How is company data anonymized before it reaches an AI lab?
Before an AI lab sees your records, buyers say they strip out names and contact details inside a sealed-off workspace. Mode and Replay both describe it that way. Pewter shows you a cleaned sample before you sign, and micro1 and Replay say only the cleaned copy moves on, not your raw files.1,2,3,4
What happens to your records, step by step
Every buyer runs its own process and describes it differently. Put together, the buyers we work with describe roughly this path from your systems to a lab, and each step below is in a buyer's own words.1,2,4,3
- You decide what's in. Mode agrees the systems and date ranges with you before anything is exported, and Nyne's ads say any folder can be left out.1,5
- The export happens without handing over your passwords. With Mode, your staff sign in to the approved systems and hand over no passwords, while Replay says it does the export itself. Frankfurt Kurnit, a law firm, advises giving a buyer no direct access to your systems.1,2,6
- The cleaning happens somewhere sealed off. Replay says it removes identifiers across 60+ categories in an isolated environment for each engagement, and micro1 says it keeps each company's data separate from other companies'.2,4
- Names and contact details come out or get swapped for codes. Mode says names and contact details are removed or transformed, and Nyne's ads say client names are swapped for codes.1,7
- You check a sample. Pewter shows a before-and-after sample with names replaced by placeholders before you sign, and micro1 says the company reviews scrubbed samples before any data is released.3,8
- Only the cleaned copy moves on. micro1 says personal and identifying information is removed or transformed, when relevant, before anything is shared with a third party, and Replay says raw data never leaves its pipeline.4,9,2
- The raw files are deleted. micro1's terms delete the data within 120 days of final delivery, though a model already trained on it is not deleted.10
Who does the cleaning, buyer by buyer
Who does the work differs by buyer. Polyshares says an outside firm scrubs the data, while Replay and Ventra say they do it themselves. Ventra also says it won't try to identify anyone in cleaned data except to test its own cleaning.11,2,12
Bankruptcy sales can add an outside check. In the Spirit Airlines case, the court's ombudsman recommended approving the sale to Google with Tonic.ai cleaning the data and filing a certification with the court before every transfer, though she did not assess the risks to employees or third parties.13
| Buyer | Who cleans it and how | It also says |
|---|---|---|
| Ventra | Reviews, cleans, formats and packages each dataset itself before licensing it12 | It won't try to identify people in cleaned data, except to test its cleaning12 |
| Polyshares | An outside firm scrubs personal details before anything is licensed11 | Data held on behalf of clients is left out14 |
| micro1 | Removes or transforms personal details, when relevant, before sharing, and keeps each company's data separate4,9 | The company reviews scrubbed samples before release8 |
| Mode | Names and contact details removed or transformed in a secure workspace1 | Systems and date ranges agreed before export, and staff hand over no passwords1 |
| Replay | Does the export and removes identifiers across 60+ categories in an isolated environment2 | Raw data never leaves its pipeline2 |
| Pewter | Removes names, contact details, account numbers and credentials as part of the deal15 | A before-and-after sample with names replaced by placeholders, and no method removes every risk3 |
What can still slip through
No cleaning method removes every risk, and Pewter says so itself. Written text is the hard part: NIST, the US standards agency, notes that in free-form text names and addresses may not be clearly marked, and identifying details can remain after cleaning.3,16
Small details add up. One study estimated that 99.98% of Americans could be re-identified in a dataset using 15 demographic attributes, which is why reading the cleaned sample yourself is worth the time.17
What slips through can resurface later. micro1's terms say trained models are not deleted, and researchers have pulled hundreds of word-for-word passages, including names, phone numbers and email addresses, out of a language model's training data.10,18
So keep the riskiest records out of the deal. SimpleClosure says it excludes sensitive employee and health records, Nyne's ads say any folder can be left out, and Frankfurt Kurnit's checklist for sellers includes leaving high-risk categories out.19,5,20
Medical, legal and financial records
Patient records have their own federal standard. HHS says health information cleaned by Expert Determination or Safe Harbor is no longer protected by the HIPAA Privacy Rule, so ask each buyer which method it uses, and ask your attorney what else applies to you.21
For law firms, accountants and financial firms, the first question is whether you can license records you hold for clients at all. Polyshares says it leaves out data held on behalf of clients, so ask your attorney which client files are off limits before a buyer sees a sample.14,20
Pros and cons
Pros
- Buyers say names and contact details are removed before anything is licensed.1,11,2
- You can ask to read a cleaned sample, and Pewter shows one before you sign.3,8
- With Mode, your own staff run the export and hand over no passwords.1
- micro1's terms delete the raw data within 120 days of final delivery.10
Cons
- In free-form text, names may not be clearly marked, and identifying details can remain after cleaning.16
- One study estimated 15 demographic details could re-identify 99.98% of Americans.17
- micro1's terms say trained models aren't deleted, even when the raw data is.10
- Cleaning harder protects people better but leaves less useful data.22
What it means for a business like yours
Before you sign anything, get three answers in writing: who does the cleaning, where it happens, and when you see a sample. The buyers above answer those three differently.11,1,3
Then make the cleaner's job easier. Leave high-risk records, such as sensitive employee files, out of the deal unless a buyer specifically asks for them, and keep your passwords to yourself.20,19,6
Should your business get in now?
Businesses are already licensing their records: micro1 has committed $1B over 12 months to buying company data, and at least 18 firms started advertising for it between September and mid-October 2026.23,24 Our view, not a promise: the money will not be around forever, because prices tend to come down as more businesses sell.23,25 Take the quiz to see which firms fit your business.
Plus a free Seller's Guide when you finish.
Plus a free Seller's Guide when you finish.FAQ
Questions, answered with sources
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Before you sign
Questions to talk through with your buyer
Every business is different, so these are best talked through with the buyer you're working with. Their team goes over them with you before anything is signed.
Questions for this kind of business
- Which cleaning method will you use, who does it, and will an outside party check it?
- Does any client contract or duty of confidentiality limit which records we can license?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?
What changed since we first published
- 10 Nov 2026 Pewter's row now lists what it says it removes; its public pages don't mention HIPAA.