Article

Who at the buyer can see your records?

By TrustPast

Updated October 24, 2026

You’ve decided the records might be worth licensing. You’ve read how names come out. Then a quieter question arrives, usually at night: once the files leave the building, whose eyes are actually on them? This page settles that one question, using only what micro1 publishes. It sorts what micro1 says about the people who handle your records from what it doesn’t say, and it gives our own advice on how to fill the gaps in writing.

Our page on whether it’s safe to license company records covers the controls as a whole: preparation, samples, retention, the points where you can stop. Here we stay with people. Who touches the raw copy, who touches the prepared copy, who receives it after that, and what you can ask to have written down about each of them.

The plain answer, in micro1’s words

micro1 publishes one paragraph that speaks to people directly. On its data partnerships page, under how company data is protected, it says “access is restricted to a limited number of authorized team members.” In the same paragraph: “employees with access to data systems use company-managed devices and follow established security controls and training requirements.”

It publishes a second set of lines under the heading “Built with privacy and control first.” They open with “We protect sensitive information through data anonymization and secure handling. Before any participation, together we confirm:” and four items follow. Two of them answer the people question:

“Your data is kept separate from other companies’ data, with access restricted to authorized personnel”
“Personal and identifying information is removed or transformed before your data is shared with third parties”

A third names who the records are licensed to: “Your data is licensed exclusively to labs and enterprises based in the U.S. and allied countries.” The fourth is about time: “Raw data is deleted according to an agreed schedule.”

So, in our own words: a limited group of authorised micro1 staff handles your records, on company-managed machines, under set security rules and training. Your records are kept apart from every other company’s. Names and identifying details are taken out or changed before your records are shared with third parties. The outside parties are labs and enterprises in the US and allied countries. And the raw copy has an end date you agree.

That is the published answer. It is a real answer. It is also a short one, and the rest of this page is about the part it leaves open.

Apply & License Your Data

Three copies, three sets of people

It helps to stop thinking of “the data” as one thing. As our own description, your records exist in three forms once a partnership starts, and different people sit around each one.

The raw copy. This is what you send. micro1 says you “securely transfer your data through” its own channels “or other approved methods,” and that “We review the data for completeness.” Its payment answer adds: “Once your company transfers its data, micro1 has 30 days to review and approve it.” So someone at micro1 opens the raw copy to check it. That copy still has the names in it, because micro1 also says your company doesn’t have to clean it first: “No, micro1 has processes for de-identifying and transforming sensitive information.” The raw copy is the one the access paragraph matters most for.

The prepared copy. This is what comes out of preparation. micro1 says that after data is shared, “it is processed according to the agreed use case and handling requirements.” It says “personally identifiable information may be removed and certain datasets may undergo synthetic rewrites that preserve workflow structure while reducing direct ties to original records.” You see part of this copy too: “companies are given the opportunity to review representative samples before prepared data is used.”

The licensed copy. This is what reaches a buyer of micro1’s. micro1 says identifying information is removed or transformed “before your data is shared with third parties,” and that the third parties are “labs and enterprises based in the U.S. and allied countries.” Its contracting step includes “a commitment not to resell or distribute your data until personal and identifying information has been anonymized.”

Read those three together and the shape is clear. The fewest people see the copy with the most in it. The widest group sees the copy with the least in it. The people question is mostly a question about the first group.

Who handles the raw copy

This is where an owner should spend the first call with micro1.

micro1 publishes four facts about these people. There is a limited number of them. They are authorised. They work on company-managed devices. And they follow security controls and training requirements micro1 has set.

It also publishes how the raw copy is fenced. It says “customer data is processed through isolated pipelines that prevent it from being commingled with other engagements.” On deletion: “Raw data is deleted according to an agreed schedule.”

Think of a locked parts cage in a warehouse. A short list of people have keys. They sign out what they take. The cage holds one customer’s stock and nothing else. And the stock leaves on a date set in the contract. micro1’s published lines describe the keys, the cage and the date. They don’t describe the sign-out sheet, or show you the key list.

Who receives the prepared copy

micro1 is plainer about this group than most owners expect.

The prepared copy goes to “labs and enterprises based in the U.S. and allied countries.” Its 9 October 2026 announcement says “micro1 uses de-identified company data,” and that the aim is to “reflect real business operations.” Its FAQ says the data is used to evaluate and improve systems in realistic business settings. In plain words, the records are licensed to train AI models on how real companies work, and the people at the receiving end get the de-identified version.

The contracting commitment matters here. micro1 commits “not to resell or distribute your data until personal and identifying information has been anonymized.” Our own reading: that sentence also tells you the prepared copy can travel on to licensees once it has been anonymized. That is the business. It is worth knowing exactly what “distribute” covers in your agreement.

micro1’s payout page says the final payout “is determined based on data sources, volume, quality, access terms, and due diligence.” Access terms are on that list. Our own reading: how widely the prepared copy may be shared is a term you can discuss, and it may move the price. Ask micro1 how.

