Article

Is licensing your company records legal?

By TrustPast

Updated October 20, 2026

An owner hears that a buyer will pay to license fifteen years of company records. The first question after the money is a fair one. Is this even allowed? The honest answer is that it depends on whose rights sit inside the records, and only your counsel can say yes for your company. This page settles whose rights to check first, what the regulators publish on their own pages, what micro1 publishes about scope and redaction, and when to pick up the phone to your lawyer.

One line before anything else. We, TrustPast, are not lawyers, and nothing here is legal advice. We can tell you what to check. Your counsel decides.

The short answer

Licensing records is a contract, and contracts sit on top of every promise you have already made. So the question isn’t really “is licensing legal.” It is “what did we promise, and to whom?”

There are four groups to check, in this order:

Customers. Your contracts with them, your privacy notice, and any state privacy law that applies to you.
Vendors and clients. NDAs, confidentiality clauses, and work a client owns under its contract with you.
Staff. The personal information about your own people that sits in email, HR folders and the CRM.
Regulated data. Health information, payment card data and financial account data, each with its own rules.

micro1 builds the same checks into its process. On its data partnerships page it says: “Before any participation, together we define”, then lists four things. The “Approved data scope and clear boundaries.” The “Security and confidentiality standards.” The “Anonymization and redaction requirements.” And the “Internal approval processes and permissions.” Nothing moves before those four are set.

And one point that changes how the whole question feels. Customer names and payments are never what is wanted. micro1 says it “uses de-identified company data.” What it says it wants is “data that reflects how work is actually performed within an organization.” In our words: how a quote became an order, how a disputed invoice was settled, how a renewal was handled.

Apply & License Your Data

What micro1 publishes about scope, redaction and approvals

Start with the buyer’s own words, because they set the frame for every check below.

On sensitive records, micro1’s page says: “We understand business data can contain sensitive information. Every partnership is designed around your organization’s requirements, with clear controls over what is shared, how it is handled, and what is never included.”

On how records are protected, it says: “Personally identifiable information (PII) is removed when relevant, access is restricted to a limited number of authorized team members, and customer data is processed through isolated pipelines that prevent it from being commingled with other engagements.”

On what happens after records are shared, it says they are “processed according to the agreed use case and handling requirements.” And: “Depending on the nature of the data, personally identifiable information may be removed and certain datasets may undergo synthetic rewrites that preserve workflow structure while reducing direct ties to original records.” It adds that “companies are given the opportunity to review representative samples before prepared data is used.”

On ownership, micro1’s answer is one sentence: “Companies retain ownership of their underlying data.” Its page describes what it offers as “data licensing opportunities.” Its October announcement speaks of “acquiring and licensing enterprise operational data.” micro1 does not publish what each of those words covers in a given agreement. That is a question for the agreement, and for your counsel reading it. Our page on whether you keep ownership of your records goes through the clauses worth looking for.

Notice what micro1 does not say. It does not say the licence is legal for every company. It says the scope, the boundaries, the redaction rules and your internal approvals are defined together, first. That is where the checks below get written down.

Customers: contracts, privacy notices and state laws

Your customers are in the records whether you like it or not. Their names are on the estimates. Their emails are in the inbox. Their account history is in the CRM. So the first check is what you told them.

Customer contracts. Some commercial contracts have a confidentiality clause that covers the customer’s information, or a clause on how you may use records of the work. Read the standard terms you sign with customers, and the larger contracts one by one. As our own advice, start with the ten biggest accounts. Those are the ones most likely to have negotiated their own terms.

Your privacy notice. If your website or your contracts carry a privacy notice, it says what you collect and who you share it with. Read it as if you were the customer.

The Federal Trade Commission’s staff wrote about this in February 2024. They said it “may be unfair or deceptive for a company to adopt more permissive data practices” and only tell people through a “surreptitious, retroactive amendment to its terms of service or privacy policy.” They wrote that a business collecting data under one set of privacy commitments “cannot then unilaterally renege on those commitments after collecting users’ data.” Whether your notice and your plan fit together is a question for your counsel. The FTC page is why it is worth asking.

State privacy laws. Some states have a general consumer privacy law. Two Attorneys General put the basics on their own pages.

California’s Attorney General says the CCPA “applies to for-profit businesses that do business in California and meet any of the following.” The three tests are a gross annual revenue of over $25 million, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling California residents’ personal information. The same page lists the rights the law gives consumers, including the right to opt out of the sale or sharing of their personal information.

Texas’s Attorney General says the Texas Data Privacy and Security Act took effect on July 1, 2024. It says the Act’s safeguards apply to companies that do business in Texas or serve its residents and that process personal data. It also says: “Small businesses (as defined by the federal Small Business Administration) are generally exempt from the Act, except that if a small business sells the sensitive data of a consumer, it must first obtain the consumer’s consent.” And it says a covered company’s privacy notice must list “the categories of personal data that the controller shares with third parties (if any).”

