Article

What happens to your staff’s personal details?

By TrustPast

Updated October 23, 2026

A company with thirty people has thirty people’s names in its files. They sign off emails, post in the dispatch channel and turn up in every job note. Some of them also have a pay stub, a review and a doctor’s note in the HR folder. This page settles what happens to those staff details in a records licence with micro1. It also covers what a buyer actually wants from staff records, and what to agree before anything leaves.

Two kinds of sentence sit on this page. What micro1 publishes, we quote. Everything else is our advice, and we say so each time. We are not lawyers, and nothing here is legal advice.

Where your staff show up in the records

Start with a walk through the files, because staff are in more of them than owners expect.

Here is our own description of where an employee’s details usually sit in a trade or service company:

Slack or Teams. Every message carries a display name. People mention each other by first name. The dispatcher tags the tech. The tech replies from the truck.
Email. The sender line, the greeting, the signature with a mobile number, the forwarded chain with four colleagues on it.
Job notes and repair orders. “[First name] checked the condenser.” The tech’s number on the ticket. The service writer’s initials on the estimate.
The CRM. Which salesperson owned the account, who called, who followed up.
The HR folder. Applications, offer letters, reviews, warnings, leave requests and the new-hire paperwork.
Payroll. Pay rates, hours, deductions, bank details for direct deposit and Social Security numbers.
Odd corners. A home address on a mileage claim. A sick note forwarded to the office manager. An emergency contact in a phone list on the shared drive.

The first four are work records with people in them. The last three are records about people. That split decides almost everything below.

Apply & License Your Data

What micro1 publishes about personal details

micro1 doesn’t publish a separate rule for employees. Its published words cover personally identifiable information in general. They don’t mention staff by name, so staff names belong on the list you agree.

On how company data is protected, micro1 says: “Personally identifiable information (PII) is removed when relevant.” In the same answer it says “access is restricted to a limited number of authorized team members,” and that “customer data is processed through isolated pipelines that prevent it from being commingled with other engagements.”

On what happens after data is shared, it says: “Depending on the nature of the data, personally identifiable information may be removed and certain datasets may undergo synthetic rewrites that preserve workflow structure while reducing direct ties to original records.” Its October announcement says micro1 “uses de-identified company data.”

Then the part that matters most for staff. micro1 says that “Before any participation, together we define:” four things. The “Approved data scope and clear boundaries.” The “Security and confidentiality standards.” The “Anonymization and redaction requirements.” The “Internal approval processes and permissions.” Its payout page and its partnerships page both say every partnership comes “with clear controls over what is shared, how it is handled, and what is never included.”

Three more lines finish the picture. Data “is retained only for a limited period based on agreed retention policies.” Companies “are given the opportunity to review representative samples before prepared data is used.” And “Upon request or at the end of an engagement, data is deleted according to the agreed retention and deletion terms.”

Notice the words “when relevant” and “may.” micro1 doesn’t promise a fixed treatment for every name. It promises a list agreed with you. So the question for an owner isn’t whether staff details are protected in the abstract. It’s what you write on that list. Our page on how de-identification works shows removal and rewrites on a few sample records. This page stays with the people.

What a buyer wants from staff records

Here is the plain version. A buyer doesn’t want your people. It wants what your people did.

micro1 says it is looking for “data that reflects how work is actually performed within an organization.” One of its cards is headed “Decision-making patterns,” with the line “How teams evaluate information and make operational decisions.” Its referral page lists “operational communications” among the records a good fit holds.

In a company with staff, the operational communication is staff talking. That is the useful part. Three examples, as our own description:

How a crew lead explained a fix. A second-year installer posts a photo of a leaking joint. The crew lead replies with four lines. Cut it back past the stain, dry-fit first, check the slope before you glue. That reply is ten years of experience written down in under a minute.

How a dispatcher sorted the day. At 7:15 two techs call in sick. The dispatcher moves a maintenance visit to Thursday, sends the senior tech to the no-heat call first and gives the apprentice the two easy jobs near the shop. Every move has a reason, and the reasons are in the channel.

How a service writer talked a customer through a repair. The customer asks why the brake job costs more than the quote. The service writer explains what the tech found, what can wait a month and what can’t. The customer approves half. The repair order shows the result. The email shows the reasoning.

Now take the names out of all three. The crew lead becomes “crew lead.” The dispatcher becomes “dispatcher.” The fix, the order of the day and the conversation are untouched. That is why removing staff names costs the record so little. The value sat in the role and the reasoning, never in who held the role.

The same holds for customers, and the core of it never changes. Records are de-identified before use. Customer names and payments are never what is wanted. What is wanted is how the work was done: how an estimate became a job, how a change order was settled, how a repair was diagnosed. Our cornerstone page on what data buyers want from a trade business goes through that file by file.

What is never wanted from staff records

This list is our own advice. It is not micro1’s rule, and micro1 doesn’t publish a list of excluded record types. It publishes the method: the scope is defined with each company. Here is what we suggest you put on your side of that line, unless micro1 agrees otherwise in writing and your counsel is satisfied:

Payroll. Pay rates, hours, deductions, bonuses, garnishments and direct-deposit bank details.
HR files. Applications, offer letters, warnings, terminations, grievances and investigations.
Performance reviews. Written ratings of a named person are about that person, not about the work.
Health information. Sick notes, medical leave, injury reports, workers’ compensation files and accommodation requests.
Social Security numbers and the other identity numbers on new-hire forms and tax forms.
Home addresses, personal phones and emergency contacts.
Personal messages. Direct messages, the social channel, the birthday thread, the leave request.

Not one of these records explains the work. A pay rate doesn’t explain how a dispatcher sorted the day. A review of a service writer isn’t the conversation she had with a customer. That is why the list is easy to keep. You lose nothing a buyer would value by leaving it out.

Our page on what is never included in a records licence covers the wider list for the whole company: privileged records, card numbers, minors’ data and the rest. This page only adds the staff side.

Former staff are still staff

In a company with fifteen years of records, former staff often outnumber current ones. The foreman who retired in 2019. The estimator who left for a competitor. The apprentice who stayed one summer.

Their names are in the same channels and the same threads. Their mailboxes may still sit in the archive, or in the old mail provider the company left behind. Their HR files are usually still in the cabinet or on the drive.

micro1’s published words on personal information don’t separate current staff from former staff. Nor should your list. Our advice: treat a former employee exactly as you treat a current one. Their name comes out under the same redaction requirements. Their HR and payroll files stay out under the same scope. Their personal mailbox folders stay out by name.

There is one practical difference. You can talk to the people who work for you today. You often can’t reach the people who left. That is a question for counsel, not for us: what were they told when they worked here, and what does the law where you operate expect now? Bring the answer to the discovery call.

Is there a mailbox in your archive that belongs to someone who left ten years ago?

What to agree before anything leaves

micro1 publishes the order of things. Its third step: if there is a potential fit, micro1 will “request additional information and schedule a discovery call to discuss your data and privacy requirements.” Its fourth: “If approved, we’ll finalize the agreement and data requirements and begin the partnership.” The staff questions belong on that discovery call, before the agreement is final.

Here is our advice on what to settle, mapped to micro1’s four items:

Approved data scope and clear boundaries. Name the excluded folders: HR, payroll, benefits, workers’ compensation. Name the excluded channels: direct messages, social channels, any channel for managers only. Name the excluded mailboxes or folders: personal folders, the payroll inbox.

Anonymization and redaction requirements. Ask that staff names, handles, signatures, phone numbers and email addresses come out of the work records in scope, the same as customer details. Ask how nicknames and first names in free text are handled. “Ask the tall one on crew two” identifies someone too.

Security and confidentiality standards. Ask who at micro1 can see the records before preparation. micro1 says access is restricted to “a limited number of authorized team members.” Ask what that means for your engagement.

Internal approval processes and permissions. Decide who at your company signs off on scope. As our own advice, include whoever runs HR. They know where the sensitive files hide.

Then use the sample review. micro1 says companies can “review representative samples before prepared data is used.” Read them for staff details, not only customer details. Look for a signature block, a tech’s number on a ticket, a sick day mentioned in passing. If one slipped through, say so before anything is used.

Last, the retention and deletion terms. micro1 says data is retained “only for agreed periods” and deleted “according to the agreed retention and deletion terms.” Write down the period. It is one of the things your staff may ask you about.

Talk to counsel, then tell your staff

This section is our advice, and the first part of it is to ask someone else. Employment law and privacy law differ by state and by country. What you may share about your staff depends on where you operate. What you must tell them first depends on it too, and on what you told them when they joined. Your counsel answers that. We don’t.

Bring counsel three things. Your employee handbook and any policy on the use of company email and chat. The scope list above. micro1’s published words on removal, rewrites, retention and deletion.

Then tell your staff, in plain words, before anything leaves. Our advice is to do it even where counsel says you needn’t. It goes better when staff hear it from the owner first.

What to say is short. The company is licensing records of how the work was done. Names come out under the terms we agreed. HR files, payroll, reviews and health information stay out. Here is who to ask. A crew lead who knows their name is on that list may well be proud that their way of fixing a leak is worth something.

What this means for a company with 30 or more staff

Here is one company, as our own hypothetical and not a list from micro1. A home services company with 45 people: HVAC and plumbing, a dispatch desk, a service counter, twelve years of records.

The records that hold staff reasoning. The dispatch channel in Slack, with every reschedule and the reason for it. The techs’ channel, where the senior people answer the junior ones. The office email: estimates, change orders, warranty threads, customer explanations. The repair orders and service histories in the field service software, with the tech’s notes. The CRM, with the follow-up history on every maintenance plan.

What comes out of those records. Every staff name, handle, initial and signature. Mobile numbers in footers. Any personal aside: the sick day, the school pickup, the leave request typed into the wrong channel.

What stays out altogether. The HR and payroll folders. The benefits and workers’ compensation files. The reviews. The direct messages. The managers’ channel. The mailbox of the office manager who handled payroll, or at least its payroll folder.

What stays in. The dispatcher’s morning board and the reasons for each change. The senior tech’s answer to a fault code. The service writer’s email explaining why a repair costs what it does. The record still shows how the company worked. It just no longer says who.

Our page for companies with 30 or more staff covers the rest of what a company that size keeps. The Slack and Teams page and the email archives page go deeper on those two records.

Worth two minutes to see your range? Our estimate asks five questions.

What is never included

micro1’s words come first, because they are the ones that count. Every partnership comes “with clear controls over what is shared, how it is handled, and what is never included.” The scope, the boundaries and the anonymization and redaction requirements are defined together, before any participation.

Our advice for the staff side is the list above. Payroll, HR files, performance reviews, health information, Social Security numbers, home addresses and personal messages. Staff names come out of the work records that are in scope. None of that costs the record anything a buyer wants. Put it on your side of the line before the discovery call, and let micro1 tell you where its line sits.

Where we fit

We, TrustPast, explain how this works and give you a range with our estimate. The range is ours, not an offer. You apply to micro1 yourself. micro1 pays us a referral fee. You pay us nothing, and we never see your files or your staff’s. We give no legal advice. Our How it’s safe page has the short version of the protections, and our page on whether licensing company records is legal lists what to check with counsel.

Before you apply, as our own advice:

Walk the drive with whoever runs HR. Note every folder about people rather than work.
List the channels. Direct messages, social channels, managers’ channels.
Count the former staff. Note whose mailboxes are still in the archive.
Call counsel about employment and privacy law where you operate.
Draft the note to staff. Three sentences: what goes, what stays, who to ask.

Then bring the list to micro1. Its answer decides the scope.

TrustPast

Questions and answers

Do our employees’ names go to micro1?

micro1 says “Personally identifiable information (PII) is removed when relevant,” and that certain datasets “may undergo synthetic rewrites that preserve workflow structure while reducing direct ties to original records.” micro1 says anonymization and redaction requirements are defined with you before any participation. Our advice: put staff names on that list by name.

Does micro1 want our payroll, HR files or performance reviews?

micro1 says it is looking for “data that reflects how work is actually performed within an organization.” It does not list payroll, HR files or reviews among the records it wants. Keeping payroll, HR files, reviews, health notes and Social Security numbers out of scope is our own advice, not micro1’s rule.

What about people who have left the company?

micro1’s published words on personal information do not separate current staff from former staff. Our advice: treat a former employee’s name, mailbox and messages exactly as you treat a current one’s, and ask counsel about both.

Can we check that staff names came out?

micro1 says “companies are given the opportunity to review representative samples before prepared data is used.” Our advice: read those samples looking for staff names, nicknames and signatures, not only customer names.

Do we have to tell our employees?

We don’t give legal advice. What your staff must be told depends on employment and privacy law where you operate and on what your handbook said. Our advice: ask counsel before you apply, and tell your staff in plain words before anything leaves.