Seller field guide · 3 min read
How do you exclude client data from a licensing scope?
Start with ownership and confidentiality boundaries, then translate those boundaries into system-level exclusion rules. Removing a client name does not establish permission to reuse the underlying work. Where restricted material cannot be separated reliably, leave the affected record or workflow outside the package.
Define what client data means in your business
A client boundary is rarely a single database field. It may include shared channels, deliverables, attachments, project discussions, support tickets and forwarded email. Ask the contract owner to identify categories of client-owned or confidential information before choosing filters.
Keep a small exclusion register with the client or contract cohort, affected systems, record classes and reason for exclusion. Limit access to the register itself because it may contain sensitive relationships. NIST’s privacy-risk framework can inform the process, but contractual permission requires its own assessment.
Source notes: NIST: Privacy Framework
Follow the references, not only the top-level record
Exports can carry references to content beyond the item you first selected. Slack documents file links in its exports; Zendesk’s export formats vary in the ticket content they preserve. Inspect the actual candidate files so that a permitted-looking conversation does not bring an unreviewed attachment along with it.
Our suggested review matrix follows content across those boundaries. A channel name or organization ID is useful for routing review, but it should not be assumed to identify every occurrence of restricted material.
| Surface | Potential boundary failure | Review action |
|---|---|---|
| Internal chat | Forwarded client text or shared-channel excerpts | Inspect content and linked files, not just channel membership |
| Project board | Internal task points to a client-owned deliverable | Separate process metadata from restricted attachments |
| Support ticket | Internal note quotes confidential customer evidence | Review the whole thread and associated records |
| Knowledge base | A reusable playbook embeds a client example | Remove or exclude the example if rights are unresolved |
Source notes: Slack: reading workspace exports · Zendesk: account export formats and limitations
Check whether the remaining story is still truthful
After exclusions, ask whether a reviewer can still understand the decision and its outcome. Removing sensitive context can change the meaning of a case. If a resolution appears arbitrary without an excluded client constraint, describe the limitation or remove that case rather than inventing an explanation.
Test the rules on different record types and known difficult examples. Keep a record of the rules applied and the person who reviewed their effectiveness. A name-removal pass, an NDA or a buyer’s willingness to accept the files does not replace the seller’s scope review.
Source notes: NIST: AI Risk Management Framework
Illustrative scenario · fictional company
A fictional agency separates coordination from deliverables
Willow Studio wants to evaluate internal project-management history. It excludes client-shared channels and deliverable folders, then discovers that several internal tasks contain pasted client briefs. Those tasks receive additional review rather than being cleared solely because they sit in an internal board. The final candidate includes permitted scheduling and approval-process records with clear limitations. Client-owned creative work and confidential briefs remain outside the scope.
When to pause or narrow the scope
Client work and customer files are excluded from this starting scope. Assess company-owned internal records separately from personnel, health, privileged or NDA-restricted material.
- Client restrictions cover the operational records you intended to include.
- The team cannot identify embedded or forwarded restricted content reliably.
- Removing the restricted material would make the remaining examples misleading.
Your preparation checklist
- Define restricted categories with the contract and data owners.
- Map client boundaries across channels, boards, tickets and files.
- Inspect linked and embedded material in representative records.
- Validate the remaining meaning after exclusions.
- Keep the approved scope and exclusion rules with the delivery record.
Start with a description of the records. The quote form does not ask you to upload a dataset.
Discuss your dataSources and further reading
- NIST: Privacy Framework · Checked October 26, 2026
- Slack: reading workspace exports · Checked October 26, 2026
- Zendesk: account export formats and limitations · Checked October 26, 2026
- NIST: AI Risk Management Framework · Checked October 26, 2026
This is general information, not legal advice or confirmation that a buyer will accept your records. Published buyer ranges describe their programs, not an offer for your dataset. Buyers may pay QuoteMyData when a deal closes; see how we are paid.
