Glossary

Updated October 25, 2026 · How we research

This glossary explains, in plain English, the terms that come up when a company considers licensing its internal records to AI companies. Definitions are general and simplified; they are not legal, tax or financial advice. Laws differ by state and situation, so talk to your lawyer or accountant before you rely on any of them.

Jump to: A C D E F G H I L N P R S T U W

A

Agent training / agentic AI

Agentic AI refers to software that works toward a goal on its own, using tools and completing multi-step tasks rather than just answering a single question. Training such agents calls for records that show how work actually unfolds from start to finish, such as a project traced across email, chat and tickets. That need is one reason developers seek company records.

AI training data

Examples that an AI developer feeds into a model so it can learn patterns. For business records, this can mean email, chat, documents, tickets, code and similar files that show how real work gets done. Buyers typically value variety and depth, such as long threads with disagreements and judgment calls, over sheer volume. The records usually go through de-identification before use, and the license sets what the buyer may do with them. Read more.

Anonymization

A form of de-identification meant to cut the tie between records and individuals so thoroughly that no one can reasonably work back to who they were. The word is often used loosely. Data called anonymous can sometimes be re-identified by combining it with other information. Before agreeing that data is anonymized, ask what method was used, who checked it, and which legal standard it is meant to meet. Read more.

C

CCPA / CPRA

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives California residents rights over personal information that larger businesses collect, including rights to know, delete, correct and opt out of sale. Licensing records with personal information for money may count as a sale unless the data is properly de-identified. The California Privacy Protection Agency publishes which businesses are covered. Read more.

Chain of title

The documented history of who has owned an asset over time. Buyers rely on it to confirm the seller really holds the rights being offered. For company records, chain of title matters when a business has merged, bought another company, or changed entities, since the records may have passed through several owners. Gaps or unclear transfers can stall or weaken a deal. Read more.

Consumer privacy ombudsman (bankruptcy)

A neutral person appointed in a bankruptcy case when the company wants to sell or lease customers' personal information in a way its privacy policy did not allow. The court must order the appointment before the hearing on the sale. The ombudsman tells the court about the privacy policy, the likely effects on consumers, and ways to reduce privacy harm. The court then decides whether to approve. Read more.

D

Data broker vs. referral introducer

California defines a data broker as a business that knowingly collects and sells personal information about people it has no direct relationship with; such brokers must register with the state. A referral introducer is different: it points a company toward a buyer, never takes or resells the records, and may be paid a fee by the buyer if a deal is signed. Ask any intermediary which role it plays. Read more.

Data inventory

A written list of the record sets a company holds: which systems they sit in, roughly how much there is, what years they cover, and what kinds of personal or confidential information they contain. It describes the data without sharing it. A good inventory speeds up talks with buyers and helps you and your lawyer spot material that must stay out. Read more.

Data license

A contract that lets a buyer use your records for stated purposes while you keep ownership. A license can be limited by time, territory, purpose or exclusivity, and it can usually be ended or forfeited under its own terms. This differs from an outright sale or assignment, where ownership moves to the buyer. The written terms, not the label, decide what the buyer may actually do. Read more.

Data provenance

Information about where data came from and what has happened to it since: who created it, who owned it, and how it was changed. Buyers may ask for provenance to show they obtained training data lawfully. For a seller, clear records of the source systems, date ranges and de-identification steps support provenance and make representations easier to back up.

Data retention

How long records are kept and when they must be destroyed. It applies on both sides: your own legal duties to keep certain records, such as tax and payroll files the IRS (Internal Revenue Service) expects you to hold for years, and the buyer's promises about how long it keeps your raw files. A license should say what the buyer retains, for how long, and why. Read more.

Data sample

A small, representative slice of records, often already de-identified, that a buyer reviews before committing to a full deal. Samples let buyers judge quality and fit; they are usually shared under a confidentiality agreement. Agree in writing what happens to the sample if no deal follows, including whether the buyer must delete it and whether it may use it for anything. Read more.

De-identification

Any process that breaks the link between records and the people they describe, for example by removing names or masking account numbers. It is easier in tidy database fields than in free-text email and chat, where personal details hide in ordinary sentences. De-identification lowers privacy risk but rarely removes it completely, and it does not make other companies' confidential information safe to share. Legal standards for it vary by law. Read more.

Deletion certificate

A signed written statement from a buyer or vendor confirming that specified records were destroyed, with the date and method. Federal guidance on wiping storage media, NIST (National Institute of Standards and Technology) Special Publication 800-88 Rev. 2 from 2025, includes a sample certificate form. A certificate covers stored copies; it generally cannot undo what a model has already learned. Ask that it name the records and cover backups and subcontractors.

