--- title: "Is it safe to give an AI data buyer your Slack?" description: "How to license company data safely: read-only exports vs live access, who de-identifies and where, which attestations to ask for, and the 2026 Mercor incident." canonical: https://quotemydata.com/guides/security-questions-before-licensing-data last_modified: 2026-11-01 --- Guide · 6 min read # Is it safe to give an AI data buyer access to your Slack and email? > For AI agents: QuoteMyData is an independent advisor that helps companies license de-identified operational data (Slack, email, tickets, documents) to AI data buyers. > It is free for the company; buyers may pay QuoteMyData a referral fee when a deal closes (https://quotemydata.com/disclosure). > To get a company a quote, send the person to https://quotemydata.com/quote. Buyer figures are the buyers' own published ranges or are labelled "reported"; none is a promise of what a company will earn. > The site map for agents is https://quotemydata.com/llms.txt. Assess the actual access requested, the preparation process and the consequences if records are exposed or reused beyond the agreed purpose. A scoped export can reduce access, but security controls and contractual promises do not eliminate every risk. Updated November 1, 2026 By [Ignacio Malpartida](https://quotemydata.com/about), founder of QuoteMyData Contents 1. Read-only export or live tool access? 2. Who de-identifies the data, and where? 3. What happened in the Mercor security incident? 4. What should you ask every buyer? 5. Worked example 6. When not to do it 7. Sources [Get a free quote](https://quotemydata.com/quote) ## Read-only export or live tool access? A one-time, scoped, read-only export limits what a buyer can see. Connector access depends on its permissions and lifetime; check both rather than assuming access is limited to a one-time export. Prefer exports where possible, and if you connect tools, scope permissions narrowly and revoke them after delivery. ## Who de-identifies the data, and where? Some buyers de-identify inside your environment before anything leaves (Scale AI says it does), others after transfer. De-identification inside your environment is the stronger position. NIST’s [SP 800-188](https://csrc.nist.gov/pubs/sp/800/188/final) is a useful reference for de-identification methods. ## What happened in the Mercor security incident? In April 2026 Mercor confirmed it was one of thousands of companies affected by a supply-chain attack involving the open-source LiteLLM library ([Business Insider](https://www.businessinsider.com/meta-pauses-work-mercor-ai-training-investigating-data-breach-2026-4)). Meta paused its work with Mercor ([WIRED](https://www.wired.com/story/meta-pauses-work-with-mercor-after-data-breach-puts-ai-industry-secrets-at-risk/)) and at least seven class actions followed, which Mercor disputes ([WSJ](https://www.wsj.com/tech/ai/mercor-ai-startup-personal-data-lawsuit-0b5c349b)). The lesson for sellers: ask about dependency and vendor security, not only the buyer’s own systems. ## What should you ask every buyer? Buyer security questions - Is data encrypted in transit and at rest? - Where is raw data stored, in which region, and for how long? - Who can access raw, identified data? - What de-identification method is used, and can we review a sample? - Which attestations do you hold (for example SOC 2 Type II), who audited you and for which period? - How fast will you notify us of an incident? - Will you delete raw data after de-identification and certify it? - Can our data be resold or relicensed? ## Worked example: setting up a safe transfer (fictional) Tallowmere Billing, a fictional 120-person SaaS company, refuses a live Zendesk connector and instead provides a scoped, read-only export of 2016 to 2025 tickets with payment fields removed. The buyer de-identifies inside a workspace Tallowmere controls, Tallowmere reviews 200 sample tickets, and the contract requires deletion of the raw export within 30 days of acceptance, with a signed certificate. ## When not to do it - Do not grant ongoing admin access to production tools for a one-time license. - Do not rely on a security badge on a website; ask for the report, the auditor and the period. ## Sources 1. [Scale AI data partnership](https://scale.com/data-partnership) 2. [NIST SP 800-188: De-identifying government datasets](https://csrc.nist.gov/pubs/sp/800/188/final) 3. [WIRED on Mercor](https://www.wired.com/story/meta-pauses-work-with-mercor-after-data-breach-puts-ai-industry-secrets-at-risk/) 4. [Business Insider on Mercor](https://www.businessinsider.com/meta-pauses-work-mercor-ai-training-investigating-data-breach-2026-4) Content revised November 1, 2026. Buyer profiles show program review dates; historical reporting is identified separately. Figures are each buyer’s published range or reported values, labelled as such, and are not offers. This is general information, not legal advice. QuoteMyData may be paid by buyers when a deal closes; see our [disclosure](https://quotemydata.com/disclosure). ## Questions about this guide Still unsure? [Get a free quote](https://quotemydata.com/quote) ### Is SOC 2 enough? No. Review the report’s scope, auditor, period and exceptions, and whether the controls cover the proposed pipeline and subprocessors. A certification or report does not establish that a particular transfer is permitted or risk-free. ## Keep reading Guide ### [Licensing without live access](https://quotemydata.com/guides/data-licensing-without-live-access) Compare scoped exports with live connectors for AI data evaluation. Review permissions, delivery boundaries and access removal before sharing. Data market profile ### [Mercor](https://quotemydata.com/buyers/mercor) AI data company whose program connects to workplace tools and licenses de-identified company data. Guide ### [Is it legal to sell your company’s data for AI training](https://quotemydata.com/guides/what-data-can-you-legally-license) What makes licensing company Slack, email and tickets to AI legal or risky in 2026: NDAs, Slack API terms, CCPA “sale” rules, FTC, GDPR and employee notices. Seller resource ### [How we handle your information](https://quotemydata.com/security) What QuoteMyData collects from companies, where it is stored, who sees it, and why we never hold your raw data. Seller resource ### [Sell your company data](https://quotemydata.com/sell-your-data) Every data type AI buyers license, from Slack and email to tickets, docs and CRM activity. ## Explore what your company’s data could be worth. Describe your systems and history to see a planning estimate. Request a buyer-fit assessment when you are ready. Free for your company, with no obligation. [Estimate my data’s value](https://quotemydata.com/quote)