Data provenance is becoming a buying requirement

For a long time the main question about training data was how much of it there was. Increasingly the first question is where it came from. Buyers of company data want to know who authorized its use, what was taken out, what the licence allows and what happened to the raw copy, and a dataset that cannot answer those questions is harder to buy at any price.

AI teams sit at the end of a long chain. Their models go to enterprise customers, and those customers have legal, security and procurement teams of their own. When one of them asks how a model was trained, the lab needs to be able to give a clear answer about each data source it used.

There are practical reasons too. If a problem is found in a dataset after delivery, the buyer needs to know exactly which company it came from and under which terms, so it can respond. If a dataset is used for evaluation, the buyer needs confidence that it is private and has not leaked into public training corpora. And internal review boards at larger labs often will not approve a new source without documentation.

None of this is unique to company data, but company data raises the stakes. It contains employees, customers and vendors who never posted anything publicly. Buyers rightly want to see that it was handled with care.

For web text, provenance is mostly about the URL and the crawl date. For licensed company data it is a chain of decisions, and each link should be documented:

• The source entity. Which company the data came from, and that the company entity, not an individual, is the licensor and the party being paid.
• Authority to sign. Who signed and why they had the right to. For a closing company this might be a director, officer, liquidator or assignee, with an authority document provided up front.
• Scope and exclusions. Which tools, date ranges and folders were included, and which clients, channels or folders were excluded, annexed to the contract before any data moved.
• Anonymization. How people, companies, addresses, emails, phones and accounts were tokenized, what was removed outright and which categories were excluded by default.
• Seller review. Confirmation that the company reviewed an anonymized sample before delivery.
• Licence terms. What the buyer may do with the data, and what it may never do.
• Deletion. Evidence that the raw archive was deleted, and when.

A buyer who has all of that can answer almost any question a downstream customer is likely to ask.

Gaps tend to appear in predictable places. A former employee offers an export they kept after leaving. A founder signs on behalf of a company that has already entered a formal insolvency process and no longer controls its assets. Data is shared before anyone agrees what is out of scope, and the exclusions are negotiated afterwards. The anonymization step is outsourced and nobody can say who held the raw files in the meantime.

Each of these may be well intentioned. Each one also leaves the buyer holding data it cannot fully account for. The safest pattern is to settle authority, scope and handling before the first file moves, not after. Our post on who can sign a data licence when a company is closing covers the authority question in more detail. It is general information, not legal advice, and questions of authority are worth taking to counsel.

Our process is designed so that provenance is a byproduct of doing things in order, not a separate paperwork exercise.

The seller sets scope and exclusions, and those are annexed to the contract before any data moves. For winding-down or closed companies, we request the authority document up front, and payment always goes to the company entity. The evaluation is read-only. Anonymization is done in-house, so no third party touches the raw data. Every person, company, address, email, phone and account becomes a consistent token across every tool; credentials, API keys, card numbers and government IDs are removed; faces, logos and signatures are blacked out in images and PDFs; HR, payroll, medical and legally privileged folders are excluded by default.

The seller reviews an anonymized sample before delivery. The licence is limited to training and evaluation, and buyers may never market to, profile, contact or re-identify anyone in the data, and may never resell it for marketing or people search. The raw archive is deleted within 30 days of sign-off as a contract obligation, and a deletion certificate is issued.

The details of the anonymization pipeline and our employee data standard are on the trust page.

For labs, provenance is becoming something to ask about at the start of an evaluation, not at the end. A source that can show its chain clearly is easier to approve, easier to defend and easier to keep using.

For sellers, it is mostly good news. The steps that create a strong provenance record are the same steps that protect the company and the people in its data: clear authority, written exclusions, in-house handling and certified deletion. A company that licenses this way is not just easier to buy from; it is better protected.

If you are an AI lab that needs company data with a documented chain from signature to deletion, send us a sourcing brief.