Five questions your board will ask about licensing data

Licensing your company's operational data is a board-level decision at most companies, and it should be. The good news is that directors tend to ask the same questions. If you can answer these five clearly, the conversation usually moves from whether to do it to the terms under which you would.

This is general information, not legal advice; your counsel should review any licence and the contracts it touches.

This is usually the first question and the most important one. The data sits in tools the company paid for, created by employees in the course of their work. But some of it involves customers, vendors and partners who have their own contracts with you.

The practical answer is scope. Before any data moves, the company decides what is in and what is out, and those choices are annexed to the licence. If a customer contract has a confidentiality clause covering their communications, that customer's channels, folders and email threads can be excluded entirely. Exclusions are routine, not a sign of a problem.

Directors will also want to know who signs. At an operating company, it is whoever normally has authority to sign commercial agreements. At a company that is winding down, a director, officer, liquidator or assignee with authority over company assets can sign, and the authority document is requested up front.

Expect this one from anyone who has worked inside the business. Privacy is handled at three levels: what gets excluded, how the rest is anonymized, and what the buyer is allowed to do with it.

• HR, payroll, medical and legally privileged folders are excluded by default
• Direct messages are excluded unless the company chooses to include them and has the right to
• Every person, company, address, email, phone number and account becomes a consistent token across every tool
• Credentials, API keys, card numbers and government IDs are removed outright
• Faces, logos and signatures are blacked out in images and PDFs
• The licence forbids the buyer from marketing to, profiling, contacting or re-identifying anyone in the data

No third party touches the raw data, and the company reviews an anonymized sample before anything is delivered. The trust page sets out the full pipeline and our employee data standard.

A reasonable worry, especially at an operating company. The archive shows how the business worked, including its plans, pricing discussions and customer problems.

Three things address it. First, the licence is for training and evaluation only, and the data is never resold for marketing or people search. Second, the scope can exclude anything sensitive, from a single pricing channel to an entire product line, or limit the licence to records older than a chosen date. Third, anonymization replaces company names, including your customers' and vendors', with tokens.

The buyer is an AI lab teaching models to do general kinds of work, not a rival reading your files. Still, if a director points to a specific folder that worries them, the simplest answer is usually to exclude it. A licence that leaves out one sensitive area is far better than no licence at all.

Directors will want a number, and you should be candid that there is not one yet. Typical licences range from about $20K to $400K and up, depending on connection depth, years of history, headcount and the number of systems involved. A firm figure comes only after the data has been counted during the evaluation.

Payment goes to the company entity, not to any individual. That matters for governance and, at a closing company, for creditors. How the proceeds are treated for accounting and tax purposes is a question for your accountant. If you want a rough range to bring to the meeting, the value estimator is a reasonable starting point.

Boards are right to weigh distraction. The process is built to be light: a 15-minute intro call, a scoping conversation, a read-only evaluation that takes under an hour of the company's time, and a review of an anonymized sample. In total it comes to about an hour of seller time, and payment typically arrives within two to four weeks.

On risk, the main points are that access is read-only, anonymization is done in-house, and nothing is delivered until the company has reviewed the sample. The raw archive is deleted within 30 days of sign-off. That is a contract obligation, not a policy, and it comes with a deletion certificate the board can keep on file alongside the licence.

A one-page memo covering these five questions will answer most of what comes up. Attach the proposed scope and exclusions, a note on who will sign, and the plan for telling employees. Directors tend to be comfortable once they see that the company controls the scope, reviews the output before delivery, and holds the buyer to clear limits on use.

It also helps to name an owner. Someone, often the CFO or COO, should be the point of contact for the evaluation and the sample review, so the board knows the process will not drift.

If you would like help preparing those answers for your own company, book a 15-minute intro call.