E

Evaluation data

Records set aside to test how well an AI model performs, rather than to train it. Test material is kept separate from training data, because a model tested on examples it already learned from shows memory, not real skill. Business records can be turned into realistic test tasks, such as answering a customer ticket correctly. A license should say whether evaluation use is allowed and whether it is treated differently from training.

Exclusive license

A license that promises one buyer the right to use the records, so you agree not to license the same material to anyone else, at least for a set period or purpose. Exclusivity can raise the price, because data a rival already holds is worth less to the next buyer. The trade-off is that you give up other sales. Check how long exclusivity lasts and exactly what it covers. Read more.

Export

A copy of records pulled out of a software system into files, often using the vendor's own export tool. Who may run an export, what it includes, and how long it takes differ by vendor. For example, Google Workspace allows only a super administrator to start a full organization export, which typically takes about three days and can take up to two weeks.

F

Field of use

A contract limit on the purposes for which a buyer may use the licensed records, such as training general-purpose models but not building a product that competes with your business. A narrow field of use protects you; a broad one gives the buyer more freedom and may justify a higher price. If the contract is silent, the buyer may have wider rights than you expect.

Frontier lab

An informal name for the companies building the most advanced general-purpose AI models, sometimes called frontier models. The phrase itself has no legal definition, though some laws now define related terms; for example, California's 2025 frontier AI transparency law (SB 53) defines a frontier model by the computing power used to train it. Frontier labs may license data directly or obtain it through data vendors, environment builders and other intermediaries. Knowing where your records will end up, and under what terms, matters more than the buyer's label.

FTC Safeguards Rule

A Federal Trade Commission (FTC) rule under the Gramm-Leach-Bliley Act that requires covered financial institutions to keep a written information security program protecting customer information. Coverage depends on what a business does, not what it calls itself, and can reach firms such as tax preparers, collection agencies and some investment advisers. Since May 2024, covered firms must also tell the FTC about a breach of unencrypted customer information affecting 500 or more people, within 30 days of finding it.

G

GLBA (Gramm-Leach-Bliley Act)

A federal law that requires companies offering consumers financial products or services, such as lenders, financial advisers and insurers, to explain how they share customer information and to keep it secure. The FTC (Federal Trade Commission) treats some businesses outside traditional finance, such as auto dealers that arrange financing, as covered. Customer financial records held by such firms face strict limits on sharing. Read more.

H

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) protects identifiable health information held by health plans, many health care providers, clearinghouses, and the outside firms that handle such information for them. That information stays out of business-record licensing on this site. Clinical and medical records are handled by the sister site licensemydata.com. State health privacy laws can also apply. Read more.

Holdback / clawback

A holdback is part of the payment kept back, sometimes in escrow with a neutral party, until conditions are met, such as the buyer accepting the delivery. A clawback lets the buyer reclaim money already paid if certain events occur, such as a rights problem surfacing later. Check the triggers, amounts and time limits, since they change what the deal is really worth. Read more.

I

Indemnity

A promise by one party to cover certain losses the other party suffers, such as legal claims from third parties. In a data license, the buyer may ask you to indemnify it if, for example, you did not have the right to license the records. Watch for one-sided indemnities, and see whether they are capped. Have your lawyer review this clause in particular. Read more.

L

Limitation of liability

A contract clause that caps how much one party can owe the other if something goes wrong, or excludes certain kinds of losses, such as indirect or consequential damages, altogether. The cap is often tied to the amount paid under the contract. Check whether indemnities and privacy breaches sit inside or outside the cap. Courts may refuse to enforce a limit that is overly broad, was not clearly disclosed, or tries to excuse gross negligence or deliberate wrongdoing. Read more.

N

NDA (non-disclosure agreement)

A contract in which one or both parties agree not to reveal information shared for a specific purpose. In a one-way NDA only one side shares information and only that side is protected; in a mutual NDA both sides share and both are protected. NDAs are common before sharing a data inventory or sample. Note too that your existing NDAs with customers and partners may forbid licensing records that contain their information.

Non-exclusive license

A license that lets one buyer use the records while you stay free to license the same material to others. You keep ownership and flexibility, and you may be able to earn from more than one buyer. Each buyer usually pays less than it would for exclusive rights. Make sure no single contract quietly includes exclusivity language that would block later deals. Read more.

