Before You Sell Your Company's Slack and CRM History to an AI Lab: An Operations Checklist

Your company’s Slack history has a buyer now.

So does your CRM.

So do your support tickets, your Jira board and the shared drive nobody has cleaned up since 2019.

AI labs want records of real people doing real work. A growing group of data buyers will pay companies to license that history for model training. micro1 announced a $1B, 12-month commitment to buy company data in October 2026. Mode announced a $5B enterprise data initiative a few days later.

That sounds like found money.

It is also an operations project. And most of the risk sits in the parts nobody owns.

The short answer

Before anyone signs a data license, operations should be able to answer six questions:

• Which systems hold what, and how far back?
• Who owns each data set, and what do our customer contracts and privacy policy allow?
• How will we remove personal data, and who checks the result?
• Is the deal exclusive or non-exclusive, and for how long?
• Is the payment upfront, revenue share, or both?
• Who signs off, and what do we tell customers and staff?

If you cannot answer those, you are not ready to price the data. You are ready to inventory it.

Step 1: Inventory which systems hold what

Start with the list buyers actually ask for.

Scale AI says it wants Slack or Teams, email, CRM, Jira, Zendesk and Drive records. Other buyers ask for similar things. The value is in how work gets done: questions, answers, decisions, handoffs and fixes.

For each system, write down:

• System and owner. Slack, Microsoft Teams, Gmail or Outlook, Salesforce or HubSpot, Jira, Zendesk, Google Drive or SharePoint.
• What it holds. Internal chat, customer email, deal notes, support conversations, project issues, contracts, SOPs.
• Date range. How many years of history exist, and how much was deleted under a retention policy.
• Who is in it. Employees only, or customers, vendors, candidates and partners too.
• Export path. Can an admin export it cleanly, or does it need an API job or a vendor’s help?
• Plan limits. Some tools limit export or history on lower tiers. Check before you promise anything.

This is the same discovery work a business process review starts with. You are mapping where work lives. The difference is that a buyer will read the map.

Expect surprises. The customer escalation that lives in a DM. The pricing sheet pasted into a ticket. The HR conversation in a public channel. Find these now, not after export.

Step 2: Settle who owns the data and what you promised

Owning the server is not the same as owning the right to license what is on it.

Check three sources of promises:

• Customer contracts. B2B agreements often limit how you can use a client’s data, whatever your privacy policy says. Some ban any use outside delivering the service.
• Your privacy policy and terms. If they say you do not sell or share customer data, a license may break that promise.
• Vendor and partner terms. Some records include content a partner or vendor has a claim on.

Do not fix a gap by quietly editing the policy. In February 2024 the FTC warned that quietly changing your terms of service to use data for AI training could be unfair or deceptive. A new policy usually covers data collected after clear notice, not the years of history you already hold.

This is legal’s call, not operations’. But operations can make legal’s job much faster by handing over the inventory and the relevant contract list. If you want to see the questions a lawyer will ask, this walkthrough of six legal questions to answer before you sell customer data is a useful prep sheet.

Step 3: Scrub personal data, then check the scrub

Most training deals require personal information to be removed first.

That is harder than it sounds in chat and email.

Names are the easy part. Free text is the hard part. People paste phone numbers, home addresses, account numbers, health details and passwords into messages. Signatures carry direct lines. Ticket bodies quote whole customer emails.

A workable scrub plan has:

• Rules. A written list of what must be removed or masked: names, emails, phone numbers, addresses, account and card numbers, government IDs, credentials, health and HR details.
• Exclusions. Whole channels, folders or pipelines that never leave: HR, legal, board, payroll, M&A, anything privileged.
• Tooling plus review. Automated redaction does the bulk. A person samples the output and logs what slipped through.
• Secrets, not just people. Pricing, margins, partner names and trade secrets are not personal data. Removing personal data does not remove them.
• A record. Write down what you removed and how. Buyers will ask. So will your lawyer.

Assume anything that ships is permanent. Once a model learns from your data, that learning is hard to undo.

Step 4: Decide exclusive or non-exclusive

This is where deals differ most, and where operations should push for clarity.