What micro1 does not publish

Here is the plain list. On its data partnerships page, its payout page, its referral page and its 9 October 2026 announcement, micro1 publishes nothing on:

Named roles. Which job titles sit inside “a limited number of authorized team members.”
Headcount. How many people that is, or how many review your raw records for completeness.
Subcontractors and subprocessors. Whether any outside firm, contractor or cloud provider handles the raw copy, and which.
Locations. Where the raw copy is stored, and from which countries it is reached. The “U.S. and allied countries” line is about who the records are licensed to, not where micro1 stores them.
Logs and audits. Whether each opening of your records is logged, how long logs are kept, and whether you can see a summary.
Certifications. Which outside security audits or reports, if any, cover the systems that hold the raw copy.
The licensees. Which labs and enterprises receive your prepared copy, and who inside them can open it.

micro1 also says its “flow-transform anonymization model has benchmarked as best in class.” The pages we cite don’t say against what, so we don’t repeat it as a measure.

As our own view, a silence on a web page is not an answer. Treat each item as a question to ask.

What to ask on the call with micro1

micro1’s referral page says qualified companies “are invited to connect with a Data Partnership Manager to discuss their data, licensing terms, and next steps.” That is the one contact role micro1 names for you. It is the person to put these questions to. What follows is our own advice, grouped so you can work down it.

People.

Which roles at micro1 can open the raw copy, and roughly how many people is that?
Who checks the raw copy for completeness, and who runs the de-identification?
Are any of them contractors rather than employees?
What happens to a person’s access when they leave micro1 or move off the engagement?

Places.

Where will the raw copy be stored, in which country and with which hosting provider?
Can it be opened from outside that country?
Does any copy, raw or prepared, sit on a laptop, or only on managed systems?

Paper trail.

Is every opening of the raw copy logged, and for how long are the logs kept?
Can we ask for a summary of who accessed our records, and how often?
Which security audits or reports cover the systems that hold our records, and can we see them under a confidentiality agreement?

Onward.

Which kinds of licensee will receive the prepared copy, and can we be told which ones?
What limits does a licensee accept on who inside it can see the records, and on sharing them further?
When the raw copy is deleted, how are we told?

You won’t need all thirteen answered on one call. Write them down anyway. A straight answer is a good sign. A promise to follow up in writing is fine, as long as the writing arrives before you sign.

Who in your company should be on that call besides you?

What to write into the agreement

A good answer on a call is worth what it says in the agreement. As our own advice, ask that these terms appear in writing. Have your counsel draft or review the wording. We don’t give legal advice, and nothing here is any.

An access list by role. Not names, which change. Roles, with a cap on how many people hold raw-copy access at once. Add a line on how quickly access ends when someone leaves the engagement.

Access logging. That access to the raw copy is logged, how long the logs are kept, and your right to ask for a summary.

A subprocessor list. Every outside firm that handles the raw copy, named, with notice to you before a new one is added.

Storage location. The country, and the type of system, where the raw copy is held. Say whether it may be moved.

Onward terms. What a licensee may and may not do with the prepared copy, and that it receives only the de-identified version. micro1 already commits that identifying information is removed or transformed before sharing. Put that commitment in your contract’s own words.

Deletion with a receipt. micro1 says raw data “is deleted according to an agreed schedule.” Agree the schedule as a number of days or months, the date the clock starts, and a written confirmation when it is done.

Our page on whether you keep ownership of your records goes through retention and ownership in the contract. micro1’s line on ownership is one sentence: “Companies retain ownership of their underlying data.”

Your side of the door

The people question has a second half that owners skip. Who at your own company will touch the records on the way out?

micro1’s referral page says the company’s point of contact “sets up the company’s profile on the company portal” and “completes data manifest.” It says that if there is a fit, “the company transfers approved data.” Someone in your office does that work.

As our own advice, pick that person on purpose. Give the export job to one or two people, not to whoever is free. Keep a dated list of what was exported, from which system, for which years. Send it only by the method micro1 approves, never as an email attachment. Delete local export files once micro1 confirms receipt. Our page on exporting a Slack workspace shows how one of those exports is pulled.

Your own access list is the one you control completely. Start there.

Why the people question is smaller than it looks

micro1 says it uses de-identified company data, and that identifying information is removed or transformed before your data is shared with third parties. So the small group with raw-copy access matters less than it sounds. As our own reading, customer names and payments are never what is wanted. What is wanted is how the work was done.

micro1’s own words point that way. “We are looking for data that reflects how work is actually performed within an organization.” And: “The most valuable datasets capture real operational expertise, decision-making processes, and repeatable workflows.” Our cornerstone page on what data buyers want from a trade business walks through that split, record by record.

Three examples from a brick-and-mortar business, as our own illustrations.

A service company’s dispatch notes. A note reads: second call this week, same unit, send the senior tech, bring the ladder for the roof curb. What a buyer wants is the call: why the repeat visit got a different tech, what was brought, what was found. The customer’s name and street add nothing to that.