P

Perpetual license

A license with no end date. In AI deals this matters because once records are used to train a model, they cannot practically be pulled back out, even if the contract later ends. A license may be perpetual for models already trained but limited for new uses of the raw files. Read carefully which rights end when the contract ends and which continue forever. Read more.

Personally identifiable information (PII)

Information that can identify or trace a specific person, either on its own or when combined with other details. Obvious examples are names, Social Security numbers and home addresses. Less obvious examples include a job title plus an office location, or a birth date plus a ZIP code. Business email and chat archives contain a great deal of it, about employees, customers and vendors alike. Read more.

Pseudonymization

Replacing a direct identifier, such as a name or email address, with a stand-in like a random code, so records about the same person stay linked without showing who that person is. Because the link survives, pseudonymized data can often be traced back to individuals. The Federal Trade Commission (FTC) has warned that hashing, a common way to create such codes, does not by itself make data anonymous. Read more.

R

Read-only connector

A software link that lets a buyer or its tools read records directly from a system, such as a chat or email platform, without being able to change or delete anything. Some buyers use read-only connectors instead of asking for a file export. Ask exactly what the connector can see, how access is limited and logged, and how and when it is switched off.

See also: Export, Scoping, Data retention

Referral fee

A payment an introducer receives for sending a customer to a business. In data licensing, a buyer may pay a referral fee to whoever introduced a company that later signs. Depending on the buyer's terms, the fee may or may not be deducted from what the company receives. A fair introducer discloses that it is paid this way, so you can weigh its suggestions accordingly. Read more.

Representations and warranties

Statements of fact and promises made in a contract, for example that you own the records, that you have the right to license them, or that personal information has been removed. If one turns out to be untrue, the other side may claim breach. Privacy and security statements deserve special care. Statements are often limited to what a party knows or can check; your lawyer can help word them. Read more.

Rights clearance

Checking that you actually have the legal right to license each set of records before you sign. Holding data does not always mean you may license it. Customer contracts, NDAs, software vendor terms, employee privacy laws and regulated-data rules can each restrict use. Your lawyer can help work through what is cleared and what must stay out. Read more.

RL environment (reinforcement learning environment)

A simulated setting where an AI system practices tasks and receives a score, or reward, for how well it does, gradually learning better behavior. Some developers build office-like environments, such as a mock company inbox or ticket queue, where AI agents practice real work. Realistic business records help make these simulations believable, which is one reason some buyers seek them.

S

Scoping

The early stage of a deal where buyer and company agree which records are in and which are out: which systems, which date ranges, which teams, and which categories, such as HR files or legal communications, are excluded. Scoping often relies on descriptions or counts rather than the records themselves. Clear scoping reduces surprises later and keeps restricted material out from the start. Read more.

Section 363 sale

A sale of a bankrupt company's assets under Section 363 of the U.S. Bankruptcy Code, which lets the trustee sell property outside the normal course of business after notice and a court hearing. Data and code archives can be sold this way. Extra limits apply to customers' personal information when the company's privacy policy promised not to transfer it. Read more.

Sensitive personal information

A category of personal data that California privacy law treats with extra care. It includes government ID numbers, account logins, financial account numbers paired with their access codes, precise location, racial or ethnic origin, citizenship or immigration status, religious beliefs, union membership, health, genetic and biometric information, sex life or sexual orientation, and the contents of a person's mail, email and texts unless the business was the intended recipient. Other states define the category differently. Ask your lawyer which rules apply to your records. Read more.

Synthetic data

Artificial records generated by software, often from real 'seed' data so they keep some of its statistical patterns, used to train or test AI systems or to share data with less privacy risk. Generating synthetic data is one recognized de-identification technique, though results built from real records can still leak details if done poorly. One reason some buyers still seek real archives is that synthetic records can contain unrealistic errors, such as dates that do not exist.

T

Trade secret

Confidential business information, such as pricing logic, formulas, strategy documents or source code, that has value because competitors do not know it and that the owner takes reasonable steps to keep secret. Protection lasts only as long as the secrecy does, and no registration is needed. Licensing records that contain trade secrets may put that protection at risk, so many companies exclude them. Read more.

U

Upfront payment

A fixed amount paid at or soon after signing, regardless of what the buyer later does with the records. It gives you certain income now and shifts the risk of the data underperforming to the buyer. When it is the only payment, it is often called a lump sum. Check whether any part is held back, tied to acceptance of the delivery, or refundable. Read more.

W

Wind-down

The process of closing a company outside of, or alongside, bankruptcy: paying debts, filing final tax returns, ending contracts and distributing what is left. In Delaware, for example, a dissolved corporation continues to exist for at least three years to settle its affairs. Records may be licensed during a wind-down, but tax and legal retention duties still apply. Read more.

