How to prepare your company data for an AI data license

Preparation is where most of a license’s risk is settled. A buyer can remove names; only you know which channel holds last year’s compensation discussion. This guide is the practical sequence, from inventory to sample. It assumes you have read the overview and worked through the legal and privacy checklist. It is not legal advice, and your counsel should sign off on the exclusions.

What goes in the inventory?

List every system that holds company work, current and retired. For each one, record:

Field	Why it matters
System and plan	Export options differ by plan. On Slack, private channels and direct messages cannot be exported on Free or Pro (Slack)
Admin owner	Someone has to grant access and approve exports
Date range	Buyers weigh history. Handshake looks for 3+ years in operation (Handshake), and Polyshares lists a short operating history as something that caps value (Polyshares)
Content types	Messages, email, tickets, documents, code, CRM records
Sensitive areas	HR, finance, client, health, export-controlled
Status	In, out, or ask counsel

Include retired tools. An old ticketing system or an archived mailbox may hold your longest history, and some buyers work with them: Turing lists older stacks alongside current tools (Turing).

Who needs admin access, and how should a buyer get in?

• Confirm you hold the top admin role in each system, and that more than one person holds it. Some exports depend on it: on Slack Business+, the export tool for private channels and direct messages needs the Primary Owner’s approval (Slack).
• Use the buyer’s connector or your own exports, never shared passwords. Buyers differ here. Mercor links to your accounts and holds credentials per session (Mercor); Turing works from exports you make from each system (Turing); Endless Data prepares and transfers the data itself (Endless Data). Know which model you are agreeing to before you grant anything.
• Plan the end. Decide who revokes the buyer’s access and when, and put that date in the agreement.

How do you preserve data before cancelling anything?

Do not cancel, downgrade or delete a workspace until the data you might license is preserved. Provider rules are not forgiving:

• Slack. Since August 26, 2024, Slack has deleted messages and files older than one year in free workspaces, on a continuous basis, and says deleted content cannot be restored (Slack). Read that before moving a paid workspace to the free plan to save money.
• Microsoft 365. After you cancel, Microsoft says data you leave behind might be deleted after 90 days and will be deleted no later than 180 days, and that explicitly deleting a subscription deletes SharePoint and OneDrive content immediately (Microsoft).
• Google Workspace. Google says that after you cancel, users’ Workspace data will be deleted and cannot be restored, and recommends its Data Export tool first (Google).

If you are winding down, closing a company sets out the order of steps.

Which secrets need rotating?

Assume the data contains credentials: API keys pasted into chat, passwords in wiki pages, tokens in code history and build configuration. Rotate them before transfer, so anything a filter misses is already useless. GitHub’s guidance is the right model: if a secret was committed, revoking or rotating it is the first step, and rewriting history alone may leave the old commits accessible elsewhere (GitHub). Turing says it removes personal data and secrets before anything reaches a model (Turing); rotate anyway. After the transfer, rotate the credentials or revoke the app the buyer used to connect.

How do you mark exclusions so they stay out?

Exclude whole containers: channels, mailboxes, shared drives, folders, projects and repositories. Keyword filters inside an included channel will miss things. Keep an exclusion register, for example:

Item	System	Reason	Method	Checked by
HR team channel	Slack	HR	Channel excluded by ID	[name]
Payroll mailbox	Email	Compensation	Mailbox not connected	[name]
Client matter folders	Drive	Client confidential	Shared drive excluded	[name]

Then use the approval points buyers offer. Polyshares says nothing leaves your systems until it has made an offer (Polyshares), and Mercor says no data leaves until you approve it (Mercor). Check the register against what is about to leave at that point, not afterwards. The consent guide lists the channels and mailboxes that usually belong on it.

How do you count records, and why do buyers ask?

Buyers price from numbers and samples, so counts move the conversation from a call to an offer. Mercor says compensation depends on data volume, the tools you connect and the depth of your data (Mercor). micro1 asks for a company profile and a data manifest on its portal (micro1). The Polyshares intake asks for headcount by country and the share of data in English (Polyshares). AIData.Broker’s valuation reads files in your browser and sends only counts (AIData.Broker).

Count after exclusions, per system and per year:

• Chat: channels, messages, active members.
• Email: mailboxes in scope, messages.
• Tickets: tickets and comments.
• Documents and wikis: pages and files.
• Code: repositories, commits, pull requests with review comments.
• CRM: records and logged activities.

Note the share in English and the years covered. Use admin reports or export manifests where they exist, and write down how each number was produced so the buyer can check it.

What de-identification does the buyer do, and what is yours?

Buyers describe removing identifiers. None of them removes the need for your own exclusions.

Task	Who	What the programs say
Remove names, emails, phone numbers, account numbers, addresses	Buyer	Polyshares uses a PII partner before it or any buyer sees the record (Polyshares); micro1 removes or transforms identifying information before sharing with third parties (micro1)
Keep whole categories out: HR, health, client work, financial accounts	You	Not a filtering job; these never leave
Rotate secrets	You	Even where the buyer also removes them
Review the sample for missed identifiers	You and the buyer	micro1 lets companies review representative samples first (micro1)
Accept the remaining risk	You, knowingly	Handshake says no de-identification process eliminates the risk entirely (Handshake)

Check which model you are dealing with. Korra, a broker, de-identifies only its listing card and makes no promise that your records are anonymous (Korra). Context can identify people after names are gone; Is it safe? explains why narrow scope beats clever filtering.

What should the sample look like?

Draw it from in-scope sources only, after exclusions, and make it representative: several systems, several years, ordinary days rather than the best threads. Turing takes its sample through a private shared folder (Turing). Keep a copy of exactly what you sent, and ask in writing that the sample be deleted if no agreement follows.

Once you have counts, the value check compares them with each buyer’s published criteria, and the tracker lists each program’s terms with the date we checked them.