to sell Google Workspace data to AI? It goes out under a license. A super admin exports it, and Google's API policy bars apps selling user data for AI. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-google-workspace-data-to-ai Published: 2026-07-31 Updated: 2026-10-14 ## The short answer List your Google Workspace services and sizes, then export through a super admin. Google's admin export covers Gmail, Drive, Chat and Calendar. Terms say you keep your IP rights. API policy bars apps from selling user data to train AI. Which text applies depends on your export route. Google Workspace holds the documents, mail and spreadsheets that make up a work trail. That trail is what buyers describe wanting. ## What counts as Workspace data? [Google's admin export tool](https://knowledge.workspace.google.com/admin/migrate/export-all-your-organizations-data) lists Gmail, Drive data including shared drives, Chat, Calendar, Contacts, Groups, Keep, Tasks, Voice and Vault retained data. [micro1](/buyers/micro1)'s David Revland, who works on human data, gave this example of a useful trail in an undated recorded forum talk: a Slack message asking for a finance report, plus the finished report in Google Sheets (self-reported). Read that way, Gmail, Drive and Sheets form one chain. ## How do you find the size? micro1 said in the same talk that its form asks for a rough size per tool and that it supplies instructions for finding those sizes, for example in Drive. Its [web page](https://www.micro1.ai/data-partnerships) gives 30 or more employees as a threshold and states no data-size threshold (self-reported). My page on the [data manifest form](/answers/what-is-a-data-manifest-form) shows the full intake order. ## How does the admin export work? Only a super administrator account at least 30 days old can start it, and that account needs two-step verification. Google applies a 48-hour security wait before data becomes available. Export typically takes 72 hours and can take up to 14 days. Google puts the files in a temporary Cloud Storage bucket and deletes them 60 days after the export begins. The tool skips accounts created in the 24 hours before the export and deleted data, unless a Vault policy retained it. ## What do Google's Workspace terms say about customer data? Google's [Workspace terms](https://workspace.google.com/terms/premier_terms/) say the customer retains all intellectual property rights in Customer Data. The [Workspace API developer policy](https://developers.google.com/workspace/workspace-api-user-data-developer-policy) bars transferring, selling or using user data to train a machine learning or AI model beyond that user's own personalized feature. It also bars selling user data to data brokers. The policy is written for apps that use Google's APIs. My reading is that an app a buyer connects through OAuth falls inside it. A super admin's own export file sits under the customer terms. A lawyer should confirm that reading for your contract. I did not find a sentence in the terms I read that bars a customer from handing over its own export. [Rights come first](/rights-check), because Drive holds client files and shared documents that belong to other people. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Super admin starts export -> 48-hour wait, export runs -> Data ready, deleted at 60 days. Google's admin export starts with a super admin and ends with deletion of the exported copy after 60 days. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Google's admin export tool](https://knowledge.workspace.google.com/admin/migrate/export-all-your-organizations-data) - [web page](https://www.micro1.ai/data-partnerships) - [Workspace terms](https://workspace.google.com/terms/premier_terms/) - [Workspace API developer policy](https://developers.google.com/workspace/workspace-api-user-data-developer-policy) --- # License law firm data to AI: questions for counsel > Hoping to sell law firm data to AI? Any license starts with client confidentiality, privilege and ABA Opinion 512. Questions for your ethics counsel. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-law-firm-data-to-ai Published: 2026-07-31 Updated: 2026-10-16 ## The short answer Much of a law firm's archive is client information. Summaries of ABA Formal Opinion 512 say it requires informed client consent before client information goes into AI. No published ABA opinion addresses transferring an archive. Mercor and micro1 list legal work in their data partnerships. Ask your ethics counsel. This page gives a firm questions to ask. There's no pitch in it, and every legal call sits with the firm's own ethics counsel. ## What do the companies say about legal data? Two name it, in different senses. [Mercor's data page](https://www.mercor.com/data/) lists legal as a sector. [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) lists legal and contracts as an area, which describes contract workflows more than law firm files. All of it is self-reported. See [what industry means](/answers/does-industry-matter-for-selling-company-data) for the full comparison. Mercor's research team also maps where AI is tested. Its [Benchmark Map](https://www.mercor.com/research/labor-index/benchmark-map/) (Oct 2026) counts 5 of 7 legal occupations as covered, but says the benchmarks heavily cover lawyers' tasks and barely cover those of legal secretaries or court clerks. My reading is that a firm's filing and docketing records sit on the less-tested side. The map measures tests, not purchases, and names no price. ## What does ABA Opinion 512 say? Opinion 512 applies the confidentiality rule, Model Rule 1.6, to a lawyer's use of generative AI. Summaries by [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102jwnl/aba-issues-comprehensive-formal-ethics-opinion-on-lawyers-use-of-generative-ai) and a legal-ethics database say it requires informed consent before client information goes into a self-learning tool. It says general boilerplate in engagement letters purporting to authorize AI use is not sufficient. I couldn't open the ABA's own pages, which blocked my fetch. The opinion covers a lawyer using a tool. Licensing puts the archive in a buyer's hands, which is a different act, but it's the closest published guidance I found. State bars adopt their own versions of the rules. ## Who holds the privilege in law firm records? As a general rule the privilege belongs to the client, and disclosing privileged material to a third party generally waives it. Our [privilege page](/answers/does-selling-emails-to-ai-waive-attorney-client-privilege) covers the cases. Spirit Airlines [excluded privileged materials from its sale](https://news.bloomberglaw.com/ip-law/google-aims-to-boost-ai-with-purchase-of-spirit-airlines-data), and [Frankfurt Kurnit's checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) lists privileged material among the categories to leave out. ## What should a firm ask counsel? 1. Which matters and clients sit in the archive, and do any engagement letters mention data use? 2. Can each client give informed consent, and has anyone asked? 3. Which files are the firm's own, such as billing, marketing and internal operations? 4. What does the firm's state bar say about client information and AI? 5. Who holds privilege for each matter, and who decides on waiver? Our [rights check](/rights-check) and [risks page](/risks) cover the wider data questions. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three checks before law firm files reach a buyer: Client consent (Informed, not boilerplate), Privilege (emphasized: Held by the client, Client holds it), Buyer fit (Self-reported lists). Privilege belongs to the client, and disclosing it to a third party generally waives it. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's data page](https://www.mercor.com/data/) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Benchmark Map](https://www.mercor.com/research/labor-index/benchmark-map/) - [Frankfurt Kurnit Klein & Selz](https://technologylaw.fkks.com/post/102jwnl/aba-issues-comprehensive-formal-ethics-opinion-on-lawyers-use-of-generative-ai) - [excluded privileged materials from its sale](https://news.bloomberglaw.com/ip-law/google-aims-to-boost-ai-with-purchase-of-spirit-airlines-data) - [Frankfurt Kurnit's checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # License financial data to AI: rules to check first > Trying to sell financial data to AI? Licensing it meets the FTC Safeguards Rule, Regulation P and DOJ's 10,000-person rule. Troveo lists ledgers and invoices. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-financial-data-to-ai Published: 2026-07-30 Updated: 2026-10-14 ## The short answer Financial data for AI comes with federal rules. Troveo lists ledgers, invoices and QuickBooks, and micro1's data partnership page lists reconciliations. The FTC Safeguards Rule lists accountants and tax preparers. Regulation P requires notice and opt-out. DOJ counts de-identified financial data on 10,000+ US persons. Counsel decides which applies. Financial records come with specific federal rules. This page maps the rules I found. Counsel gives the answer. ## Which companies name finance data? Two companies name finance data: - [Troveo's page](https://www.troveo.ai/business-data) lists a finance and operations group of QuickBooks, Stripe, NetSuite, Pigment and Shopify. It names ledgers and invoices as data types. - [micro1](https://www.micro1.ai/data-partnerships) lists financial processes and reconciliations. Both are self-description. None shows a price for finance data alone. A [micro1](/buyers/micro1) referral partner said in a micro1 video that a New York loans company took part. She said it closed in two to three weeks (self-reported, about 8:44). The company is unnamed and the story can't be checked. The video discusses no consent or lender-specific rule. So the rules below still apply. ## Who counts as a financial institution? The FTC Safeguards Rule, [16 CFR 314.2](https://www.law.cornell.edu/cfr/text/16/314.2), defines a financial institution as any institution whose business is an activity that is financial in nature. Its examples include: - A tax preparation service. - An investment advisory company. - A mortgage broker. - A credit counseling service. - A real estate settlement provider. The reach is wider than banks. My reading is that a company's own books and a client's account data raise different questions. That framing is not a cited rule. ## What do Regulation P and the DOJ rule say? Regulation P, [12 CFR 1016.10](https://www.law.cornell.edu/cfr/text/12/1016.10), bars a financial institution from disclosing nonpublic personal information to a nonaffiliated third party. It needs notice, an opt-out notice and a reasonable time to opt out first. [Can I license health or financial client data to AI](/answers/can-i-sell-health-or-financial-client-data-to-ai) reads the text. DOJ's Data Security Program, [28 CFR Part 202](https://www.law.cornell.edu/cfr/text/28/202.205), sets a bulk threshold. The threshold is personal financial data on more than 10,000 US persons. The data counts, per [section 202.206](https://www.law.cornell.edu/cfr/text/28/202.206), even if it is anonymized, pseudonymized, de-identified or encrypted. See [the DOJ bulk data rule](/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data). ## What about records a firm must keep? [17 CFR 240.17a-4(b)(4)](https://www.law.cornell.edu/cfr/text/17/240.17a-4) requires a broker-dealer to preserve originals of communications received and copies of communications sent that relate to its business. The retention period is three years. The first two are in an easily accessible place. A duty to keep records and licensing them are separate questions. Counsel answers the second. ## What can you gather first? List the finance tools. Note whether any hold clients' account details. List which notices clients received. The [rights check](/rights-check) and the [risk map](/risks) follow the same order. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three rules that can touch financial records: Regulation P (Notice, then opt-out), DOJ bulk rule (emphasized: Counts de-identified data, 10,000 US persons), SEC 17a-4 (Keep three years). The DOJ rule is emphasized because its thresholds count financial data even when it is de-identified. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's page](https://www.troveo.ai/business-data) - [micro1](https://www.micro1.ai/data-partnerships) - [16 CFR 314.2](https://www.law.cornell.edu/cfr/text/16/314.2) - [12 CFR 1016.10](https://www.law.cornell.edu/cfr/text/12/1016.10) - [28 CFR Part 202](https://www.law.cornell.edu/cfr/text/28/202.205) - [section 202.206](https://www.law.cornell.edu/cfr/text/28/202.206) - [17 CFR 240.17a-4(b)(4)](https://www.law.cornell.edu/cfr/text/17/240.17a-4) --- # micro1 vs Handshake AI: company data programs > micro1 vs Handshake AI for company data: stated deal ranges, staff minimums, the intake process and the trust signals on record. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-vs-handshake-ai Published: 2026-07-30 Updated: 2026-10-14 ## The short answer micro1 vs Handshake AI: both pay companies for data, on different scales. micro1 states $100K+, $500K+ and $1M+ tiers. Handshake AI states $100K to $4M+. Both firms also hire experts to train AI models, and most of their reviews come from that side. This page sticks to the company-data programs. ## What do micro1 and Handshake AI say they pay? [micro1's page](https://www.micro1.ai/data-partnerships) lists $100K+, $500K+ and $1M+ tiers, and its Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. Its CFO said in an undated recorded forum talk that the corpus track pays $100K to $2M per company. [Handshake AI](/buyers/handshake-ai)'s [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) says partnerships range from $100K to $4M+ depending on the data shared. Handshake AI also runs a calculator. For 100 employees, 10 years and a US base, it shows $383,083 to $896,969 and labels the result indicative only. I'd read that label before the number. ## How do the processes compare? Handshake AI starts with an intake form about your company and tools, then a scoping call on parameters, de-identification, terms and timeline. Its [referral page](https://joinhandshake.com/ai/data-partnerships/referral) says the team reaches out within one to two days. [micro1](/buyers/micro1)'s page lists assessment, evaluation, discovery and partnership. In an undated recorded forum talk, David Revland, who works on human data at micro1, added a data manifest form, a payment proposal and a transfer its own engineers help run. ## Who qualifies? Handshake AI's [referral page](https://joinhandshake.com/ai/data-partnerships/referral) asks for 20 or more full-time employees and three or more years in operation. The current public criteria at micro1 list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Acceptance depends on its review and current demand. An undated micro1 forum talk gave lower, earlier figures, which are history. ## What do they say about de-identification? Handshake AI says it removes direct and indirect identifiers before delivery, and adds that no de-identification process eliminates re-identification risk entirely. micro1's page says PII is removed when relevant. In an undated recorded forum talk, Revland said it swaps names for consistent stand-ins, and micro1 staff said companies cannot pre-scrub. In both cases each company's side does the work, so ask who sees raw data and when. ## What do the trust signals show? Both Trustpilot pages mix worker and company experiences, and the review counts differ widely. [Business Insider](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) reported that contractors on OpenAI projects through Handshake AI were suspended, and four said they went unpaid. For micro1, which shows 4.7 of 5 from about 10.7K reviews, complaints cite interview questions and support. Figure: comparison of Stated company minimums at two data programs: micro1 (30+ staff, mature operations), Handshake AI (emphasized: Only one stating company age, Twenty or more staff, 3+ years). Handshake AI is emphasized because it is the only one of the two to state a minimum company age. Read each in full at [how micro1's data partnership works](/guides/micro1-data-partnership) and [Handshake AI data partnerships](/answers/handshake-ai-data-partnerships). Run the [rights check](/rights-check) first, and talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's page](https://www.micro1.ai/data-partnerships) - [data partnerships page](https://joinhandshake.com/ai/data-partnerships/) - [referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Business Insider](https://www.aol.com/articles/contractors-worked-openai-projects-handshake-050101409.html) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # SimpleClosure vs Troveo: closing or operating > SimpleClosure vs Troveo compared: a shutdown service built for closing startups, now open to operating ones, against a marketplace. Terms and prices. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/simpleclosure-vs-troveo Published: 2026-07-30 Updated: 2026-10-14 ## The short answer SimpleClosure Asset Hub, built for closing startups, now takes operating ones too. Reported prices run $10,000 to $100,000 per company. Troveo serves operating companies, with deals starting at six figures. SimpleClosure's terms give the buyer all rights, resale included. Troveo keeps you as owner and shares revenue. Their published price points overlap. The companies they serve sit at opposite ends of their life. ## Who is each one built for? [SimpleClosure](/buyers/simpleclosure) launched Asset Hub in Apr 2026 for founders and investors in dissolved venture-backed startups. Source code was live at launch. Workspace data, meaning email, Slack, Notion and Drive, was in beta ([Business Wire via Yahoo Finance](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html)). Its [AssetHub page](https://simpleclosure.com/product/assethub/) now says you do not need to be shutting down. Operating companies can explore licensing while they keep using the assets. [Troveo](/buyers/troveo) started with video and audio and added business data in 2026. Its [guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) says a small firm with a decade of specialized records can hold more training value than a large firm with generic data. My [small business page](/answers/can-a-small-business-sell-data-to-ai) compares each program's staff floor with a 20-person scenario. ## What do the prices show? [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) nearly 100 SimpleClosure deals at $10,000 to $100,000 per company. [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) puts startup shutdown archives at roughly the same $10,000 to $100,000 per deal. It cites about $5,000 for a single repository as an unnamed platform's baseline. It puts full-company operational data at six figures or more. ## What do the terms say about ownership? [SimpleClosure's terms](https://simpleclosure.com/tos/), grant it a perpetual, irrevocable license to sell or transfer your digital assets. They say all right, title and interest vests in the acquiring entity once an acquisition completes. They also ask you to represent that you got the consent of people whose personal information is inside. [Troveo's guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) says you keep ownership. You grant a defined right for a defined purpose and period. Its pages say you share in revenue on every sale. SimpleClosure's fees aren't stated in the terms I read. Troveo's revenue split isn't published. ## How is personal data handled? SimpleClosure says it manages data collection, PII removal and transfer to the buyer. [Troveo says](https://www.troveo.ai/business-data) it scrubs names, contact details, credentials and client identities. It uses one documented standard that it does not publish. [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) reported that the Center for AI and Digital Policy wrote to the Senate Commerce Committee urging the FTC to strengthen its oversight of AI companies. Its founder told [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) the data is "identifiable people." Our page on [shutting-down companies and Slack data](/answers/can-a-shutting-down-company-sell-its-slack-to-ai) covers the legal questions. ## How do the two fit together? SimpleClosure's route was built for a company that has closed or is closing, and its AssetHub page now takes operating companies too. A company that keeps operating can also look at Troveo and the direct programs in [where to license company data](/answers/where-to-sell-company-data). Figure: comparison of Where each service sits in a company's life: SimpleClosure (emphasized: Takes assets from closing firms, Companies closing), Troveo (Companies operating). SimpleClosure is emphasized because Asset Hub was built for startups that are shutting down. It now takes operating companies too. Run the [rights check](/rights-check) first, and talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Business Wire via Yahoo Finance](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) - [AssetHub page](https://simpleclosure.com/product/assethub/) - [guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [SimpleClosure's terms](https://simpleclosure.com/tos/) - [Troveo's guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [Troveo says](https://www.troveo.ai/business-data) - [SimpleClosure Asset Hub announcement](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [SimpleClosure CEO post](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) - [Troveo: AI data licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Troveo content owners](https://www.troveo.ai/content-owners) --- # What is a data manifest form? > What is a data manifest form? In micro1's corpus-deal process it is the intake step that lists your tools and rough data sizes. Self-reported. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-data-manifest-form Published: 2026-07-30 Updated: 2026-10-13 ## The short answer A data manifest form in micro1's program is the intake step listing your tools and rough data sizes. It asks which tools you use, like Google Workspace, Slack and GitHub. A referral partner said it takes under 10 minutes and a payment proposal follows within days. Companies cannot pre-scrub. The form is one step in a longer process. ## Where does the form sit in the process? [micro1](/buyers/micro1)'s David Revland, who works on human data, described the corpus track in order in an undated recorded forum talk. It starts with a referral, a peer introduction or a direct contact. A first call with a data partnership manager follows, then the data manifest form on micro1's data platform. After that micro1 sends a payment proposal, then contract language, then the data transfer. Then it verifies the delivered data and pays. ## What does the form ask? Think of it as an inventory of your tools with a weight next to each. It asks which services the company uses and a rough size per tool. micro1's David Revland gave Google Workspace, Slack, project management tools and GitHub as examples. The sizes are rough, and the talk described instructions for working them out. micro1's public pages do not mention a manifest form, so this description rests on the talk alone. In a micro1 video, a micro1 referral partner walking through the form gave Google Workspace at about 3 TB and Slack at about 300 GB as example sizes (self-reported, about 2:20). They illustrate the form and are not thresholds. Sizes help micro1 scope a deal. In the undated talk, micro1 staff also gave earlier eligibility figures, which are history. micro1's own [data partnerships page](https://www.micro1.ai/data-partnerships) is the current source: 30+ employees, mature operations and primarily English documentation, with no data-size threshold stated. ## Can I clean the data before I fill it in? micro1 staff said in the same undated talk that companies cannot pre-scrub and that micro1 must transform the data itself, because redacting first would destroy the cross-platform trail it needs. In that talk, micro1's David Revland described swapping a name for a consistent stand-in across tools. The [re-identification page](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages) explains why consistent stand-ins matter for privacy. ## What do the payment figures look like? micro1's data partnerships page lists tiers of $100K+, $500K+ and $1M+, and its [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages. The CFO said in an undated recorded forum talk that deals near $2M are real. These are self-reported figures, and no outcome is promised. The [deals page](/deals) tracks dated deal reports. ## What should I prepare? A list of your tools, who administers each, and a rough size. Our [rights check](/rights-check) flags where contracts or personal data need your lawyer. Our [managed readiness service](/managed-readiness) fills it in with you and never takes your data. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Intro and first call -> Data manifest form -> Payment proposal to payment. micro1's David Revland described a path in an undated recorded forum talk from first contact to payment, and the data manifest form is the middle step. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) --- # Can a lawyer or accountant take a referral fee? > Can a lawyer or accountant take a referral fee for AI data deals? The AICPA Code names commissions and referral fees. Lawyer rules differ by state. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-a-lawyer-or-accountant-take-a-referral-fee-for-ai-data-deals Published: 2026-07-29 Updated: 2026-10-13 ## The short answer It depends. No rule names a fee from a data buyer. ET 1.520 bars a CPA's commission when the firm audits or reviews that client. ABA Model Rule 7.2(b) bars paying for recommendations. Rule 1.7(a)(2) treats a lawyer's personal interest as a conflict. Their state bar or board decides. This page reports rule text and gives no legal or ethics advice. ## Who pays whom when your adviser makes an introduction? If your lawyer or accountant introduces you to an AI data company, that company may pay them. Several data companies publish referral programs, and [micro1](/buyers/micro1)'s [referral terms](https://www.micro1.ai/legal/referral-terms) require the person referring to get consent from an authorized representative of the company first. The payment comes from the data company, not your price. It's still a personal interest in where you license your data, which is what the professional rules below look at. [Data broker commission](/answers/data-broker-commission) covers who pays each kind of intermediary. ## What do the ABA Model Rules say? Rule 7.2(b): a lawyer "shall not compensate, give or promise anything of value to a person for recommending the lawyer's services," with listed exceptions. It covers a lawyer paying others. Rule 1.5(e) sets three conditions for dividing a fee between lawyers in different firms. Rule 5.4(a) bars sharing legal fees with a nonlawyer, with narrow exceptions. Rule 1.7(a)(2) finds a concurrent conflict where there is a significant risk that a personal interest of the lawyer will materially limit the representation. Rule 1.7(b) allows it with informed consent, confirmed in writing. Rule 1.8(f) sets conditions for accepting compensation for representing a client from someone else. None of these names a fee from a data buyer. Whether they reach one is for your bar. ## What does the AICPA Code say? [ET 1.520.001](https://mn.gov/boa/assets/AICPA%20Code%20of%20Professional%20Conduct_tcm1233-764395.pdf) bars a member from recommending a product or service for a commission, or receiving one, while the member also performs an audit, a review, certain compilations or an examination of prospective financial information for that client. Paragraph .03 requires disclosure of a permitted commission to the person who gets the recommendation. Paragraph .04 requires disclosure of referral fees for CPA services. The text I read doesn't say whether a data buyer's fee counts as a commission. ## How much do states differ? [California's Rule 7.2(b)](https://www.calbar.ca.gov/legal-professionals/rules/rules-professional-conduct/current-rules-professional-conduct/chapter-7-information-about-legal-services) bars compensation "for the purpose of recommending or securing" the lawyer's services, wording that differs from the Model Rule. Kansas requires CPAs to follow the AICPA code on commissions and referral fees ([K.A.R. 74-5-103](https://www.law.cornell.edu/regulations/kansas/K-A-R-74-5-103)). A [New York State Bar opinion from 2012](https://nysba.org/ethics-opinion-942/) applied Rules 1.5, 1.8(f), 5.4(a) and 7.2(a) to a different arrangement, a nonlawyer firm paying a lawyer. ## What should you ask your adviser? Ask whether anyone will pay them if you sign with the buyer they suggest, and how much. Ask them to put that in writing, and to say which rule for their license allows it. If their firm also audits or reviews your books, ET 1.520's text bars a CPA commission for that client, so ask how they've handled it. Our [advisor pages](/partners) show what your CPA, lawyer or deal advisor should check, and who pays whom. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Ask who pays them -> Get it in writing -> Check the rule. Ask who pays your adviser, get it in writing, then check the rule for their license. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [referral terms](https://www.micro1.ai/legal/referral-terms) - [ET 1.520.001](https://mn.gov/boa/assets/AICPA%20Code%20of%20Professional%20Conduct_tcm1233-764395.pdf) - [California's Rule 7.2(b)](https://www.calbar.ca.gov/legal-professionals/rules/rules-professional-conduct/current-rules-professional-conduct/chapter-7-information-about-legal-services) - [K.A.R. 74-5-103](https://www.law.cornell.edu/regulations/kansas/K-A-R-74-5-103) - [New York State Bar opinion from 2012](https://nysba.org/ethics-opinion-942/) --- # Can I restrict who my data is sublicensed to? > Can you restrict sublicensing of company data? You can ask. Some marketplace terms grant sublicensable licenses by default. Polyshares says it accepts limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-restrict-who-my-data-is-sublicensed-to Published: 2026-07-29 Updated: 2026-10-14 ## The short answer Yes, you can ask for a limit on who gets your data next. Some marketplace terms, such as SimpleClosure's, grant a sublicensable, perpetual license by default. Polyshares says it accepts contract penalties that limit sublicensing to US-based AI research companies. Have a lawyer draft the limit. A sublicensing limit says who, if anyone, can receive the license. > **A sublicense lets your buyer pass your data on to another party.** It works like a library lending a book. A limit decides whether the borrower may lend it on. ## Is sublicensing allowed by default? It depends on the contract. SimpleClosure's terms for companies that list data grant it a non-exclusive, transferable, sublicensable, perpetual and irrevocable license ([details](/answers/ai-data-licensing-services)). Kled's terms and Wirestock's terms carry similar wording. Those are marketplace terms, and a direct buyer's contract may differ. No buyer we read publishes its full contract. ## What does Polyshares say about sublicensing limits? Ryan Lock, a managing partner at Polyshares, wrote that Polyshares offers contract penalties that limit sublicensing to US-based AI research companies ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). He also calls a lack of sublicensing limits a market standard. That is his view alone. Its site says "Use is bounded by the license" and does not say which labs take data ([terms](https://polyshares.com/data-licensing)). _Ask who the second buyer is. "Partners" is not a name._ ## What kinds of limit can you ask for? - A named list of allowed recipients. - A country limit. Check the [DOJ bulk data rule](/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data) first. - A use limit, such as research only. - A penalty or audit right if the buyer breaks the limit. A limit only works if you can check it. Ask how. ## What should you do next? Find the grant clause in the draft and read the sublicensing line. The [agreement template](/answers/data-licensing-agreement-template) lists it with the other grant terms. Our [license versus sale page](/answers/license-or-sell-company-data-to-ai) covers who keeps title. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [X article](https://x.com/RyanLockAI/status/2107864069105389717) - [terms](https://polyshares.com/data-licensing) --- # How much does SimpleClosure cost? What is published > How much does SimpleClosure cost? No price list for shutdowns, and AssetHub takes a percentage it does not publish, only on a completed deal. What to ask. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-much-does-simpleclosure-cost Published: 2026-07-29 Updated: 2026-10-14 ## The short answer SimpleClosure posts no price list. Its AssetHub page says there is no upfront cost and that it takes a percentage only when assets are licensed or transferred, with no rate published. Its terms cap its own liability at the greater of six months of amounts paid or $100. [SimpleClosure](/buyers/simpleclosure) does two jobs. It runs shutdown services for companies winding down. Its Asset Hub, [launched](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html), sells source code and workspace data from those companies to buyers. Its [AssetHub page](https://simpleclosure.com/product/assethub/) now says operating companies can license too. ## What does SimpleClosure publish about price? For the wind-down service, SimpleClosure's [homepage](https://simpleclosure.com) names no figure. It says year-end surge pricing begins November 1 and tells visitors to lock in current pricing. It sends them to a team call. SimpleClosure's launch page for Delaware small businesses shows no price figures either. For AssetHub, the April launch release disclosed no pricing. Its [AssetHub page](https://simpleclosure.com/product/assethub/) now says "There's no upfront cost" and that SimpleClosure "only takes a percentage if your assets are successfully sold or licensed." It does not publish the percentage, so ask for it in writing before you list anything. ## What do the terms say? SimpleClosure's [terms of service](https://simpleclosure.com/tos/) contain no fee structure. They point to separate asset agreements for it. They do contain an owner license that is perpetual, irrevocable and sublicensable. They also contain an owner indemnity and SimpleClosure's own cap of the greater of six months of amounts paid or $100. The full list of owner promises is in [reps and warranties](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for). > **A perpetual, irrevocable license has no end date and no way to cancel.** It's like renting out a room with no end date. The house stays yours, but the room never comes back. ## What do owners receive? Forbes reported, as [relayed by Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) that SimpleClosure had processed nearly 100 deals in the past year. Payouts were $10,000 to $100,000 per company. The article does not say whether those figures were SimpleClosure's own, so read them as company-sourced. Tiered dollar figures on SimpleClosure's [affiliate page on Dub](https://partners.dub.co/simple-closure) are what it pays affiliates, not a price list for you. Figure: range, Reported Asset Hub payouts per company, $10K to $100K. Forbes reported a tenfold spread in Asset Hub payouts per company. Source: Forbes via Gizmodo, company-sourced. ## What should you ask before you sign? - What is the fee or revenue share on a data license, in percent and in dollars? - Who is the buyer, and can I see the sale terms? - How does it process personal information, and who holds the mapping? - What does the perpetual, irrevocable license let a buyer do next? - If a buyer is breached, who pays? See [who is liable if the data buyer is hacked](/answers/who-is-liable-if-the-data-buyer-is-hacked). _Asking "how much?" is allowed. It is even encouraged._ Companies that are not shutting down can use AssetHub too, per its page, and they have other routes. Those are compared in the [buyers directory](/buyers) and the [guide to licensing company data](/guides/how-to-sell-company-data-to-ai-companies). The [rights check](/rights-check) asks the rights questions any of them will raise. Talk to a privacy or commercial lawyer in your state before you sign. Have a lawyer read any contract before you sign. They like that. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [launched](https://finance.yahoo.com/sectors/technology/articles/simpleclosure-launches-asset-hub-unlock-130000668.html) - [AssetHub page](https://simpleclosure.com/product/assethub/) - [homepage](https://simpleclosure.com/) - [terms of service](https://simpleclosure.com/tos/) - [relayed by Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [affiliate page on Dub](https://partners.dub.co/simple-closure) - [SimpleClosure Asset Hub announcement](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [SimpleClosure CEO post](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) --- # Real data vs synthetic data for AI agents > Real data vs synthetic data for AI agents: Troveo says synthetic stretches and real grounds. Epoch shows labs buy app clones. Where each wins, and who says so. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/real-data-vs-synthetic-data-for-ai-agents Published: 2026-07-29 Updated: 2026-10-14 ## The short answer Real data vs synthetic data for AI agents divides the labor. Synthetic data handles edge cases and privacy. Real data grounds the model and tests it. Labs buy app clones for about $300,000, but no public study shows real company data beats a clone. Everyone in the public sources has a stake here. [Troveo](/buyers/troveo) and [micro1](/buyers/micro1) gain when AI labs want real data. Clone vendors gain when they do not. ## Where does synthetic data win? [Troveo's guide](https://www.troveo.ai/resources/synthetic-vs-real-training-data) says synthetic data "earns its place in four situations": - **Edge cases.** These are rare events, such as crashes a driving system rarely sees. - **Privacy-sensitive domains.** Generated stand-ins avoid personal records. - **Labeling.** Synthetic data arrives with labels attached. - **Volume balancing.** It fills classes that have too few examples. For agents, Epoch describes environments that are simulated websites or app clones. Each task has a prompt and an automated grader. A clone is synthetic by design. ## Where does real data win? The same Troveo guide says synthetic data is risky in bulk and names model collapse, where models trained on model output get worse. Troveo also says that testing on generated scenarios grades the generator and not the world. Its view is that real data does the grounding, and held-out real data does the testing. micro1's CFO made the agent version of the point in an undated recorded forum talk. Built environments imitate the world. Real company data shows how a real problem got resolved (self-reported). A second micro1 speaker said training so far has leaned mostly on synthetic data built with experts' help. These setups do not copy the real world, and a narrow ask yields a fixed artifact. The new data aims to capture "what is really going on behind the scenes in the workplace" (self-reported, about 17:30 to 18:00). ## What does Epoch add? [Epoch's FAQ](https://epoch.ai/gradient-updates/state-of-rl-envs) reports that exclusive deals for environments cost roughly four to five times non-exclusive ones. One lab researcher it quotes said many clones are buggy and not useful. It also says labs such as Cursor can use user data to build tasks. It does not say whether real company data makes better environments than clones. ## What does this mean for a company with records? Real company data is a bet. The bet is that agents learn more from a real chain of work than from a built one. The vendors say yes. No independent comparison is public. Read my page on the [reasons labs want real data](/answers/why-ai-labs-want-real-company-data) and the [RL environment explainer](/answers/what-is-an-rl-environment) next. My free [fit check](/business) and [rights check](/rights-check) start from what you hold. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Where each kind of data wins, per Troveo: Synthetic data (Stretches a base), Real data (emphasized: Grounds and tests the model, Grounds and tests). Troveo says real data grounds and tests the model, while synthetic data stretches it. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's guide](https://www.troveo.ai/resources/synthetic-vs-real-training-data) - [Epoch's FAQ](https://epoch.ai/gradient-updates/state-of-rl-envs) --- # Does my NDA let me license data to AI? > Wondering if your NDA lets you sell data to AI? Its text decides any license: the definition of confidential information, permitted use and term. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/does-my-nda-let-me-sell-data-to-ai Published: 2026-07-28 Updated: 2026-10-14 ## The short answer It turns on your NDA's own text: its permitted use, its definition of confidential information and its term. The Defend Trade Secrets Act reaches disclosure by someone who knew the secret was acquired under a duty of secrecy. Ask counsel to read each NDA against the deal. Email and chat archives hold other companies' information. [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), a law firm, says that content is "often covered by NDAs." ## What do I read in the NDA? Read three parts: - **Definition of confidential information.** It says what the NDA covers, and whether a thread with a partner falls inside it. - **Permitted-use clause.** It says what you may do with the information. - **Term and survival clause.** It says whether the duty continues after the relationship ends. Those three parts decide the question. A lawyer who has read all your NDAs can sort the archive into what is covered and what is not. ## What does trade-secret law add? The Defend Trade Secrets Act defines misappropriation to include disclosure or use by a person who knew, or had reason to know, that their knowledge of the secret was "acquired under circumstances giving rise to a duty to maintain the secrecy of the trade secret or limit the use of the trade secret" ([18 U.S.C. 1839(5)(B)(ii)(II)](https://www.law.cornell.edu/uscode/text/18/1839)). A partner whose secret sits in your mailbox is the kind of party that statute protects. I found no reported case where that happened to a seller of its own archive. ## Did a partner object to the Spirit Airlines data sale? In the Spirit Airlines bankruptcy, Springshot argued that part of the archive was data generated by its software. It said its contract covered that data. International Aero Engines pointed to confidentiality agreements. It said its proprietary information must be excluded. [The Next Web](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google) reported both. That was a court sale, which gave partners a place to object. ## Does anonymizing fix NDA limits? A [micro1](/buyers/micro1) referral partner said in a micro1 video that anonymization and the licensing agreement let almost any company take part (self-reported, about 13:46). Anonymization targets personal data. An NDA covers the confidential information its own text defines. Whether stripped content falls outside the NDA is a question for counsel. The video describes no contract term, so nothing shows what the licensing agreement protects against. ## What do law firms recommend? FKKS recommends excluding customer or partner confidential data from a licensing deal. It also recommends reviewing customer, partner, vendor and platform terms before any offer. [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) says a data provider should offer representations that it has sufficient rights to license the dataset. It also says to offer indemnification for third-party claims. An NDA that covers part of the archive makes that promise hard to keep. Talk to a commercial lawyer in your state before you sign. See also [who owns company emails](/answers/who-owns-company-emails) and our [rights check](/rights-check), which starts with a contract index. Figure: steps Find every NDA -> Read definition, use and term -> Counsel reviews. An NDA question gets answered by three clauses, read in order. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [18 U.S.C. 1839(5)(B)(ii)(II)](https://www.law.cornell.edu/uscode/text/18/1839) - [The Next Web](https://thenextweb.com/news/springshot-objection-spirit-airlines-data-google) - [Sidley](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) --- # Troveo alternatives: who else takes company data > Troveo alternatives for company data: micro1, Handshake AI, Mercor, Replay, Polyshares and SimpleClosure, with the size, pay and terms each one states. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/troveo-alternatives Published: 2026-07-28 Updated: 2026-10-14 ## The short answer Troveo alternatives include micro1 and Handshake AI, which publish minimums and payment ranges, Mercor with 100+ tool connectors, Replay, which pays upfront plus a revenue share, Polyshares, which pays per license, and SimpleClosure for closing startups. Every figure is self-reported, and none is an offer. [Troveo](https://www.troveo.ai/business-data) runs a marketplace that licenses company data to buyers for a revenue share. How its program works is in [Troveo business data](/answers/troveo-business-data). The options below take company records in other ways. ## Which Troveo alternatives publish their terms? micro1, Handshake AI, Mercor, Replay, Polyshares and SimpleClosure each publish a size floor, a pay model or both on their own pages. Troveo states no minimum, and its estimator starts at 20 employees. **Troveo alternatives, side by side** | Buyer or program | Minimum size | Stated range | Pay model | Payment timing | What you keep | |---|---|---|---|---|---| | [micro1](https://vaultfish.com/buyers/micro1) | 30+ employees, US first | Tiers of $100K+, $500K+, $1M+ | Paid under the agreed partnership | Not published | Companies keep ownership | | [Handshake AI](https://vaultfish.com/buyers/handshake-ai) | 20+ full-time staff, 3+ years | $100K to $4M+ | License fee | 30 to 60 days after dataset acceptance | Not published | | [Mercor](https://vaultfish.com/buyers/mercor) | None stated | Up to $300K, press report | One wire, no fees to you | 2 to 4 weeks after signing | Not published | | [Replay](https://vaultfish.com/buyers/replay) | Bands start at 20 employees | $10K to $1M+ by headcount | Upfront plus revenue share | Upfront, then on each license | License only, nothing transferred | | [Polyshares](https://vaultfish.com/buyers/polyshares) | None stated | $100K to $2M+ | License fee, no commission | Net 30 to 60 after approval | You keep data, exclusive by default | | [SimpleClosure Asset Hub](https://vaultfish.com/buyers/simpleclosure) | None stated, closing or operating | $10K to $100K per company, press | A percentage on a sale or license | Not published | Perpetual license to SimpleClosure | _Every figure is the company's own claim unless marked press. Terms change, so confirm on each company's page._ ## Which Troveo alternative also shares revenue? Replay is the closest match. It pays upfront plus a revenue share of every license, where Troveo pays only a share of each sale. Replay also publishes headcount bands, starting at $10K to $100K for 20 to 50 employees. The two are compared line by line in our [Replay review](/answers/replay-review). ## What if the company is closing? **[SimpleClosure](/buyers/simpleclosure) AssetHub** licenses source code and workspace data from startups that are winding down. [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) nearly 100 deals at $10,000 to $100,000 per company. Its AssetHub page says it takes a percentage only when assets are sold or licensed, and publishes no rate. See [SimpleClosure Asset Hub](/answers/simpleclosure-asset-hub). A free listing board, [BuyMyDeadStartup](/answers/buymydeadstartup), is also an option. ## What about sites that don't name a buyer? Some sites collect your details and pass you to a partner they don't name, or publish no terms you can read. Ask who the buyer is before you share anything. Our [red flags page](/answers/ai-data-broker-red-flags) lists what to check. Marketplaces such as Defined.ai and [Datarade](https://datarade.ai/) list packaged datasets, a different lane from company archives. See [Defined AI data marketplace](/answers/defined-ai-data-marketplace). ## How should a company choose between Troveo and the alternatives? Ask each one the same questions: who is the legal entity, who receives the data, what share do I keep, and who holds liability if a recipient is breached. The [buyers directory](/buyers) and [deals tracker](/deals) keep the dated facts, and the [rights check](/rights-check) comes before any of them. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [Datarade](https://datarade.ai/) - [Troveo: how much is company data worth](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [Troveo: AI data licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Troveo content owners](https://www.troveo.ai/content-owners) --- # Troveo revenue share: what is published > Troveo revenue share: owners get a share of every sale and pay no fees, but the percentage and the price list are unpublished. What to ask before you sign. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/troveo-revenue-share Published: 2026-07-28 Updated: 2026-10-14 ## The short answer Troveo revenue share means you receive a percentage of each sale, but the percentage is unpublished. Its pages say you share in revenue on every sale with no fees or deductions. Ask for the split, how "net" is defined, and what comes off before your share. The percentage is the one number every owner wants and no public [Troveo](/buyers/troveo) page gives. What follows is what the pages do say, dated, so you know what to ask for. ## What does Troveo say about its revenue share? On the [business-data page](https://www.troveo.ai/business-data) Troveo says you "share in the revenue" on every sale, "the first and every one after." Its FAQ adds that owners pay "no fees, no setup costs, no deductions from your payouts" and that Troveo only makes money when you do. Troveo also runs a video licensing line. A [Publish Press](https://news.thepublishpress.com/p/how-to-make-money-when-ai-uses-your-content) write-up says that line pays a share based on gross earnings, and Troveo's [content-owners page](https://www.troveo.ai/content-owners) calls those payments royalty-based. Neither states a percentage. Figure: comparison of What Troveo's pages say about its split: Business data (Share of every sale), Video line (Share of gross), The percentage (emphasized: The percentage is unpublished, Unpublished). Troveo's pages describe a share for business data and for video, and the percentage is unpublished. ## Does Troveo publish a price list? No. Troveo's own [cost guide](https://www.troveo.ai/resources/ai-training-data-cost) says there is "no price list for AI training data." It names scarcity, exclusivity, rights cleanliness and readiness as price drivers. Its [company-data guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) says typical full-company deals start at six figures. It cites about $5,000 for a single repository as an unnamed platform's baseline. Neither figure says what you would get. ## What does "net" mean in a Troveo deal? Troveo's own assessment page uses "net earnings" language. The word suggests a deduction between the sale price and your share, and no public page defines it. ## What should you ask before you sign? - What percentage of each sale do I receive, and is it fixed? - How is "net" defined, and what comes off before my share? - How long does exclusivity last, and what are the exit terms? Troveo says it is time-limited and ["has to be earned."](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - Which buyer categories see my data, and can I decline one? - When and how are payouts reported? Compare the program with others in the [buyers directory](/buyers), and run the [rights check](/rights-check) before you export anything. [How Troveo's business-data program works](/answers/troveo-business-data) has the process. Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [business-data page](https://www.troveo.ai/business-data) - [Publish Press](https://news.thepublishpress.com/p/how-to-make-money-when-ai-uses-your-content) - [content-owners page](https://www.troveo.ai/content-owners) - [cost guide](https://www.troveo.ai/resources/ai-training-data-cost) - [company-data guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - ["has to be earned."](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - [Troveo: AI data licensing deals](https://www.troveo.ai/resources/ai-data-licensing-deals) --- # What data do AI labs want from companies? The chain > What data do AI labs want from companies? micro1 says the chain from a request to the finished work, such as a Slack request and a report. Self-reported. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-data-do-ai-labs-want-from-companies Published: 2026-07-28 Updated: 2026-10-13 ## The short answer Labs want the chain from request to finished work across tools. In an undated forum talk, micro1's David Revland described a Slack request for a finance report and the report in Sheets. Troveo says AI companies pay more for work they can follow. Neither publishes a figure. The sources agree on the shape of what buyers want. They don't agree on a price. None is public. ## What is the request-to-deliverable chain? [micro1](/buyers/micro1)'s CFO used a marketing budget request as the example in an undated recorded forum talk. The value the CFO described is the path from the request, through the analysis, to the approval, spread across tools. A Slack message asks. A spreadsheet holds the work. An email carries the approval. Each step sits in a different system. The CFO said in the same talk that micro1 does not want personal information, since the workflow is the product. In a micro1 video, an unnamed micro1 speaker named three most valuable artifacts (self-reported, about 0:41): - Company workflow and operational data. - Google Workspace data. - Internal communications. ## Which tools does the chain run through? micro1's data manifest form, as described in the undated recorded forum talk, asks about Google Workspace, Slack, project management tools and GitHub. [Mercor's data page](https://www.mercor.com/data/) lists Slack messages, Gmail, Salesforce accounts and opportunities, GitHub repositories, and Notion, Confluence and Drive content. [Troveo](https://www.troveo.ai/business-data) groups systems into eight named categories, from chat and email to finance and code. It adds a catch-all for internal and custom systems. Our [data manifest form page](/answers/what-is-a-data-manifest-form) shows where that step sits in micro1's process. ## Do outcomes matter? [Troveo](/buyers/troveo)'s [guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) says data showing what happened next adds signal that activity logs lack. Examples are won or lost, and resolved or escalated. Fortune, in its report on micro1's Spirit offer, wrote that an agent needs to learn how to choose actions, use tools, respond to intermediate results and recover from mistakes. It said AI companies call the record of those steps a trajectory. ## What does a lab do with the chain? The sourced uses are on our page about [what labs do with company data](/answers/what-do-ai-labs-do-with-company-data). The reasons real chains beat built ones are on [why labs want real company data](/answers/why-ai-labs-want-real-company-data). What labs say they look for in an offer, from their own job posts, partnership page and intake form, is on [how a lab's data team judges an offer](/answers/how-ai-labs-evaluate-a-data-offer). ## Where does a company start? List the tools your team uses and who administers each. Our [rights check](/rights-check) asks who owns the records and who can sign. The [data readiness checklist](/answers/data-readiness-checklist) adds the questions a lawyer will ask. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps A Slack message asks -> Work happens in Sheets -> The finished report. micro1's David Revland said in an undated recorded forum talk that labs want the whole chain, from the ask to the finished report. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's data page](https://www.mercor.com/data/) - [Troveo](https://www.troveo.ai/business-data) - [guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) --- # How to license Slack data to AI: who buys and how > Searching how to sell Slack data to AI? You license it. Who has taken workspace archives, how owners export them, and the contract and privacy limits first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-slack-data-to-ai Published: 2026-07-27 Updated: 2026-10-14 ## The short answer An owner exports the Slack workspace or lets a buyer connect to it. SimpleClosure reported processing nearly 100 startup shutdowns at $10,000 to $100,000 per company. Slack's API terms bar outside apps from using API data to train an LLM. Free and Pro export public channels only. Slack is the tool press coverage names most often. micro1's CFO says labs want it because a thread shows who asked for what and how the work got approved. ## Who has bought Slack data? [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) reported that [SimpleClosure](/buyers/simpleclosure) had processed nearly 100 deals at $10,000 to $100,000 per company. [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) reported that Mercor approached failed or acquired startups for datasets that include Slack chat logs, with offers as high as $300,000. Both are company claims reported by the press. I found no price list for Slack data alone. ## What do AI labs want from Slack threads? [micro1](/buyers/micro1)'s David Revland, who works on human data, said in an undated recorded forum talk that labs want the chain from request to deliverable, such as a Slack message asking for a finance report plus the finished report in Google Sheets (self-reported, recording undated). ## How does the data leave Slack? [Slack's help page](https://slack.com/help/articles/204897248) sets the limits by plan. Free and Pro owners and admins export public channels. Business+ owners can export all channels, including private channels and direct messages. Enterprise org owners can export all channels and direct messages. Slack's [export tools guide](https://slack.com/help/articles/204897248-Guide-to-Slack-import-and-export-tools) puts the owner in charge of two things: appropriate employment agreements and corporate policies, and making sure all use of data exports is permitted under applicable law. Files come out as links, not as the files themselves, on Free, Pro and Business+. ## What happens to the Slack messages after a deal? For Slack messages, micro1's David Revland said in an undated recorded forum talk that its team swaps each name for a consistent stand-in across every tool. micro1 staff said companies cannot scrub first. SimpleClosure said it removes personally identifiable information (Gizmodo). Whether removal holds up is a separate question. See [can AI re-identify anonymized emails and Slack messages](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages). ## What limits a Slack deal? Four pages cover the limits, one each: - [Whether it is legal to license company Slack data](/answers/is-it-legal-to-sell-company-slack-data) - [What Slack's API terms say about exported data](/answers/does-slack-allow-ai-companies-to-use-my-exported-data) - [Shared channels with other companies](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai) - [Staff messages when the company is shutting down](/answers/can-a-shutting-down-company-sell-its-slack-to-ai) Your [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai) come before all four. Our [rights check](/rights-check) asks whose records these are and whether staff messages are included, and the free [fit check](/business) asks where the work happens. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Inventory channels, counsel review -> Export -> Buyer transforms, verify and pay. Slack licensing starts with counsel reviewing the channels before anything is exported. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [Slack's help page](https://slack.com/help/articles/204897248) - [export tools guide](https://slack.com/help/articles/204897248-Guide-to-Slack-import-and-export-tools) --- # License Intercom conversations to AI: what to check > Hoping to sell Intercom conversations to AI? Licensing them starts with the export. The CSV holds metadata only, and threads carry your customers' words. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-intercom-conversations-to-ai Published: 2026-07-27 Updated: 2026-10-14 ## The short answer To license Intercom conversations to AI, you need the Conversations API or Amazon S3 export because the CSV export holds only metadata, not messages. Conversations carry customer names, emails and words, so privacy law and your customer contracts limit the deal. I found no published price for Intercom data. A support thread holds a problem, the replies and how it ended. Troveo's guide calls the outcome, resolved or escalated, the useful signal. I'd add that every one of them also holds a customer's own words. ## Which companies name Intercom? [Troveo](https://www.troveo.ai/business-data) names Intercom alongside Salesforce, HubSpot and Zendesk under CRM, sales and support. [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) puts customer support among its six areas. All of that is self-reported. For what buyers say about the data type itself, see our pages on [support tickets](/answers/sell-support-tickets-to-ai) and [customer service transcripts](/answers/sell-customer-service-transcripts-to-ai). ## What does an Intercom export include? Less than you'd hope. [Intercom's help article](https://www.intercom.com/help/en/articles/2046229-export-your-intercom-data) says the CSV export holds reporting metadata. That means conversation IDs, timestamps, attributes and metrics. Conversation and message content is not included. For the messages you need the Conversations API or an Amazon S3 JSON export. A browser download takes up to 10,000 rows. Larger exports arrive by email. The API allows a maximum 90-day timeframe per request. Data is generally available for up to two years. Exporting needs the "Can access Chart drill-in" and "Can export CSV" permissions. ## What does Intercom do with conversation data? [Intercom's AI training page](https://www.intercom.com/help/en/articles/11993352-ai-model-training-and-fine-tuning) says it uses anonymized data from Fin conversation logs to train custom models. It says it removes direct and indirect identifiers first. A workspace opts out under Settings, Workspace, Security, AI model training and fine-tuning. Intercom says it processes requests within 30 days. Some accounts are opted out by default: - Those with a signed business associate agreement. - EU or AU regional workspaces. - Trial accounts. - Contracts negotiated before September 2025. That covers Intercom's own use of the data. It doesn't tell you whether you may license it. ## Whose data is inside a conversation? Your end customers'. Names, emails and message text all sit in the threads. California treats a transfer for money as a sale of personal information. [The CCPA page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) explains the test. [GDPR](/answers/gdpr-company-data-ai-training) applies to people in the EU. Your [customer contracts](/answers/do-customer-contracts-allow-selling-data) may add limits of their own. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three ways to export Intercom conversations: CSV export (Metadata only), Conversations API (emphasized: Carries message content, Message content), Amazon S3 export (JSON, message content). The Conversations API carries message content, which the CSV export leaves out. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Intercom's help article](https://www.intercom.com/help/en/articles/2046229-export-your-intercom-data) - [Intercom's AI training page](https://www.intercom.com/help/en/articles/11993352-ai-model-training-and-fine-tuning) --- # What does a data licensing advisor do? > A data licensing advisor helps a company prepare and negotiate an AI data deal. How it differs from a finder, how advisors get paid, and conflicts to ask about. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-licensing-advisor Published: 2026-07-27 Updated: 2026-10-14 ## The short answer A data licensing advisor helps prepare, price and negotiate a license to an AI buyer. Titles overlap with finder. The key question is who pays them and when, as success fees, buyer referrals and flat fees each create different conflicts. ## What does an advisor do day to day? The tasks fall into four groups. Inventory your systems and records, line up facts about rights, match you to buyers and compare the terms on offer. A typical process runs as a fit check, a discovery call, buyer review over the following weeks, then signing and delivery. Ask where the data travels. The cleaner setup sends it from your systems straight to the buyer you sign with, so the advisor never holds a copy. ## How is an advisor different from a finder? Role and payment are separate questions. An advisor, as the word is normally used, works for the owner. A finder may sit between the owner and a buyer, and may be paid by either side or both. The same firm can do both jobs, so the fee model tells you more than the title. ## What conflicts of interest can exist? Each fee model pulls in a different direction. - A success fee pays only if a deal closes, which gives the advisor a reason to close. - A referral fee paid by a data program gives a reason to steer you to that program. [micro1's referral terms](https://www.micro1.ai/legal/referral-terms) are one published example. - A flat fee pays either way, which gives a reason to sell the review over the deal. None of these makes an advisor a bad choice. They tell you what to ask. ## What does disclosure require? The FTC's rule on endorsements says a connection that might affect the weight of a recommendation, and that the audience would not expect, must be disclosed clearly and conspicuously ([16 CFR 255.5](https://www.law.cornell.edu/cfr/text/16/255.5)). A paid link next to the link is the plain version. I'd ask any advisor which buyers pay it and how. ## What can an advisor not do? Give legal advice, unless the advisor is also a law firm. Ask that question early. Whether you hold the right to license your records is a question for counsel. Talk to a privacy or commercial lawyer in your state before you sign. The [rights check](/rights-check) and [risk map](/risks) show what to bring them. Figure: comparison of Three ways a data licensing advisor gets paid: Flat fee (Paid either way), Success fee (emphasized: Pay tied to a closed deal, Paid if a deal closes), Buyer referral (Paid by the buyer). A success fee is paid only if a deal closes, which ties the advisor's pay to the outcome. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's referral terms](https://www.micro1.ai/legal/referral-terms) - [16 CFR 255.5](https://www.law.cornell.edu/cfr/text/16/255.5) --- # Defined AI data marketplace: how licensing works > Looking at selling through Defined AI? It licenses data from business partners. The consent proof it asks for, and its self-reported figures like $85M raised. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/defined-ai-data-marketplace Published: 2026-07-26 Updated: 2026-10-14 ## The short answer Defined AI marketplace lists datasets for AI training through four reviews ending in ethics and compliance check. Defined.ai reports 65% revenue growth and $85M raised, figures about the company that predict nothing for your company. Commission unpublished. Requires consent documentation and commercialization rights. [Defined.ai](/buyers/defined-ai) shows up in searches next to the company-data buyers, but it sits in a different lane. It lists datasets that a business has already packaged and cleared for licensing. ## What is the Defined.ai marketplace? Defined.ai provides AI training data through a data marketplace. It also sells custom services such as data collection, annotation and evaluation. Its [release](https://defined.ai/press-room/defined-ai-reports-sixty-five-percent-revenue-growth) reports three numbers: - 65% revenue growth in 2025 - 143% net revenue retention - a 1,200% rise in third-party partner datasets on the marketplace It says it has raised $85M in total. Its [partner page](https://defined.ai/partnerships) also quotes what partners take in. I leave those figures out, because one company's revenue predicts nothing for yours. I found no audit of any of them. ## How does a business license data there? Its [data partner page](https://defined.ai/partnerships) says any business that generates or aggregates data can apply. The data can be audio, video, image, text or multimodal. Figure: steps Create account, market review -> Data quality review -> Ethics and compliance check. Defined.ai describes a process from account creation to a compliance check before a dataset is listed. Partners must show the data is "ethically sourced, including proper consent, documentation, and the right to commercialize" it for AI training. The marketplace lists what it is seeking, including cinematic video, anime-style imagery, code and STEM content. ## What does it charge? The partner page does not state a commission or fee structure. Without that number you can't compare it with other marketplaces. Ask for the revenue split and payment timing in writing. For another marketplace's disputed rate, see [Datarade marketplace](/answers/datarade-marketplace). ## Does it fit a company with Slack and email archives? A company archive is a different asset from a packaged dataset. I found no Defined.ai program for it. Consent documentation is a stated requirement there. Messages written by employees and customers raise exactly the consent questions in the rights check. The [buyers directory](/buyers) compares buyers that run company-data programs. The [rights check](/rights-check) shows what to confirm before any listing. Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [release](https://defined.ai/press-room/defined-ai-reports-sixty-five-percent-revenue-growth) - [partner page](https://defined.ai/partnerships) --- # What is a data corpus for AI? > What is a data corpus for AI? A body of data treated as one set. In micro1's program it means a company's whole archive across its tools. Self-reported. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-a-data-corpus-for-ai Published: 2026-07-26 Updated: 2026-10-13 ## The short answer A data corpus for AI is data treated as one set. In micro1's program it is a company's whole archive across its tools. micro1's page lists $100K+ to $1M+ tiers and 30+ employees, and it states no data-size threshold. The word sounds academic, and it is. Companies now use it for something closer to a filing cabinet. ## Where does the word come from? The plural is corpora. In natural language processing a text corpus is a collection of language data. Researchers often annotate it, for example by tagging each word's part of speech, so a study or a model can use it ([Wikipedia](https://en.wikipedia.org/wiki/Text_corpus)). That sense is a collection built for a purpose. The business sense keeps the idea of one body of data. ## What does corpus mean in micro1's program? In an undated recorded forum talk, David Revland, who works on human data at [micro1](/buyers/micro1), used "corpus" for everything a company has stored: Google Workspace, Slack, project management tools and GitHub. The corpus deal is the track where that whole body moves in one transfer, under a partnership in which micro1 says you keep ownership of the underlying data. micro1's pages state no data-size threshold. Its current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. The undated talk gave earlier size, staff and language figures, which are history. See [micro1's requirements](/answers/micro1-data-partnership-requirements) for both. ## How is a corpus different from a workflow? A corpus looks backward at records you already hold. micro1's workflows track produces new records, because employees grade an AI agent on live tasks. In the undated talk, Revland also described a possible top-up about six months after a corpus deal, covering data created since. Our [corpus vs workflows page](/answers/micro1-corpus-sale-vs-workflows-track) compares the two. ## Do other companies use the word? Not in the pages I read. Troveo calls it company data exports. [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) says operational data and datasets (all). If a buyer says corpus, ask what it includes and which tools are in scope. ## What should you do before a corpus deal? Count it by tool, since micro1's data manifest form asks for a rough size per tool. Then sort it by who holds the rights, because a corpus includes material that isn't yours to license. The [rights check](/rights-check) asks whose records these are and what your contracts allow, and our [managed readiness service](/managed-readiness) works through the count with you without touching your data. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two ways to take part in micro1's program: Corpus deal (emphasized: Covers the whole archive, Whole archive, once), Workflows track (New records by task). In micro1's program a corpus is the whole archive, moved once, while the workflows track repeats by task. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Wikipedia](https://en.wikipedia.org/wiki/Text_corpus) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) --- # 1099 data licensing: which IRS form applies > 1099 data licensing: the IRS puts royalties from intangible property in 1099-MISC box 2 at $10, and no buyer page I read says which form it issues. