Article

What is never included in a records licence

By TrustPast

Updated October 22, 2026

Every company with thirty people and fifteen years of files has a few things in those files it would never hand over. A lawyer’s email about a lien. A card number typed into a dispatch note. A subcontractor’s tax form in the vendor folder. This page settles who decides what stays out of a records licence with micro1, and then, as our own advice, walks through where those records hide in a real company and how to keep them out.

Two kinds of text sit on this page, and we keep them apart. What micro1 publishes, we quote. Everything else is our advice, and we say so each time.

Who decides what is left out

micro1 does, with you, before anything moves. Nobody else.

On its payout page and its data partnerships page, micro1 says every partnership is designed around your organization’s requirements, “with clear controls over what is shared, how it is handled, and what is never included.” It also says: “We understand business data can contain sensitive information.”

Then it says when the lines are drawn. “Before any participation, together we define:”

“Approved data scope and clear boundaries”
“Security and confidentiality standards”
“Anonymization and redaction requirements”
“Internal approval processes and permissions”

Read the first word of that list again. Before. The scope is not settled after the records arrive. It is set before any participation, by both sides.

micro1 also publishes where that conversation happens. Its third step: if there is a potential fit, micro1 will “request additional information and schedule a discovery call to discuss your data and privacy requirements.” Its fourth: “If approved, we’ll finalize the agreement and data requirements and begin the partnership.” Its referral page adds that every company goes through micro1’s evaluation process.

What micro1 does not publish is a fixed list of excluded records. It publishes a method: the list is drawn with each company. So the categories below are not micro1’s rules. They are our advice on what to put on your side of the line before you get to the call. Ask micro1 what it will and won’t take. Its answer is the one that counts.

Our pages on whether it’s safe to license company data and whether licensing company records is legal cover access, redaction, deletion and whose rights to check. This page is narrower. It is the walk through the filing cabinet.

Apply & License Your Data

What is wanted instead

Before the list of what stays out, a word on what goes in. It makes the list shorter than owners expect.

micro1 says: “We are looking for data that reflects how work is actually performed within an organization.” And: “The most valuable datasets capture real operational expertise, decision-making processes, and repeatable workflows” (its sentence goes on). It names the kinds of records it means: “SOPs, knowledge bases, internal documentation, CRM data, project histories, and QA processes.”

Put plainly, customer names and payments are never what is wanted. What is wanted is how the work was done. How an estimate became a job. How a change order was settled. How a repair was diagnosed. A card number teaches nothing about any of those. Neither does a Social Security number, a child’s name or a fingerprint.

micro1 also says personally identifiable information “is removed when relevant,” and its October announcement says it “uses de-identified company data.” The records are de-identified before use. That is the floor. Our advice below is about what never needs to reach the floor at all.

Our cornerstone page on what data buyers want from a trade business goes through the wanted side, file by file.

Our list, and why it is ours

Here is the list we suggest every company keeps out, unless micro1 agrees otherwise in writing and your counsel is satisfied:

Attorney-client privileged records
Health information
Payment-card and financial-account details
Social Security numbers
Minors’ data
Biometric data
Classified or export-controlled material
Client-owned work under an NDA
Customer lists

Again, this is TrustPast’s advice, not micro1’s guidance. We picked these because none of them shows how work was done, and several come with rules of their own. Where a rule applies, your counsel reads it, not us. We are not lawyers.

Each category gets the same three parts below. What it looks like in a real company’s files. Where it hides. What we suggest you do about it.

Attorney-client privileged records

What it looks like. The thread with your lawyer about a mechanic’s lien on a commercial job. The memo on a wrongful termination claim. The email where the project manager cc’d counsel on a dispute with a general contractor. The folder called Legal, or Claims, or the name of the case.

Where it hides. Mostly in email, and not always in the Legal folder. A project manager forwards the lawyer’s advice to the superintendent. It now sits in a job folder, under a job number, next to the daily logs. A scanned letter from counsel gets attached to a work order because that’s where the dispute started.

Our advice. Exclude the Legal folder by name. Then flag the channel: list your outside counsel’s email domains and ask that any message to or from them is out of scope. That catches the forwards. Whether a forwarded thread stays privileged is a question for your lawyer, not for us and not for micro1. Ask counsel before the discovery call, and bring the domain list to it.

Health information

What it looks like. A dental billing note in an HVAC company’s email, because the office manager used the work account to chase her own bill. A doctor’s note for three days off. A workers’ compensation claim after a fall from a ladder. A dispatch note that says the customer is on home oxygen and the call goes first.

Where it hides. In the inbox, in HR, and in the field notes. The field notes are the surprise. A technician writes down why a job was urgent, and the reason is somebody’s health. The job itself is useful. The reason is not what anyone wants.

Our advice. Exclude the HR and workers’ compensation folders outright. For email, ask how health details in free text will be handled under the redaction requirements you agree, and look for them in the sample review. If you serve clinics, health plans or care homes, call counsel before scope is set. Our page on whether licensing is legal lists the regulator pages to bring.

Payment-card and financial-account details

What it looks like. A card number in a phone note: “cust gave card over phone, 16 digits, exp, CVV.” A photo of a check attached to an invoice. An ACH form with a routing and account number. A financing application for a new system.

Where it hides. In the dispatch or field service software, in the notes field nobody was supposed to use for cards. In the accounting system’s attachments. In the email of whoever takes payments.

Our advice. Keep the accounting system and the payment processor’s exports out of scope altogether. A job runs the same whether it was paid by card or check. For the notes, search your own system for long strings of digits before discovery, so you know the size of the problem. Then ask micro1 how the redaction requirements treat card and account numbers in free text. Card rules have their own rulebook, and counsel reads it; our page on whether licensing company records is legal covers regulated records.

What it looks like. A W-9 in the vendor folder. The IRS says the form is used “to provide your correct Taxpayer Identification Number,” and the Social Security number is one of the numbers on the IRS list of taxpayer identification numbers. A one-truck subcontractor may fill it in with exactly that. Payroll records. New-hire paperwork. A commercial credit application signed by a personal guarantor.

Where it hides. In the vendor folder on the shared drive, which sits next to the job folders. In email, when the office asked a sub to send a W-9 and the sub replied with a photo of it. In the project folder, when a sub’s onboarding packet was saved with the job.

Our advice. Exclude the vendor, payroll and HR folders by name. Flag the channel: any email with an attachment named like a tax form is out. And tell micro1 on the discovery call that these sit near the job files, so the redaction rules account for them. A sub’s Social Security number has never told anyone how a roof was framed. Our page on what happens to your staff’s personal details covers payroll, HR files and former staff on their own.

Minors’ data

What it looks like. A student’s name on a work order for a school job, because the classroom was the location. A note that the homeowner’s son let the technician in. A summer helper under eighteen in the payroll file. Photos from a school site with children in the background.

Where it hides. In job files for schools, daycares and youth facilities. In the photo folders, where nobody reads the background. In the field notes, where the person who opened the door gets written down.

Our advice. If you work on schools or anything with children on site, raise it on the discovery call by name. Ask whether those job files are in scope at all, and if they are, how names and photos of children are handled. Our own preference is plain: leave the photos from those sites out. The work order can show how the job ran without a picture of the playground.

Biometric data

What it looks like. Fingerprint scans from the time clock. Face scans from a badge system. Driver-facing camera footage from the trucks. Voice recordings from the call system, if they were kept.

Where it hides. In the systems a vendor installed and nobody thinks of as records. The time clock vendor holds the templates. The fleet camera vendor holds the video. Sometimes an export ends up on the shared drive.

Our advice. Leave these systems out of scope. None of them shows how a job was estimated, run or fixed. If call recordings are part of what you’d license, ask micro1 on the discovery call how voices and names are handled before anyone agrees to include them. Counsel decides whether any biometric rule applies to you.

Classified or export-controlled material

What it looks like. Drawings for a mechanical job on a military base. Specifications from a defense supplier, stamped with an export-control legend. A facility access form for a secured site. A part number list for a controlled component.

Where it hides. In the project folder of one or two jobs, among hundreds of ordinary ones. In the email of the estimator who bid them. In the plan room.

Our advice. If you have ever worked on a government, defense or aerospace site, list those jobs and exclude them by job number. Check the stamps on drawings. If you are unsure whether a job touches controlled material, assume it does and leave it out. This is the category where counsel speaks first.

Client-owned work under NDA

What it looks like. The drawings a general contractor sent under a non-disclosure agreement. A manufacturer’s installation specs marked confidential. A property owner’s building plans. A report you wrote that the client’s contract says belongs to the client.

Where it hides. In the bid folders and the project folders, mixed with your own estimates and change orders. Your estimate is yours. The drawing it was priced from may not be.

Our advice. Pull every NDA and every contract with an ownership clause, and list the clients they cover. Exclude those clients’ files, or at least the documents they own, unless the client agrees in writing and your counsel says that is enough. Only the contracts say which is which. Our legal page covers what to look for in them.

Customer lists

What it looks like. The CRM contacts export. The mailing list for the spring tune-up. The spreadsheet of maintenance agreement holders. The list a salesperson kept of every commercial account he ever called.

Where it hides. Everywhere. Every system has a customer table. That’s the point of a CRM.

Our advice. This is the easiest one to say and the most important. A list of who your customers are is not how the work was done. It is not what is wanted. What is wanted from the CRM is the history: how a lead was qualified, how a quote was followed up, how a complaint was settled. Ask that the contact table itself stays out, and that names in the notes come out under the redaction requirements. Then check it in the sample review. micro1 says “companies are given the opportunity to review representative samples before prepared data is used.”

How to keep it out: three tools

Across all nine categories, the advice comes down to three tools. They are ours, and they are cheap.

Exclude the folder. The bluntest tool, and the best. HR, payroll, vendor, legal, accounting. Name each one, and write the names into the scope. micro1 says the “Approved data scope and clear boundaries” are defined together before any participation. That is where the folder names go.

Flag the channel. Some sensitive records don’t live in a folder. They travel. A lawyer’s email domain, a payment inbox, the notes field in the dispatch software. List the channels, and ask how the redaction requirements will treat them. It catches what the folder rule misses.

Ask on the discovery call. For everything you can’t sort yourself, ask. Bring a one-page inventory: each system, its years, what it holds, and what you would never let out. micro1 says the discovery call is there “to discuss your data and privacy requirements.” Use it for exactly that.

You don’t clean your systems before you apply. Your files stay as they are. The inventory is so the scope fits your records, not a generic company’s. Who at your company signs off belongs on it too. micro1 lists “Internal approval processes and permissions” among the things defined before any participation.

What this means for a company with 30 or more staff

Here is one company, as our own hypothetical and not a list from micro1. A mechanical contractor with 60 people, commercial and residential, fourteen years of records.

What it keeps. The estimates, with each revision. The job files: daily logs, work orders, photos, inspection reports. The change orders, with the email where each one was argued. The service tickets on the residential side. The project manager’s email, which is where most decisions were written down. The CRM, with the history of every commercial account.

What we would keep out. The HR and payroll folders. The vendor folder, with its W-9s. The accounting system. The Legal folder and any thread with counsel’s domain. The two jobs on the air base, by job number. The hospital wing, where the general contractor’s drawings came under an NDA. The photos from the three school jobs. The time clock exports. The CRM contact table.

What stays. The estimate that went from a repair to a replacement after the second site visit. The change order that added a return duct, and the email on how it was priced. The service ticket where the technician traced a no-heat call two steps upstream. The daily log that explains why the crane date moved. With the names removed, that is the record a buyer uses to train AI models on real work.

What to ask micro1. Whether the scope can name excluded folders, job numbers and email domains. How free-text notes are handled. How many samples you’ll see, and from which years. What happens if a sample shows something that should have come out.

Worth two minutes to see your range? Our estimate asks five questions. The page for companies with 30 or more staff covers the records a company that size tends to keep.

What is never included

micro1’s words on this are short, and they are the ones that count. Every partnership comes “with clear controls over what is shared, how it is handled, and what is never included.” The scope, the boundaries and the redaction requirements are defined together, before any participation.

Our advice is the list above. Privileged records, health information, card and account details, Social Security numbers, minors’ data, biometric data, controlled material, client-owned work and customer lists. None of them shows how work was done. Put them on your side of the line before the discovery call, and let micro1 tell you where its line sits.

Where we fit

We, TrustPast, explain how this works and give you a range with our estimate. The range is ours, not an offer. You apply to micro1 yourself, through the button below. micro1 pays us a referral fee. You pay us nothing, and we never see your files. We give no legal advice. Our How it’s safe page has the short version of the protections.

Ask micro1 before you apply

Four things to do first, as our own advice:

Walk the shared drive. Note every folder in the nine categories above.
List the channels. Counsel’s domains, the payment inbox, the notes fields.
Mark the jobs. Government sites, schools, NDA clients, by job number.
Call counsel if any category is more than a stray file.

Then ask micro1, in the application or on the discovery call, whether anything on your list is a problem. Its answer decides the scope. Ours only gets you ready for the question.

TrustPast

Questions and answers

Who decides what is left out of a licence with micro1?

micro1 and the company, together. micro1 says: “Before any participation, together we define” the “Approved data scope and clear boundaries,” the “Security and confidentiality standards,” the “Anonymization and redaction requirements” and the “Internal approval processes and permissions.”

Does micro1 publish a list of records it will never take?

No. micro1 says every partnership is designed around the organization’s requirements, “with clear controls over what is shared, how it is handled, and what is never included.” The list is set with each company. The categories on this page are our own advice, not micro1’s.

When do we talk to micro1 about what stays out?

micro1 says that if there is a potential fit, it will “request additional information and schedule a discovery call to discuss your data and privacy requirements.” Then: “If approved, we’ll finalize the agreement and data requirements and begin the partnership.”

Are customer names part of what micro1 wants?

micro1 says: “We are looking for data that reflects how work is actually performed within an organization.” It says personally identifiable information “is removed when relevant,” and its October announcement says it “uses de-identified company data.” Keeping the customer contact table out of scope is our own advice.

Do we see the records before they are used?

micro1 says “companies are given the opportunity to review representative samples before prepared data is used.”