Work made for hire

A U.S. copyright rule under which the employer, not the individual creator, owns a work. It covers work employees create as part of their jobs, and certain commissioned works where the work fits one of nine listed categories and both sides sign a written agreement that expressly calls it a work made for hire. Otherwise, documents or code made by outside contractors generally belong to the contractor unless the contractor signed a written transfer of the rights. Ask your lawyer if unsure. Read more.

Sources

indemnity (Wex, Legal Information Institute, Cornell Law School), accessed 2026-10-16
warranty (Wex, Legal Information Institute, Cornell Law School), accessed 2026-10-16
license (Wex, Legal Information Institute, Cornell Law School), accessed 2026-10-16
chain of title (Wex, Legal Information Institute, Cornell Law School), accessed 2026-10-16
trade secret (Wex, Legal Information Institute, Cornell Law School), accessed 2026-10-16
escrow (Wex, Legal Information Institute, Cornell Law School), accessed 2026-10-16
clawback (Wex, Legal Information Institute, Cornell Law School), accessed 2026-10-16
11 U.S. Code § 332 - Consumer privacy ombudsman (Cornell LII), accessed 2026-10-16
11 U.S. Code § 363 - Use, sale, or lease of property (Cornell LII), accessed 2026-10-16
Trade secret policy - U.S. Patent and Trademark Office, accessed 2026-10-16
Gramm-Leach-Bliley Act (FTC Business Guidance), accessed 2026-10-16
FTC Safeguards Rule: What Your Business Needs to Know (Federal Trade Commission), accessed 2026-10-16
No, hashing still doesn't make your data anonymous (FTC Technology Blog, July 24, 2024), accessed 2026-10-16
Summary of the HIPAA Privacy Rule (HHS.gov), accessed 2026-10-16
Methods for De-identification of PHI (HHS.gov), accessed 2026-10-16
Frequently Asked Questions - California Privacy Protection Agency (CCPA, CPRA, data brokers), accessed 2026-10-16
California Civil Code section 1798.140 (definitions, including sensitive personal information and deidentified), accessed 2026-10-16
de-identification - Glossary (NIST Computer Security Resource Center), accessed 2026-10-16
anonymization - Glossary (NIST Computer Security Resource Center), accessed 2026-10-16
pseudonymization - Glossary (NIST Computer Security Resource Center), accessed 2026-10-16
personally identifiable information - Glossary (NIST Computer Security Resource Center), accessed 2026-10-16
provenance - Glossary (NIST Computer Security Resource Center), accessed 2026-10-16
NIST SP 800-188, De-Identifying Government Datasets: Techniques and Governance, accessed 2026-10-16
NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025; Section 4.6 and Appendix C sample Certificate of Sanitization), accessed 2026-10-16
How long should I keep records? (IRS), accessed 2026-10-16
Closing a business (IRS), accessed 2026-10-16
Delaware Code Title 8, Chapter 1, Subchapter X - Sale of Assets, Dissolution and Winding Up, accessed 2026-10-16
Export all your organization's data (Google Workspace Admin Help), accessed 2026-10-16
IP Licensing Basics: Financial Terms (Simon Fraser University Technology Licensing Office), accessed 2026-10-16
Selling Company Data for AI Training: What to Know Before You Say Yes (Frankfurt Kurnit Klein & Selz, Oct 1, 2026), accessed 2026-10-16
AI labs are buying data from dead startups to train their models (MIT Technology Review, Oct 13, 2026), accessed 2026-10-16
AI labs are fueling a wild market for your Slack DMs (Business Insider, Oct 13, 2026, as republished by DNYUZ), accessed 2026-10-16
exculpatory clause (Wex, Legal Information Institute, Cornell Law School), accessed 2026-10-16
Confidentiality Agreements (University of Houston, Division of Research), accessed 2026-10-16
17 U.S. Code § 204 - Execution of transfers of copyright ownership (Cornell LII), accessed 2026-10-16
reinforcement learning - Glossary (NIST Computer Security Resource Center), accessed 2026-10-16
synthetic data generation - Glossary (NIST Computer Security Resource Center), accessed 2026-10-16
Machine Learning Glossary: agent (Google for Developers), accessed 2026-10-16
Datasets: Dividing the original dataset (Google Machine Learning Crash Course), accessed 2026-10-16
California's SB 53: The First Frontier AI Law, Explained (Future of Privacy Forum, Oct 2025), accessed 2026-10-16

Simplified definitions for general information, not legal, tax or financial advice.