We won’t tell you whether either law covers your company. A distributor with 60 people may cross one line and not another. Your counsel decides which state laws apply, and what they require before records are licensed. The de-identification step micro1 describes is part of that conversation, not a substitute for it.

Vendors and clients: NDAs, client-owned work and confidentiality

The second group is the companies you work with, not the people you serve.

NDAs. A commercial contractor bidding a hospital wing, or a distributor carrying a manufacturer’s line, has probably signed an NDA or two. An NDA usually says what counts as confidential and what you may do with it. Pricing sheets, drawings, specifications and terms may all be inside one. Pull every NDA you can find and list what each one covers.

Client-owned work. Some contracts say the work product belongs to the client. Drawings, reports, designs and data you produced for a client may be theirs, not yours. Only the contract says which is which. As our own advice, anything a client owns stays out of the scope unless the client agrees otherwise in writing, and your counsel says that is enough.

Confidentiality clauses in ordinary contracts. Master service agreements, supply agreements and leases often carry a short confidentiality clause. They are easy to miss because nobody negotiated them. Look for the words confidential, proprietary and non-disclosure.

micro1’s “Approved data scope and clear boundaries” is where this check lands. If a client’s drawings are out, the scope says so. If one supplier’s pricing is out, the boundary says so. As our own advice, decide what you would put in before that conversation. micro1 says the scope and boundaries are defined together before any participation.

Staff: employee personal data

Your own people are in the records too. In the email archive. In the CRM notes, as the rep who owned the account. In the job files, as the technician who signed the ticket. In the HR folder, which is a different thing altogether.

The FTC’s guide for business opens with the point that most companies keep sensitive personal information in their files, the kind “that identifies customers or employees.” Its first principle is plain: “Know what personal information you have in your files and on your computers.” The second: “Keep only what you need for your business.”

California’s Attorney General is specific about staff. It says the CCPA’s “exemptions for employment-related personal information and personal information reflecting business-to-business transactions” expired on December 31, 2022. Its list of sensitive personal information includes social security numbers, financial account numbers together with the code or password that opens the account, and “contents of mail, email, and text messages.” That last item matters for any company thinking about its email archive.

So check three things, as our own advice. Which systems hold staff personal information. Which of those systems are in the scope. And what the redaction requirements say about staff names and details. The HR folder, payroll and benefits files were never how the work was done. They don’t belong in the scope.

The email archive and the CRM are different. They hold the work: the thread where a change order was argued and settled, the notes where a rep explained why a quote went out at that price. They also hold names, signatures and personal asides. That is what the “Anonymization and redaction requirements” micro1 lists are there to handle, and what the sample review is there to check.

Regulated data: health, payment card and financial account

The fourth group has its own rulebooks. Each regulator publishes who its rules reach. We only repeat what their pages say.

Health information. The HIPAA definitions sit in the federal regulations at 45 CFR 160.103. A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in certain transactions. A business associate is, in part, a person who on behalf of a covered entity “creates, receives, maintains, or transmits protected health information.” The same section defines health information as information created or received by a list of parties that includes an “employer, life insurer.” If you serve health plans or providers, or your records hold anything about anyone’s health, that is a call to counsel before the scope is set.

Payment card data. The PCI Security Standards Council says PCI DSS “provides a baseline of technical and operational requirements designed to protect payment account data.” It says the intended audience is entities that “store, process, or transmit cardholder data” and adds: “This includes all entities involved in payment card processing – including merchants, processors, acquirers, issuers, and service providers.” Card numbers teach nothing about how a job was run. As our own advice, they stay out.

Financial account data. The FTC’s Safeguards Rule page defines customer information as “any record containing nonpublic personal information about a customer of a financial institution.” It lists the kinds of business it covers, among them mortgage brokers, finance companies, collection agencies and tax preparation firms. If your company does anything that looks like lending, collecting or handling customers’ finances, ask counsel whether the rule reaches you.

None of these pages says anything about licensing records. They say who the rules cover. Whether your records fall inside is your counsel’s call.

When to call counsel

Always, before you sign. The agreement is a contract, and it may touch contracts you already have. Your counsel decides which.

Earlier than that, as our own advice, call when any of these is true:

Your records hold health information, card numbers or bank account details anywhere, including in scanned attachments.
You have signed NDAs with clients or suppliers, or contracts that give a client ownership of the work.
Your privacy notice says you do not share customer information, or says nothing either way.
You have customers in a state with a consumer privacy law, and you are not sure whether it covers you.
Your HR or payroll files sit on the same shared drive as the job files.
A bank, an insurer or a large client has terms on how you handle their information.

Bring counsel a one-page inventory: each system, its years, what it holds, and what you would never let out. That turns an open-ended review into a short one. micro1 says the “Internal approval processes and permissions” are defined together before any participation. If your counsel’s sign-off is one of your approvals, put it in.

What this means for a company with 30 or more staff

micro1’s published line is 30 or more employees. Here are four operating companies of that size, as our own hypotheticals and not a list from micro1. Each one shows where the checks land.

A distributor with 60 people. The work is in the CRM and the email: how a rep priced a large order, how a short shipment was settled with a customer, how a backorder was worked around. Check the supplier agreements for confidentiality on pricing. Check the privacy notice on the web store. Leave the card data and the customer account numbers out.

A property manager with 45 people. The work is in the maintenance tickets and the email: how a leak was traced, how a vendor was chosen, how a lease renewal was negotiated. Check the management agreements with owners for who owns the records. Tenant applications, with their social security numbers and bank details, stay out.

A commercial contractor with 80 people. The work is in the estimates, the change orders and the project email: how a bid moved after the walk-through, how a change order was priced and argued. Check the NDAs on private projects, and the contracts that give an owner the drawings. Client-owned work stays out unless the client agrees.

An insurance agency with 35 people. The work is in the CRM and the email: how a renewal was handled, how a claim question was answered, how coverage options were explained. This is the one with the most regulated data. Health details and financial account information can sit in the files. Counsel reads the scope before anything else happens.

In each case, the part a buyer wants is the reasoning. The records that only identify people are what the redaction rules you agree are there to remove. Our cornerstone page on what data buyers want from a trade business goes through the same split, file by file. The page for companies with 30 or more staff covers the records a company that size tends to keep.

What is never included

micro1’s own words on this are short. Every partnership is designed with “clear controls over what is shared, how it is handled, and what is never included.” Before any participation, the approved data scope and clear boundaries, and the anonymisation and redaction requirements, are defined together. micro1 settles what is excluded with each company, before anything is shared.

What follows is our own advice, not micro1’s. Keep these out unless micro1 agrees otherwise in writing and your counsel is satisfied: attorney-client privileged records, health information, payment-card and financial-account details, Social Security numbers, minors’ data, biometric data, and classified or export-controlled material. Ask micro1 before you apply if any of your records sit near those lines.

Two more points, also our own advice. Anything a client owns under its contract with you belongs to the client. And the HR folder, payroll and benefits files are not how the work was done. Neither belongs in the scope. Our page on what is never included walks through each category, with where it hides and how to keep it out.

Our How it’s safe page covers access, redaction and sample review in plain words. The longer version, in micro1’s own wording, is on whether it’s safe to license company data.

Where we fit

We, TrustPast, explain how this works and give you a range with our estimate. The range is ours, not an offer. You apply to micro1 yourself, through the button below. micro1 pays us a referral fee. You pay us nothing, and we never see your files. We give no legal advice, and we are not in the room when your counsel reads the agreement.

Before you apply

Four things to settle first, as our own advice:

List the promises. Customer contracts, the privacy notice, NDAs, client contracts. One folder.
Map the people. Which systems hold customer, staff and regulated data, and where.
Draw the boundary. The systems, years and folders that stay out, whatever the price.
Line up counsel. A short read now, a full read of the agreement before you sign.

Then answer the five questions on the estimate. If the range is worth your time, apply. You can stop at any step before you sign. After that, the agreement’s terms apply. What happens on the way there is on what happens after you apply.

TrustPast

Questions and answers

Is it legal for a company to license its records to micro1?

That depends on what the records hold and what the company promised the people in them. We can’t answer it for your company, and we are not lawyers. Check your customer contracts and privacy notice, your vendor and client contracts, your staff records and any regulated data, then have your counsel decide.

Does the company still own the records?

micro1’s answer to “who owns the data?” is one sentence: “Companies retain ownership of their underlying data.” Its page describes the arrangement as “data licensing opportunities.”

What does micro1 agree with a company before any records are shared?

micro1 says that before any participation it defines, together with the company, the “Approved data scope and clear boundaries,” the “Security and confidentiality standards,” the “Anonymization and redaction requirements” and the “Internal approval processes and permissions.”

Are customer names and payments part of what is licensed?

They are never what is wanted. micro1 says it “uses de-identified company data” and that personally identifiable information “is removed when relevant.” What it says it wants is “data that reflects how work is actually performed within an organization.”

Do state privacy laws apply to a company of 30 or 40 people?

Some may and some may not. California’s Attorney General says the CCPA applies to for-profit businesses doing business in California that meet any one of three tests, the first being gross annual revenue of over $25 million. Texas’s Attorney General says small businesses as the SBA defines them are generally exempt from the Texas act, with an exception for selling sensitive data. Your counsel decides which apply to you.

When should we call counsel?

Before you sign anything, and earlier if your records hold health information, card or bank details, client-owned work under an NDA, or customers in a state whose privacy law may cover you. As our own advice, a short read before the discovery call costs less than a long one after.