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/1099-data-licensing Published: 2026-07-24 Updated: 2026-10-13 ## The short answer For 1099 data licensing, the IRS splits royalty payments at $10 or more into Form 1099-MISC box 2. Other payments go to 1099-NEC box 1a (services, $2,000+) or 1099-MISC box 3 (other income, $2,000+). Ask the buyer in writing which form it will issue. A 1099 is the payer's report to the IRS and to you. The [IRS instructions](https://www.irs.gov/instructions/i1099mec) spell out who files which form and when, and it reads drier than you'd hope. ## Who files a 1099? Only payments made in the course of a trade or business are reportable. The IRS instructions say personal payments are not, and that nonprofit organizations count as engaged in a trade or business. If someone pays you privately, outside any business, they don't file. ## Which box covers which payment? - **1099-MISC box 2, royalties.** Gross royalties of $10 or more. The instructions say to use box 2 for royalty payments from intangible property such as patents, copyrights, trade names and trademarks. - **1099-NEC box 1a, nonemployee compensation.** $2,000 or more for services in the course of the payer's business, including fees and commissions. - **1099-MISC box 3, other income.** Other income of $2,000 or more that isn't reportable in another box. For tax years beginning after 2025, the [instructions](https://www.irs.gov/instructions/i1099mec) say the threshold for certain information returns and backup withholding rose to $2,000, and may be adjusted for inflation starting in calendar year 2027. The $10 royalty threshold is unchanged in the text I read. ## Do payments to a company get a 1099? Payments to a corporation, including an LLC treated as a C or S corporation, generally don't need a Form 1099-MISC. The instructions also list payments to corporations that are reportable, attorneys' fees among them, so the payer has to check that list. ## When are 1099 forms due? Form 1099-NEC is due to the recipient and the IRS by [January 31](https://www.irs.gov/instructions/i1099mec). Form 1099-MISC is due to the IRS by February 28 on paper or March 31 electronically. ## What do the companies say about 1099s? [Troveo](https://www.troveo.ai/business-data), [micro1](/buyers/micro1) and the other company pages I read don't say which form they issue for a data payout, or whether they issue one. My [income page](/answers/is-data-licensing-income-taxable) covers whether the income is taxable. Here's what I'd do: ask any payer in writing which form it will issue and what taxpayer information it needs. That's [Form W-9](https://www.irs.gov/forms-pubs/about-form-w-9) for a US company and a Form W-8 for a foreign one. Talk to a tax professional about your own situation. Figure: comparison of Three 1099 boxes by type of payment: 1099-MISC box 2 (emphasized: Names patents and copyrights, Royalties, $10+), 1099-NEC box 1a (Services, $2,000+), 1099-MISC box 3 (Other, $2,000+). The IRS puts royalties from intangible property in 1099-MISC box 2, at a $10 threshold. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [IRS instructions](https://www.irs.gov/instructions/i1099mec) - [Troveo](https://www.troveo.ai/business-data) - [Form W-9](https://www.irs.gov/forms-pubs/about-form-w-9) micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) --- # License agency data to AI: own records and client files > Want to sell agency data to AI? You can license your own records. Client files sit under client contracts, so sort what you own and check buyer size limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-agency-data-to-ai Published: 2026-07-24 Updated: 2026-10-14 ## The short answer To license agency data to AI, separate the agency's own records from client files. Client files sit under client contracts and often hold confidential information covered by NDAs, so a lawyer reads those agreements first. An agency sits on two kinds of records. Some belong to the agency, and some belong to the people it works for. ## Whose data does an agency hold? The [Frankfurt Kurnit memo](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) tells owners to review customer, partner, vendor and data license agreements and to identify data held as a service provider or processor. My reading is that client work often falls into that second group, because agencies handle material on a client's behalf. The agency's own records are the cleaner part: internal chat about its operations, its project tickets and its finance files. Even there, client names show up in the threads. My [rights check](/rights-check) asks whose records these are, yours or your clients'. ## Does an agency meet published size limits? [micro1's web page](https://www.micro1.ai/data-partnerships) describes operationally mature companies with 30 or more employees, with US companies first and English-language records. In an undated recorded forum talk, [micro1](/buyers/micro1) staff gave earlier figures of 20 full-time staff and about 1 TB of data (self-reported). That talk is history. micro1's current pages say 30 or more employees, and my [micro1 guide](/guides/micro1-data-partnership) dates both. The lowest published staff figure I found is [Handshake AI](/buyers/handshake-ai)'s 20 full-time employees, so a smaller studio may find no buyer whose published criteria fit today. ## What if a client asks about licensing its own data? That call is the client's, made with its own lawyer. The client's data belongs to the client, so ask before you name it to anyone, and keep its files out of any conversation with a buyer. For your agency's own records, the [rights check](/rights-check) is a free place to start. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of What an agency holds: Agency records (emphasized: The cleaner place to start, Yours to check), Mixed threads (Client names inside), Client files (Client contract decides). Start with the agency's own records, and leave client files to the client's contract. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Frankfurt Kurnit memo](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [micro1's web page](https://www.micro1.ai/data-partnerships) --- # How to export Slack data: what each plan allows > How to export Slack data: Free and Pro export public channels, Business+ adds private channels and DMs on approval, Enterprise adds custom exports. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-to-export-slack-data Published: 2026-07-23 Updated: 2026-10-14 ## The short answer What you can export depends on your plan. Free and Pro export public channels only. Business+ exports public and private channels and DMs after the Primary Owner approves. Enterprise adds filtered and custom exports. JSON exports hold links to files, not the files. [Slack's help page](https://slack.com/help/articles/201658943) treats the export as an admin task and hands you a plan-by-plan menu. ## Who can export on each plan? Free and Pro workspaces: Workspace Owners and Admins can export public channels only. Business+: Workspace Owners and Admins, with private channels, direct messages and a channel audit report available after the Primary Owner approves. Enterprise: Org Owners, plus the Export Admin system role. File links reach back 90 days on Free and have no time limit on Pro, Business+ and Enterprise. Enterprise is the plan with custom, filtered and user-specific exports, in JSON or TXT. ## What does an export contain? Each channel or direct message gets its own folder of date-stamped JSON files. Reference files such as users.json, channels.json, groups.json and dms.json sit beside them. [Slack says](https://slack.com/help/articles/220556107) JSON exports contain no workspace files, only links that point back to them. A single-user TXT export does include a files folder. ## How long does it take? I found no Slack page that gives a time or a size cap for an export. Treat any figure you hear as unverified until Slack states it. ## Is exporting your job in a corpus deal? [micro1](/buyers/micro1)'s CFO said in an undated recorded forum talk that its forward-deployed engineering team helps your IT people with the transfer. The CFO estimated about 10 hours of work over a week or two from one or two IT people (self-reported, recording undated). For the longer version, see [how long a data transfer takes](/answers/how-long-does-a-data-transfer-take) and [micro1's process](/answers/micro1-data-partnership-process). ## What should you check before exporting? The route you pick decides which terms apply. [Slack's API terms](https://slack.com/terms-of-service/api), limit apps that pull data through the API, and they are written for app providers. [What Slack's terms say about exported data](/answers/does-slack-allow-ai-companies-to-use-my-exported-data) reads the text. Channels also hold your staff's words and other companies' words. Run the [rights check](/rights-check) first, then look at the [Slack licensing overview](/answers/sell-slack-data-to-ai) and [how to size a workspace](/answers/how-to-check-slack-workspace-size). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of What a Slack export can include, by plan: Free and Pro (Public channels), Business+ (emphasized: First plan with DMs, Plus private and DMs), Enterprise (Plus filtered exports). Business+ is emphasized because it is the first plan whose export can include private channels and direct messages. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Slack's help page](https://slack.com/help/articles/201658943) - [Slack says](https://slack.com/help/articles/220556107) - [Slack's API terms](https://slack.com/terms-of-service/api) --- # Company data to AI: license or sale? > Wondering whether to license or sell company data to AI? A license means different things. SimpleClosure's terms move title. Troveo says ownership stays. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/license-or-sell-company-data-to-ai Published: 2026-07-22 Updated: 2026-10-14 ## The short answer It depends on the contract. Troveo says ownership never transfers. SimpleClosure's terms vest all right and title in the acquirer. micro1's page says companies keep ownership, but its CFO called the corpus track a one-time sale in an undated talk. California's CCPA can reach a license too. A license grants permission to use data. A sale transfers title. Buyers blur the line. If you sign a deal, know which one you hold. ## What does Troveo say? [Troveo's business page](https://www.troveo.ai/business-data) says you own the data. It says [Troveo](/buyers/troveo) licenses the data for you under terms you sign off on, and that ownership never transfers. Its licensing guide says the owner keeps the data and grants a defined right to use it. The guide names term and exclusivity among the terms to negotiate. ## What does SimpleClosure say? [SimpleClosure's terms](https://simpleclosure.com/tos/) give it a broad license to user data and content. The license is: - Non-exclusive. - Transferable. - Sub-licensable. - Perpetual. - Irrevocable. The terms also say that when digital assets are acquired, all right, title and interest in them vests in the acquiring entity. That entity may use or license them without further compensation to the owner. That is a different structure from Troveo's, even though both involve a company's data. ## What does micro1 say? [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) says companies retain ownership of their underlying data. In an undated recorded forum talk, [micro1](/buyers/micro1)'s CFO called the corpus track a one-time sale for $100K to $2M per company. That figure is self-reported with no stated date, and no outcome is promised. So the talk and the page use different words for the same program. A micro1 referral partner gave a third label in a micro1 video (self-reported, about 12:29). She named "a one-off sale" as the biggest misconception. She said the company licenses its data and keeps full access, and the data "remains at the company". Later she repeated that you are licensing, not selling. A company keeps access because an export is a copy. Deletion at the end of the deal stays a question for the contract. See [can I delete my data after an AI company trains on it](/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it). ## Does the license or sale label change privacy law? California defines a sale as selling, renting, releasing, disclosing, making available or transferring personal information to a third party for money or other valuable consideration. Section 1798.190 tells courts to disregard steps that remove consideration to avoid that definition. The [CCPA page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) goes through the text. ## Which terms should I compare in a draft? Look for these terms: - Who holds title after signing. - What uses are permitted. - Whether the buyer can sublicense. - How long the term runs. - Whether it is exclusive. - What happens at the end. Sublicensing is a term to negotiate. See [limits on sublicensing](/answers/can-i-restrict-who-my-data-is-sublicensed-to) and [exclusivity terms](/answers/what-is-an-exclusivity-term-in-a-data-license). The [buyers page](/buyers) lists the terms buyers publish. Our [managed readiness service](/managed-readiness) lays your drafts side by side without negotiating for you. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three ways companies describe a company-data deal: Troveo (Ownership stays), micro1 (Ownership stays), SimpleClosure (emphasized: Title moves to the other side, Title moves). SimpleClosure's terms move title to the company that takes the data. Troveo and micro1 say ownership stays with the company. Talk to a privacy or commercial lawyer in your state before you sign. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's business page](https://www.troveo.ai/business-data) - [SimpleClosure's terms](https://simpleclosure.com/tos/) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) --- # How to check GitHub organization size > How to check GitHub organization size: the docs show no single org view, so admins sum each repository's size field. What GitHub says on units and limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-to-check-github-organization-size Published: 2026-07-22 Updated: 2026-10-14 ## The short answer GitHub has no single organization-size view, so add up repositories. The REST API lists an organization's repositories with a size field for each. The docs do not state the unit. Test against a repository you can measure by cloning before you add figures. GitHub recommends repositories under 5 GB. David Revland, who works on human data at [micro1](/buyers/micro1), said in an undated recorded forum talk that its form asks for a rough size per tool (self-reported), so a rough figure is the goal. ## What does GitHub publish about size? [GitHub's page on large files](https://docs.github.com/en/repositories/working-with-files/managing-large-files/about-large-files-on-github) says repositories should ideally be under 1 GB, and under 5 GB is strongly recommended. Git warns on files over 50 MiB, and GitHub blocks files over 100 MiB. Large files should move to Git LFS. The page points to the open-source git-sizer tool for analyzing repository structure. ## How do you total an organization? The [REST reference](https://docs.github.com/en/rest/repos/repos#list-organization-repositories) has a "List organization repositories" endpoint, `GET /orgs/{org}/repos`, with `per_page` up to 100 and a `page` parameter. The response includes an integer `size` for each repository. The reference gives no description or unit for `size`. Add the figures only after you check one against a repository you can measure by cloning it. We also did not confirm whether LFS data is counted. ## Does micro1 ask for the organization size? micro1's David Revland said in the same undated forum talk that its data manifest form asks which services a company uses and a rough size for each, and GitHub is on that list (self-reported, recording undated). The micro1 pages I read do not name GitHub and set no figure for code. See [micro1 GitHub data](/answers/micro1-github-data). By bytes, code adds little to a 1 TB corpus. By content, history shows how people worked. Our [GitHub licensing page](/answers/sell-github-data-to-ai) covers who has bought code, and [can I license source code to AI](/answers/can-i-sell-source-code-to-ai) covers licenses, client-owned code and export controls. ## What about GitLab? GitLab shows storage in its own Usage quotas page. See [licensing GitLab repos to AI](/answers/sell-gitlab-repos-to-ai). Run the [rights check](/rights-check) before size. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps List the org's repositories -> Read each size field, add up -> Test against a known repository. A GitHub organization's rough size is the sum of its repositories' size fields, tested against one you can measure. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [GitHub's page on large files](https://docs.github.com/en/repositories/working-with-files/managing-large-files/about-large-files-on-github) - [REST reference](https://docs.github.com/en/rest/repos/repos) --- # License HubSpot CRM data to AI: terms and export > Trying to sell HubSpot CRM data to AI? Before you license it, know HubSpot may train its own models on it unless a Super Admin opts out, going forward only. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-hubspot-crm-data-to-ai Published: 2026-07-22 Updated: 2026-10-14 ## The short answer License HubSpot CRM data to AI: Troveo names HubSpot. HubSpot trains its own models on your data by default. A Super Admin can opt out going forward. Contacts are customer personal data, so CCPA and your contracts set the limits. No price published for HubSpot data alone. My [CRM data page](/answers/sell-crm-data-to-ai) covers what buyers want from any CRM. This page covers what is specific to HubSpot. ## Which companies name HubSpot? [Troveo](https://www.troveo.ai/business-data) lists HubSpot with Salesforce, Intercom and Zendesk under CRM, sales and support. [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) lists CRM data. [Mercor's data page](https://www.mercor.com/data/) names Salesforce and does not name HubSpot. All of these are self-reported. ## What does HubSpot say about training its own models? [HubSpot's page](https://knowledge.hubspot.com/account-management/hubspot-ai-mode-training) says it may use customer data to train and improve its own AI models, both for features inside one account and for features shared across accounts. A Super Admin can opt out at any time. The setting is on by default. The page says opting out does not limit access to AI features. It also says previously used data cannot be deleted from trained models, and that opt-outs apply only going forward. Accounts with Sensitive Data turned on are opted out by default and cannot opt in. ## How does a HubSpot export work? From a record view, an export button sends a download link by email, in CSV, XLSX or XLS. By default only the properties and associations in the view are included, and the options include all properties. [HubSpot's page](https://knowledge.hubspot.com/import-and-export/export-records) says download links expire after 30 days and caps exports at 300 per rolling 24 hours, with up to 3 at once. An export shows what a record holds today. A buyer asking for history needs more, and that is a question for the buyer's data manifest. ## What limits sit on licensing CRM data? Contact records are personal information about people who never agreed to licensing. See [the CCPA test](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) and [customer consent](/answers/do-i-need-consent-to-sell-customer-data-for-ai-training). My [rights check](/rights-check) asks what personal data the records hold and what your customer contracts allow. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Settings, Account management, AI -> Open the Access tab -> Switch off AI Model Training. HubSpot's AI Model Training switch is under Settings, Account management and AI, and switching it off applies going forward. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Mercor's data page](https://www.mercor.com/data/) - [HubSpot's page](https://knowledge.hubspot.com/account-management/hubspot-ai-mode-training) - [HubSpot's page](https://knowledge.hubspot.com/import-and-export/export-records) --- # License home service company data to AI: what to check > Want to sell home service company data to AI? Licensing it is possible. One buyer lists a roofing license. Check customer data and call recordings first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-home-service-company-data-to-ai Published: 2026-07-21 Updated: 2026-10-16 ## The short answer Polyshares lists a $450,000 roofing license and a $275,000 solar license, both unnamed and self-reported, and its intake names ServiceTitan. Home service records hold customer names, addresses and job notes. Customer data, software terms and recording laws decide what leaves. Have a lawyer read your contracts first. One buyer publishes deals in the trades. This page covers those, the records and the rules that apply. ## Who lists home services? [Polyshares](/buyers/polyshares)' [case studies page](https://polyshares.com/track-record) lists a roofing company under home services at $450,000 and a solar company under energy at $275,000. It describes each as a perpetual exclusive license to the operational record, anonymized before delivery. Company names stay confidential and the page carries no dates. Both rows sit in the [deals tracker](/deals). Every figure is Polyshares' own. Its [homepage](https://polyshares.com/) says its founders licensed data on their own companies first, and its partner bios name a roofing company and a solar company among their past firms. The case studies don't say whether either listed deal is one of those. The same homepage lists ServiceTitan among the systems it asks about, and its [intake](https://polyshares.com/intake) adds Housecall Pro and Jobber under field operations. micro1's page lists six areas and none is home services. A micro1 referral partner told an unnamed, unverifiable story about a Florida pool builder in a micro1 video. See [whether industry matters](/answers/does-industry-matter-for-selling-company-data) and the [construction page](/answers/sell-construction-company-data-to-ai) for the general contractor deal. ## What does a home service firm hold? [ServiceTitan's help page on exporting Housecall Pro data](https://help.servicetitan.com/docs/export-your-housecall-pro-data) lists three reports: customers (names, contact details and notes), jobs (invoice numbers, the customer and line items) and estimates. Customer addresses and phone numbers are the main personal data. My [customer data page](/answers/is-it-legal-to-sell-customer-data) covers notice and consent rules. ## What do home service software terms say? [Housecall Pro's terms](https://www.housecallpro.com/terms-of-service/) say customer data a Pro enters remains the Pro's property. They also say user data may train Housecall Pro's own AI models, and that Housecall Pro owns anonymized, aggregated data derived from the service. [ServiceTitan's API and Data Authorization terms](https://www.servicetitan.com/legal/api-data-authorization) make the customer and its authorized partners solely responsible for privacy-law compliance when data moves to a partner. [Jobber's terms](https://getjobber.com/terms-of-service/) give Jobber a perpetual license, with a right to sublicense, to content you submit. Read your own contract. ## What about call recordings? Federal law allows recording with one party's consent unless the purpose is criminal or tortious ([18 U.S.C. 2511(2)(d)](https://www.law.cornell.edu/uscode/text/18/2511)). Florida's statute allows interception when all parties have given prior consent ([934.03(2)(d)](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0900-0999/0934/Sections/0934.03.html)). See [call recordings](/answers/can-i-sell-call-recordings-to-ai). ## Does a trades firm clear the headcount line? micro1's [pages](https://www.micro1.ai/data-partnerships) say 30 or more employees, with mature operations (self-reported). Its undated [Enterprise Data Partnership post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) lists 30 to 200, while the main pages set no upper limit, so a firm over 200 should confirm the program with micro1. I found no published count of trades firms by headcount, so I can't say how typical a 30-employee firm is. See [micro1's minimum](/answers/micro1-data-partnership-minimum-employees). Run the [rights check](/rights-check) before you list anything. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: scale, micro1 staff figures, by source: Undated micro1 talk, historical 20 employees, micro1 pages, current 30 or more (emphasized). micro1's current pages say 30 or more. The lower figure comes from an earlier, undated talk. Source: micro1.ai/data-partnerships and micro1.ai/company-referral, plus an undated recorded micro1 forum talk. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [case studies page](https://polyshares.com/track-record) - [homepage](https://polyshares.com/) - [intake](https://polyshares.com/intake) - [ServiceTitan's help page on exporting Housecall Pro data](https://help.servicetitan.com/docs/export-your-housecall-pro-data) - [Housecall Pro's terms](https://www.housecallpro.com/terms-of-service/) - [ServiceTitan's API and Data Authorization terms](https://www.servicetitan.com/legal/api-data-authorization) - [Jobber's terms](https://getjobber.com/terms-of-service/) - [18 U.S.C. 2511(2)(d)](https://www.law.cornell.edu/uscode/text/18/2511) - [934.03(2)(d)](https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0900-0999/0934/Sections/0934.03.html) - [pages](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership post](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710) --- # Data verification before payment: what the companies say > Data verification before payment in AI data deals: micro1's David Revland said micro1 verifies data, then pays. What Mercor, Handshake AI and Troveo publish. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-verification-before-payment-ai Published: 2026-07-20 Updated: 2026-10-14 ## The short answer Verification sits between transfer and payment. micro1's David Revland said micro1 verifies data before paying. Mercor says wire transfer on delivery. Handshake AI says due diligence affects the amount. None publishes pass criteria. Ask what the check tests before transferring. Verification sits between the transfer and the money, and it's the step with the least published detail. That gap is the story here. Verification comes late in a deal. The first read of your offer happens much earlier, and [how a lab's data team judges an offer](/answers/how-ai-labs-evaluate-a-data-offer) covers it. ## What did micro1 say? In an undated recorded forum talk, David Revland, who works on human data at [micro1](/buyers/micro1), listed seven steps for a corpus deal. The last two are the data transfer, then micro1 verifying the delivered data and paying (recording, date not stated). micro1's data partnerships page states no payment timing and no verification procedure. The [process page](/answers/micro1-data-partnership-process) lists all seven steps. ## What do other buyers publish? | Buyer | What its page says | Pass criteria published | |---|---|---| | Mercor | [Wire transfer on delivery](https://www.mercor.com/data/) of the anonymized dataset, typically 2 to 4 weeks from the signed agreement | None found | | Handshake AI | [Due diligence outcome affects pricing](https://joinhandshake.com/ai/data-partnerships/). Payment typically comes 30 to 60 days after it accepts the de-identified dataset | None found | | Troveo | [Pays on every sale](https://www.troveo.ai/business-data), not just the first | None found in what I read | Every entry is a buyer describing itself. One more buyer view: Ryan Lock of Polyshares wrote that a 30-day acceptance window is standard ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). No pass test came with it. See [acceptance periods](/answers/what-is-an-acceptance-period-in-a-data-deal). ## Why does the order matter to your company? If payment follows verification, a failed check could change the amount or end the deal. Nothing I read says which. The [corpus deal page](/answers/micro1-corpus-sale-vs-workflows-track) shows where the check sits against micro1's other track. ## What should you ask before you transfer? - What does the check test, and who decides a pass? - If part of the data fails, is the price cut or the deal cancelled? - How long does verification take, and when is payment due after it? - Who bears the cost of re-exporting data? Put the answers in the contract. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) The [checklist for choosing an AI data broker](/guides/how-to-choose-an-ai-data-broker) covers more questions. Figure: steps Your data transfers -> micro1 verifies it -> micro1 pays. Revland (micro1) said in an undated recorded forum talk that micro1 verifies the delivered data first and pays after. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Wire transfer on delivery](https://www.mercor.com/data/) - [Due diligence outcome affects pricing](https://joinhandshake.com/ai/data-partnerships/) - [Pays on every sale](https://www.troveo.ai/business-data) - [X article](https://x.com/RyanLockAI/status/2107864069105389717) --- # Help licensing company data to AI: who does which step > Looking for help selling company data to AI? Here is who does each licensing step, what we do for free, and what our optional paid readiness service covers. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/help-selling-company-data-to-ai Published: 2026-07-20 Updated: 2026-10-14 ## The short answer Help comes from the program's own team, an advisor, a lawyer or a readiness service. Our fit check, discovery call, tools, guides and introductions are free. Managed readiness is a paid option, quoted in writing first. We never take a percentage of your deal. The useful question is which step you need help with, and who is paid to do it. ## Which steps need help, and who does them? | Step | Who helps | What a source says | |---|---|---| | Inventory and sizes | You, a program's intake form, or us | micro1's David Revland described, in an undated recorded forum talk, a data manifest form that asks which services you use and a rough size for each (self-reported) | | Rights and contracts | Your lawyer | Frankfurt Kurnit says to review customer, partner, vendor and platform terms before any offer ([its checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)) | | Matching to buyers | An advisor or a buyer | [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) says it holds a scoping call on data parameters, de-identification, terms and timeline, then delivers to labs under contract | | Transfer | micro1, per its forum talk | Revland said in the same talk that micro1's engineers walk your IT team through the transfer, and its CFO put IT time at about 10 hours over a week or two (self-reported) | | Anonymizing | The company you license to | [Troveo](https://www.troveo.ai/business-data) says it handles the anonymization, packaging and buyer conversations | ## What do we do? The fit check, a discovery call, the tools, the guides and introductions are free to your company. Managed readiness is an optional paid service. It produces five pieces: a buyer one-pager, a systems inventory, questions for your counsel, a buyer shortlist with each buyer's current criteria, and a term-question checklist. We build them from descriptions and counts, never records, and deliver in 2 to 3 weeks with two rounds of revisions. Every legal question goes to your counsel in writing. The [managed readiness page](/managed-readiness) shows what goes into each piece and who decides it. ## What do we never do? We never touch your data, hold your credentials or sit in a data room. We give no legal advice and never say whether you may license a set of records. We don't negotiate or sign for you, and we guarantee no buyer, price or timeline. A review can end in a no, or a price near zero. ## How are we paid? Managed readiness is optional, scoped and quoted in writing before you pay. Everything else on this page is free to your company, and we never take a percentage of your deal. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) ## How does an advisor's fee compare? A success-fee advisor charges nothing upfront and takes a percentage of what you receive, agreed in writing and charged when you are paid. Managed readiness is a fee quoted in writing before you pay, and it does not change with your deal. Our [advisor page](/answers/data-licensing-advisor) shows how each fee model pulls in a different direction, and our [services page](/answers/ai-data-licensing-services) compares the kinds of provider. ## Where do you start? Run the [rights check](/rights-check) or take the free [fit check](/business). Both take a few answers and no data. Talk to a privacy or commercial lawyer in your state before you sign. Figure: steps We gather the facts -> Your counsel decides -> You choose, then the transfer. We gather the facts, your counsel makes the legal calls, and you choose the buyer. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [its checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [Troveo](https://www.troveo.ai/business-data) --- # How to record data licensing revenue: ASC 606 text > How to record data licensing revenue? ASC 606 times a sales-based royalty on an IP license, but no source says whether a data corpus is IP. Accountant needed. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-to-record-data-licensing-revenue Published: 2026-07-18 Updated: 2026-10-14 ## The short answer Under ASC 606, a sales-based royalty on an IP license is recorded when the sale or usage happens or the performance obligation is satisfied, whichever is later. No source we found settles whether a data corpus is IP or a one-time sale is a license. An accountant decides the treatment. An accountant who has read your contract decides the treatment. I can only lay out what the published sources say and where they go quiet. ## What does ASC 606 say about royalties on a license? [Deloitte's revenue roadmap, chapter 12 on licensing](https://dart.deloitte.com/USDART/home/codification/revenue/asc606-10/roadmap-revenue-recognition/chapter-12-licensing/12-7-sales-or-usage-based), sums up the sales-based and usage-based royalty exception. You record revenue at the later of two events: - The later sale or usage. - The point when you meet, or partly meet, the performance obligation the royalty relates to. The exception applies when the license of intellectual property is the main item the royalty relates to (ASC 606-10-55-65A). The roadmap's point is that you don't record revenue from estimated future royalties. ## Does the type of license change the timing? FASB issued ASU 2016-10. The [Journal of Accountancy](https://www.journalofaccountancy.com/news/2016/apr/fasb-issues-revenue-recognition-clarifications-201614242/) reports that it asks what a promise to grant a license gives the customer. It could be one of two things: - A right to access the entity's intellectual property, which is met over time. - A right to use it, which is met at a point in time. The ASU also clarifies the scope of the royalty guidance above. ## Is a company data corpus intellectual property here? I found no source that says. I read no FASB text on data as the licensed asset. The sources above talk about intellectual property in general. I also found nothing on whether a one-time corpus transfer is a license or a sale. Put both questions to your accountant. ## How do the payment shapes differ? Our [pay page](/answers/how-are-you-paid-for-company-data) lists the payment shapes that data companies, buyers and licensors publish. - [Troveo](https://www.troveo.ai/business-data) describes a license with a payment on every sale. It says ownership never transfers. Our [Troveo page](/answers/troveo-revenue-share) has what it publishes. - micro1's CFO described, in an undated talk, a one-time payment for a corpus (self-reported). - [SimpleClosure's terms](https://simpleclosure.com/tos/) say title vests in the acquiring entity, as our [license or license page](/answers/license-or-sell-company-data-to-ai) reports. - Wiley, a public publisher, licenses content for AI generally at a fixed price. [Wiley's 2025 10-K](https://www.sec.gov/Archives/edgar/data/107140/000010714025000081/jwa-20250430.htm) said most of that revenue was recognized on acceptance, and [Wiley's 2026 10-K](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm) says at a point in time or partly over time. [What publishers earn from AI licensing](/answers/what-do-publishers-earn-from-ai-licensing) has Wiley's numbers. My reading is not a source. I think a payment on every sale, a lump sum and a transfer of title would each be tested against different parts of the rule. Your accountant confirms which. ## What should you bring to an accountant? Bring these: - The signed agreement. - The payment schedule. - What the buyer receives, and whether title moves. - Any usage reports the buyer sends. Our [rights check](/rights-check) covers the rights questions that come before the books. Talk to a tax professional about your own situation. Figure: steps Sale or usage occurs -> Performance obligation satisfied -> Revenue recognized at the later event. ASC 606 recognizes a sales-based IP royalty at the later of the sale or usage and the obligation being met. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Deloitte's revenue roadmap, chapter 12 on licensing](https://dart.deloitte.com/USDART/home/codification/revenue/asc606-10/roadmap-revenue-recognition/chapter-12-licensing/12-7-sales-or-usage-based) - [Journal of Accountancy](https://www.journalofaccountancy.com/news/2016/apr/fasb-issues-revenue-recognition-clarifications-201614242/) - [Troveo](https://www.troveo.ai/business-data) - [SimpleClosure's terms](https://simpleclosure.com/tos/) - [Wiley's 2025 10-K](https://www.sec.gov/Archives/edgar/data/107140/000010714025000081/jwa-20250430.htm) - [Wiley's 2026 10-K](https://www.sec.gov/Archives/edgar/data/107140/000162828026045111/jwa-20260430.htm) micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) --- # micro1 data partnership forum: recap of an undated talk > A recap of an undated, recorded micro1 forum talk on its company data program: ways in, process, earlier eligibility figures and privacy. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-data-partnership-forum Published: 2026-07-17 Updated: 2026-10-14 ## The short answer The micro1 data partnership forum is a session series on its data program. This recaps an undated recorded talk from the third session: why micro1 wants company data, three ways in, the process, earlier eligibility figures and personal information. It is history. micro1's current pages govern. Each section links to the page that covers the topic in full, and [how micro1's data partnership works](/guides/micro1-data-partnership) has the whole program. ## Why did micro1 say it wants company data? [micro1](/buyers/micro1) called itself a data lab that trains and improves AI models and agents. It said synthetic training environments imitate the real world, and in its words, "the ideal training environment is the real world itself." Its CFO used a marketing budget request as the example. The value is the path from request to analysis to approval across tools, and the names and vendor line items matter less. See [what micro1 is](/answers/what-is-micro1). ## What are the three ways to take part? A corpus deal, a recurring [workflows track](/answers/micro1-workflows-track) and a referral. The CFO said in the undated talk that a company can do the first two. ## What is the process? The undated talk described seven steps from first contact to verified payment. The [process page](/answers/micro1-data-partnership-process) lists them, and the [transfer page](/answers/how-long-does-a-data-transfer-take) covers the earlier 10-hour estimate. ## What are the thresholds? micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized. Its [pages](https://www.micro1.ai/data-partnerships) state no data-size threshold. The undated talk gave earlier figures: 20 full-time employees, about 1 TB of data, about 80% or more in English, any industry, and US and Canadian companies preferred. Those are history, and they do not decide who qualifies now. The [requirements page](/answers/micro1-data-partnership-requirements) compares the two. ## What did micro1 say about pay? micro1's [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages, depending on size and value. In the undated recorded talk, the CFO said a corpus deal pays $100,000 to $2 million per company and gave a per-task figure for workflows. See [what micro1 pays](/answers/how-much-does-micro1-pay-for-company-data). No outcome is promised. ## What did it say about personal information? In the undated talk, micro1 said it transforms names instead of redacting them, and that companies cannot pre-scrub. See [PII transformation](/answers/micro1-pii-transformation). ## What did a second pass of the undated recording add? - **Transfer effort.** In the undated talk, the CFO first said one or two people on the IT side, then described about 10 hours over a week or two from a single person (about 19:30). - **Workflows scale.** Some companies have dozens of employees doing workflow tasks, and the CFO's illustration was 1, 2 or 15 employees at about five tasks a week (about 20:00 to 20:50). - **Track order.** David Revland, who works on human data at micro1, called workflows an option after the corpus transfer, and the CFO said a company can do both (about 16:15). - **Contact route.** Email any panelist at their first name at micro1.ai or use the landing page. No URL was read out (about 25:30). ## What is missing? The date, a named buyer list and any testimonial from a partner company. The recording is not a contract, and the [evidence table](/answers/is-micro1-legit) shows what can be checked. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three ways to take part, as the forum described them: Corpus deal (emphasized: The forum described it first, One transfer), Workflows (Repeats by task), Referral (An introduction). The forum described the corpus deal first, and it is one transfer while workflows repeat. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [pages](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # What is an exclusivity term in a data license? > An exclusivity term in a data license limits your data to one buyer for a set time. What it covers, what Polyshares says is standard, and what to ask for. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-an-exclusivity-term-in-a-data-license Published: 2026-07-17 Updated: 2026-10-14 ## The short answer An exclusivity term in a data license is a promise that only one buyer gets your data for a set time. Polyshares' Ryan Lock cites two years as standard, but no other source backs that. Ask for the length, scope and a way out. > **An exclusivity term is a promise that one buyer gets your records for a set time.** It works like renting your spare room to one tenant on a lease. No second tenant until the lease ends. ## What does the clause cover? [Troveo](/buyers/troveo)'s guide names three limits that make exclusivity safer ([Troveo](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license)): - A **term**, so the data returns to market. - A **scope**, so it covers one category or use. - A **performance trigger**, so exclusivity ends if the buyer underuses the data. ## How long is the term? It varies. Ryan Lock of Polyshares wrote that two years is a market standard ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). He is a buyer recruiting brokers, and no other source we read gives a standard length. Troveo's guide names no length. micro1's data partnerships page says nothing about exclusivity. ## Can you trade length for price? Lock says a shorter term or a faster payout costs headline price. That is his claim about his own deals. Ask any buyer to quote both versions. Our page on [exclusive vs non-exclusive price](/answers/exclusive-vs-non-exclusive-data-license-price) covers what public sources say about price. Troveo argues that non-exclusive licenses can earn more over time. _Exclusive means one buyer. It does not mean one buyer forever._ ## What should you ask before you sign? 1. How long does exclusivity last? 2. Does it cover all uses or one? 3. What ends it early? 4. Which earlier licenses must you disclose? Never promise exclusivity while an earlier non-exclusive license is still running. The [license versus sale page](/answers/license-or-sell-company-data-to-ai) and the [agreement guide](/guides/data-licensing-agreement) cover the other clauses. Also read [what is an acceptance period](/answers/what-is-an-acceptance-period-in-a-data-deal). micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/resources/exclusive-vs-non-exclusive-data-license) - [X article](https://x.com/RyanLockAI/status/2107864069105389717) --- # Can I license only part of my company data to AI? > Want to sell only part of your company data to AI? A license can set scope. micro1 agrees scope with each company, but no source says folders can stay out. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-only-part-of-my-company-data-to-ai Published: 2026-07-16 Updated: 2026-10-14 ## The short answer Maybe. micro1 says scope and boundaries are set with each partner company, but it doesn't say whether folders or channels can be excluded. Ask in writing before committing to partial scope. Owners often assume the choice is all or nothing. The public record doesn't confirm or rule out anything in between. ## What does micro1's intake ask for? [micro1](/buyers/micro1)'s David Revland, who works on human data, said in an undated recorded forum talk that the data manifest form asks which services a company uses. It also asks for a rough size for each. Revland said micro1 supplies instructions for finding the sizes. A micro1 referral partner said in a micro1 video that the form takes under 10 minutes. The partner gave Google Workspace at 3 TB and Slack at 300 GB as examples (all self-reported). See [what a manifest form asks](/answers/what-is-a-data-manifest-form). ## Can you edit data before it leaves? Not according to micro1 staff. In the same undated talk micro1 staff said companies can't pre-scrub. The same talk said redacting first would destroy the cross-tool trail micro1 needs, so micro1 transforms the data itself. My reading is that any exclusion happens when you choose what to export. Editing has no part in it. [How micro1 transforms names](/answers/micro1-pii-transformation) explains the step. ## What can Google's export filter? [Google's Data Export tool](https://support.google.com/a/answer/14338836) can export all data or one user's. Higher editions add more choices: - an organizational unit - a group - up to 100 users The Assured Controls add-on adds filters for service, Drive label and date range. Google says a filtered export leaves out shared drives. It points to the full export for them. Whether micro1 accepts a filtered export is a separate question for micro1. ## What would you hold back? A [law firm](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) lists categories to exclude outright: - privileged material - HR files and payroll - health and benefits data - union communications - customer or partner confidential information My [do-not-license list](/answers/what-data-can-i-not-sell-to-ai) gives the sources. [Shared Slack channels](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai) hold other companies' words. ## Does a smaller scope change the payment? [micro1 lists dataset size and volume](https://micro1.ai/data-partnerships) among the factors that set what it pays. The partner said the amount follows employee count and data sizes (self-reported). No formula is published. So no source says how much a smaller scope would change an offer. ## What should you ask in writing? Here's what I'd ask: - Can you exclude a source, a folder or a mailbox? - Who sets the exclusions? - Does the price change? [micro1's page](https://micro1.ai/data-partnerships) says companies can review representative samples before prepared data is used (self-reported). So I'd ask whether that review covers your exclusions. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps List sources, mark exclusions -> Export only the rest -> Confirm scope in writing. Decide exclusions before export and confirm the scope with the buyer in writing. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Google's Data Export tool](https://support.google.com/a/answer/14338836) - [law firm](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [micro1 lists dataset size and volume](https://micro1.ai/data-partnerships) --- # How many years of data do AI labs want? > How many years of data do AI labs want? No lab page states a minimum. Calculators from Troveo and Handshake AI both weight company history. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/how-many-years-of-data-do-ai-labs-want Published: 2026-07-16 Updated: 2026-10-13 ## The short answer No AI lab states a minimum number of years. Calculators from Troveo and Handshake AI both weight company history. Handshake showed $383,083 to $896,969 for 10 years and 100 staff. These are lead-form formulas. I read the [micro1](/buyers/micro1), Mercor, [Handshake AI](/buyers/handshake-ai) and [Troveo](/buyers/troveo) data pages. None states a minimum of years of records, so this page reports what the calculators do with the number. ## What do the calculators weight? - **Troveo:** its [estimator](https://www.troveo.ai/business-data) offers four buckets, under 3 years, 3 to 7, 8 to 15 and 15 or more. - **Handshake AI:** its [calculator](https://joinhandshake.com/ai/data-partnerships/) asks for years of operation. For 100 employees and 10 years it showed $383,083 to $896,969, and says the figure is indicative and not an offer. Each one sits in front of a lead form, so I read the history input as a way to sort leads. ## Why does Troveo say data history matters? [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) says patterns need time, such as seasonal cycles, product changes and how problems recurred and got solved, and that a long history is hard to substitute. [Troveo's second guide](https://www.troveo.ai/resources/data-monetization-examples) says Google's Spirit Airlines bid put a public price on a company's entire operating history. Both are views from a marketplace that licenses data. ## Does the age of the company count? A micro1 referral partner said in a micro1 video that she looks for companies that have been around at least a few years, with a sizable amount of data (self-reported, about 4:40). micro1's undated recorded forum talk named no age rule. That is a company-age screen from a partner, not a requirement for years of data, and micro1 publishes no minimum. ## Can newer years of data be added later? micro1's David Revland, who works on human data, said in an undated recorded forum talk that a top-up is possible about six months after a first transfer, taking data created since then (self-reported). That makes your count of years a moving number. ## Does Polyshares count all years the same? Not by its own account. Ryan Lock, a managing partner at Polyshares, wrote that it credits years with full context, meaning chat and work tools and not only email or Drive ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). In his example, ten years of tool switching earned full credit for two. He is one buyer describing his own method, so this does not set a minimum. ## How should you count your years? Note the start date of the records in each tool, then the volume per year. Years of Slack and years of email rarely match. The free [fit check](/business) asks how many years of records you hold and where the work happens, and our [rights check](/rights-check) covers whether you may license them. Figure: comparison of How two calculators ask about history: Troveo (Four age buckets), Handshake AI (emphasized: Takes a number of years, Years of operation). Both calculators ask how old the company is, and neither asks how many years of records you kept. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [estimator](https://www.troveo.ai/business-data) - [calculator](https://joinhandshake.com/ai/data-partnerships/) - [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) - [Troveo's second guide](https://www.troveo.ai/resources/data-monetization-examples) - [X article](https://x.com/RyanLockAI/status/2107864069105389717) --- # micro1 data top up: a second delivery months later > micro1 data top up: an undated talk said micro1 may take data created after your first transfer, about 6 months later. What is known and what to ask. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-data-top-up Published: 2026-07-16 Updated: 2026-10-14 ## The short answer A micro1 data top up is a possible second delivery under the partnership, about 6 months after the first transfer, covering data created since then. micro1's David Revland described it in an undated recorded forum talk. Payment, terms and whether it is optional are unknown. Ask in writing. A corpus deal is one transfer. The top-up is the undated recorded talk's answer to what happens to the records you keep creating after it. ## What did micro1 say about a top-up? In an undated recorded forum talk, David Revland, who works on human data at [micro1](/buyers/micro1), said micro1 may come back about 6 months after the first transfer for data created in the meantime (self-reported, recording, date not stated). Revland framed this as part of the corpus track of the [micro1 data partnership](/guides/micro1-data-partnership), described in the [process page](/answers/micro1-data-partnership-process). ## What don't we know? The list is longer than the list of what we do know. - **Price.** No figure was given for a top-up. The first-deal range is on the [pay page](/answers/how-much-does-micro1-pay-for-company-data). - **Obligation.** I found nothing saying whether micro1 must offer one or the company must accept. - **Cutoff.** The talk gave no rule for which data counts as new. - **Written terms.** The pages I read do not describe a top-up. That covers micro1's [data partnerships page](https://www.micro1.ai/data-partnerships) and its [referral program announcement](https://www.micro1.ai/forum/company-data-partnerships-referral-program). ## Does a top-up change the first deal? It might, and the contract is where that would show. If the first deal grants rights to data "created up to" a date, a later transfer needs its own paper. I have not seen micro1's contract, and none is public. ## What should you ask micro1? - Is a top-up offered, or only possible? - How is it priced against the first deal? - Which data counts as new, and from which date? - Do deletion and retention terms in the first contract apply to it? Compare this with the workflows track, which [pays by task](/answers/micro1-workflows-track) and repeats by design. Run the [rights check](/rights-check) again before any second transfer, since the systems and the people in them change. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps First transfer, about six months -> New data accumulates -> micro1 may ask for a top-up. Revland (micro1) said a top-up would cover only the data created after the first transfer. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [referral program announcement](https://www.micro1.ai/forum/company-data-partnerships-referral-program) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # AI data licensing services: which type fits you? > AI data licensing services come in five types: direct programs, marketplaces, success-fee advisors, shutdown services and referral front ends. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/ai-data-licensing-services Published: 2026-07-15 Updated: 2026-10-14 ## The short answer AI data licensing services come in five types. Direct programs like micro1 and Mercor pay companies under their own agreements. Marketplaces like Troveo say they pay on every deal. Advisors take a cut of what you get. Shutdown services help closing firms. Front ends pass your details to others. The type matters more than the brand name. > **The type decides who pays you, when, and who carries the legal risk.** It's like clearing an attic. A dealer buys the lot, a shop sells it piece by piece, an agent takes a cut, and a doorbell service passes your name along. ## What are the types of AI data licensing services? **Direct program.** [micro1](/buyers/micro1) states deal tiers of $100K or more, $500K or more and $1M or more, set per deal ([micro1](https://www.micro1.ai/data-partnerships)). [Mercor](/buyers/mercor) says it wires payment after the anonymized dataset reaches the buyer, typically within 2 to 4 weeks of a signed agreement ([Mercor](https://www.mercor.com/data/)). **Marketplace.** [Troveo](/buyers/troveo) says it matches you with buyers and anonymizes the data to a documented standard. It licenses the data on terms you approve. It says it pays a revenue share on every sale and charges owners no platform fee. The split is unpublished ([Troveo](https://www.troveo.ai/business-data)). **Success-fee advisor.** An advisor takes a percentage of what you receive, agreed in writing before any introduction. Ask for the percentage, whether it ever holds your data and which buyers it works with. My [advisor page](/answers/data-licensing-advisor) has the questions. **Shutdown service.** [SimpleClosure](/buyers/simpleclosure)'s Asset Hub serves companies winding down. Fortune reported more than 350 companies listed assets there between April and mid-September 2026. **Referral front end.** A front end collects company details through a form and passes them to a partner it may not name. Ask who receives your details before you fill it in. Every payout figure above comes from the service's own pages, so it is self-reported. Terms change, so check each page before leaning on a number. Figure: comparison of Three ways to reach an AI data buyer: Direct partnership (Paid under the agreement), Marketplace license (emphasized: Says it pays on every sale, Paid per sale), Advisor fee (Percent of deal). A marketplace says it pays on every sale, while a direct partnership pays under its agreement and an advisor takes a percentage. ## What do the terms say? I read the terms for owners before the sales page. SimpleClosure's terms grant it a non-exclusive, transferable, sublicensable, perpetual and irrevocable license. The owner warrants it owns or has authority over the data. The owner also agrees to cover SimpleClosure's losses if it breaks the terms. SimpleClosure caps its own liability at the greater of what you paid in six months or $100 ([terms](https://simpleclosure.com/tos/)). Terms differ by type, so lay them side by side. The [buyer directory](/buyers) records each service. ## What should you ask any service? - Which legal entity signs the contract? - Who sees your raw data, and who certifies the de-identification? - What do you warrant, and what do you cover if something goes wrong? - What happens to your copy and to trained models if you ask for deletion? - Is any referral fee flowing between the service and the person who introduced you? The ombudsman's filing in the Spirit Airlines case notes the sale was built around an independent de-identification expert. It also refers to a security incident update Mercor published. Ask every service for its incident history. The [Spirit page](/answers/spirit-airlines-data-sale) has the detail. _Asking about incidents is not rude. It is the job._ ## Where do we fit? We are an independent guide. We never touch your data and we give no legal advice. Our [managed readiness review](/managed-readiness) prepares your file for the lawyer conversation. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1](https://www.micro1.ai/data-partnerships) - [Mercor](https://www.mercor.com/data/) - [Troveo](https://www.troveo.ai/business-data) - [terms](https://simpleclosure.com/tos/) --- # Can I delete my data after AI trains on it? > Can I delete my data after an AI company trains on it? Deleting files does not undo training, Troveo says. Regulators can order model deletion in some cases. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-delete-my-data-after-an-ai-company-trains-on-it Published: 2026-07-15 Updated: 2026-10-13 ## The short answer You can ask, but deleting files does not undo training. Troveo says trained models survive the license ending because data cannot be untrained. An FTC order announced in February 2024 made Avast delete derived data and algorithms, but that involved a vendor, not a company licensing its own archive. Three questions hide inside this one. Can the buyer keep the files? Can the buyer keep the model? Can a regulator reach the model? The sources answer each one differently. ## What do the companies say about deleting files? [micro1's data partnerships page](https://micro1.ai/data-partnerships) says data is kept for a limited time under agreed retention policies. On request, or at the end of an engagement, it is deleted under the agreed terms. [Troveo](/buyers/troveo)'s [guide](https://www.troveo.ai/resources/ai-data-licensing-deals) lists whether data must be deleted at expiry among the terms to settle. These are self-reported statements. The contract is what binds. ## Does deleting undo training? Troveo says no. Its [guide](https://www.troveo.ai/resources/ai-data-licensing-deals) says buyers typically insist that models already trained survive the license ending, "because nothing can be untrained." So I'd split the request into three separate asks: - stopping future access - deleting a retained copy - changing a model already built using the records ## Can a regulator order a model deleted? It has happened in FTC orders. The [FTC order against Avast](https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over), announced 22 February 2024, reached any algorithms Jumpshot built from browsing data the FTC says Avast sold against its promises to users. It's a warning for any company that passes data on, and weak precedent for a company licensing its own archive. The other orders, and what model deletion does and doesn't reach, are in [our page on FTC model deletion orders](/answers/can-the-ftc-make-a-buyer-delete-a-model-trained-on-your-data). ## Does the CCPA let me stop a buyer's misuse after it trains on my data? California's sale statute ([CCPA text](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)) requires a seller of personal information to hold rights in the buyer agreement. The seller must be able to take reasonable steps to stop and fix unauthorized use. Section 1798.100(d) lists that right. It reaches use of the data. The statute does not say it reaches a trained model. ## What should I look for in a draft? In a draft, I'd look for five things: - the deletion trigger - the deadline - whether backups and derived data are included - whether you get written confirmation - whether the buyer's rights over models survive the term The [buyers page](/buyers) records what each buyer publishes about retention. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) The [managed readiness service](/managed-readiness) lines up the deletion terms from each draft for your lawyer. Figure: steps Data delivered, model trains -> Data deleted at expiry -> Trained model survives. Troveo's guide says models already trained survive the license ending, because nothing can be untrained. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's data partnerships page](https://micro1.ai/data-partnerships) - [guide](https://www.troveo.ai/resources/ai-data-licensing-deals) - [FTC order against Avast](https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over) - [CCPA text](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) --- # Is licensing data to an AI lab a sale under CCPA? > Searching whether selling data to an AI lab is a CCPA sale? A license can be one. The statute counts transfers for money or other valuable consideration. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa Published: 2026-07-15 Updated: 2026-10-14 ## The short answer Under Civil Code 1798.140(ad)(1), a transfer of personal information for monetary or other valuable consideration is a sale. Two exits exist: a third party that assumes control of the business, or data that meets the deidentified definition. The text does not mention AI labs. Ask counsel about any deal. The California Consumer Privacy Act reaches employee and business-contact data as well as consumer data. That surprises people, so I'm putting it first. ## What does the CCPA's definition of sale say? The CCPA's [section 1798.140(ad)(1)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) defines sell with a long list of verbs: selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating. The target is a consumer's personal information. It is passed to a third party for money or other valuable consideration. The wording is broad enough to reach a license. [Section 1798.190](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) adds an anti-avoidance rule. A court or the agency must ignore steps taken to avoid the definition of sell. That includes steps that drop the money while a party still gets something of value. ## Does the merger exception cover a data license? The exception in (ad)(2)(C) covers personal information transferred "as an asset that is part of a merger, acquisition, bankruptcy, or other transaction." The third party must take control of all or part of the business. A license to a lab leaves the owner in control of its business. On the text, that points away from the exception. That is a reading. It is not a court ruling. ## Does de-identifying the data avoid the sale rule? Only if the data meets the definition. Under [1798.140(m)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), the data cannot reasonably be used to learn facts about a consumer. It cannot be linked to one either. The business must also meet three conditions. - It takes reasonable steps so the information cannot be tied to a consumer or household. - It publicly commits to keep it deidentified and not to re-identify it. - It requires every recipient by contract to follow the same rules. ## Does CCPA cover employee data in a sale? The [California Attorney General](https://oag.ca.gov/privacy/ccpa) says the employment and business-to-business exemptions expired. Employee and B2B personal information has been covered since 1 January 2023. ## What does a sale require afterward? A business that sells personal information must sign an agreement with the buyer. The agreement does four things: - It limits the purposes. - It requires the same level of privacy protection. - It gives the business steps to check compliance. - It requires the buyer to report if it cannot comply. It also lets the business stop and fix unauthorized use. That is [Civil Code 1798.100(d)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf). The fines are real. The [Attorney General announced](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general) $12.75 million from General Motors on 8 May 2026 for selling driving data to buyers against its privacy policy. See the [risks page](/risks) for the full table and the [privacy policy page](/answers/do-i-need-to-update-my-privacy-policy-before-licensing-data-to-ai) for the notice side. Figure: comparison of Three outcomes under the CCPA sale test: Sale (emphasized: A transfer for money fits first, Money or value), Control exception (Buyer runs business), Deidentified (Three conditions). A transfer for money or other valuable consideration fits the definition of sale first, and the two exits need extra facts. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [section 1798.140(ad)(1)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [California Attorney General](https://oag.ca.gov/privacy/ccpa) - [Attorney General announced](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general) --- # Can I license Slack Connect messages to AI? > Searching whether you can sell Slack Connect messages to AI? Licensing them is murky. An export carries partner messages, and Slack's text is silent on it. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai Published: 2026-07-14 Updated: 2026-10-14 ## The short answer The answer turns on the partner's rights. A shared-channel export carries the partner's messages, and Slack says those follow the partner's retention rules. Slack's help page doesn't say who may license them. Ask counsel whether your partner contracts and NDAs allow this use. Shared channels are where your archive stops being only yours. Most people forget they exist. ## What does Slack say about shared-channel data? [Slack's help page on Slack Connect](https://slack.com/help/articles/115004152843-How-data-management-features-apply-to-Slack-Connect) says "your workspace or Enterprise organization's retention settings will only apply to messages and files sent by your members." Content from outside people follows their own organization's retention policies. Paid-plan workspace owners and admins can export data from public channels shared with other companies. The page doesn't address who owns shared-channel content. ## Does Teams handle it differently? [Microsoft's shared channels page](https://learn.microsoft.com/en-us/microsoftteams/shared-channels) says shared channel messages are stored in a dedicated system mailbox. It says channels inherit retention, data-loss-prevention and compliance policies from the team or host organization. It also says admins can discover all message data in the channel regardless of who added it. That tells you who can search and export the data. It says nothing about who may license it. ## What is the risk? A shared channel often holds a customer's, partner's or vendor's confidential information. [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) says email and chat contain other companies' confidential information. NDAs often cover it. See [NDAs and a data license](/answers/does-my-nda-let-me-sell-data-to-ai). If the export route is an app, [Slack's API terms](https://slack.com/terms-of-service/api) (its rules for app connections) add limits. They are covered in [licensing company Slack data](/answers/is-it-legal-to-sell-company-slack-data). I found no case about licensing shared-channel content. ## How do you sort your own messages from a partner's? Our readiness checklist tags each system and channel in one of three ways: - First-party. - Held for someone else. - Third-party content, such as Slack Connect, shared drives and guests. We record the tags as facts. We leave the decision on third-party content to counsel. Do that sort first. A licensing file that mixes the three groups can't show which messages you had the right to license. Talk to a commercial lawyer in your state before you sign. The [rights check](/rights-check) asks whose records these are and whether staff messages are included. Figure: comparison of Whose messages sit in a shared-channel export: Your members (Your retention rules), Partner's members (emphasized: Their messages keep their rules, Their own rules). Retention follows each organization's members, so a partner's messages in your export keep the partner's rules. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Slack's help page on Slack Connect](https://slack.com/help/articles/115004152843-How-data-management-features-apply-to-Slack-Connect) - [Microsoft's shared channels page](https://learn.microsoft.com/en-us/microsoftteams/shared-channels) - [FKKS](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Slack's API terms](https://slack.com/terms-of-service/api) --- # Is it legal to license customer data? > Searching whether it's legal to sell customer data? A license can count as a sale in California. Penalties land when it contradicts your privacy notice. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-it-legal-to-sell-customer-data Published: 2026-07-14 Updated: 2026-10-14 ## The short answer The sale itself is the regulated act. California's CCPA requires notice, opt-out and a written contract with the buyer. Penalties have followed sales that contradicted customer notices. California settled with General Motors for $12.75 million over driving data. Ask a lawyer to read your notices first. Short version: the sale is the regulated act. The notice you gave your customers is the benchmark. ## How does the CCPA treat a sale of customer data? [The statute](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) defines a sale as disclosing personal information to a third party for "monetary or other valuable consideration." A business that sells must give notice and honor opt-outs. It must also sign a contract with the buyer. The contract limits the purposes. It also requires the same protection ([section 1798.100(d)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). The statute tells courts to "disregard the intermediate steps" of deals built to avoid the word sale. ## What happened when companies broke their customer data promises? General Motors paid $12.75 million in civil penalties. The [attorney general](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general) said GM sold location and driving data to two data brokers. It covered hundreds of thousands of Californians. GM also misled consumers about how the data was used, the attorney general said. The orders bar selling driving data to consumer reporting agencies for five years. They require deletion within 180 days, with limited exceptions. DoorDash paid $375,000. The [attorney general](https://www.oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company) said DoorDash took part in a marketing cooperative that shared customers' names, addresses and transaction histories. That was a sale, made without the required notice and opt-out. ## Does calling it a license change anything? The CCPA's definition covers disclosing, making available or otherwise communicating personal information. The exchange must be for monetary or other valuable consideration. It does not turn on whether the contract says sale or license. On that text, a data license to an AI buyer can fit the definition. The exception is data that meets the statute's test for deidentified information. Deidentified means it can no longer be tied to a person. Ask counsel whether your deal fits. That test has three parts: - reasonable measures - a public commitment not to reidentify - a contract binding every recipient to the same ## Do other laws change the answer? Yes. [Virginia](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) counts a sale only when personal data is exchanged for money. Some data sits under sector rules. That includes health records, financial records, student records and children's data. One example is HIPAA's ban on selling protected health information without authorization ([45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502)). The role you held matters too. Did you collect the data as the owner, or hold it as a vendor for someone else? See [SaaS vendors](/answers/can-a-saas-company-sell-its-customers-data-to-ai). Talk to a privacy or commercial lawyer in your state before you sign. Our [risks page](/risks) and [rights check](/rights-check) list what to bring. Figure: range, California data-sale settlements, $375K to $12.75M. California has settled data-sale cases at very different sizes. Source: California Attorney General press releases. