Is this offer legitimate?
Check who the buyer is, which legal entity will sign and pay, and whether its story holds up through sources you find yourself. Never send raw data, passwords or system access before a signed contract that says exactly what is shared and how it is protected.
Why is vetting important in this market?
Buying company records for AI training became a visible business in 2026, and visible markets attract people who are not what they claim. Your records are also valuable to the wrong people: email archives and chat logs hold customer details, pricing, passwords pasted into chat, and the names and habits of your staff.
Checking how a buyer will protect your records matters as much as checking that the buyer is real.
- CheckAre these records your company's own?
Records you create running your business usually are. Data you hold for customers, under their contracts, often is not.
- CheckDo contracts or NDAs restrict use?
Customer, supplier and partner agreements can bar sharing even de-identified material. Read them, or have counsel read them.
- CheckDo they contain personal data?
Employee and customer details must be removed, and some laws (for example California's) give people rights over their data.
- CheckIs any of it regulated?
Health records, financial-account data and professional client files carry their own rules. Exclude them unless counsel says otherwise.
Who exactly is signing and who is paying?
Ask for the full legal name of the company that will sign the contract and the one that will pay you. They should be the same, or you should understand why not.
Look the entity up yourself in the state business registry where it says it is formed. Delaware's Division of Corporations offers a free name search, and California's bizfile Online offers a free business search. Confirm the name, formation date and registered agent match what you were told. A company that cannot name its legal entity, or gives one that does not exist, is a stop sign.
Is the person contacting you who they say they are?
Introducers, brokers and recruiters are common in this market, and many are legitimate. Ask each one plainly who they work for and how they are paid. A disclosed referral fee paid by the buyer is normal; an introducer who will not say is not.
Verify contacts independently. The FBI advises checking links and email addresses for small misspellings of a company's real domain name. Confirm any unusual request through a separate channel, such as a phone number you looked up yourself, not one in the message. The FTC's general advice applies too: honest businesses give you time to decide.
Red flags to watch for
None of these proves fraud on its own, but each one deserves a hard question.
- They ask for a full export, admin login or API access before any contract is signed.
- They ask you to pay a fee to be considered, to "unlock" an offer or to cover processing.
- They pressure you to sign quickly or say the offer expires today.
- The paying entity, bank account or country changes partway through.
- They will not say what the data will be used for, or say "anything we like".
- They cannot describe how personal information will be removed or who does it.
- There are no references, no business address and no verifiable history.
What should happen before any data leaves your hands?
A sensible order is: confidentiality agreement, then a small, cleaned sample if the buyer needs one, then a signed license, then the full delivery. The sample should be scrubbed of personal and confidential material first and should be covered by the confidentiality agreement.
The license should name the parties, the exact data, the permitted uses, any exclusivity, the payment terms, how personal information is handled, security duties, and what happens to the data if the deal ends. Have your lawyer review it. Never send passwords or logins by email; the FBI specifically advises against it.
How can I check references?
Ask the buyer for one or two companies that have licensed data to it and are willing to talk. Some will decline for confidentiality reasons, which is understandable. Others can point to public reporting, published program terms or an established parent company you can look up. Search the company name together with words like breach, lawsuit or complaint.
This site checks each buyer program's own published pages before listing it, but a listing is not an endorsement. You still need to do your own checks.
Common questions
Is it normal for a buyer to want a sample?
Yes, many buyers want to see representative records before pricing. Send only a small, cleaned sample under a signed confidentiality agreement.
Should I ever pay a buyer or introducer to get an offer?
Be very wary. In a normal deal the buyer pays you. Any fee you are asked to pay deserves close scrutiny and a call to your lawyer.
How does this site get paid?
Some buyers may pay Minimus a referral fee when a company we sent signs with them. You pay us nothing. Each buyer's page on this site says whether we are in its referral program. See the guide on how referral fees work.
What if I already sent data?
Ask your lawyer about your options, change any shared passwords, and ask the recipient in writing to confirm deletion. If money was sent based on false instructions, contact your bank at once and file a report at ic3.gov.
Sources
- Business Email Compromise: The $55 Billion Scam (FBI IC3 PSA I-091124-PSA, Sept 11, 2024), accessed 2026-10-15
- How To Avoid a Scam (FTC Consumer Advice), accessed 2026-10-15
- Delaware Division of Corporations entity search, accessed 2026-10-15
- California Secretary of State bizfile Online (SCORE Ventura County overview), accessed 2026-10-15
- AI labs are buying data from dead startups to train their models (MIT Technology Review, Oct 13, 2026), accessed 2026-10-15
General information, not legal, tax or financial advice.