The real risks
1. Personal information leaks
Emails, tickets and CRM notes are full of names, phone numbers and addresses, both customers' and employees'. If they aren't removed, you may break privacy laws and your own commitments.
2. Confidential business information
Pricing rules, vendor terms, margins and strategy documents can hide inside ordinary SOPs. Decide up front what's off-limits.
3. Rights you don't have
Client contracts and NDAs may forbid sharing records you hold for clients. Licensing them anyway exposes you to claims. See client data vs. company data.
4. Use beyond what you agreed
Without clear terms, data could be kept forever or used for purposes you didn't expect.
Protections to require
| Protection | What to look for | micro1 states |
|---|---|---|
| Ownership | You keep it; buyer gets a license | Yes |
| Scope | Written list of included systems and date ranges | Defined before participation |
| PII removal | Who removes it, and how it's checked | Removed when relevant |
| Sample review | You approve samples before use | Yes |
| Isolation | Your data isn't mixed with other clients' | Isolated pipelines |
| Access control | Limited, named staff; managed devices | Yes |
| Deletion | Fixed retention period and deletion on request | Per agreed terms |
Source for the third column: micro1 Data Partnerships.
10 questions to ask any buyer
- Exactly what will the data be used for?
- Will it be shared with or sold to any third party?
- Who removes personal information, and how is it checked?
- Can we review samples before they're used?
- How long is data retained, and how is deletion confirmed?
- Is our data kept separate from other customers' data?
- Who has access, and on what devices?
- Will synthetic rewriting be applied?
- Can we exclude specific systems, teams or topics?
- What happens if there's a breach?
Bottom line
The safest approach is to start with what you clearly own (SOPs, knowledge bases, process docs) and leave regulated or client-owned records out. Use our agreement checklist, and have counsel review the contract.
Frequently asked questions
Is it safe to share company data with AI companies?
It can be, with the right terms: limited scope, PII removal, sample review, isolated storage and guaranteed deletion. Start with data you clearly own.
Will AI companies leak my business secrets?
Reputable programs restrict access and keep data isolated, but you should scope out sensitive material like pricing logic and vendor terms.
Do I need a lawyer to sell company data?
It's strongly recommended. A data licensing agreement covers ownership, privacy and liability, so have counsel review it.