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [The statute](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [attorney general](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general) - [attorney general](https://www.oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company) - [Virginia](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) - [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502) --- # License Linear data to AI: export caps and terms > Trying to sell Linear data to AI? Licensing is the route. Troveo names Linear, member CSV exports cap at 250 issues, and Linear says it won't train on it. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-linear-data-to-ai Published: 2026-07-14 Updated: 2026-10-14 ## The short answer To license Linear data to AI, export your issues and projects. Troveo lists Linear as a tool buyers want. The CSV export caps at 250 issues for members and 2,000 for admins, so a full history needs the GraphQL API. Linear says it won't train on customer data. An issue shows who asked for a change, who built it and how it closed. Our [Jira page](/answers/sell-jira-data-to-ai) covers what buyers have said about tickets in general. ## Which companies name Linear? [Troveo](https://www.troveo.ai/business-data) lists Linear with Jira, Asana, Monday, Notion and Figma under work and knowledge. Mercor's data page doesn't name Linear, and micro1's data partnerships page lists project histories without naming a tool. All of it is self-reported. ## How does a Linear export work? [Linear's docs](https://linear.app/docs/exporting-data) describe CSV exports from the command menu, from view dropdowns, or from Settings, Administration, Import Export. Members can export up to 250 issues or 200 projects. Admins and owners can export up to 2,000 issues, and guests can't export at all. The download link expires after 12 hours. A GraphQL API is also available. A workspace with more than 2,000 issues needs it for a full history, which is my reading of the cap. The docs page carries no date. ## What do Linear's terms say? The [Terms](https://linear.app/terms) say the customer owns all right, title and interest in its User Submissions. Linear's license to them is limited to providing the service to the customer. The [AI Addendum](https://linear.app/legal/ai-addendum), effective the same day, says in section 13.2 that Linear will not use customer data, including prompts and outputs, to train, fine-tune or improve its own AI models. Section 13.3 says subprocessors must agree not to train their own models on customer data. ## What needs a rights check? Issues name customers, link to support threads and quote contract terms. That's my reading of how teams use Linear. Under the Terms your company owns the submissions, but your [customer contracts](/answers/do-customer-contracts-allow-selling-data) and [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai) can still limit licensing. The [rights check](/rights-check) lists the questions. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: scale, Issues per CSV export, by role: Member 250 issues, Admin or owner 2,000 issues (emphasized). Admins and owners can export far more issues per CSV than members. Source: Linear docs, Exporting data, undated. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [Linear's docs](https://linear.app/docs/exporting-data) - [Terms](https://linear.app/terms) - [AI Addendum](https://linear.app/legal/ai-addendum) --- # Texas data broker law: who must register > Texas data broker law, Chapter 509 as amended by SB 2121: who it covers, the revenue test, the $100 a day penalty and the Attorney General's enforcement so far. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/texas-data-broker-law Published: 2026-07-14 Updated: 2026-10-14 ## The short answer The Texas data broker law is Chapter 509, amended by SB 2121, effective 1 September 2025. It covers businesses handling personal data they did not collect directly, if that is over 50% of revenue or 50,000+ people. The penalty is $100 per day, capped at $10,000 per year. The Texas test looks at how the data was collected. It doesn't list staff or customers as exempt. Legally, a "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers. It keeps "data broker" for the legal term. ## What did SB 2121 change? The 2023 version of the Texas law defined a broker by its main source of revenue. SB 2121 rewrote the definition to turn on activity. The activity is collecting, processing or transferring personal data the business did not collect directly from the person. The revenue test moved into its own section. In a 12-month period, the chapter covers a broker only if one of these is true: - More than 50 percent of its revenue comes from processing or transferring data it did not collect directly. - It earns revenue from the data of more than 50,000 individuals. [SB 2121](https://capitol.texas.gov/tlodocs/89R/analysis/html/SB02121F.htm) took effect on 1 September 2025. ## Does Texas have a direct-relationship test? The text says "collected directly from the individual." It doesn't list customers or employees as exempt. Vermont, Oregon and New Jersey handle it the other way. So the [Texas test](/answers/do-i-need-to-register-as-a-data-broker-to-sell-my-own-data) can read differently on a mixed archive. That's my reading of the text. I found no Texas guidance on archive licensing. ## What is the penalty? [WilmerHale's summary](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250904-texas-expands-and-modifies-data-broker-registration-law) reports a penalty of $100 for each day a broker violates the law. The total can't exceed $10,000 in a 12-month period. The same summary says brokers register with the Secretary of State. ## Has Texas enforced it? The Attorney General's office [announced letters in June 2024 to more than 100 companies](https://www.privacyworld.blog/2024/06/the-eyes-of-texas-are-upon-you-texas-privacy-enforcement-heats-up/). The letters cited an apparent failure to register. On 13 January 2025 it [sued Allstate and its subsidiary Arity](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250121-texas-ag-brings-first-ever-lawsuit-under-a-state-comprehensive-privacy-law). The complaint alleges that Arity did not register as a data broker. I haven't confirmed an outcome in that case. Allegations in a complaint are not findings. ## How does Texas compare with the other states? [Vermont](/answers/vermont-data-broker-law) lists employees and customers as direct relationships. Our [state map](/answers/are-data-brokers-legal) places Texas next to California, Oregon, New Jersey and Connecticut. Figure: scale, Texas data broker penalty: One day of violation $100, Cap in any 12 months $10,000 (emphasized). Daily Texas penalties add up to a yearly cap. Source: Texas Business and Commerce Code ch. 509, via WilmerHale. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [SB 2121](https://capitol.texas.gov/tlodocs/89R/analysis/html/SB02121F.htm) - [WilmerHale's summary](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250904-texas-expands-and-modifies-data-broker-registration-law) - [announced letters in June 2024 to more than 100 companies](https://www.privacyworld.blog/2024/06/the-eyes-of-texas-are-upon-you-texas-privacy-enforcement-heats-up/) - [sued Allstate and its subsidiary Arity](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250121-texas-ag-brings-first-ever-lawsuit-under-a-state-comprehensive-privacy-law) --- # FTC retroactive terms of service AI: what it says > FTC retroactive terms of service AI: staff wrote that a quiet, retroactive change to allow AI use may be unfair or deceptive. Cases and remedies. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/ftc-retroactive-terms-of-service-ai Published: 2026-07-13 Updated: 2026-10-14 ## The short answer The FTC says retroactive, quiet changes to allow AI use may be unfair or deceptive. FTC staff published that position. 1Health paid $75,000 in 2023 for a retroactive privacy change. Avast paid $16.5 million in 2024 and had to delete derived data and algorithms. The FTC blog post is staff commentary. It is not a rule. Its weight comes from the cases behind it, so I have listed them in order. ## What did the FTC say? Staff in the Office of Technology and the Division of Privacy and Identity Protection wrote that a company may not collect data under one set of promises and then change them in secret. They added that users may have no recourse because switching costs are high. The post says the FTC will pursue firms that "surreptitiously re-write" their privacy policies or terms. The goal of those firms is to give themselves free rein to use consumer data for product development ([FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive)). ## Which cases does the FTC cite? It names two cases. Gateway Learning Corporation (2004) changed its privacy policy to share consumer data with third parties. It gave no notice and got no consent. The second case is 1Health.io (2023). The 1Health order was finalized 7 Sep 2023. It charged that in 2020 the company retroactively widened the third parties it could share data with. It did not tell consumers or get consent. It paid $75,000 for refunds ([FTC](https://www.ftc.gov/news-events/news/press-releases/2023/09/ftc-finalizes-order-1healthio-over-charges-it-failed-protect-privacy-security-dna-data-unfairly)). ## What happened with Match and OkCupid? On 30 Mar 2026 the FTC announced an action over OkCupid. It gave an unrelated third party access to photos, location and demographic data of nearly three million users. The third party's investors included OkCupid's founders. The order permanently bars the companies from misrepresenting how they collect, use and share personal information. The release lists no money ([FTC](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-takes-action-against-match-okcupid-deceiving-users-sharing-personal-data-third-party)). ## Can the remedy reach what was built from the data? In some orders, yes. The Avast order, announced 22 Feb 2024, required deletion of web browsing information sent to Jumpshot "and any products or algorithms Jumpshot derived from that data." It also required $16.5 million for consumers ([FTC's Avast order announcement](https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over)). The Rite Aid order, announced 19 Dec 2023, required deletion of images and any algorithms or other products developed using them ([FTC's Rite Aid announcement](https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without)). My reading is that a buyer could face a deletion demand over data that was unlawfully obtained. That demand would reach back to the owner through contract warranties. That is analysis. It is not a holding. The Everalbum order and the limits of model deletion are in [our page on FTC model deletion orders](/answers/can-the-ftc-make-a-buyer-delete-a-model-trained-on-your-data). ## What does this mean for a company with an archive? Your notice history matters. What were customers and employees told when their records were collected? Does a license to an AI buyer fit it? Our page on [updating your privacy policy](/answers/do-i-need-to-update-my-privacy-policy-before-licensing-data-to-ai) covers the California side. The [consent page](/answers/do-i-need-consent-to-sell-customer-data-for-ai-training) covers when fresh consent may be the safer course. The [risk map](/risks) lists the other exposures. The [rights check](/rights-check) starts the fact-finding. Talk to a privacy or commercial lawyer in your state before you sign. Figure: steps Promise made at collection -> Terms change, data used for AI -> FTC treats it as deception. In the cases above, a promise came first, a quiet change second and the FTC's action last. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) - [FTC](https://www.ftc.gov/news-events/news/press-releases/2023/09/ftc-finalizes-order-1healthio-over-charges-it-failed-protect-privacy-security-dna-data-unfairly) - [FTC](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-takes-action-against-match-okcupid-deceiving-users-sharing-personal-data-third-party) - [FTC's Avast order announcement](https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over) - [FTC's Rite Aid announcement](https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without) --- # License healthcare company data to AI: what stays out > Searching how to sell healthcare company data to AI? Any license keeps patient data out. HIPAA bars selling health information without authorization. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-healthcare-company-data-to-ai Published: 2026-07-13 Updated: 2026-10-14 ## The short answer License healthcare data to AI only after finding any patient records. HIPAA says you can't sell patient health data without a valid authorization. Mercor lists healthcare, and Protege runs a market for health datasets. A lawyer who reads your records decides. This page reports what the texts and buyer pages say. It is research, not legal advice. > **Patient records need a valid authorization before they can be sold.** Think of the attic. Patient files sit in the locked cabinet. The other boxes are a separate pile, and you sort that pile first. ## Does HIPAA stop a healthcare company from licensing its data? The sale rule, [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502), binds a covered entity or business associate. It reaches patient records and similar files a covered entity holds. For protected health information, the rule says yes unless an authorization meets its terms. Our [health and financial data page](/answers/can-i-sell-health-or-financial-client-data-to-ai) reads that rule and the de-identification test line by line, so this page does not repeat them. This page adds the industry view. A clinic, billing firm or health-software vendor holds records that may be protected health information. The operational files around them, such as vendor contracts or marketing assets, are a different category. ## What do the companies and marketplaces say about healthcare? [Mercor's data page](https://www.mercor.com/data/) names healthcare among eight sectors. It lists clinical notes, claims and intake forms as the data types for it (self-reported). Those are the files HIPAA's sale rule is written around. micro1's page lists six areas without naming health. See [does industry matter](/answers/does-industry-matter-for-selling-company-data). [Protege](/buyers/protege) sells licensed health, video and audio datasets to AI developers, per [its site](https://withprotege.ai/). Our [Protege page](/answers/protege-ai-data-marketplace) covers what it publishes. _The cafeteria menu can wait. Sort the patient files first._ ## What does a HIPAA violation cost? HHS's [inflation adjustment, published in the Federal Register](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment), lists these figures for calendar year 2025: - Tier 1, no knowledge of the violation: $145 minimum, $73,011 maximum per violation. - Tier 2, reasonable cause: $1,461 minimum, $73,011 maximum. - Tier 3, willful neglect corrected within 30 days: $14,602 minimum, $73,011 maximum. - Tier 4, willful neglect not corrected within 30 days: $73,011 minimum, $2,190,294 maximum. Each tier carries a calendar-year cap of $2,190,294. ## Which other health rules sit beside HIPAA? Two come up for healthcare companies. Washington's My Health My Data Act, at [RCW 19.373.070](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070), bars selling consumer health data without a valid authorization that is separate from consent to collect it. The authorization expires one year after signing. [Section 19.373.100](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.100) exempts protected health information governed by HIPAA, among other categories. So our reading is that the Act reaches health data outside HIPAA's scope. [42 CFR 2.12](https://www.law.cornell.edu/cfr/text/42/2.12) applies Part 2 to records that identify a patient as having a substance use disorder and come from a federally assisted program. ## What can a healthcare company gather first? List the systems that hold patient information, the notices patients received and the business-associate agreements you signed. The [rights check](/rights-check) asks whether health records rules apply and lists what to settle with counsel. The [risks page](/risks) lists where company-data sales drew fines. Figure: range, HIPAA top tier, per violation, 2025 figures, $73K to $2.19M. HIPAA's top penalty tier reaches into the millions per violation. Source: HHS inflation adjustment, Federal Register. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [45 CFR 164.502(a)(5)(ii)](https://www.law.cornell.edu/cfr/text/45/164.502) - [Mercor's data page](https://www.mercor.com/data/) - [its site](https://withprotege.ai/) - [inflation adjustment, published in the Federal Register](https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment) - [RCW 19.373.070](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070) - [Section 19.373.100](https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.100) - [42 CFR 2.12](https://www.law.cornell.edu/cfr/text/42/2.12) --- # Who are the AI data companies, by lane? > AI data companies sort into three lanes: direct programs, marketplaces and expert-labor platforms. Names in each lane and which ones take company records. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/ai-data-companies Published: 2026-07-13 Updated: 2026-10-14 ## The short answer AI data companies sort into three lanes. Direct programs like micro1, Handshake AI, Mercor and Scale AI take company records such as SOPs, CRM data, chat and tickets. Marketplaces like Troveo and Protege license data. Expert-labor platforms like Surge AI hire contractors for expert work and take no company files. "AI data company" covers firms with very different business models. The lane tells you whether a firm takes your records under a program, licenses them for you or takes no company records at all. That is the first thing we sort out. > **The lane matters more than the logo.** Think of a library. One firm borrows the boxes from your attic. One lends them out for you. One hires writers for new books. ## Which AI data companies take company records? These firms take records from businesses. All terms below are self-reported unless noted. | Company | What it takes | Stated terms | |---|---|---| | [micro1](https://www.micro1.ai/data-partnerships) | SOPs, knowledge bases, CRM data, project histories, ticket workflows | 30+ staff and mature operations on its pages. Tiers $100K+, $500K+, $1M+ | | [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) | Operational data "from businesses across every major industry" | $100K to $4M+. [Handshake AI's company referral page](https://joinhandshake.com/ai/data-partnerships/referral) asks for 20+ full-time staff and 3+ years | | Mercor data arm | Slack, Teams, Gmail and more through connectors | One-off payment by volume, depth and tools | | [Replay](https://www.replay.ai/) | Communications, tickets, code, CRM, financial records and support history | Bands start at 20 to 50 employees, $10K to $100K. Upfront plus revenue share | | [Polyshares](https://polyshares.com/) | Slack, Teams, email, Drive, SharePoint, CRM, tickets and call recordings | No minimum stated. $100K to $2M+, net 30 to 60 after approval | | Idler | Codebases and de-identified operating data | Firms with 10 to 100 staff. No price published | | [Scale AI](https://scale.com/data-partnership) | Data warehouses, chat, email, documents, Jira, Notion, Salesforce and SAP records | 40+ employees preferred. $10K to $1M+ per partnership, labelled illustrative | micro1 also runs a referral program for introductions. Size floors for each are in [do you qualify for an AI data program](/answers/ai-data-program-minimums), and our [Replay review](/answers/replay-review) reads Replay in full. ## Which AI data companies are marketplaces? A marketplace licenses your data to buyers and pays you a share. [Troveo](https://www.troveo.ai/business-data) added business data in 2026. It covers chat, email, documents, CRM and finance systems. It pays a revenue share on every sale and hasn't published the split. Protege describes revenue-share payments when an owner's content enters qualified deals. Its materials focus on healthcare, media and video. Defined.ai, Datarade, Snowflake Marketplace and AWS Data Exchange list data products for enterprise buyers. They sell to those buyers and take no archives from you. ## Which AI data companies sell expert work? Scale AI (Outlier and Remotasks), Surge AI, Turing, Snorkel AI, Appen and Toloka sell expert labor to AI labs. Their contractors write, grade and correct AI output. Three of them now also pay companies for records. Scale AI runs a [data partnership](https://scale.com/data-partnership), Turing runs [Project Lazarus](https://lazarus.turing.com/) and Appen licenses [enterprise data](https://www.appen.com/enterprise-data). We found no such program at Surge AI, Snorkel AI or Toloka. The [buyer directory](/buyers) covers the lanes that take company records. Figure: comparison of Three lanes of AI data companies: Direct programs (emphasized: The lane that pays for your records, Pay for your records), Marketplaces (Share each sale), Expert-labor platforms (Sell contractors' work). Direct programs are the lane that pays businesses for their records. _The logos all look friendly._ ## Where should a company owner start? Look at the first two lanes. Count your systems and years of records first. Then run the [rights check](/rights-check). The free [fit check](/business) comes next. Marketplaces for enterprise data products, such as Snowflake and AWS Data Exchange, are a fourth group. They sell data and don't buy it from you. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1](https://www.micro1.ai/data-partnerships) - [Handshake AI](https://joinhandshake.com/ai/data-partnerships/) - [Handshake AI's company referral page](https://joinhandshake.com/ai/data-partnerships/referral) - [Replay](https://www.replay.ai/) - [Polyshares](https://polyshares.com/) - [Scale AI](https://scale.com/data-partnership) - [Troveo](https://www.troveo.ai/business-data) - [Project Lazarus](https://lazarus.turing.com/) - [enterprise data](https://www.appen.com/enterprise-data) --- # License Jira data to AI: what is public and what to check > Looking to sell Jira data to AI? In practice you license it. Buyers have asked failed startups for tickets, and Atlassian says customers own their data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-jira-data-to-ai Published: 2026-07-12 Updated: 2026-10-14 ## The short answer To license Jira data to AI, you export your ticket history. Mercor paid as high as $300,000 for defunct startup datasets that included Jira tickets. Atlassian says the customer owns the data. Tickets carry customer and vendor details that need a rights review before the deal. A ticket records a problem, an owner, the steps taken and who approved the fix. That sequence is close to what agent builders say they want. ## Why does Troveo say labs want Jira tickets? [Troveo's guide](https://www.troveo.ai/resources/sell-code-to-ai-companies) says issues and tickets linked to code are part of the development story a lab values, next to commit history and review. Our page on [RL environments](/answers/what-is-an-rl-environment) explains where such records get used. [Forbes' report](https://www.forbes.com/sites/annatong/2026/04/16/ais-new-training-data-your-old-work-slacks-and-emails/), summarized in its own post on X, named Slack archives, Jira tickets and email threads as what labs treat as premium training data. [Epoch AI's survey](https://epoch.ai/gradient-updates/state-of-rl-envs) describes clones of apps like Slack and does not discuss real company archives. So demand gets described more often than it gets proven. ## How does Jira data get exported? [Atlassian's backup manager](https://support.atlassian.com/jira-cloud-administration/docs/export-issues/) exports Jira work items and field content, comments, users and groups, and optionally attachments, avatars and logos. Size limits are 25 GB for the data and 50 to 100 GB for attachments. Include attachments and you wait 48 hours between backups. The backup also skips automation flows and third-party app data. ## What do Atlassian's terms say? The [Atlassian Customer Agreement](https://www.atlassian.com/legal/customer-agreement) says the customer owns all intellectual property and other rights in Customer Data and Customer Materials. It also says the customer may retrieve its Customer Data from the Cloud Products. AI features fall under separate AI Terms, which I didn't read. ## What sits inside Jira tickets? Support and service projects hold customers' own words, vendors' details and employee names. That's my reading of how teams use Jira. The rights question runs through your [customer and vendor contracts](/answers/does-my-nda-let-me-sell-data-to-ai) and the [rights check](/rights-check). If the company is closing, see [licensing a Slack workspace during a shutdown](/answers/can-a-shutting-down-company-sell-its-slack-to-ai). The [Slack data page](/answers/sell-slack-data-to-ai) covers the chat side of the same archive. Talk to a privacy or commercial lawyer in your state before you sign. Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of What a Jira backup includes and leaves out: In every backup (emphasized: Included in every backup, Work items, comments), Optional media (Attachments, avatars), Not exported (Automation, app data). Work items and comments lead because every backup includes them, while media is optional and automation is excluded. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's guide](https://www.troveo.ai/resources/sell-code-to-ai-companies) - [Forbes' report](https://www.forbes.com/sites/annatong/2026/04/16/ais-new-training-data-your-old-work-slacks-and-emails/) - [Epoch AI's survey](https://epoch.ai/gradient-updates/state-of-rl-envs) - [Atlassian's backup manager](https://support.atlassian.com/jira-cloud-administration/docs/export-issues/) - [Atlassian Customer Agreement](https://www.atlassian.com/legal/customer-agreement) --- # What reps and warranties does an AI data buyer ask for > What reps and warranties does an AI data buyer ask for? Public terms list ownership, lawful collection, consents, no infringement and open-source notice. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for Published: 2026-07-12 Updated: 2026-10-14 ## The short answer An AI data buyer asks owners to promise five things: you own or can license the data, collected it lawfully, gave required notices and got consents, infringe nobody's rights, and disclosed known problems. SimpleClosure's terms have the owner indemnify the buyer. No buyer publishes its full contract. A rep is a statement of fact you make when you sign. A warranty is a promise that the statement is true, backed by money if it isn't. In a data deal the owner makes most of them. ## What does SimpleClosure's list for owners say? [SimpleClosure's terms of service](https://simpleclosure.com/tos/), are the only complete public list I found. An owner of digital assets warrants six things: - You are the lawful owner, or you hold all the rights, licenses, consents and authority to sell, transfer or license the assets. - The assets do not violate anyone's intellectual property, privacy or contractual rights. - You gave the notices and got the consents that privacy laws such as CCPA, CPRA and GDPR require. - The assets are free of liens and third-party claims. - Every open-source component is disclosed. - Known defects, claims and disputes are disclosed in advance. ## What do other buyers say? [Troveo's licensing guide](https://www.troveo.ai/resources/ai-data-licensing-deals) says the owner promises two things. The owner holds the rights it licenses. The owner acquired the data lawfully. [Handshake AI's data partnership page](https://joinhandshake.com/ai/data-partnerships/) says partners remain responsible for making sure their transfer meets legal requirements (both undated). The wording differs, but the shape matches. The buyer wants proof that you had the right to hand the records over. ## What happens if a warranty turns out wrong? [SimpleClosure](/buyers/simpleclosure)'s terms make the owner defend SimpleClosure against claims that come from any of these: - a broken warranty - an infringement allegation - a privacy-law violation - a missing consent - an undisclosed open-source obligation SimpleClosure caps its own liability at the greater of six months of amounts paid or $100. Read that pairing carefully. The owner's exposure is wide. SimpleClosure's is capped. Replay's [data privacy page](https://www.replay.ai/data-privacy) says it caps your exposure at the fees paid. Most others have not published their terms, so ask for them before any call. The same warranties come back in an acquisition. How a data license meets the acquirer's reps is in [licensing data before an acquisition](/answers/license-company-data-before-selling-your-business). ## What can you gather before the first call? Gather facts, not conclusions. Make a list of: - the systems that hold the records - the contracts with confidentiality clauses - the privacy notices your staff and customers received - any open-source code in a repository - any open dispute The [rights check](/rights-check) walks through that list. The [risks page](/risks) covers what buyers publish about de-identification. The [guide to licensing company data](/guides/how-to-sell-company-data-to-ai-companies) shows where warranties fit in the full process. Who carries the loss if a buyer is breached is a separate question. It is answered in [who is liable if the data buyer is hacked](/answers/who-is-liable-if-the-data-buyer-is-hacked). What the buyer may do with the data, train on it or look it up per answer, is in [training license vs RAG license](/answers/training-license-vs-rag-license). Why a consent gap can cost a buyer its model is on [our page on FTC model deletion orders](/answers/can-the-ftc-make-a-buyer-delete-a-model-trained-on-your-data). What to check when a deal is called insured is on [our page on insuring a data deal](/answers/can-you-insure-an-ai-data-licensing-deal). Figure: comparison of Who carries the risk in SimpleClosure's terms: Owner (emphasized: Terms put the risk on owners, Warrants and indemnifies), SimpleClosure (Liability capped), Buyer (Terms not published). SimpleClosure's published terms put the warranties and the indemnity on the owner. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [SimpleClosure's terms of service](https://simpleclosure.com/tos/) - [Troveo's licensing guide](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Handshake AI's data partnership page](https://joinhandshake.com/ai/data-partnerships/) - [data privacy page](https://www.replay.ai/data-privacy) Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) --- # License recruiting agency data to AI: the rules > Looking to sell recruiting agency data to AI? A license meets the FCRA, a one-year rule and California law on candidate records. No buyer page names recruiting. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-recruiting-agency-data-to-ai Published: 2026-07-11 Updated: 2026-10-14 ## The short answer Most recruiting agency records describe candidates, not your company, so start there. No buyer page I read names recruiting. Three public rules apply: the Fair Credit Reporting Act, a federal one-year hiring record requirement, and California's privacy law on job applicants. A recruiting agency holds two kinds of records. Its own operations are one, and the candidates and client employers it works for are the other. ## Which companies list recruiting? None by name, on the pages I read. [Mercor's data page](https://www.mercor.com/data/) lists eight sectors and [micro1's page](https://www.micro1.ai/data-partnerships) lists six areas, and neither names recruiting. All of it is self-reported. The [industry page](/answers/does-industry-matter-for-selling-company-data) compares the lists. ## Does the Fair Credit Reporting Act reach a recruiting agency? It can. The FCRA, [15 U.S.C. 1681a(f)](https://www.law.cornell.edu/uscode/text/15/1681a), defines a consumer reporting agency as a person that, for fees, regularly assembles or evaluates consumer credit information or other information on consumers to furnish consumer reports to third parties. Background-screening firms are the usual example. Whether an agency's candidate files fall under the definition depends on what it does with them. That's a question for counsel. ## How long must hiring records be kept under EEOC rules? The EEOC rule at [29 CFR 1602.14](https://www.law.cornell.edu/cfr/text/29/1602.14) says an employer must preserve personnel and employment records, including application forms, for one year from the date the record was made or the personnel action, whichever is later. The period runs until a discrimination charge is finally resolved if one is filed. The text speaks of records made or kept by an employer. Whether it reaches a recruiting agency's own files, and what a retention duty means for licensing or a deletion request, is for counsel too. ## What do California rules add for a recruiting agency's applicant data? California's privacy law covers job applicants and employees. In its order of 30 Sep 2025, the [California Privacy Protection Agency](https://cppa.ca.gov/announcements/2025/20250930.html) fined Tractor Supply $1.35 million. Law-firm summaries call it the agency's first action over workforce disclosures, and say it faulted the applicant notice for omitting privacy rights. My reading is that applicant records are personal information in California. See [the CCPA page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa), [employee consent](/answers/do-i-need-employee-consent-to-sell-company-data) and [HR records](/answers/can-i-sell-hr-or-payroll-records-to-ai). Talk to a privacy or commercial lawyer in your state before you sign. Our [rights check](/rights-check) lists the first questions. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three rules that reach recruiting records: FCRA (Defines the agency), 29 CFR 1602.14 (emphasized: Records must be kept a year, One-year retention), California law (Covers applicants). The EEOC rule sets a one-year minimum for hiring records, which a deletion plan has to respect. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's data page](https://www.mercor.com/data/) - [micro1's page](https://www.micro1.ai/data-partnerships) - [15 U.S.C. 1681a(f)](https://www.law.cornell.edu/uscode/text/15/1681a) - [29 CFR 1602.14](https://www.law.cornell.edu/cfr/text/29/1602.14) - [California Privacy Protection Agency](https://cppa.ca.gov/announcements/2025/20250930.html) --- # Does the DOJ bulk data rule apply to company data? > Searching whether the DOJ bulk data rule covers selling company data? It covers licensing to covered persons and foreign buyers, and counts de-identified data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data Published: 2026-07-10 Updated: 2026-10-14 ## The short answer It can, when the buyer is foreign. The DOJ rule, 28 CFR Part 202, prohibits transfers to covered persons and requires contract terms against onward transfer for other foreign recipients. Its thresholds count de-identified data. Ask counsel whether your buyer and volumes fall inside it. The [Justice Department's Data Security Program](https://www.justice.gov/nsd/data-security) is a national security rule, and a company-archive license can fall inside it. ## Does the DOJ bulk data rule count a license to an AI lab as data brokerage? [Section 202.214](https://www.law.cornell.edu/cfr/text/28/202.214) of the DOJ bulk data rule defines data brokerage as the sale of data, licensing of access to data, or similar commercial deals. Employment, investment and vendor agreements are excluded. The rule covers transfers where the buyer did not collect the data directly from the people. A license of an archive to a lab fits that wording on its face. ## Who is a covered person? [Section 202.211](https://www.law.cornell.edu/cfr/text/28/202.211) covers two kinds of foreign entity: - One that is 50% or more owned by a country of concern or by covered persons. - One that is organized or based in a country of concern. It also covers two kinds of individual: - Employees or contractors of such entities. - People who live mainly in a country of concern. [Section 202.601](https://www.law.cornell.edu/cfr/text/28/202.601) lists the countries: China, Cuba, Iran, North Korea, Russia and Venezuela. Under the rule's own example, Chinese or Russian citizens in the United States count as US persons. ## What counts as bulk? [Section 202.205](https://www.law.cornell.edu/cfr/text/28/202.205) sets thresholds over any 12 months: - Personal health data on more than 10,000 US persons. - Personal financial data on more than 10,000 US persons. - Covered personal identifiers on more than 100,000 US persons. - Biometric identifiers or precise geolocation on 1,000 persons or devices. [Section 202.212](https://www.law.cornell.edu/cfr/text/28/202.212) excludes demographic or contact data that links only to other demographic or contact data. Names and email addresses alone fall there. Payroll, health or financial data inside HR mail may count toward a threshold. That second point is my reading. ## What if the buyer is a different kind of foreign person? [Section 202.302](https://www.law.cornell.edu/cfr/text/28/202.302) requires a US person to use a contract. The contract must bar the foreign buyer from onward data brokerage with a country of concern or covered person. The US person must also report any known or suspected violation within 14 days. ## What is the penalty? [Section 202.1301](https://www.law.cornell.edu/cfr/text/28/202.1301) applies IEEPA. It sets a civil penalty of up to the greater of $368,136 or twice the transaction amount. Criminal penalties apply to willful violations. Look up a buyer's ownership in public sources and take the legal analysis to your lawyer. Our [rights check](/rights-check) covers your own side: contracts, personal data and who can sign. The [state data broker laws](/answers/are-data-brokers-legal) are a separate set of rules. Figure: comparison of Who receives the data under 28 CFR 202: Covered person (emphasized: The transfer is prohibited, Prohibited), Other foreign person (Contract terms). A transfer to a country of concern or covered person is prohibited, and any other foreign person needs contract terms. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Justice Department's Data Security Program](https://www.justice.gov/nsd/data-security) - [Section 202.214](https://www.law.cornell.edu/cfr/text/28/202.214) - [Section 202.211](https://www.law.cornell.edu/cfr/text/28/202.211) - [Section 202.601](https://www.law.cornell.edu/cfr/text/28/202.601) - [Section 202.205](https://www.law.cornell.edu/cfr/text/28/202.205) - [Section 202.212](https://www.law.cornell.edu/cfr/text/28/202.212) - [Section 202.302](https://www.law.cornell.edu/cfr/text/28/202.302) - [Section 202.1301](https://www.law.cornell.edu/cfr/text/28/202.1301) --- # License accounting firm data to AI: tax data rules > Looking to sell accounting firm data to AI? A license meets 26 U.S.C. 7216, which makes misuse of return information a misdemeanor. Consent must be in writing. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-accounting-firm-data-to-ai Published: 2026-07-10 Updated: 2026-10-14 ## The short answer To license accounting firm data to AI, know that 26 U.S.C. 7216 makes disclosing clients' tax return information a misdemeanor, with a fine up to $1,000 or a year in prison. You need the client's written, dated consent first. A firm's own operating records may differ from client files. An accounting firm holds its own operating records and its clients' financial files. The law treats the second group very differently. ## What do the companies say about accounting data? [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) lists finance and accounting as an area. [Troveo's page](https://www.troveo.ai/business-data) names ledgers and invoices as data types. A firm whose records are mostly client files has less of its own to offer, for the reasons below. Both are self-reported. I found no price for accounting data. The [QuickBooks page](/answers/sell-quickbooks-data-to-ai) covers the export side. ## What does [26 U.S.C. 7216](https://www.law.cornell.edu/uscode/text/26/7216) say? It applies to a person in the business of preparing tax returns, or who prepares one for pay. The person commits a misdemeanor by knowingly or recklessly disclosing information furnished for a return, or using it for any purpose other than preparing or assisting in preparing a return. The penalty is a fine of up to $1,000 (up to $100,000 where section 6713(b) applies), imprisonment of up to one year, or both. The statute has listed exceptions in subsection (b). ## What does the tax-return consent rule (26 CFR 301.7216-3) require? The Treasury rule, [26 CFR 301.7216-3](https://www.law.cornell.edu/cfr/text/26/301.7216-3), says a preparer may not disclose or use return information before getting the taxpayer's written consent. Consent must come before the disclosure, and it must carry the taxpayer's signature and date and name the preparer and the taxpayer. It must also identify the information, the purpose and, unless an exception applies, the recipients. If a consent does not say how long it lasts, it runs for one year from signing. One document cannot authorize both uses and disclosures, so each needs its own. ## Does the FTC Safeguards Rule apply? The FTC's Safeguards Rule, [16 CFR 314.2](https://www.law.cornell.edu/cfr/text/16/314.2), lists an accountant or other tax preparation service in the business of completing income tax returns as a financial institution. My [financial data page](/answers/can-i-sell-health-or-financial-client-data-to-ai) covers the notice and opt-out rule that follows from that status. Bookkeeping files that are not tax return information may sit under different rules. Which records fall where is a question for counsel. Talk to a privacy or commercial lawyer in your state before you sign. The [rights check](/rights-check) lists the first questions. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Written consent, signed and dated -> Names parties, purpose, recipients -> Lasts one year by default. Under 26 CFR 301.7216-3, consent comes first in writing and lasts one year unless it says otherwise. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Troveo's page](https://www.troveo.ai/business-data) - [26 U.S.C. 7216](https://www.law.cornell.edu/uscode/text/26/7216) - [26 CFR 301.7216-3](https://www.law.cornell.edu/cfr/text/26/301.7216-3) - [16 CFR 314.2](https://www.law.cornell.edu/cfr/text/16/314.2) --- # Data licensing agreement template: what is free > Is there a data licensing agreement template? Common Paper's 12 free agreements include no data license. A clause checklist to take to a lawyer, not a contract. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/data-licensing-agreement-template Published: 2026-07-09 Updated: 2026-10-14 ## The short answer No single free template exists. Common Paper's 12 free agreements include an AI Addendum closest to a data license. No buyer publishes its contract. Use this page's clause checklist to take to a lawyer. A template is a starting draft. A company archive going to an AI buyer needs more. The skill that pays off is reading any draft against a list of clauses. ## Which free templates exist? Common Paper's [standards page](https://commonpaper.com/standards/) lists 12 agreements: - Mutual NDA - Terms of Service - Design Partner - Cloud Service - Service Level - Data Processing - Business Associate - Professional Services - AI Addendum - Partnership - Software License - Pilot All are free to use and modify under CC BY 4.0. The AI Addendum is the one nearest to a data license. Its [page](https://commonpaper.com/standards/ai-addendum/) says version 1.0 will remain unchanged. I read the overview and skipped the clause text. So I cannot say how it handles licensing a company archive. The Data Processing Agreement covers how personal data is handled. Neither is a data license. ## What clauses do lawyers say a data license covers? Two published sources give topic lists. Sergei Tokmakov, a California attorney, wrote an [undated memo](https://terms.law/insights/ai-training-data-licensing-usable-agreement.html) on AI training-data licenses. It names four items: - a grant clause (training, fine-tuning, evaluation, output rights, territory, duration and sublicensing) - a warranty stack covering ownership, non-infringement and lawful collection - an indemnity with defined carve-outs - a data provenance file [Sidley Austin's note](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) adds more topics: - who owns each part of the dataset - which model versions may use it - who owns a trained model - provider representations - indemnity - what happens at termination, including audit and deletion My [guide to data licensing agreements](/guides/data-licensing-agreement) puts these into a table with published examples. The [reps and warranties page](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) covers the promises. ## Why is there no vetted template here? No lawyer has reviewed a template for this site. A downloadable contract from us would read as legal advice, and we give none. ## Which agreements might already limit a data license? Your own agreements. Common Paper's [Mutual NDA, version 1.0](https://commonpaper.com/standards/mutual-nda/), shows the standard wording a counterparty may already hold you to. - Information may be used only for the stated purpose. - It may not go to third parties without written approval. - It must be destroyed or returned when asked. - The duty outlasts the agreement. A company archive often holds a customer's or partner's information. My [NDA page](/answers/does-my-nda-let-me-sell-data-to-ai) covers what to check. Whether a given clause blocks licensing is a question for a lawyer who has read it. Talk to a privacy or commercial lawyer in your state before you sign. The [rights check](/rights-check) lists what to bring. The [managed readiness service](/managed-readiness) indexes the contracts for your lawyer without judging them. Figure: comparison of Where free clause guidance for a data license comes from: Common Paper standards (emphasized: Free under CC BY 4.0, 12 agreements), Attorney memo (Clause commentary), Sidley Austin note (Clause topics). Common Paper's 12 agreements are free under CC BY 4.0, and the other two sources only comment on clauses. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [standards page](https://commonpaper.com/standards/) - [commonpaper.com](https://commonpaper.com/standards/ai-addendum/) - [undated memo](https://terms.law/insights/ai-training-data-licensing-usable-agreement.html) - [Sidley Austin's note](https://www.sidley.com/en/insights/newsupdates/2026/07/legal-implications-in-ai-development-and-deployment-training-data-and-grounding-data) - [Mutual NDA, version 1.0](https://commonpaper.com/standards/mutual-nda/) --- # License software company data to AI: what buyers list > Looking to sell software company data to AI? Companies license it. Buyers name code, tickets, chat and CRM, and SaaS firms add a customer-data limit. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-software-company-data-to-ai Published: 2026-07-09 Updated: 2026-10-14 ## The short answer List what you hold and check the rights to each kind. Software teams hold what buyers ask for most: source code, tickets, chat, CRM records and documents. A SaaS company has one extra limit. Its customers' data is a separate bucket. A processor follows the customer's instructions. A software team does its work in a handful of tools. That is the pattern buyers say they want. This page also answers the SaaS version of the question. ## Which records do the companies name? David Revland, who works on human data at [micro1](/buyers/micro1), said in an undated recorded forum talk that its intake form asks which services you use. Examples were Google Workspace, Slack, project management tools and GitHub (self-reported, recording undated). Troveo's [business-data page](https://www.troveo.ai/business-data) and Mercor's [data page](https://www.mercor.com/data/) give their own lists. **Tools and records each buyer names. A blank cell means the buyer did not list it on the page we read.** | | micro1 | Troveo | Mercor | |---|---|---|---| | Google Workspace | Yes | | | | Project management tools | Yes | | | | Slack | Yes | Yes | | | GitHub | Yes | Yes | Repositories, commits, pull requests, issues | | GitLab | | Yes | | | Jira | | Yes | | | Linear | | Yes | | | Zendesk | | Yes | | [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) reported that SimpleClosure's Asset Hub takes source code, documents, workflows, Slack messages and emails from defunct companies. ## Which tool pages cover the details? Each record type has its own rules. See [source code](/answers/can-i-sell-source-code-to-ai), [GitHub data](/answers/sell-github-data-to-ai), [Jira data](/answers/sell-jira-data-to-ai), [Slack data](/answers/sell-slack-data-to-ai) and [support tickets](/answers/sell-support-tickets-to-ai). ## What if you run a SaaS product? Your own work records and your customers' data are different things. Think of the attic. Your boxes are yours. Your customers' boxes are stored with you, and you follow their instructions. A vendor that holds customer data as a processor works on documented instructions from the controller under [GDPR Article 28(3)(a)](https://gdpr-info.eu/art-28-gdpr/). Article 28(10) treats a processor that sets its own purposes as a controller. Our page on [whether a SaaS company can license its customers' data](/answers/can-a-saas-company-sell-its-customers-data-to-ai) has the cases and the contract benchmark. Our [rights check](/rights-check) asks what your customer contracts allow as a question of its own. ## How do tools you use limit licensing? Salesforce's [agreement](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Salesforce_MSA.pdf) puts the legality of your data on you. Zendesk's [does the same](https://www.zendesk.com/company/agreements-and-terms/main-services-agreement/) for notices and consents. Slack's [API terms](https://slack.com/terms-of-service/api) bar third-party apps from using API data to train an LLM. See [Salesforce](/answers/sell-salesforce-data-to-ai) and [Zendesk](/answers/sell-zendesk-tickets-to-ai). ## What should you do first? Start with the [rights check](/rights-check), which asks about customer contracts, NDAs and employee messages. Then try the free [fit check](/business) for a readiness score. micro1's [page](https://www.micro1.ai/data-partnerships) says 30 or more employees, with mature operations and primarily English documentation. Acceptance depends on its review and current demand. See [data readiness](/answers/data-readiness-checklist). A startup that is closing has different routes. See [licensing startup data](/answers/sell-startup-data-to-ai). _Yes, the ticket titled "fix the thing" counts as a record._ Figure: comparison of Three kinds of data a software company holds, by whose it is: Own work records (emphasized: The company's own records, Yours to review), Licensed code (Licensor's terms), Customer data (On instruction). A software company starts with its own work records, since licensed code and customer data follow other parties' terms. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [business-data page](https://www.troveo.ai/business-data) - [data page](https://www.mercor.com/data/) - [Gizmodo](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [GDPR Article 28(3)(a)](https://gdpr-info.eu/art-28-gdpr/) - [agreement](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Salesforce_MSA.pdf) - [does the same](https://www.zendesk.com/company/agreements-and-terms/main-services-agreement/) - [API terms](https://slack.com/terms-of-service/api) - [micro1.ai](https://www.micro1.ai/data-partnerships) --- # micro1 corpus deal vs workflows track: which fits? > micro1 corpus deal vs workflows track: one partnership covering your archive against repeat paid work with an AI agent, with micro1's own figures. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/micro1-corpus-sale-vs-workflows-track Published: 2026-07-09 Updated: 2026-10-13 ## The short answer A corpus deal is a data partnership covering stored records, and micro1 says you keep ownership. The workflows track is repeat work grading an AI agent. micro1's Enterprise Data Partnership listing says approved data packages pay $100K-$2M+. A company can run both. [micro1](/buyers/micro1) describes three ways into its program: a corpus deal, a workflows track and a referral. This page sets the first two side by side. ## What is a corpus deal? A corpus deal is the Enterprise Data Partnerships track. micro1 gets access to the records your company already stores, in one transfer, under a partnership agreement. micro1 says companies keep ownership of their underlying data. Confirm licensed uses, duration, exclusivity and payment structure in the proposed agreement. The [data partnerships page](https://www.micro1.ai/data-partnerships) lists $100K+, $500K+ and $1M+ tiers, and micro1's Enterprise Data Partnership listing says $100K-$2M+ for approved data packages. micro1's CFO said in an undated recorded forum talk that a corpus deal pays $100K to $2M per company and that deals near $2M are real. David Revland, who works on human data at micro1, said micro1 may come back about six months later for a top-up of newer data. ## What is micro1's workflows track? In micro1's workflows track, employees use a general-purpose AI agent on their real daily work, then grade how it did and describe how it should have done the task. micro1 receives the evaluation and the agent's trajectory. The company chooses how many employees take part and how often. In the undated talk, the CFO described pay per completed task of about $700 to $800 for a couple of hours of work. The captions on the recording are automatic, so treat that range as unconfirmed. ## How do the two tracks compare? | | Corpus deal | Workflows track | |---|---|---| | What micro1 gets | Your stored records, in one transfer | Graded agent runs on live tasks | | How it pays | Under the agreed partnership, per company | Per completed task | | Who does the work | One or two IT people, about 10 hours over a week or two (undated talk) | Employees you choose | | Current criteria | 30+ employees, mature operations and primarily English documentation on [micro1's pages](https://www.micro1.ai/data-partnerships), US prioritized | None found for this track | ## Can a company do both? micro1's CFO said in the undated talk that a company can take part in both tracks. Revland described workflows as "another option once you complete your data corpus transfer." Whether a company can run workflows without a corpus deal is not stated, so ask. Here is the difference as I see it. The corpus deal looks backward at what you have stored, and the workflows track produces new records as people work. micro1 also pitches the workflows track as a way for teams to get more fluent with AI agents, in its words "more AI native." Figure: range, Corpus deal, per company, $100K to $2M. micro1's CFO describes a corpus deal as one transfer with a wide payment range. Source: micro1 CFO, recorded forum talk, self-reported. ## What should you check before choosing? Both tracks put real work in front of micro1, so the rights questions travel with the data. The [rights check](/rights-check) asks the main ones. The corpus track starts with a [data manifest form](/answers/what-is-a-data-manifest-form), and [how long a transfer takes](/answers/how-long-does-a-data-transfer-take) covers the IT time. For the full walkthrough, read the [micro1 data partnership guide](/guides/micro1-data-partnership). Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [data partnerships page](https://www.micro1.ai/data-partnerships) - [micro1 company referral](https://www.micro1.ai/company-referral) - [micro1 referral terms](https://www.micro1.ai/legal/referral-terms) --- # Remove secrets from code before licensing: the limits > Trying to remove secrets from code before selling it? Before any license, know that scanners miss some, chat and tickets leak keys too, and old keys stay live. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/remove-secrets-from-code-before-selling Published: 2026-07-09 Updated: 2026-10-14 ## The short answer Remove secrets from code before licensing by scanning, but one scan is not enough. The best scanner reached 75% precision and 88% recall, and faulty patterns missed secrets. Secrets also hide in tools like Slack and Jira. Rotate any leaked credential right away. Ask the buyer how it detects secrets. This page covers the risk and where it sits. It gives no scrubbing method. No buyer I read publishes one for owners to follow. ## Why do secrets matter in a company data license? A company archive often includes the tools where keys end up. [Troveo's business data page](https://www.troveo.ai/business-data) names Slack, Jira and GitHub among the tools it takes. [Mercor's data page](https://www.mercor.com/data/) names Slack, Confluence and GitHub. [GitGuardian's 2026 report](https://www.gitguardian.com/state-of-secrets-sprawl-report-2026) says 32.2% of internal repositories hold at least one hardcoded secret. For public ones, the figure is 5.6%. It also says about 28% of incidents came from collaboration and productivity tools, not code repositories. Both figures come from GitGuardian itself, a security vendor. ## Can a scanner find every secret? No tool in one study did. Basak, Cox, Reaves and Williams compared nine secret-detection tools in [a paper](https://arxiv.org/abs/2307.00714). The best precision was GitHub's scanner at 75%. The best recall was Gitleaks at 88%. The authors trace false negatives to faulty regular expressions, skipped file types and insufficient rule sets. The study dates from 2023. Read the figures as a rough shape and not a current score. ## Does removing a secret from history fix it? [GitHub's documentation](https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning) says secret scanning covers the full Git history on all branches. It also covers issues, pull requests, discussions, wikis and gists. It says removing a secret from history takes a lot of time. It is often unnecessary if you have already revoked the credential. You should rotate the affected credential immediately. GitGuardian reports that 64% of the secrets it found leaked in 2022 were still active four years later. A secret that stays live stays a risk, whoever holds the copy. ## What do the companies say about credentials? [Troveo's page](https://www.troveo.ai/business-data) says people's names, contact details, credentials and client identities are scrubbed. It says [Troveo](/buyers/troveo) handles the anonymization. [micro1](/buyers/micro1) staff said in an undated talk that companies cannot pre-scrub personal information because micro1 transforms it itself. That statement is about personal information and not credentials. I found no published detection method or error rate for secrets from any buyer or marketplace. ## Where does the risk land if one gets through? It depends on the contract. The Sell Traces contributor terms are one published example. They say automated redaction is imperfect and can miss sensitive information. They also make the contributor indemnify Sell Traces (cover its costs) for claims over what a submission contains. Sell Traces is a marketplace for individuals' AI session traces. That is a different product from a company archive. Treat it as an example of where a clause can put the risk. Ask any buyer who scans for secrets, with what tool, and what happens if one gets through. Put the answer in the contract. My [reps and warranties page](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) lists the promises buyers ask for. The [data readiness checklist](/answers/data-readiness-checklist) and the [managed readiness service](/managed-readiness) both list credentials among the categories to exclude. Talk to a privacy or commercial lawyer in your state before you sign. Figure: scale, Repositories with at least one hardcoded secret: Public repositories 5.6%, Internal repositories 32.2% (emphasized). Internal repositories hold hardcoded secrets far more often than public ones. Source: GitGuardian, State of Secrets Sprawl 2026, self-reported. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo's business data page](https://www.troveo.ai/business-data) - [Mercor's data page](https://www.mercor.com/data/) - [GitGuardian's 2026 report](https://www.gitguardian.com/state-of-secrets-sprawl-report-2026) - [a paper](https://arxiv.org/abs/2307.00714) - [GitHub's documentation](https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning) --- # Can a shutting down company license its Slack to AI? > Searching whether a closing company can sell its Slack to AI? Some have licensed theirs. Delaware ties a sale of substantially all assets to a stockholder vote. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-a-shutting-down-company-sell-its-slack-to-ai Published: 2026-07-08 Updated: 2026-10-14 ## The short answer Some already have. SimpleClosure has processed about 100 such deals at $10,000 to $100,000 per company. Delaware's section 271 ties a sale of substantially all assets to board action and a stockholder vote. Section 281(c) shields directors who follow it. Ask counsel how that fits your company. In a shutdown, the board and stockholders decide what happens to the archive. That makes this a corporate law question before it is a data question. ## Who is licensing, and for how much? [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916), citing Forbes, that [SimpleClosure](/buyers/simpleclosure)'s platform had processed nearly 100 deals over the past year. Payouts ran from $10,000 to $100,000 per company. Treat these as reported figures. SimpleClosure's CEO [wrote](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) that assets have come from more than 350 companies. The [Asset Hub page](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) names source code and workspace data. It describes that data as documents, communications and institutional knowledge. SimpleClosure's CEO tells founders to do four things: - check a buyer's completed deals - define what transfers - review files for confidential third-party material - get agreements that state actual prices and payment timelines ## What does Delaware require when a shutting-down company sells its assets? For a Delaware corporation, [section 271](https://delcode.delaware.gov/title8/c001/sc10/index.html) lets a board sell all or substantially all of the company's property. A majority of the outstanding stock entitled to vote must approve it. That vote happens at a meeting called on at least 20 days' notice. Whether a data sale counts as substantially all of the assets depends on the company. For a dissolved corporation, [section 281](https://delcode.delaware.gov/title8/c001/sc10/index.html) sets out how to provide for known and contingent claims. Section 281(c) shields directors who follow it from personal liability to claimants. Section 282 caps a stockholder's liability at what was paid out to them. ## What stays in place after the company closes? Contracts with customers and partners don't disappear because the company did. The people in the messages are still people. I found no case on data-subject claims against a dissolved company. As far as my search goes, the shield's reach over privacy claims is untested. What your staff may object to is on [licensing employee emails](/answers/can-i-sell-employee-emails-to-ai). The ombudsman process is explained in [what a consumer privacy ombudsman is](/answers/what-is-a-consumer-privacy-ombudsman). Talk to an insolvency or corporate lawyer in your state before you sign. The [managed readiness page](/managed-readiness) covers how we help you assemble the file for that conversation. Figure: steps Board, stockholder vote (271) -> Directors plan for claims (281) -> Stockholder liability cap (282). Delaware ties a shutdown sale to stockholder approval, then to a plan for claims. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Gizmodo reported](https://gizmodo.com/failed-companies-are-selling-old-slack-chats-and-email-archives-to-train-ai-2000747916) - [wrote](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) - [Asset Hub page](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [section 271](https://delcode.delaware.gov/title8/c001/sc10/index.html) Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) --- # Do I need SOC 2 to license data to AI? > Searching whether you need SOC 2 to sell data to AI? I found no rule or term that asks a licensing company for one. Read any buyer's SOC 2 report itself. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/do-i-need-soc-2-to-sell-data-to-ai Published: 2026-07-08 Updated: 2026-10-14 ## The short answer No statute or buyer term requires it. SimpleClosure's terms and Troveo's guide ask for promises about your rights, consents and lawful collection. Mercor claims SOC 2 Type II. Whistleblower allegations surfaced against Delve on fraudulent reports. Ask to read any buyer's SOC 2 report. SOC 2 is a report from an independent auditor on a company's security controls. Buyers and vendor-risk teams ask suppliers for it. An owner is rarely the supplier under review. ## What do buyers actually ask an owner for? The published terms for owners focus on rights. [SimpleClosure's terms](https://simpleclosure.com/tos/) have the owner represent that it got all required consents from individuals whose personal information is in the assets. [Troveo's licensing guide](https://www.troveo.ai/resources/ai-data-licensing-deals) says you promise two things. You hold the rights you are licensing, and the data was acquired lawfully. Neither asks the owner for a security report. Other deals may differ, so read the terms in front of you. ## Do the companies claim SOC 2? Of the buyer pages I read, [Mercor's](https://www.mercor.com/data/) names SOC 2 Type II. I couldn't find the auditor, scope or observation period on that page. The micro1, [Troveo](/buyers/troveo) and [SimpleClosure](/buyers/simpleclosure) pages I read didn't claim a certification. All of these are self-reported statements. ## Why does the Delve story matter? Jackson Lewis wrote an [article](https://www.workplaceprivacyreport.com/2026/05/articles/governance-risk-and-compliance-2/the-delve-scandal-why-a-soc-2-report-cant-be-a-check-the-box-exercise-for-vendor-management/). It reports that whistleblower investigators alleged Delve, a compliance startup, generated fraudulent audit reports. They also alleged it fabricated evidence of controls for hundreds of customers. These are allegations, not findings. The article's advice is to read the reports you receive with care. ## What should I read in a buyer's SOC 2 report? Jackson Lewis lists four checks: - Whether the systems you depend on are covered or carved out. - How stale the observation period is. - Who did the audit, and whether they had evident conflicts. - Whether results look realistic. Zero incidents across dozens of organizations deserves curiosity. Ask the buyer for the report under NDA. Bring it to your security lead or a CPA firm that does SOC 2 audits. Our [buyers page](/buyers) records what each buyer publishes about security. The [safety page](/answers/is-it-safe-to-sell-company-data-to-ai) covers the [Mercor](/buyers/mercor) breach. Figure: steps Scope and test dates -> Auditor independence -> Realism of findings. Jackson Lewis lists what to read in a SOC 2 report before relying on it. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [SimpleClosure's terms](https://simpleclosure.com/tos/) - [Troveo's licensing guide](https://www.troveo.ai/resources/ai-data-licensing-deals) - [Mercor's](https://www.mercor.com/data/) - [article](https://www.workplaceprivacyreport.com/2026/05/articles/governance-risk-and-compliance-2/the-delve-scandal-why-a-soc-2-report-cant-be-a-check-the-box-exercise-for-vendor-management/) micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) --- # License insurance company data to AI: who sets the rules > Want to sell insurance company data to AI? A license answers to state regulators under GLBA. The NAIC model asks for authorization before health data leaves. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-insurance-company-data-to-ai Published: 2026-07-08 Updated: 2026-10-14 ## The short answer License insurance company data to AI: GLBA sends enforcement to your state insurance regulator. NAIC Model 672 requires authorization before health data leaves. Mercor lists insurance. No price published for insurance data. State rules decide what applies. This page reports what the texts and buyer pages say. It is not legal advice. ## Which companies list insurance? [Mercor's data page](https://www.mercor.com/data/) names "Finance & Insurance" among eight sectors. Its data types are statements, underwriting files and claims (self-reported). micro1's page lists six areas, none named insurance. See [does industry matter](/answers/does-industry-matter-for-selling-company-data) for the side-by-side. ## Who enforces privacy rules against an insurance company? [15 U.S.C. 6805(a)](https://www.law.cornell.edu/uscode/text/15/6805) lists the agencies that enforce the federal privacy subtitle. Paragraph (6) covers "any person engaged in providing insurance." The applicable State insurance authority of the State in which the person is domiciled enforces it. So an insurer's regulator is usually a state department of insurance. Which state, and what its rules say, depends on where the company is domiciled. ## What does the NAIC model say about health information? The NAIC publishes [Model 672](https://content.naic.org/sites/default/files/model-law-672.pdf), the Privacy of Consumer Financial and Health Information Regulation. It is only a model. A state adopts its own version, or none. Section 18A of the model says a licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained. Section 18B lists insurance functions that need no authorization. They include claims administration, underwriting, fraud detection and actuarial research. Section 19 says an authorization must: - Be written or electronic. - Describe the information, the recipients and the purpose. - Carry a signature and date. - State how long it lasts and how to revoke it. - Last no more than 24 months. I read the 2017 edition of the model text. Whether your state adopted it, and in what form, is a question for counsel. ## What about financial information? The federal side uses notice and opt-out. My [health and financial data page](/answers/can-i-sell-health-or-financial-client-data-to-ai) reads Regulation P, and the [do-not-license list](/answers/what-data-can-i-not-sell-to-ai) sets it beside HIPAA and FERPA. ## What can an insurer or agency gather first? List these three things: - Which states you are licensed in. - Which systems hold policyholder records. - Which privacy notices policyholders received. The [rights check](/rights-check) asks whether financial or health privacy rules apply and lists what to settle with counsel. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three layers of insurance privacy text: GLBA (Federal duty), State regulator (Enforces for insurers), NAIC Model 672 (emphasized: Authorization for health data, Authorization). NAIC Model 672 is filled because it asks for an authorization before a licensee discloses health information. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Mercor's data page](https://www.mercor.com/data/) - [15 U.S.C. 6805(a)](https://www.law.cornell.edu/uscode/text/15/6805) - [Model 672](https://content.naic.org/sites/default/files/model-law-672.pdf) --- # Can AI re-identify anonymized emails and Slack? > Can AI re-identify anonymized emails and Slack messages? Three 2026 preprints show LLMs matching accounts, finding missed identifiers and beating baselines. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-ai-re-identify-anonymized-emails-and-slack-messages Published: 2026-07-07 Updated: 2026-10-14 ## The short answer Maybe. Three 2026 preprints show LLMs matching accounts at 68% recall and re-identifying 79.2% of identities, but none tested company email or Slack. The FTC says data is anonymous only when it can never be associated back to a person. Ask de-identification buyers their standard. Most buyers I read describe a de-identification step before data reaches a buyer. These papers test how well that kind of step holds up. They are preprints on arXiv, so peer review hasn't confirmed them. ## What did the Lermen account-matching study find? Lermen and co-authors, [in a preprint](https://arxiv.org/abs/2602.16800), matched pseudonymous accounts across platforms using only raw user text. They linked Hacker News accounts to LinkedIn profiles and matched Reddit users across communities and across time. The abstract reports up to 68% recall at 90% precision, and says the best non-LLM method came in near 0%. The method works on unstructured text without a fixed schema. ## What about de-identification tools? Palacios and co-authors, [in a preprint](https://arxiv.org/abs/2608.17051), tested 100 pediatric oncology notes. An LLM prompted with institution-specific knowledge scored F1 0.918 against 0.779 for Stanford's TiDE system. Re-annotation confirmed 227 identifier spans that the original gold standard missed. The takeaway is a narrow one. Scrubbers miss identifiers that are specific to one organization, and the gold standard used to grade them can miss some too. ## Do the studies cover emails and Slack? No. The first used public social accounts and the second used clinical notes. A third preprint, by [Ko and co-authors](https://arxiv.org/abs/2603.18382), reports that agents reconstructed 79.2% of identities in the sparsest Netflix Prize setting, against 56.0% for a classical baseline. I found no study that ran the test on a company's own email or chat archive. In my reading, free text where names and context sit inside the message is the setting these results point to. ## What does the FTC say? The [FTC's technology blog](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous) says data is only anonymous when it can never be associated back to a person. The post is about hashing. ## What does this mean for an owner? It means de-identification is a claim to examine, and I'd examine it. Ask any buyer who does the work, to what standard, and whether anyone tests for re-identification afterward. The [risks page](/risks) lists what published buyer terms say, and the [rights check](/rights-check) lists what to settle with counsel. Figure: comparison of Three 2026 preprints on LLM re-identification: Account matching (emphasized: Closest to a message archive, 68% recall), Clinical notes (F1 0.918), Netflix Prize (79.2% found). Account matching ran on raw user text across platforms, the setting closest to a message archive. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [in a preprint](https://arxiv.org/abs/2602.16800) - [in a preprint](https://arxiv.org/abs/2608.17051) - [Ko and co-authors](https://arxiv.org/abs/2603.18382) - [FTC's technology blog](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous) --- # Do I need a new privacy policy to license data to AI? > Do I need to update my privacy policy before licensing data to AI? California requires notice at collection, and FTC staff say quiet changes may deceive. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/do-i-need-to-update-my-privacy-policy-before-licensing-data-to-ai Published: 2026-07-07 Updated: 2026-10-14 ## The short answer It depends on what your old notices said. California requires notice at or before collection. FTC staff said quiet, retroactive changes may be unfair, and the FTC sued Match and OkCupid on 30 Mar 2026. Ask counsel whether a new use needs fresh notice or consent. A privacy policy is a promise about how data will be used. Most disputes start when the use changes. The promise stays the same. ## What does California require? [Civil Code 1798.100(a)(1)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) says a business must tell consumers three things at or before the point of collection: - the categories of personal information collected - the purposes it is used for - whether it is sold or shared The same paragraph bars a business from using personal information for added purposes that clash with the disclosed purpose. Notice is the way around that. The [sale rule's merger exception](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) adds a limit. It does not authorize material, retroactive changes to a privacy policy. ## What has the FTC said? [The FTC's technology blog](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) speaks to a company that loosens its data practices. It says a quiet, retroactive amendment to its terms of service or privacy policy may be unfair or deceptive. That holds if it is the only way consumers hear of the change. I found no replacement for that post. I found no sign it was withdrawn. ## What happened with Match Group and OkCupid? [The FTC's press release](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-takes-action-against-match-okcupid-deceiving-users-sharing-personal-data-third-party) says OkCupid's privacy policy told users it did not share personal information except as the policy indicated. The agency says OkCupid shared nearly three million user photos with an unrelated third party. It also shared location and demographic data. That party's investors included OkCupid's founders. The release describes a settlement. It permanently bars the companies from misrepresenting how they handle personal information. That covers how they collect, use, disclose and protect it. It lists no money. ## What does that mean for an archive license? Your notice history matters. Your old privacy policies, employee handbooks and customer terms show what people were told. They show it as of the day the data was collected. A [checklist from the law firm Frankfurt Kurnit Klein and Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) says something similar. Most privacy policies and handbooks do not plan for licensing workplace messages for AI training. The first step is to collect dated copies of every notice. Our [managed readiness service](/managed-readiness) does that. Then your lawyer decides if a new purpose needs notice or consent. The [CCPA sale page](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) covers the sale rules. Figure: steps Privacy policy sets limits -> Photos and location data shared -> FTC announces action. In the Match and OkCupid case, the FTC says data went out against the policy first and its action came after. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Civil Code 1798.100(a)(1)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [The FTC's technology blog](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) - [The FTC's press release](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-takes-action-against-match-okcupid-deceiving-users-sharing-personal-data-third-party) - [checklist from the law firm Frankfurt Kurnit Klein and Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # Is it legal to license company Slack data? > Wondering if it's legal to sell company Slack data? It goes out under a license, and Slack says customers own their data. NDAs and privacy law set limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-it-legal-to-sell-company-slack-data Published: 2026-07-07 Updated: 2026-10-14 ## The short answer Slack says customers own their data, which does not settle a license. NDAs, customer contracts, employee and privacy law, shared-channel content from other organizations and API terms can limit a license. A Frankfurt Kurnit memo says holding data does not mean you can license it. Ask a lawyer. Slack's [privacy principles](https://slack.com/trust/data-management/privacy-principles) say "Customers own their own Customer Data." They also say Slack will not use Customer Data to train generative AI models unless the customer opts in. Both lines describe what Slack does. Neither says what you may do with an export. ## Does Slack stop me from licensing my own export? I found no sentence in Slack's privacy principles that bars a customer from handing over its own export. Read that as "not found", which is a long way from "permitted". Owners can export, with limits by plan. Free and Pro workspaces export public channels. Slack's [export tools guide](https://slack.com/help/articles/204897248-Guide-to-Slack-import-and-export-tools) says that under limited circumstances their owners may apply to export private channels and DMs, on the basis of valid legal process, consent of members, or a requirement or right under applicable laws. Business+ and Enterprise owners can export private channels and DMs too ([Slack help center](https://slack.com/help/articles/201658943-Export-your-workspace-data)). ## Which limits come from outside Slack? Slack channels with customers, partners and vendors hold other companies' confidential information, often under NDAs. That is the [FKKS memo's](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) point, and it is why [NDAs](/answers/does-my-nda-let-me-sell-data-to-ai) come first. The same channels hold people's messages. California's [CCPA](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) defines a sale as disclosing personal information for "monetary or other valuable consideration," and it has [covered employee data](https://oag.ca.gov/privacy/ccpa) since 1 Jan 2023. More on that in [licensing employee emails](/answers/can-i-sell-employee-emails-to-ai). ## What about Slack Connect channels? [Slack says](https://slack.com/help/articles/115004152843) retention settings apply only to messages and files sent by your members. Other people's content follows their own organization's rules. So a shared-channel export carries a partner's messages inside it, and Slack's text does not say who owns that content. We cover it in [shared channel messages](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai). ## Do Slack's API terms matter? They matter to whoever connects by API. Slack's [API terms](https://slack.com/terms-of-service/api) say an app provider offering apps outside the customer's organization may not use API Data to train a large language model. They also bar bulk export of message and file data without an additional agreement. A buyer that links to your workspace through an app is that provider. The terms are written for app providers and say nothing about a customer's own export. Talk to a privacy or commercial lawyer in your state before you sign. Our [rights check](/rights-check) and [risks page](/risks) list what to bring to that call. Figure: steps Channel owners and contracts -> Privacy law, export route, terms -> Counsel reviews. Ownership, contracts, privacy law and the export route get checked before a Slack archive goes to a buyer. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [privacy principles](https://slack.com/trust/data-management/privacy-principles) - [export tools guide](https://slack.com/help/articles/204897248-Guide-to-Slack-import-and-export-tools) - [Slack help center](https://slack.com/help/articles/201658943-Export-your-workspace-data) - [FKKS memo's](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [CCPA](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [covered employee data](https://oag.ca.gov/privacy/ccpa) - [Slack says](https://slack.com/help/articles/115004152843) - [API terms](https://slack.com/terms-of-service/api) --- # What counts as PII in company data? > What counts as PII in company data? NIST, GDPR and the CCPA define it three ways, and email addresses, user IDs, voices and inferences all fall inside. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-counts-as-pii-in-company-data Published: 2026-07-07 Updated: 2026-10-13 ## The short answer What counts as PII in company data depends on which law applies. NIST covers information linked to a person, GDPR covers identifiable persons, and CCPA covers information tied to a consumer or household. Emails, user IDs, voices and inferences count under at least one. Ask a privacy lawyer. No single list settles the question. Each law words it in its own way. A field can be PII under one law and fall outside another. ## What does NIST list as PII? [NIST SP 800-122](https://csrc.nist.gov/pubs/sp/800/122/final) says PII is information that can tell who a person is or trace their identity. Examples are a name, Social Security number, date and place of birth, mother's maiden name or biometric records. It adds any other information linked or linkable to a person, such as medical, school, money and job details. Its example list includes: - names and ID numbers - street and email addresses - phone numbers - IP or MAC addresses that link to one person - voice signatures, listed among personal traits NIST adds that laws define personal information in different ways. The definitions are not interchangeable. ## What does the GDPR count as personal data, its term for PII? [Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) defines personal data as any information about an identified or identifiable natural person. Its examples are a name, an ID number, location data and an online identifier. Article 4(5) covers pseudonymisation. That means data cannot be tied to a person without extra information. The UK's [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) says pseudonymised data is personal data in the hands of anyone who holds that extra information. Article 9 adds special categories, such as health data and trade union membership. ## What does the CCPA add? [California Civil Code 1798.140(v)](https://california.public.law/codes/civil_code_section_1798.140) covers information that could reasonably be tied to a consumer or household. Its list includes: - real names and aliases - postal and email addresses - IP addresses and account names - audio information - professional or job-related information - inferences drawn into a profile The [California Attorney General](https://oag.ca.gov/privacy/ccpa) says the employee and business-to-business exemptions expired on 31 Dec 2022. Staff and business-contact data now fall inside the law. ## Where do those definitions land in company tools? This part is my reading, not a cited list. Email carries sender and recipient addresses, display names and signature blocks. [Slack's export](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) ships with a users.json reference file of user IDs, so authors stay identifiable. Tickets carry requester names and phone numbers. CRM records hold contact details and notes. Call recordings hold voices. Message text can also hold health or family detail. See [are Slack messages personal data](/answers/are-slack-messages-personal-data), [pseudonymization vs anonymization](/answers/pseudonymization-vs-anonymization) and [whether AI can re-identify scrubbed messages](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages). The [rights check](/rights-check) asks whose records these are and what personal data they hold. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of Three tests for personal information: NIST SP 800-122 (Linked or linkable), GDPR Article 4(1) (Identifiable person), California CCPA (emphasized: Reaches a household too, Consumer or household). The CCPA is emphasized because its test reaches a household, where NIST and GDPR name an individual. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [NIST SP 800-122](https://csrc.nist.gov/pubs/sp/800/122/final) - [Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [California Civil Code 1798.140(v)](https://california.public.law/codes/civil_code_section_1798.140) - [California Attorney General](https://oag.ca.gov/privacy/ccpa) - [Slack's export](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) --- # License customer service transcripts to AI: the gates > Trying to sell customer service transcripts to AI? Licensing them runs into privacy and recording laws first. Troveo lists support data. No price is public. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-customer-service-transcripts-to-ai Published: 2026-07-06 Updated: 2026-10-14 ## The short answer License customer service transcripts to AI: customers' personal data and recording laws are the gates. Troveo lists support tickets and call recordings. Troveo says real conversations with resolutions fill a gap for labs. Recording laws apply to calls. Zendesk puts consent duties on you. A transcript is a customer's words sitting in your files. That is why the legal questions come before the market ones. ## Who lists support conversations as a data type? Two companies list support conversations: - [Troveo](https://www.troveo.ai/business-data) lists CRM, sales and support systems, among them Zendesk and Intercom. Its [licensing guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) names call recordings and support tickets as data types that have drawn real bids. - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) describes support documentation, ticket workflows and QA processes for customer support teams. ## What do transcripts hold that you cannot hand over? Customer names, contact details and account facts, plus whatever customers said about third parties. [Troveo](/buyers/troveo) says it scrubs names, contact details, credentials and client identities to a documented standard before any AI company sees anything. [micro1](/buyers/micro1) says it removes personal information when relevant. ## What do platform terms say about end users? [Zendesk's customer agreement](https://www.zendesk.com/company/agreements-and-terms/main-services-agreement/) says the customer retains ownership of its service data. It also says the customer must give notices to agents and end users, and get required consents from them. That lets Zendesk process the data lawfully. Its terms changed for existing customers on 1 Sep 2025. Whether a license fits your own privacy notice and customer contracts is a separate question for counsel. My pages on [customer consent](/answers/do-i-need-consent-to-sell-customer-data-for-ai-training) and [CCPA sales](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) explain the notice side. ## Do recordings change the answer? Yes. Audio carries voices, which brings wiretap and biometric law. The Otter.ai ruling concerned a vendor. I found no case against a company licensing its own lawfully recorded calls. Read the [call recordings page](/answers/can-i-sell-call-recordings-to-ai) before any audio leaves. Talk to a privacy or commercial lawyer in your state before you sign. ## What are transcripts worth? No source gives a price for support transcripts. [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) says buyers rarely start from a rate card. It says value follows what a dataset lets a lab do that it cannot already do. My free [fit check](/business) starts from what you hold. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three forms of support conversation data: Ticket text (Customer data), Chat logs (Notice duties), Call audio (emphasized: Recording laws apply, Recording laws). Call audio is filled because the Otter.ai ruling and Spirit's carve-out both concern recordings. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Troveo](https://www.troveo.ai/business-data) - [licensing guide](https://www.troveo.ai/resources/sell-data-to-ai-companies) - [micro1's data partnerships page](https://www.micro1.ai/data-partnerships) - [Zendesk's customer agreement](https://www.zendesk.com/company/agreements-and-terms/main-services-agreement/) - [Troveo's guide](https://www.troveo.ai/resources/how-much-is-company-data-worth) --- # License engineering firm data to AI: the licensing rule > Wondering how to sell engineering firm data to AI? A license meets NCEES rules that bar revealing client information without consent. Copyright applies too. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-engineering-firm-data-to-ai Published: 2026-07-06 Updated: 2026-10-16 ## The short answer Before engineering firm data goes to AI, check the NCEES model rules. They bar licensees from revealing client information without consent. micro1's data partnership page lists software and engineering as an area. Copyright rules and export controls apply. Counsel reads the client contracts first. This page reports what the texts and buyer pages say. It is not legal advice. ## Who lists engineering firms? [micro1's page](https://www.micro1.ai/data-partnerships) lists "software and engineering" as one area (self-reported). [Mercor's data page](https://www.mercor.com/data/) does not name engineering among its eight sectors. [Polyshares](/buyers/polyshares)' [intake](https://polyshares.com/intake) lists AutoCAD among its design and CAD tools, the nearest any buyer comes to naming drawings. [Mercor](/buyers/mercor)'s page names spec sheets under manufacturing. I found no buyer that names calculation workflows as a data type. Mercor's research team measures a related gap. Its [Benchmark Map](https://www.mercor.com/research/labor-index/benchmark-map/) (Oct 2026) counts 19 of the 56 architecture and engineering occupations as covered by at least 5 prompts from its 29 AI benchmarks. A benchmark is a test, not a purchase, so the map names no buyer or price. ## What do the NCEES model rules say about client information? The [Model Rules](https://ncees.org/wp-content/uploads/Model-Rules.pdf) are published by the National Council of Examiners for Engineering and Surveying for state boards to adopt. Section 240.15 covers rules of professional conduct. In its part on obligations of licensees to employers and clients: - Item 4 says licensees shall not reveal facts, data or information obtained in a professional capacity without the prior consent of the client, employer or public body they serve, except as authorized or required by law or rules. - Item 9 says licensees shall not use confidential information received in the course of assignments as a means of making personal profit without the consent of the party it came from. The rules govern licensees. Whether a firm's data deal counts as a licensee's disclosure depends on the facts and on the state's adopted text, which I did not check state by state. ## Who owns an engineering firm's drawings? Federal copyright law says copyright vests initially in the author ([17 U.S.C. 201(a)](https://www.law.cornell.edu/uscode/text/17/201)). In a work made for hire, the employer or the person it was prepared for is treated as the author, and a transfer of copyright ownership is not valid unless it is in writing and signed by the owner ([17 U.S.C. 204(a)](https://www.law.cornell.edu/uscode/text/17/204)). Which of those applies to a given drawing set turns on the client agreement, which these texts do not show. The [architecture page](/answers/sell-architecture-firm-data-to-ai) covers the AIA owner-architect form, which deems the architect and its consultants the owners of their drawings, and the [construction page](/answers/sell-construction-company-data-to-ai) covers the contractor's side. ## Do export controls apply? They can. The export rule that treats releasing source code or technology to a foreign person in the United States as an export is on my [source code page](/answers/can-i-sell-source-code-to-ai), and the same question applies to engineering files that hold controlled technology. I did not research export law further. ## What can an engineering firm gather first? List the clients and public bodies whose information sits in your files, the agreements that cover it and the states where your engineers hold licenses. The [rights check](/rights-check) asks the contract and personal-data questions and lists what to settle with counsel. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Two NCEES model-rule duties on client information: Revealing information (emphasized: Covers any disclosure, Needs prior consent), Personal profit (Needs source's consent). NCEES item 4 bars revealing client information without prior consent, and item 9 bars using it for personal profit without consent. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1's page](https://www.micro1.ai/data-partnerships) - [Mercor's data page](https://www.mercor.com/data/) - [intake](https://polyshares.com/intake) - [Benchmark Map](https://www.mercor.com/research/labor-index/benchmark-map/) - [Model Rules](https://ncees.org/wp-content/uploads/Model-Rules.pdf) - [17 U.S.C. 201(a)](https://www.law.cornell.edu/uscode/text/17/201) - [17 U.S.C. 204(a)](https://www.law.cornell.edu/uscode/text/17/204) --- # License videos to AI companies: routes and what to check > Looking to sell videos to AI companies? A business licenses its library. What Troveo and Protege ask for, what buyers pay and the rights to settle first. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-videos-to-ai-companies Published: 2026-07-06 Updated: 2026-10-14 ## The short answer A business licenses videos to AI companies through a marketplace like Troveo or Protege, which license footage to AI labs. Bloomberg reported buyers pay $1 to $4 per minute. Troveo prefers 1080p or 4K footage you fully own. Settle releases for everyone on camera first. Video is the kind of business content with the clearest buyers. Everything below is the platforms describing themselves unless a source is named. ## Which companies buy videos for AI training? The footage goes to AI labs and model builders. [Troveo](/buyers/troveo) says it licenses to AI labs, and an interview write-up says OpenAI, Google Gemini, Anthropic and others need this kind of material ([Media and the Machine](https://mediaandthemachine.substack.com/p/this-ai-company-has-paid-out-20m)). Most businesses never deal with a lab directly. A marketplace handles clearing, annotation and the license. ## What does each route ask for? **[Troveo](https://www.troveo.ai/content-owners)** asks for content you fully own or have rights to, with 1080p or 4K preferred, clear audio and well-shot footage. It sets no minimum on its page, and processing takes 1 to 2 weeks. Its own page says payment is a royalty each time content is used. **[Protege](https://withprotege.ai/data-provider/video)** lists broadcasters, producers and distributors who own content outright or control it under broad rights. It describes a revenue share and publishes no percentage. **[micro1](/answers/micro1-commercial-video-data-partner)** runs a separate program for new footage. It asks companies with at least 20 employees to film first-person video of hands-on work, and it states no pay amount. **YouTube** has a [third-party training setting](https://support.google.com/youtube/answer/15509945) for business channels too, and it is off by default. YouTube says it is not facilitating payments between those AI companies and channel owners. ## What if your business owns a stock photo or video library? A business that owns a stock library of photos or clips can license it through a marketplace, the same way as other footage. [Protege](https://withprotege.ai/data-provider/video) lists producers and distributors who own content outright, and Troveo asks for content you fully own. Upload platforms work differently. [Wirestock's terms](https://wirestock.io/docs/terms-of-use) enroll each upload in its dataset deals program with no opt-out, and the license survives for content already provided, so read any platform's terms before your team uploads the library. Check model and property releases before any license, because the people and brands in a picture hold rights of their own. ## What do buyers pay for video? Bloomberg's January 2025 figure of $1 to $4 a minute ([as repeated by The Star](https://www.thestar.com.my/tech/tech-news/2025/01/13/youtubers-are-selling-their-unused-video-footage-to-ai-companies)) is a buyer price. No source states what share reaches the business that owns the footage. What Troveo publishes about its split is on [Troveo's revenue share](/answers/troveo-revenue-share). ## What rights should you settle first? Footage your business owns may still show other people or use other people's work. Check who appears in it (staff, clients, guests), who holds their releases and who owns any music or branded sets. Our [guide to licensing your business's content](/guides/license-your-business-content-to-ai) walks through consent for members, clients and guests. Read the [rights check](/rights-check), too. Talk to a privacy or commercial lawyer in your state before you sign. No outcome is promised. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: steps Sign agreement and survey -> Upload, Troveo clears, annotates -> Licensed to labs, you are paid. Troveo's process runs from signed agreement to payment. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Media and the Machine](https://mediaandthemachine.substack.com/p/this-ai-company-has-paid-out-20m) - [Troveo](https://www.troveo.ai/content-owners) - [Protege](https://withprotege.ai/data-provider/video) - [third-party training setting](https://support.google.com/youtube/answer/15509945) - [Wirestock's terms](https://wirestock.io/docs/terms-of-use) - [as repeated by The Star](https://www.thestar.com.my/tech/tech-news/2025/01/13/youtubers-are-selling-their-unused-video-footage-to-ai-companies) --- # What should a data broker do for you? > What a data broker should do for your company: a records inventory, a price that holds up and terms in plain words. What it shouldn't do, and what to ask. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-does-a-value-add-data-broker-do Published: 2026-07-06 Updated: 2026-10-14 ## The short answer A data broker should do more than pass your name to a buyer. Ryan Lock of Polyshares says a useful broker builds a records inventory, sets a price that holds up and explains the terms. That is one view from a firm that works with brokers. Ask who pays them. A broker who only passes your name to a buyer adds little. This page covers what a broker should do for your company, what it shouldn't do, and what to ask before you agree to a fee. ## What should a broker do for you? Ryan Lock, listed as Managing Partner on the [Polyshares homepage](https://polyshares.com/), wrote that plain introductions will be competed away as more brokers arrive ([X article](https://x.com/RyanLockAI/status/2107864069105389717)). His firm works with brokers, so weigh his view that way. Read as what you should get, his list has four items: - **An inventory.** Each tool, the years you can export from it, and the total size. - **A price that holds up.** He says unrealistic asking prices kill deals. - **Terms you understand.** Exclusivity, acceptance, payout timing, scope of use, sublicensing, de-identification and liability caps. - **Plain words.** Most owners have never read a data license. He says he is not an attorney and tells readers to consult one. 1. **Inventory** Tools, years, size. 2. **Fair price** Ask for what holds up. 3. **Terms** Explain each clause. 4. **Close** ## What shouldn't a broker do? - **Keep quiet about who pays them.** A fee from the buyer gives a broker a reason to steer you, so ask before anything else. - **Rush you past your lawyer.** Nobody should ask you to sign a license your lawyer hasn't read. - **Ask for your files first.** An inventory needs tool names, years and sizes. It doesn't need the records themselves. - **Name a price before the inventory exists.** A figure with nothing behind it is a sales line. ## How is a broker paid? By commission or a success fee. That gives the broker a reason to close, which may not match your goal. Read [data broker commission](/answers/data-broker-commission) and the [red flags page](/answers/ai-data-broker-red-flags). _A broker who explains the clause that cuts their own fee is worth keeping._ ## How does an advisor compare? Our advisor page lists similar work: inventory your records, line up rights facts, match you to buyers and compare terms. See [what a data licensing advisor does](/answers/data-licensing-advisor). The [inventory template](/answers/company-data-inventory-template) shows the first task. ## What should you ask a broker? 1. Who pays you, and how much? 2. Do you work for me or for the buyer? 3. Will you show me the contract before I commit? 4. Are you a lawyer? For picking one, see [how to choose an AI data broker](/guides/how-to-choose-an-ai-data-broker). Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Polyshares homepage](https://polyshares.com/) - [X article](https://x.com/RyanLockAI/status/2107864069105389717) --- # Do I need consent to license customer data for AI? > Wondering if you need consent to sell customer data for AI? A license can be a CCPA sale, which needs notice and opt-out. Your collection promises do the rest. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/do-i-need-consent-to-sell-customer-data-for-ai-training Published: 2026-07-05 Updated: 2026-10-14 ## The short answer Under California's CCPA, a sale needs notice and opt-out right. Opt-in applies only for under 16. What you promised at collection matters more. The FTC said quiet changes may be unfair. Ask a lawyer who has read your old notices. California is the example here because its statute is the most detailed. Other states set their own rules, and some are stricter. ## What does the CCPA require for a sale of customer data? A ["sale"](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) is disclosing personal information to a third party for "monetary or other valuable consideration." [Section 1798.120](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) gives a consumer the right to tell a business not to sell. It also requires the business to give notice of that right. Opt-in is the rule for known minors. Say a business has actual knowledge that a consumer is under 16. It cannot sell that data unless the consumer affirmatively authorizes it. For a child under 13, a parent must authorize it. ## Why do my old customer promises matter so much? A sale that contradicts a notice is the pattern regulators go after. [The FTC's staff post](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) says a business that collects data under one set of privacy promises cannot simply go back on them. It cites cases going back to 2004. The FTC also said that widening data use through a surreptitious, retroactive amendment may be unfair or deceptive. On that reading, updating a notice after collection may not settle the question for data you already collected. Ask counsel how it applies to your old notices. ## Does the GDPR work the same way? No. The GDPR asks whether a new purpose is compatible with the original one. [Article 6(4)](https://gdpr-info.eu/art-6-gdpr/) lists the factors: - any link between the purposes - the context and the relationship with the person - the nature of the data - the possible consequences - the safeguards For data not collected from the person, [Article 14(4)](https://gdpr-info.eu/art-14-gdpr/) applies. The controller must give the person information on the new purpose before the further processing starts. The controller is the company that decides how the data is used. A lawyer in the EU or UK can say whether licensing for AI training clears that test. ## What did regulators do when a company sold data at scale? In the 23andMe sale, [Missouri's attorney general](https://ago.mo.gov/attorney-general-bailey-secures-privacy-protections-in-sale-of-23andme-to-nonprofit-entity/) announced on 2 Jul 2025 that a multistate effort won two things. Consumers got a right to delete their data. Resale also got limits. The buyer, TTAM Research Institute, is a nonprofit. That was a bankruptcy sale of consumer data. It shows the pressure states apply. It does not describe a private sale. California's attorney general [settled with General Motors on 8 May 2026](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general). The case was about driving data sold to buyers against what GM told drivers. See [licensing customer data](/answers/is-it-legal-to-sell-customer-data). Talk to a privacy or commercial lawyer in your state before you sign. Our [rights check](/rights-check) asks what your customer contracts and terms allow and lists what to take to counsel. Figure: steps Pull notice, compare to new use -> Check opt-out, sale notice, contract -> Counsel reviews. Consent starts with what your notice said on the day the data came in. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - ["sale"](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [The FTC's staff post](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) - [Article 6(4)](https://gdpr-info.eu/art-6-gdpr/) - [Article 14(4)](https://gdpr-info.eu/art-14-gdpr/) - [Missouri's attorney general](https://ago.mo.gov/attorney-general-bailey-secures-privacy-protections-in-sale-of-23andme-to-nonprofit-entity/) - [settled with General Motors on 8 May 2026](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general) --- # What is AI data governance? > What is AI data governance? The rules and records for what data goes into AI. What NIST and EU AI Act Article 10 say, and the steps before a company data deal. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/what-is-ai-data-governance Published: 2026-07-05 Updated: 2026-10-14 ## The short answer AI data governance is the rules and records for which data goes into an AI system and how to prove its origin. EU AI Act Article 10 requires documenting data origin and preparation for high-risk systems. For owners: inventory systems, review contracts, exclude risky categories and document the review. The phrase has two meanings. One is governing the AI system itself, which NIST's framework covers. The other is governing the data you feed it, which is the sense I use here. ## What does the NIST AI Risk Management Framework say? [NIST](https://www.nist.gov/itl/ai-risk-management-framework) released AI RMF 1.0 for voluntary use. It sets four functions: Govern, Map, Measure and Manage. NIST published a Generative AI Profile, NIST AI 600-1. The framework covers risk management for AI systems in general. NIST's page does not mention data governance as such, so it gives a company licensing records no checklist of its own. ## What does EU AI Act Article 10 require? [Article 10](https://artificialintelligenceact.eu/article/10/) applies to high-risk AI systems that train on data. It says training, validation and testing data sets must follow governance practices that cover: - the design choices behind the data set - the data collection processes and where the data came from - for personal data, the original purpose it was collected for - preparation steps such as annotation, labelling, cleaning and aggregation - an examination of possible biases and the gaps in the data Those duties fall on the providers of the AI system. The text names no owner. A buyer that has to document data origin may ask an owner for the same facts. ## What does it look like for a company with records to license? Frankfurt Kurnit Klein & Selz [published a checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) for companies weighing a data deal. It tells them to involve legal, privacy, security, HR and communications people, inventory systems and record types, and review customer, partner, vendor and platform terms. It also says to exclude categories such as privileged material, HR files, payroll, health information, union communications and customer confidential data, then to document the review. Ownership, access, retention and consent all sit inside those steps. They are questions about who holds rights to the records, who can reach them, how long copies live and what people were told. ## Why do buyers ask owners about it? California's AB 2013 took effect on 1 Jan 2026. [Crowell's alert](https://www.crowell.com/en/insights/client-alerts/californias-ab-2013-requires-generative-ai-data-disclosure-by-january-1-2026) says it requires developers of generative AI for public use in California to post details of their training data. Those details cover where it came from, how it was gathered, whether licensed material was used and whether it includes personal information. A buyer in that position has a reason to ask where your records came from. See [what data provenance is](/answers/what-is-data-provenance). ## Where do you start? Our [data readiness checklist](/answers/data-readiness-checklist) and [inventory template](/answers/company-data-inventory-template) cover the first step. The [rights check](/rights-check) turns contract and consent questions into a short form, and the [risk map](/risks) shows where objections have come from. We gather facts and give no legal advice. Talk to a privacy or commercial lawyer in your state before you sign. Figure: steps Inventory systems -> Contracts and risky records -> Document the review. Frankfurt Kurnit's checklist for a company data deal runs from an inventory to a documented review. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [NIST](https://www.nist.gov/itl/ai-risk-management-framework) - [Article 10](https://artificialintelligenceact.eu/article/10/) - [published a checklist](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [Crowell's alert](https://www.crowell.com/en/insights/client-alerts/californias-ab-2013-requires-generative-ai-data-disclosure-by-january-1-2026) --- # Is it safe to license company data to AI? > Asking whether it's safe to sell company data to AI? In a license, risk sits partly with whoever handles raw data. Mercor's March 2026 breach is the test case. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-it-safe-to-sell-company-data-to-ai Published: 2026-07-03 Updated: 2026-10-14 ## The short answer The published evidence says the risk is real. Many buyers handle raw data before de-identification. In March 2026 a supply-chain attack hit data buyer Mercor and exposed about four terabytes, including SSNs of over 40,000 contractors. Ask any buyer where raw data sits and who deletes it. "Safe" is a fair question with no single answer. So here is what is on the record, with dates. You can use it to ask any buyer better questions. ## What happened at Mercor? [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) reported that tainted releases of the LiteLLM library were available for roughly 40 minutes. The Next Web reported that thousands of companies were affected, and [Mercor](/buyers/mercor) confirmed it was one of them. The outlet reports about four terabytes exposed. That included the names and Social Security numbers of more than 40,000 contractors and customers. [Hausfeld](https://www.hausfeld.com/what-we-do/current-claims/mercor-data-breach), a plaintiffs' firm, dates the intrusion to on or about 24 March 2026. The [Business and Human Rights Resource Centre](https://www.business-humanrights.org/en/latest-news/usa-ai-startup-mercor-sued-over-hiring-practices-and-contractors-data-handling/) lists claims about the breach. It also lists claims about how Mercor handled applicant and contractor data. Mercor said it strongly disputes the claims. These are allegations, and no court has ruled. ## How do the companies move the data? Each buyer describes its own method, and these are self-reported. | Company | How it says data moves | | --- | --- | | micro1 | Its forward-deployed engineering team helps run the transfer with your IT people. Its CFO said this takes about 10 hours of one or two IT people over a week or two (undated recorded forum talk) | | Mercor | [100+ integrations](https://www.mercor.com/data/) pull the data. Extraction and anonymization are automated | | Troveo | No OAuth into your systems. The owner exports | Mercor's page says no AI lab buyer or third-party vendor ever sees your raw data. That is a claim, and the buyer's own pipeline still handles it. Models differ by buyer. [Polyshares](/buyers/polyshares) says a specialist partner de-identifies the data. Its data handling page says two Polyshares people can see an unmasked record ([page](https://polyshares.com/data-handling)). Ask each buyer which model it uses. See [how fast de-identification should finish](/answers/data-deidentification-timeline-after-extraction). ## What does a micro1 referral partner say about safety? In a [micro1](/buyers/micro1) video, a micro1 referral partner said anonymization plus the licensing agreement let almost any company take part and "sleep good at night" (self-reported, about 13:46). She added that no company has had a privacy or data-security issue, which I can't verify. She earns from referrals. The video describes no contract term. Ask for the anonymization method and the agreement text before you rely on either. ## What do law firms advise? [Frankfurt Kurnit Klein and Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) gave this advice: - Limit access to raw data before de-identification. - Keep buyers out of your systems. - Require certification of the de-identification to your satisfaction. ## What can I check before I agree? Ask who touches the raw data, where it sits, how long it stays, and who deletes it. Ask what certifications exist and what they cover. The [SOC 2 page](/answers/do-i-need-soc-2-to-sell-data-to-ai) explains them. The [buyers page](/buyers) compares what each buyer publishes. The [rights check](/rights-check) lists what to settle before a call. Our [managed readiness service](/managed-readiness) walks through your export method and access logging. We never take your data. Figure: comparison of Three transfer routes buyers describe: Owner export (Buyer moves it), Buyer connector (Buyer pulls it), Direct delivery (emphasized: Raw data skips the buyer, Owner to buyer). Only direct delivery keeps the raw data out of the buyer's hands, by the buyers' own descriptions. Talk to a privacy or commercial lawyer in your state before you sign. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [The Next Web](https://thenextweb.com/news/meta-mercor-breach-ai-training-secrets-risk) - [Hausfeld](https://www.hausfeld.com/what-we-do/current-claims/mercor-data-breach) - [Business and Human Rights Resource Centre](https://www.business-humanrights.org/en/latest-news/usa-ai-startup-mercor-sued-over-hiring-practices-and-contractors-data-handling/) - [100+ integrations](https://www.mercor.com/data/) - [polyshares.com](https://polyshares.com/data-handling) - [Frankfurt Kurnit Klein and Selz](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) --- # License startup data to AI: shutdown and live routes > Searching how to sell startup data to AI? A live company licenses a corpus. A closing one lists code and workspace data via Asset Hub. Both, with dated payouts. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-startup-data-to-ai Published: 2026-07-03 Updated: 2026-10-14 ## The short answer A closing startup lists its data through a shutdown service like SimpleClosure, which reported nearly 100 deals at $10,000 to $100,000 per company. A live startup can apply to a direct program like Handshake AI, which asks for 20+ full-time employees and 3+ years, or use Troveo's marketplace. Startups hold the data buyers describe wanting: chat, tickets, code and documents from a small team that did everything in a few tools. ## How does a closing startup license its data? SimpleClosure [announced its Asset Hub](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) on 16 Apr 2026. It lists source code and workspace data, in beta then, and names AI companies, research labs and enterprise teams as buyers. Its CEO, Dori Yona, [wrote](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) that assets have come from more than 350 companies. She advises founders to check a buyer's completed deals, define what transfers, scrub personal and third-party material, and get payment terms in writing. Mercor approached failed or acquired startups for datasets, with offers as high as $300,000 ([BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d)). Bloomberg reported ([The Next Web](https://thenextweb.com/news/spacex-dead-startups-data-grok)) that SpaceX held informal talks about buying operational records from troubled startups. ## Where does a live startup go? A live startup can go to a direct program or a marketplace. [Handshake AI](/buyers/handshake-ai)'s referral page asks for 20+ full-time employees and 3+ years, and [Troveo](/buyers/troveo) states no minimum. [micro1](/buyers/micro1)'s [data partnerships page](https://www.micro1.ai/data-partnerships) lists tiers of $100K+, $500K+ and $1M+, and its [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) says $100K-$2M+ for approved data packages. micro1 says companies keep ownership of their underlying data. micro1's current public criteria list 30+ employees, mature operations and primarily English documentation, with US companies prioritized (self-reported). Acceptance depends on its review and current demand. In an undated forum talk, David Revland, who works on human data at micro1, described steps that run from a first call to a data manifest form, a payment proposal, contract, transfer and payment. See [the data manifest form](/answers/what-is-a-data-manifest-form). ## What if the startup has already failed? A failed startup follows the closing route, with decisions made by its board and stockholders. [Delaware law](https://delcode.delaware.gov/title8/c001/sc10/index.html) ties a sale of substantially all assets to stockholder approval, covered in [licensing a Slack workspace during a shutdown](/answers/can-a-shutting-down-company-sell-its-slack-to-ai). A bankruptcy adds a court. The Spirit Airlines sale shows how that looks, on our [Spirit Airlines page](/answers/spirit-airlines-data-sale). To compare the services that run shutdowns, see [startup wind down services](/answers/startup-wind-down-service). ## What should a founder check first? Your investor, customer and vendor contracts, your NDAs and your employees' messages. Our [rights check](/rights-check) asks about customer contracts, NDAs, staff messages and investor approval, and the [risk map](/risks) lists where deals break. Talk to a privacy or commercial lawyer in your state before you sign. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: scale, Reported startup data payouts, per company: Shutdown payouts $10K to $100K, micro1 corpus deals $100K to $2M (emphasized). Shutdown payouts end where corpus deals begin. Source: Gizmodo and micro1's referral page, both self-reported. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [announced its Asset Hub](https://simpleclosure.com/blog/insights/simpleclosure-asset-hub/) - [wrote](https://simpleclosure.com/blog/guides/how-real-are-those-million-dollar-data-offers/) - [BigGo](https://finance.biggo.com/news/d34746c0-e437-4855-93c5-09c6e850550d) - [The Next Web](https://thenextweb.com/news/spacex-dead-startups-data-grok) - [data partnerships page](https://www.micro1.ai/data-partnerships) - [Enterprise Data Partnership listing](https://www.micro1.ai/company-referral) - [Delaware law](https://delcode.delaware.gov/title8/c001/sc10/index.html) --- # Scale AI alternatives for licensing company data > Scale AI alternatives for licensing company data: Scale now runs a data partnership, and these firms run similar programs, with the terms each states. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/scale-ai-alternatives Published: 2026-07-02 Updated: 2026-10-14 ## The short answer Scale AI sells labeled data and model evaluation to AI labs, and it now runs a data partnership for company records. micro1, Handshake AI and Mercor run similar programs, and Troveo licenses records as a marketplace. SimpleClosure serves startups that are closing. For labeling tools, look at Labelbox. Most "Scale AI alternatives" lists come from vendors who rank themselves first. That is a funny way to run a comparison. The top results for this query come from CleverX, Ultralytics and similar sellers, so check what each author sells before you trust the ranking. ## What is Scale AI? Scale AI sells human-labeled data, RLHF and model evaluation to AI labs and big companies. Its Outlier and Remotasks brands recruit the contractors who do the work. [TechCrunch](https://techcrunch.com/2025/06/13/scale-ai-confirms-significant-investment-from-meta-says-ceo-alexandr-wang-is-leaving/) confirmed Meta's 49% [non-voting](https://sacra.com/c/scale-ai/) investment of $14.3 billion on 13 Jun 2025. > **Scale AI's main business pays people to label examples for AI labs. Its data partnership, which licenses your records, is a separate job.** One is staffing the library desk. The other is lending the library the boxes from your attic. ## What are the alternatives for a company that holds data? Scale's own [data partnership](https://scale.com/data-partnership) takes de-identified workflow records. It prefers 40+ employees and states an illustrative $10K to $1M+ per partnership. Our [Scale AI profile](/buyers/scale-ai) has the rest. [micro1](/answers/what-is-micro1), Handshake AI, [Mercor](/answers/mercor-data-licensing), Troveo, Replay and Polyshares run programs for company records too. SimpleClosure also handles data for companies that are shutting down. **Other programs for company records, the lane Scale AI has joined** | Buyer or program | Minimum size | Stated range | Pay model | Payment timing | What you keep | |---|---|---|---|---|---| | [micro1](https://vaultfish.com/buyers/micro1) | 30+ employees, US first | Tiers of $100K+, $500K+, $1M+ | Paid under the agreed partnership | Not published | Companies keep ownership | | [Handshake AI](https://vaultfish.com/buyers/handshake-ai) | 20+ full-time staff, 3+ years | $100K to $4M+ | License fee | 30 to 60 days after dataset acceptance | Not published | | [Mercor](https://vaultfish.com/buyers/mercor) | None stated | Up to $300K, press report | One wire, no fees to you | 2 to 4 weeks after signing | Not published | | [Troveo](https://vaultfish.com/buyers/troveo) | None stated, estimator from 20 | Six figures, per its page | Revenue share on each sale | On each sale | You own it, ownership stays | | [Replay](https://vaultfish.com/buyers/replay) | Bands start at 20 employees | $10K to $1M+ by headcount | Upfront plus revenue share | Upfront, then on each license | License only, nothing transferred | | [Polyshares](https://vaultfish.com/buyers/polyshares) | None stated | $100K to $2M+ | License fee, no commission | Net 30 to 60 after approval | You keep data, exclusive by default | | [SimpleClosure Asset Hub](https://vaultfish.com/buyers/simpleclosure) | None stated, closing or operating | $10K to $100K per company, press | A percentage on a sale or license | Not published | Perpetual license to SimpleClosure | _Every figure is the company's own claim unless marked press. Terms change, so confirm on each company's page._ Before you talk to any of them, read the public record. Our [is Mercor legit](/answers/is-mercor-legit) and [is Handshake AI legit](/answers/is-handshake-ai-legit) pages collect it for two of them. The [guide to licensing company data](/guides/how-to-sell-company-data-to-ai-companies) explains the steps. ## Who are Scale AI's competitors? For labeled data and expert work, [Sacra](https://sacra.com/research/handshake-indeed-for-data-labelers/) compares Scale AI with Handshake, Mercor, Surge, Turing, micro1 and Invisible. Of those, Handshake AI, Mercor, Turing and micro1 also run programs for company records, as Scale now does. The lanes are sorted in [AI data companies](/answers/ai-data-companies). ## What are the alternatives for labeling software? Labelbox, SuperAnnotate and Ultralytics sell tools your own team runs, per third-party comparison lists. That lane suits an AI team that labels its own data, and the tools pay nobody for records. Labelbox and SuperAnnotate also run separate licensing programs, [Labelbox Prism](/buyers/labelbox-prism) and [SuperAnnotate](/buyers/superannotate). Figure: comparison of Three lanes near Scale AI: Scale AI (Labeled data, plus a data partnership), Company data (emphasized: The lane this site covers, License your records), Labeling tools (Software you run). Company data is the lane where a business licenses its own records. It is the lane we cover. _Yes, we sell a lane too. Ours is the middle one. Read the list with that in mind._ micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Have a lawyer read any contract before you sign. They like that. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [TechCrunch](https://techcrunch.com/2025/06/13/scale-ai-confirms-significant-investment-from-meta-says-ceo-alexandr-wang-is-leaving/) - [non-voting](https://sacra.com/c/scale-ai/) - [data partnership](https://scale.com/data-partnership) - [Sacra](https://sacra.com/research/handshake-indeed-for-data-labelers/) --- # Are Slack messages personal data? > Are Slack messages personal data? GDPR, UK guidance, California and Virginia treat work messages differently. What each text says. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/are-slack-messages-personal-data Published: 2026-07-01 Updated: 2026-10-14 ## The short answer Slack messages are personal data under GDPR if tied to an identifiable person. California covers employee messages since 2023. Virginia excludes the employment context. The answer changes by location. Message text holding health or family detail is a special category under GDPR Article 9. A Slack message has an author, a channel and a timestamp. Its text can say anything. The legal tests care most about the author and the text. ## What does the EU and UK test say? [GDPR Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) defines personal data as any information about an identified or identifiable natural person. A user ID that maps to a named account is an identifier on that wording. [Slack's export](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) includes a users.json file. It lists the IDs. That link is my reading. Pseudonymised data stays inside the definition. The [UK ICO says](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) it is personal data for anyone who holds the extra information. For employees, [Article 88](https://gdpr-info.eu/art-88-gdpr/) lets member states set their own rules. The Court of Justice said in [case C-65/23 (19 Dec 2024)](https://www.dpcuria.eu/case?reference=C-65/23) that those rules must still follow Articles 5, 6 and 9. ## What does California say? The [California Attorney General says](https://oag.ca.gov/privacy/ccpa) the employment-related and business-to-business exemptions expired on 31 Dec 2022. So employee messages and business contacts in a workspace fall inside the CCPA. The law covers personal information. That means anything that could reasonably be tied to a consumer or household. ## What does Virginia say? [Virginia's consumer data law](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) defines a consumer as a resident acting in an individual or household context. It leaves out a person acting in a commercial or employment context. Personal data is information linked, or reasonably linkable, to an identifiable person. Other states word this in other ways. I didn't read them. Customer details that sit inside a workspace are a separate question from staff chat. ## What inside a message raises the stakes? [GDPR Article 9](https://gdpr-info.eu/art-9-gdpr/) lists special categories, such as health data, trade union membership and political opinions. A message about a sick day, a family matter or a union vote can fall there. That match is my reading of the list. Shared channels bring in other companies' people. See [Slack Connect and shared channels](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai), [the PII definitions](/answers/what-counts-as-pii-in-company-data) and [whether you can license Slack data to AI](/answers/sell-slack-data-to-ai). The [rights check](/rights-check) asks whose records these are and whether staff messages are included. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of How three places treat work messages: EU and UK (Any identifiable person), California (emphasized: Employee data covered, Employees covered), Virginia (Work context excluded). California is emphasized because it covers employee and business-contact data, where Virginia excludes the work context. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [GDPR Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) - [Slack's export](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) - [UK ICO says](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [Article 88](https://gdpr-info.eu/art-88-gdpr/) - [case C-65/23 (19 Dec 2024)](https://www.dpcuria.eu/case?reference=C-65/23) - [California Attorney General says](https://oag.ca.gov/privacy/ccpa) - [Virginia's consumer data law](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) - [GDPR Article 9](https://gdpr-info.eu/art-9-gdpr/) --- # Do I need employee consent to license company data? > Asking whether you need employee consent to sell company data? For a license, California runs on notice and opt-out, and EU regulators doubt staff consent. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/do-i-need-employee-consent-to-sell-company-data Published: 2026-07-01 Updated: 2026-10-14 ## The short answer It depends on where staff sit and what they were told. California's CCPA requires notice and opt-out, and bars uses that clash with the notice given at collection. EU and UK regulators doubt employee consent is freely given. Ask counsel which rule covers each group of staff. Consent is one tool among several, and often not the biggest one. Notice, opt-out and old promises usually matter more. So the useful work is finding out which rule covers each group of your employees. ## What does California require for employee data? California's CCPA has covered employee data since 1 Jan 2023, per the [state attorney general](https://oag.ca.gov/privacy/ccpa). [Section 1798.120](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) lets a person tell a business not to sell their personal information. It also requires notice of that right. The statute demands affirmative authorization only for a person the business knows to be under 16. [Section 1798.100(a)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) also bars using data for a purpose that clashes with the one disclosed at collection, unless there is fresh notice. That points you back to your employee notices. Pull the versions staff received when they joined. Then compare them with a license to an AI buyer. ## Is employee consent enough in the EU or UK? [Recital 43 of the GDPR](https://gdpr-info.eu/recitals/no-43/) says consent should not be a valid legal ground where there is a clear imbalance between the person and the controller. The [UK ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/) adds that freely given consent is harder to get when one side holds the power, "particularly for public authorities and employers." [Article 88](https://gdpr-info.eu/art-88-gdpr/) lets member states and collective agreements add employee-specific rules. Our [EU employee data page](/answers/can-i-sell-eu-employee-data-to-ai) covers the GDPR checks that come before consent. ## What do buyers and counsel say about consent? Daniel Goldberg, a partner at Frankfurt Kurnit, says in [his article](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) that for data collected going forward, a company can update notices. Where it fits, the company can also ask for opt-in consent. [SimpleClosure's terms](https://simpleclosure.com/tos/) have the owner state two things. It gave all required notices to the people whose data sits in the assets. It also got all required consents from them. The named groups are employees, contractors, customers, investors and vendors. The warranty puts the burden on the owner, as our [reps and warranties page](/answers/what-reps-and-warranties-does-an-ai-data-buyer-ask-for) shows. ## What about employee messages about pay or working conditions? Federal labor law sits outside the consent question. Goldberg notes that employee messages about pay, scheduling and working conditions may be protected concerted activity under [Section 7 of the National Labor Relations Act](https://www.law.cornell.edu/uscode/text/29/157). That holds with or without a union. Our [employee email page](/answers/can-i-sell-employee-emails-to-ai) covers that layer. Figure: steps Group staff, pull their notices -> Check sale, opt-out, EU/UK limits -> Counsel decides. Employee consent starts with which law covers each group of staff and what they were told. ## What should you bring to counsel? Bring a headcount by state and country, the dated privacy notices and handbooks, any union agreement and the buyer's terms for owners. Our [rights check](/rights-check) asks whether staff messages are included and whether a policy covers them. The [risks page](/risks) lists where deals have drawn objections. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [state attorney general](https://oag.ca.gov/privacy/ccpa) - [Section 1798.120](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [Recital 43 of the GDPR](https://gdpr-info.eu/recitals/no-43/) - [UK ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/) - [Article 88](https://gdpr-info.eu/art-88-gdpr/) - [his article](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) - [SimpleClosure's terms](https://simpleclosure.com/tos/) - [Section 7 of the National Labor Relations Act](https://www.law.cornell.edu/uscode/text/29/157) Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. [How we are paid](https://vaultfish.com/disclosure) --- # License CRM data to AI: what the companies and rules say > Searching how to sell CRM data to AI? You license it. micro1, Mercor and Troveo name CRM records in their data programs. Contact data and contracts set limits. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-crm-data-to-ai Published: 2026-07-01 Updated: 2026-10-14 ## The short answer Mercor lists Salesforce accounts and opportunities, Troveo names Salesforce and HubSpot, and micro1's data partnerships list CRM data. Won or lost outcomes add signal, Troveo says. Customer personal data is the limit. Salesforce makes you responsible for the legality of your customer data. HubSpot says you own it. A CRM holds two things at once, a record of how sales work went and a list of people. micro1, Mercor and Troveo list the first, and the law cares about the second. ## Which CRM records do the companies name? [micro1](https://www.micro1.ai/data-partnerships) lists CRM data and CRM metadata among operational datasets. [Mercor](https://www.mercor.com/data/) lists Salesforce accounts, contacts, opportunities and reports. [Troveo](https://www.troveo.ai/business-data) groups CRM, sales and support under one heading and names Salesforce and HubSpot as systems. ## Why does Troveo say CRM outcomes matter? [Troveo's guide](https://www.troveo.ai/resources/license-company-data-for-ai) says data showing what happened next, won or lost, resolved or escalated, adds signal that activity logs alone lack. A CRM is one of the few places where that result sits next to the steps that led to it. A deal record linked to the email thread and the proposal is worth more than any one of them, in [Troveo](/buyers/troveo)'s view. ## What limits sit on CRM data? Contact records are personal information about your customers and prospects. California has covered business-to-business and employee data under its privacy law since 1 Jan 2023, and a transfer for money counts as a sale unless the data meets the de-identification test. See [CCPA sales](/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa) and [customer consent](/answers/do-i-need-consent-to-sell-customer-data-for-ai-training). Contracts add more. Customer agreements and NDAs can limit what you do with account notes. My [NDA page](/answers/does-my-nda-let-me-sell-data-to-ai) covers that. Talk to a privacy or commercial lawyer in your state before you sign. ## What do Salesforce and HubSpot say about CRM data? [Salesforce's main services agreement](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Salesforce_MSA.pdf), section 3.3, puts responsibility for the accuracy, quality and legality of customer data, and for how you acquired it, on the customer. [HubSpot's terms](https://legal.hubspot.com/terms-of-service) say you own your customer data, and also say HubSpot may use it to improve its own AI features unless you opt out in your settings. Check that setting, since it concerns a use you never licensed. ## Who removes contact details? Troveo says it scrubs names, contact details, credentials and client identities to a documented standard, and [micro1](/buyers/micro1) says it transforms the data itself. My [re-identification page](/answers/re-identification-risk-emails) covers what that leaves behind. My [rights check](/rights-check) asks what personal data the records hold and what your customer contracts allow. micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure) Figure: comparison of Three CRM record types and what they carry: Opportunities (emphasized: The outcome buyers pay for, Won or lost), Accounts (Customer history), Contacts (Personal data). Opportunities are filled because Troveo says a won or lost outcome is the signal buyers pay for. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link. [How we are paid](https://vaultfish.com/disclosure)_ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [micro1](https://www.micro1.ai/data-partnerships) - [Mercor](https://www.mercor.com/data/) - [Troveo](https://www.troveo.ai/business-data) - [Troveo's guide](https://www.troveo.ai/resources/license-company-data-for-ai) - [Salesforce's main services agreement](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Salesforce_MSA.pdf) - [HubSpot's terms](https://legal.hubspot.com/terms-of-service) --- # Pseudonymization vs anonymization in a data license > Searching pseudonymization vs anonymization for a data sale? In a license, pseudonymised data stays personal data for anyone who can link it back. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/pseudonymization-vs-anonymization Published: 2026-07-01 Updated: 2026-10-14 ## The short answer Pseudonymization vs anonymization asks one thing. Can anyone link a record to a person? A stand-in name is a link. The UK ICO says it stays personal for anyone with the key. Anonymous data has to pass a harder test. Ask counsel whether your stand-ins count as anonymous. The law treats these two ways of hiding who a record is about very differently. > **Pseudonymized data swaps each name for a stand-in label. Someone still holds the list that matches labels to names.** Picture boxes in an attic with labels instead of names. If the list sits in a drawer, the boxes can be matched again. Burn the list and they cannot. ## What is the difference between pseudonymization and anonymization? The ICO describes pseudonymisation as techniques that replace, remove or transform identifying information and store it apart. The data stays personal data for anyone with the extra information. For a recipient without it, the data "may be anonymous" ([ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/)). The guidance is under review. GDPR Recital 26 says pseudonymised data that could be tied to a person with extra information is data on an identifiable person. Anonymous information is different, because the person is no longer identifiable. The test asks what means are reasonably likely to be used, counting cost, time and available technology ([Recital 26](https://gdpr-info.eu/recitals/no-26/)). ## What did the EU's top court say about pseudonymization and recipients? In EDPS v SRB (C-413/23 P, 4 Sep 2025), the Court of Justice held that pseudonymised data can fall outside data protection law from a recipient's view. The conditions are strict. The recipient must be unable to re-identify people. For the party that holds the means to re-identify, the data stays personal ([Jones Day summary](https://www.jonesday.com/de/insights/2025/09/cjeu-clarifies-scope-of-personal-data-in-edps-v-srb-decision)). The EDPB's draft Guidelines 02/2026 on anonymisation are open for comment until 30 Oct 2026. They cover singling out, linkability and inference ([EDPB](https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en)). ## What does California call it? The CCPA's term is "deidentified." It has three parts. The business takes reasonable measures so the data cannot be tied to a consumer or household. It publicly commits not to re-identify it. It binds every recipient by contract to the same terms (Civ. Code 1798.140(m), [statute text](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). My [de-identification page](/answers/data-de-identification) goes through it. ## Why does the difference matter when you license data for AI? micro1 wants the trail across tools. David Revland, who works on human data at [micro1](/buyers/micro1), said in an undated recorded forum talk that micro1's team swaps each name for a consistent stand-in across platforms, so the role and cross-tool trail survive. That is pseudonymization by design. A micro1 referral partner described the same step differently in a micro1 video. They called it full anonymization that removes phone numbers, emails and names (video, about 13:27). A swap and a removal leave you with different data. Ask which one the contract says, and who holds any name mapping. The Spirit Airlines sale agreement likewise requires de-identification "while preserving referential integrity across the data set." The flight attendants' union argued that linked data could let identities be rebuilt ([Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)). See my [union objection page](/answers/spirit-airlines-data-union-objection). The FTC wrote that hashing does not make data anonymous ([FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous)). _A fake name is still a name in a costume._ ## What should you ask a data company? 1. Do links between records survive, and why does the buyer need them? 2. Which legal test does the process aim to meet, and who certifies it? 3. Who holds any key that can reverse the swap? 4. What stops a recipient from combining the data with other sources? My [re-identification page](/answers/can-ai-re-identify-anonymized-emails-and-slack-messages) covers how well scrubbing holds up. The [data anonymization guide](/guides/data-anonymization) covers a full licensing deal. Run the [rights check](/rights-check) first. This page is research, not legal advice. Have a privacy lawyer in your state read any contract before you sign. They like that. Figure: comparison of Two states a record can be in: Pseudonymized (emphasized: Personal data to key holders, Link can be rebuilt), Anonymized (Link is gone). Pseudonymised data stays personal data for anyone holding the key, says the ICO. [Apply to micro1's data partnership (paid link)](https://req.micro1.ai/post/74520e8b-4673-4da5-b855-53609aaf6710?referralCode=f82e519e-5d64-4e0e-9574-760c84371cf2&utm_source=referral&utm_medium=share&utm_campaign=data_referral) · [micro1's own data-partnerships page](https://www.micro1.ai/data-partnerships) _Paid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra._ _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [Recital 26](https://gdpr-info.eu/recitals/no-26/) - [Jones Day summary](https://www.jonesday.com/de/insights/2025/09/cjeu-clarifies-scope-of-personal-data-in-edps-v-srb-decision) - [EDPB](https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en) - [statute text](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) - [Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf) - [FTC](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous)