The buyer runs the export, the de-identification and the payment. The decisions about what leaves your company are yours, and they are best made before anyone sends you an offer. Six steps, in order.
Last checked: 7 October 2026. Buyer terms are quoted as published on that date.
Preparation does two jobs. It removes the delays that sit on the seller’s side, and it means you negotiate knowing exactly what you are offering and what you are not.
None of this requires sending data anywhere. It is internal work: lists, a written scope, a few checks and a decision about who approves. Most of it also helps with the broader process described in how to sell data to AI companies, and it shortens the stages covered in how long an AI data deal takes.
Work through the steps in order. Each one uses the output of the one before: the inventory feeds the scope, the scope tells you where to look for exclusions, and the exclusions and retention check decide what the secrets scan has to cover. The last step, naming who signs, turns the result into a decision your company can actually make.
Start with the systems buyers name. For each one, record who administers it, how many years it covers, roughly how much is in it, and how it can be exported.
| Category | Systems buyers list | Record for each |
|---|---|---|
| Communication and documents | Gmail, Outlook, Google Drive, SharePoint, Slack, Microsoft Teams, Notion, Confluence, Dropbox, DocuSign, Zoom recordings and transcripts | Admin, years, rough volume, which teams use it |
| Work tracking and support | Jira, Asana, Monday.com, Zendesk, ServiceNow | Projects or queues, years, links to other systems |
| Sales and finance | Salesforce, HubSpot, QuickBooks, Xero, NetSuite, Paychex | Which records hold customer or payroll data |
| Design and trades | AutoCAD, Figma, ServiceTitan | Who owns the files: you or the client |
| Code | GitHub, GitLab and Bitbucket repositories with history | Repos, years, contractors, third-party code |
Years matter. Mode asks for several years of records the company owns, and micro1 looks for mature operations and documented processes (both as published). Note where systems connect: a ticket that links to a commit, or a CRM record that links to an email thread. Connected records are what buyers describe wanting, and the links are easy to lose in a careless export. For code specifically, see codebases and git history.
micro1 says scope is agreed in writing; Mode says it buys “an agreed copy” (both as published, checked 7 October 2026). Arrive with your own draft so the agreed version starts from your words.
A good scope statement names the systems, the teams or projects, the date range and the data types, and refers to the exclusions list. It should be short enough that a non-lawyer at your company can read it and know what is leaving. If it takes a page to explain, the scope is probably too wide for a first deal.
The exclusions list is the most important document you will write. It protects your clients, your staff and you, and it makes the scope easy to defend.
Anything covered by NDAs or engagement terms with clients. See client confidentiality and data sales.
Communications with counsel, dispute files and anything under attorney-client privilege.
Performance reviews, pay, health and leave records, disciplinary files, recruiting notes.
Patient information under HIPAA, and customer financial data that may fall under GLBA.
Customer contact lists, payment details and account records. micro1 states no customer information is exposed; your list should make that easy to keep true.
Vendor manuals, licensed stock, purchased reports, open-source code and anything you did not create.
Add security runbooks, board materials and M&A files if you have them. Keep the list as categories plus named exceptions, and attach it to the scope. General information, not legal advice. Talk to your own lawyer before you sign.
De-identification is aimed at people’s details. Passwords, API keys and access tokens are your job.
Code history, wiki pages, chat messages (“here is the login”), support tickets, shared spreadsheets, CI settings, email threads with vendors and screenshots.
Rotate every credential you find before any export, then exclude or redact the item. A rotated key is harmless if it slips through; a live one is not.
Use secret-scanning tools on repositories, including their full history, and keyword searches (password, token, key, login) in chat, wiki and ticket systems.
Your IT or security lead. They should sign off that the scan was done before the scope is final.
Offers can come with deadlines. Knowing who must say yes, and what each person is checking, stops a good offer from expiring in someone’s inbox.
| Role | What they decide or check |
|---|---|
| Owner or CEO | Whether to sell at all, which buyers, and the final signature. |
| Finance lead | Payment structure, milestones, tax treatment and how the income is booked. |
| Legal counsel | The agreement, client contracts, exclusivity, warranties and indemnities. |
| IT or security lead | Export access, the secrets scan, and what systems the buyer touches. |
| HR or people lead | Employee notice and how staff hear about it. |
| Privacy lead | Personal data, EU and UK records, retention and deletion promises. |
| Board or partners | Approval where your governing documents require it. |
In a 25-person company several of these roles are the same person. That is fine, as long as each question has been asked by someone.
The six steps produce one document a buyer can review without seeing your data. Keep it short: one page per system is plenty for a first conversation.
| Field | What to write |
|---|---|
| Company profile | Industry, full-time staff, where the team works, primary business language. |
| Systems | Each system in scope, with the teams that use it. |
| Date range | First and last month covered, and any gaps from auto-deletion or migrations. |
| Volume | Approximate counts: tickets, pages, messages, repositories, hours. Rough is fine; invented is not. |
| Connections | Where records link across systems, such as tickets to commits or projects to documents. |
| Exclusions | The categories excluded and the reason for each, without naming clients. |
| Format | How the data can be exported and what the export includes, such as history, comments or attachments. |
| Samples | What samples are available after an NDA, and how they were chosen. |
The company profile row maps directly onto what programs publish as eligibility: employee counts, location, language and years of records. The eligibility checker uses the same inputs, so running it first is a quick way to see which programs your manifest should be sent to.
An offer that arrives before your inventory exists forces rushed decisions about scope and exclusions.
“All our data” is not a scope. It cannot be checked, defended to staff or warranted in a contract.
An exclusions list that is not written down cannot be attached to the agreement or applied consistently.
Promising seven years when email auto-deleted after three damages trust at the review stage.
Credentials in chat, wikis and tickets are as live as those in a repository.
Employee notice is easier to plan than to repair. Bring the people lead in at the start.
The output is a one-page manifest and a few samples per system. No price appears because nobody can value data without reviewing it.
With the manifest ready, apply to more than one program at once. Practitioners advise sharing the manifest and samples, never the full dataset, before you have a price, and getting more than one offer; our guide to getting more than one offer explains how to compare them.
A prepared seller can ask sharper questions, because the answers map onto decisions already made.
Write the answers down for each buyer. When more than one offer arrives, the comparison is on terms as well as price, and these notes are the terms.
Quoted from each program’s own pages, checked 7 October 2026. Published ranges are not promises of amount, acceptance or timing.
micro1: 30+ employees, mature operations, documented processes, modern software tools, primarily English, US first; “$100k+ qualified,” “$500k+ large-scale,” “$1M+ highly unique.” Mode: 20+ full-time US office employees (accounting firms 10+, law firms 6+), several years of records the company owns; “$100K-$5M.” Grepped: any vertical; “$20K-$5M.”
Independent site. Some links are referral links: if your company signs with a buyer through them, the buyer may pay us a fee. You are not charged, and we never see your data.