The words in a data deal, in plain English.

Removing or changing the parts of a record that point to a person or company, so the record can't reasonably be linked back to them. Under California law, data only counts as deidentified if the holder also commits publicly not to re-identify it and binds every recipient to the same promise by contract.

De-identification vs anonymizationSource: Cal. Civ. Code 1798.140(m)

Processing data so that nobody can identify the people in it by any means reasonably likely to be used. Under GDPR, truly anonymous data falls outside the regulation, but the bar is high and has to be judged case by case.

De-identification vs anonymizationSource: GDPR Recital 26

Replacing names and IDs with stand-in codes (PERSON_04 instead of a name) while the key that links codes back to people is kept separately. Pseudonymized data is still personal data under GDPR, because someone holding the key can reverse it.

Source: EDPB Guidelines 01/2025

A field that names someone on its own: a full name, email address, phone number, account number or tax ID. Scrubbing removes or replaces these first.

A field that is harmless alone but can identify someone in combination with others, such as ZIP code, birth date and gender, or a company domain plus a job title. Most re-identification attacks work through quasi-identifiers.

k-anonymity in plain English

Working out who a de-identified record belongs to, usually by matching its quasi-identifiers against another dataset. Every license we sign bans the buyer from attempting it, and we test for it before every sale.

Source: Rocher et al., Nature Communications 2019

A test for a released table: every combination of quasi-identifier values has to appear in at least k records, so each person hides in a group of at least k. A table with k = 5 never lets a combination of those fields point to fewer than five records.

k-anonymity in plain EnglishSource: Sweeney, 2002

An extra check on top of k-anonymity. Each group of look-alike records must contain at least l different values of the sensitive field, so being in the group doesn't reveal the sensitive value anyway.

Source: Machanavajjhala et al., 2007

Making a value less precise so it matches more records: an exact amount becomes a range, a date becomes a month or quarter, a city becomes a region.

Deleting a value, or a whole record, that would still single someone out after generalization. Rare records are the usual candidates.

Under GDPR, any information about an identified or identifiable living person. Work contact details count: a colleague's name and work email in a CRM are personal data.

Source: UK ICO on business contacts

GDPR's most sensitive types of personal data, including health, biometric and genetic data, religion, sexual orientation and union membership. Using it needs an extra legal condition under Article 9, so we leave it out unless it is already anonymized under existing approvals.

Source: GDPR Article 9

The organization that decides why and how personal data is processed. A company that collected data for its own business is usually the controller of it.

Can I sell data I hold for my customers?

An organization that processes personal data on a controller's instructions, such as a software vendor holding its customers' records. A processor that starts using the data for its own purposes, like selling it, is treated as a controller for that processing under GDPR Article 28(10).

Can I sell data I hold for my customers?Source: GDPR Article 28

The contract between a controller and a processor that sets what the processor may do with the data. Many DPAs limit use to providing the service, which blocks a sale even after scrubbing.

One of the six legal grounds GDPR requires before personal data can be processed, such as consent, contract or legitimate interests. Licensing data for AI training is a new purpose, so it needs its own basis or a documented compatibility check.

GDPR and selling data for AI training

A GDPR lawful basis that lets an organization process data for its own reasonable interests after a three-part test: a real interest, a need for the data, and a balance against the people's rights and expectations.

Source: UK ICO guidance

The GDPR principle that data collected for one purpose can't be reused for an incompatible one. Article 6(4) lists what to weigh when deciding whether a new use, like AI training, is compatible.

Source: GDPR Articles 5(1)(b) and 6(4)

Contract terms approved by the European Commission that allow personal data to leave the EEA, for example to a US lab. They come with a transfer risk assessment.

Source: European Commission

California's definition is broad: making personal information available to a third party for money or other valuable consideration. Licensing records that still contain personal information counts, which is why de-identification comes first.

CCPA and selling dataSource: Cal. Civ. Code 1798.140(ad)

In California, a business that knowingly collects and sells personal information about consumers it has no direct relationship with. Data brokers must register with the state each year. In everyday use the word also covers intermediaries that arrange data sales.

Red flags when choosing a data brokerSource: Cal. Civ. Code 1798.99.80

Our check of whether you may license a dataset: we read your customer agreements, DPAs and confidentiality clauses before any data moves. Data we can't clear stays out.

Can I sell data I hold for my customers?

A non-disclosure agreement where both sides promise to keep the other's information confidential. We send one on the day of the first call, before you share a sample.

NDAs and data rooms

A controlled space where a buyer reviews a redacted sample and the supporting documents (rights statement, scrub report, field notes) before signing. Access is logged and limited to named people.

NDAs and data rooms

One row of business data, such as an invoice, a ticket or an experiment entry, after scrubbing. A set of records from one domain is the simplest thing labs license.

Episodes, records and environments

A sequence of steps showing a situation, what a person did and how it turned out, in order. Episodes are built from audit trails like ticket transitions or ledger edits, and they teach models how work actually gets done.

Episodes, records and environments

A working copy of a system, such as a CRM or a ledger, where an AI agent can practice tasks and get scored. We build environments from a system's real structure filled with synthetic data drawn from the real patterns.

Episodes, records and environmentsSource: Epoch AI on RL environments

One goal inside an environment plus a way to check whether the agent reached it, such as tests that must pass. Labs pay per task, and Epoch AI's interviews put most tasks at $200 to $2,000.

Source: Epoch AI

Made-up data generated to match the statistical patterns of real data. It fills environments safely, but it can't replace the real decisions and outcomes labs are short of.

The documented origin of a dataset: which system it came from, which version, which date range, and proof that the seller had the right to license it. Labs ask for it in diligence.

The part of our SDK that reads from one system, such as Xero, HubSpot or Jira, with read-only access, so new records can be pulled on a schedule.

How the SDK works

The report produced every time data is scrubbed: which fields were removed or generalized, how many values changed, and the re-identification test result. You see it before anything is uploaded, and buyers see it in diligence.

Our free review of a sample you share under NDA: what is sellable, what has to go, and whether any record could be re-identified. You keep it whether or not you sell.

A contract that lets a buyer use a dataset on stated terms while you keep ownership. Ours set the allowed uses (training, fine-tuning, evaluation), the length, exclusivity, deletion at the end, and a ban on re-identification and resale.

Data licensing terms, explained

A promise to license a dataset to one buyer only, for a field or a period. Exclusive deals cost buyers more: RL environment founders interviewed by Epoch AI put exclusive deals at roughly 4 to 5 times the price of non-exclusive ones.

Source: Epoch AI

The first license on a dataset, which covers every past record up to the first run. It has its own price, separate from the monthly refresh price.

Recurring data revenue

One scrubbed delivery of a dataset for one month. Each batch moves through received, in review and accepted (or rejected), and accepted batches are what refresh payments are counted against.

A batch that carries only the records created or changed since the last run. Our SDK builds one each month by default, scrubs it on your machine and uploads it.

Recurring data revenue

The part of a license that buys future batches at a set price per batch. Every accepted batch pays that price once for each license with an active refresh term, which is what makes the income recurring.

Recurring data revenue, explained

Your portion of what a buyer pays for a license and period, stored in basis points. The default is 8,000 basis points, or 80%; your seller agreement sets the actual figure.

A listing platform where data sellers post products and buyers subscribe, such as AWS Data Exchange, which charges a 3% listing fee on public offers. The seller still prepares the data and handles rights.

Marketplaces vs brokers vs direct licensingSource: AWS Marketplace listing fees