License data for AI without selling the people in it
Email archives, chat logs, tickets and documents now have buyers. Every deal needs the same three things: personal data out, the useful structure kept, and evidence that a court, buyer or regulator will accept.
Evidence pack · batch 07Ready for releaseIllustration
Files in
48,210
Files out
48,210
Values treated
1.92M
Policy
Licensing v2
Treated, by category
Names612k
Emails488k
Free-text identifiers419k
Phone numbers201k
Addresses154k
Account numbers37k
Other9k
Residual risk
Re-scan of a 2,000-file sample0 original values
Manual review of 200 files0 issues
Approved for release · Data Protection Officer · 3 Oct 2026Summary PDFFindings CSVPolicy JSON
What buyers and courts now ask for
People taken out
From message bodies, signatures, attachments and metadata, not just the To and From lines.
Value kept
Threads, timing and who-replied-to-whom stay intact. Blacked-out text is worth far less for training.
Evidence
Counts of what was found and removed, and a measured risk of re-identification, for each transfer.
How it works
1Take inventoryMailboxes, chat workspaces, tickets and files: what's there, and where personal data clusters.
2De-identify, links keptConsistent replacements, so one person stays one (different) person across every thread and file.
3Check what got throughRe-scan the output, count any original values that survived, and run the re-identification tests you agreed up front.
4Hand over the evidenceWhat was found, what policy ran on what, what failed, and how to reproduce the run, for each batch that leaves.
The evidence pack
What you can hand a buyer, a court or your DPO
Every run leaves a record of what the approved policy covered, what it actually touched and what, if anything, got through.
Also in every run record
Run ID, time, and who started it
The exact policy, software version and seed used
Files and records read, transformed, skipped and written
Errors, warnings and manual exceptions
Output re-scan results
Where the assurance stops
We attest to technical facts: what was scanned, what ran, what passed and what failed. We do not certify that data is anonymous against every possible recipient or dataset. Your DPO, counsel or risk team makes that call, with the evidence in hand.
In production today
Mixed archives are de-identified in one pass: Slack exports, mailboxes with attachments, office files, scanned PDFs, calendar files and images, under a single policy.
Grouping is a policy choice: related brands can share one replacement or keep their own. So is strictness: “mental health” as a research topic can stay while “she was treated for anxiety” is masked.
Runs in parallel
Files are processed independently, so the deadline sets the size of the run.
Re-runnable
The same policy applies to the next batch, and the one after.
Engineer-led
A second opinion on someone else's de-identification
If another team or vendor has already scrubbed the data, an independent check samples the output, looks for what was missed and reports the risk that remains. Buyers, ombudsmen and boards can lean on a check from someone who didn't do the work.
Sample drawn from each transfer
Missed identifiers counted by type
Re-identification attempts on indirect details
A short report for the buyer or the court
What's in a typical archive
Email bodies, signatures and forwarded threads with customers in them.
Attachments: contracts, CVs, invoices, passports scanned for onboarding.
Slack and Teams messages, including private jokes and health mentions.
Tickets and CRM notes written about customers.
Calendar invites, spreadsheets and screenshots with names and numbers in them.
Code repositories, with author names and emails in every commit.
What's available
PDF, DOCX and PPTX filesEngineer-led
Mailboxes, Slack exports, office files, text in imagesEngineer-led
It can be. Under GDPR, pseudonymised data is still personal data, and only data that can't reasonably be traced back to someone counts as anonymous. That's why measuring what could still be traced back matters as much as replacing names. Take legal advice on your own deal.
Will the data still be useful for training?
That's the reason to replace rather than black out. Realistic names and numbers in the same places keep the text natural, and consistent replacements keep who-said-what-to-whom intact across a thread.
How long does it take to set up?
We build the policy with you from your own rules for what counts as sensitive. After the first runs, changes are policy edits applied on the next run, with no engineering work.
Who is this for?
Companies licensing their own data, the advisers and estates handling a wind-down or bankruptcy sale, and buyers who want proof before they take delivery.
The platform underneath, in production
Documents run on the same platform banks, insurers and health companies already trust with their data.
Documents and text use the same policies, the same engine and the same deployment as these results.