A change-order email thread. Four replies over two days. The crew found rotten sheathing. The project manager priced the repair in two options. The client picked one and asked for the next visit to move. That thread shows a change order being settled. The client’s name, the address and the invoice number add nothing to it.

The warehouse crew’s Slack channel. A forklift is down. Someone moves the morning pick to the second bay. A supervisor notes the delivery to hold until noon. That is a team working around a broken machine. The crew members’ names are what the redaction rules are there to replace with roles.

So the small group at micro1 that sees the raw copy is looking for the work, not the people. micro1 says identifying information is removed or transformed before your data is shared with third parties. That step happens with them. Our page on how de-identification works shows that step on real kinds of record. Our page on whether the buyer sees your customers’ names maps where the names sit.

What this means for a service company with 30 or more staff

Here is one company, as our own hypothetical and not a description from micro1. Say a commercial refrigeration and kitchen equipment service company with 55 staff. It has a dispatch office, a parts warehouse, and fourteen years in the same software. micro1’s referral page sets the line at “30+ employees,” so it’s in range. Our page on companies with 30 or more staff covers that lane.

The records it keeps. The CRM, with every lead, quote and follow-up for its restaurant and grocery accounts. The dispatch notes on every service call. The change-order threads in the shared project inbox for new kitchen installs. The Slack channels for dispatch, the warehouse crew and the install teams. The SOPs for walk-in cooler start-ups. Our pages on CRM records and Slack and Teams chats explain what each of those holds.

Who would touch them. Its office manager and IT contractor would run the export. At micro1, a limited number of authorised staff would check the raw copy and prepare it. The prepared copy would go to labs and enterprises in the US and allied countries, without names.

What it asks. The thirteen questions above, with two of its own. Whether its outside IT contractor counts as a person on its own side of the access list. And whether the Slack channel where staff discuss scheduling and time off can stay out of scope entirely.

What it writes down. A role-based access list with a cap. Logging, with a summary on request. A named subprocessor list. Storage in the US. Deletion of the raw copy within an agreed period, with written confirmation. Counsel reviews the wording.

Worth two minutes to see your range? Our estimate asks five questions.

What is never included

micro1 doesn’t publish a fixed list of excluded records. It says “We protect sensitive information through data anonymization and secure handling,” and it lists what is confirmed together before any participation: U.S. and allied buyers only, data segregation, de-identification before sharing, and defined retention periods. What stays out is settled with each company.

What follows is our own advice, not micro1’s. Keep these out unless micro1 agrees otherwise in writing: attorney-client privileged records, health information, payment-card and financial-account details, Social Security numbers, minors’ data, biometric data, and classified or export-controlled material. On a page about who can see the records, add three more. The HR and payroll folders. Any channel where staff talk about pay, leave or health. And anything a client owns under its contract with you. Fewer sensitive files in scope means fewer things for anyone to see.

Where those records hide, folder by folder, is on what is never included in a records licence. Our How it’s safe page gives the short version. For whose rights to check first, see whether licensing company records is legal, and ask your counsel.

Where we fit

We, TrustPast, explain how this works and give you a range with our estimate. The range is ours, not an offer. You apply to micro1 yourself, through the button below. micro1 pays us a referral fee. You pay us nothing.

We’re not on any access list. We never see your files, raw or prepared. Your records go from your systems to micro1, on terms you agree with micro1. This page exists so you arrive at the call with micro1’s Data Partnership Manager, the people questions already written down.

TrustPast

Questions and answers

Who at micro1 can open our records?

micro1 says “access is restricted to a limited number of authorized team members,” and that “employees with access to data systems use company-managed devices and follow established security controls and training requirements.” It doesn’t publish the job titles or how many people that is. As our own advice, ask for both on the call with micro1’s Data Partnership Manager and have the roles written into the agreement.

Does anyone outside micro1 see the records?

micro1 says “Personal and identifying information is removed or transformed before your data is shared with third parties” and “Your data is licensed exclusively to labs and enterprises based in the U.S. and allied countries.” It doesn’t name those licensees on its pages. As our own advice, ask how a licensee’s own access is limited and whether those limits are in your agreement.

Does micro1 use subcontractors or say where the records are stored?

Its data partnerships, payout, referral and announcement pages say nothing about subcontractors, subprocessors, storage locations, access logs or audits. As our own advice, ask for a written list of anyone else who will handle the records, where the raw copy will be stored, and whether access is logged.

Is our raw data kept after it is prepared?

micro1 says “Raw data is deleted according to an agreed schedule” and that “Upon request or at the end of an engagement, data is deleted according to the agreed retention and deletion terms.” The schedule is set in your agreement, not published as one period for everyone.

Why would anyone at micro1 need our customers’ names?

micro1 says it is looking for “data that reflects how work is actually performed within an organization,” and its 9 October 2026 announcement says it “uses de-identified company data.” A name doesn’t show how a job was dispatched or a change order settled. The steps do.