Our verdict
Mercor is the largest company in this ranking by reported run rate, above $2B in June 2026, and was valued at $10B in 2025. For sellers of company data it is the fastest documented payer, wiring funds 2-4 weeks after signing with no fees. It publishes no offer range, and a March 2026 cyberattack was followed by class actions.
The facts, with receipts
Every row links to its source.
| Fact | Value and source |
|---|---|
| Reported run rate | Above $2B gross run rate (June 2026) |
| Data it buys | Slack, Teams, Gmail, Outlook, Confluence, Salesforce, GitHub, Drive, Notion and 100+ other tools |
| Seller fees | No fees |
| Time to payment | Wire 2-4 weeks after signing |
| Security attestation | SOC 2 Type II |
| Company referral program | Exists; payout amount not published |
| Contractor referral bonus | 20% of the referral's earnings, up to a cap of $250-$15,000 |
| Spirit Airlines archive bid | Bid $7.5M; Google won with $10M, Mercor is the backup buyer |
| Valuation | $10B after a $350M Series C |
| Acquisition | Acquired Sepal AI |
| Acquisition | Acquired Deeptune to build training environments for AI agents |
| Industries Mercor Data names | Legal; healthcare; finance and insurance; professional services; manufacturing; retail and e-commerce; real estate; logistics and supply chain |
| Approach to an acquired startup | Mercor approached Warmly about its archives after HubSpot acquired the company |
| Mercor: company size | No minimum company size stated on its data page |
| Mercor's LinkedIn claim | Partnered with over 300 enterprises, paying companies up to $10M per enterprise |
| Tools across Mercor's partners | Slack 55%, GitHub 53%, Google Drive 53%, Gmail 50%, Figma 40%, Jira 35% |
| How Mercor collects | Mercor's ads say it "connects to the tools you already use, anonymizes what's inside" |
| Who Mercor advertises to | Account-based video ads naming large enterprises (Marsh McLennan, Chubb, Capital One), with the line "Monetize company data. Safeguard company secrets."; its Meta ads are recruiting only |
| Mercor's approach to Warmly | Eight days after Warmly agreed to be acquired by HubSpot in late June 2026, Mercor emailed Warmly's CEO offering to buy or license its code and task records |
| Exclusivity terms | Not mentioned on its data page |
| Retail and e-commerce data Mercor names | Order records, inventory logs, listings |
| Real estate data Mercor names | Listings, leases, inspection reports |
| Logistics and supply chain data Mercor names | Shipping manifests, dispatch logs, invoices |
| Professional services data Mercor names | Client decks, SOWs, project files |
| Manufacturing data Mercor names | Work orders, QA logs, spec sheets |
| What Mercor takes from GitHub | Repositories, commits, PRs and issues |
| Mercor on company size | States no minimum headcount or years in business on its data page |
| Legal documents Mercor names | Contracts, case files, discovery docs |
| Finance and insurance documents Mercor names | Statements, underwriting files, claims |
| Healthcare documents Mercor names | Clinical notes, claims, intake forms |
| Real estate documents Mercor names | Listings, leases, inspection reports |
| How Mercor handles data before release | No data leaves the seller's systems until the seller approves it; extraction and anonymization are automated, and no AI lab sees raw data |
| Who founded Mercor | Founded in 2023 by Brendan Foody (CEO), Adarsh Hiremath (CTO) and Surya Midha (board chair) |
| Mercor's customers | Mercor's customers include Anthropic, OpenAI and Meta |
| Mercor's June 2026 update on the breach | Of nearly five million experts, "a very limited subset" had sensitive information affected; no employee data was affected; the impact on customer information was "very limited" |
| Security changes Mercor lists | Auditing all third-party code it depends on, rotating credentials and keys, tighter cloud and network controls, outside penetration testing and 24/7 managed detection and response |
| How Mercor Data collects | Businesses link accounts from 100+ supported tools; extraction and anonymization are "fully automated", and no AI lab buyer or third-party vendor sees the raw data |
| What sets Mercor's payout | Data volume, the tools you connect and the depth of your data; connecting more tools raises the payout |
| Offer range | Not published |
| Security incident | Confirmed a cyberattack tied to the compromise of the open-source LiteLLM project |
| Litigation | Several class actions filed on 2026-04-01 in the Northern District of California after the breach |
| What the attackers claimed | The extortion group Lapsus$ claimed up to four terabytes, including source code and database records, and posted samples such as apparent Slack data, ticketing records and videos of AI interviews with contractors |
How we rated them
The rating for AI teams is a weighted average of the parts below, using only what is published. See how we rate.
- Expert depth and vetting No data
- Quality systems No data
- Security and neutrality 6.0
- Scale and speed 9.5
- Transparency 6.5
Provenance
Where the work comes from and who stands behind it. Anything we cannot source says so.
- Where the workforce is located
- Not disclosed
- How experts are vetted
- Not disclosed
- Annotation platform or tooling
- Not disclosed
- Subcontracting
- Not disclosed
- Security certifications
- SOC 2 Type II, stated on Mercor's data page7
- Ownership
- Not disclosed
Strengths and weaknesses
Strengths
Mercor for other readers
Incidents and conflicts
Reader reviews
What people who worked with Mercor say
7.4/10
None yet
A written summary appears once enough reviews are published. It will quote both praise and complaints.
No reviews yet. Be the first.
If you have sold data to, hired, or worked for Mercor, your review helps the next person decide.
FAQ
Mercor: questions, answered
Mercor confirmed a cyberattack on 31 March 2026, tied to the compromise of the open-source LiteLLM project, and several class actions were filed in the Northern District of California on 1 April. Mercor later called the affected data a very limited subset. No reliable count of affected people has been published.1,2
Mercor states a SOC 2 Type II attestation on its data page. None of the other companies in our current sources publishes one where we could check it. That does not mean they lack one: ask each vendor for its report under NDA, and treat a refusal as a signal.7
Mercor is about four times larger by reported gross run rate, above $2B against micro1's $500M, but it confirmed a cyberattack in March 2026. micro1 has no reported incidents in our sources and publishes its program terms in full. Neither publishes vetting or quality metrics, so run a paid pilot with both.3,43,1,44
Change log
- First published.