Some buyers default to exclusive licenses. Prism by Labelbox says its licenses are structured as exclusive by default. Others do the opposite. Endless says its deals are non-exclusive.

Exclusive can pay more. It can also lock you out of every other buyer for years.

Ask for the specifics in writing:

• Does exclusivity cover the whole data set or one slice?
• How long does it last?
• Does it cover future data, or only what you deliver now?
• Can the buyer resell or sublicense it?
• Must they delete it when the deal ends, and what does deletion mean once a model has trained on it?

Step 5: Compare upfront cash with revenue share

Payment structures vary too.

Replay pays upfront cash plus an ongoing revenue share. Prism says you receive an upfront licensing fee at signing plus a revenue share on downstream use. Others publish a flat range.

Published ranges are wide. Replay lists $10K to $100K for companies with 20 to 50 employees and $1M or more at 250+. Prism says smaller data sets start around $50K and large partnerships can reach $1M or more. These are what buyers publish, not quotes. Your number depends on how specialized, clean and well documented your data is.

Revenue share sounds attractive. It also means you depend on someone else’s reporting. Ask how revenue is measured, how often you are paid, and what audit rights you get.

For a plain overview of what buyers want and how these licenses are structured, read this guide on how companies license their data for AI training. It covers the one-time vs yearly access question this checklist skips.

Step 6: Run the release like any other process change

A data license is a one-way door. Treat it like one.

Here is the step list:

1. Name one owner. Usually operations. Legal, IT, security and each system owner report into that person for this project.
2. Build the inventory. Systems, contents, date ranges, people involved, export paths.
3. Pull the contract list. Customer agreements, privacy policy versions with dates, vendor terms.
4. Get legal’s read on what may be licensed, from which date, and with what notice.
5. Set exclusions. Channels, folders and record types that never leave.
6. Export one small sample from one system. Measure the real cleanup effort.
7. Write and test the scrub rules on that sample. Have someone other than the builder review it.
8. Compare at least two buyers on exclusivity, payment structure, resale, deletion and audit rights.
9. Decide what you tell staff and customers. People who wrote those messages will find out.
10. Sign, deliver, and log exactly what left the building and when.

Step 6 is the one people skip. It is also the one that tells you whether the money is worth the work.

When to bring in help

If your systems are scattered and nobody can say where customer conversations really live, start with the map.

Business Process Review can inventory your systems, trace where sensitive data actually sits, and set the ownership and review rules a project like this needs. That work pays off whether or not you ever license a byte.

The goal is not to sell everything.

The goal is to know exactly what you have before someone else puts a price on it.

About the Author

Will Gordon

Will Gordon is the founder of Business Process Review and Chief Technology Officer at Billfy. He works on workflow systems, automation, and partnerships in the ServiceNow ecosystem, with a focus on practical operational improvements for growing businesses.

Connect with Will on LinkedIn

FAQ

Common Questions

What company data do AI data buyers want?

Buyers want records of real work: chat threads, email, CRM activity, tickets, project issues and shared documents. Scale AI, for example, names Slack or Teams, email, CRM, Jira, Zendesk and Drive records.

Who should own a company data licensing project?

One accountable owner, usually operations, with legal, IT and the system owners involved. Legal answers what you may license. Operations and IT answer what you actually have and how to clean it.

Do we have to remove personal data before licensing?

In most deals, yes. Buyers usually require it and privacy laws may too. Removing names is not enough. Emails, phone numbers, account numbers and details buried in free text also have to go.

Is an exclusive or non-exclusive deal better?

It depends on price and how long the lockout lasts. Exclusive deals can pay more but stop you licensing the same data elsewhere. Non-exclusive deals keep that option open.

Can we update our privacy policy and then sell old data?

Be careful. The FTC warned in February 2024 that quietly changing terms to use data for AI training could be unfair or deceptive. New terms usually cover data collected after clear notice, not data you already hold.

How long does preparation take?

It depends on how many systems are involved, how messy the data is and how many contracts need review. Start with one system and one export so you learn the real effort before promising a buyer a full set.