Your datasets never pass through us. Any transfer happens directly between your company and the buyer, after you sign. This page shows exactly what moves, where, under which document, and who is on the hook at each link. It is written so your counsel can check it against the contracts.
We are an agent, not a marketplace and not a data processor. The only things that pass through us are the manifest you approve and the offers that come back.
You approve the manifest. Later, you choose the de-identified sample. After signing, you transfer the licensed records directly to the buyer, from your systems to theirs.
We hold a one-page description of what exists and nothing else. No upload path, no data room, no credentials. We could not misuse your data if we wanted to, because we do not have it.
Signs the license with you. Receives the supplied copy from you, not from us. De-identifies before training, uses it only within the field of use, deletes it at the end of the term, and certifies that it did.
A promise is only worth the mechanism behind it. Each line below names the mechanism and the party who can hold us to it. If any of them turn out to be false, you have a contract claim, not a complaint.
| The line | How it is enforced | Who enforces it |
|---|---|---|
| We never receive, store, or transmit your datasets. | Structural. There is no upload on this site and no data room of ours. Pricing happens on the manifest; transfer is direct from you to the buyer. | You control the transfer. The engagement letter makes it a contractual obligation on us. |
| No sample leaves your company without a mutual NDA. | The sample stage starts with the NDA, not the records. You choose which 50 to 200 de-identified records go in. | Your counsel reviews the NDA. The buyer is bound by it. |
| Your name is not shown to a buyer until you approve. | Buyers see an anonymized profile first: industry, size, years, systems. Identity is released only when you say so. | You. The engagement letter prohibits us from naming you without approval. |
| No records move before de-identification is in the contract. | The license names the method, the verification step, and who performs it, before delivery, not after. | The buyer, contractually. Your counsel confirms the clause is there before you sign. |
| No exploding offers. | We do not pass along an offer with fewer than ten business days to decide. Buyers know this before they bid. | Us. If a buyer insists on a shorter deadline, you hear about it and the offer does not come through us. |
| We never ask for logins, exports, API keys, or files. | The manifest is built from a conversation. Counts and date ranges are enough; nothing is connected to anything. | You. If anyone claiming to work with us asks for access, say no and email us. |
| We take no fee from the buyer on your deal. | Our only fee is the published seller-side success fee. There is no origination fee, finder's fee, or referral fee on the other side. | The engagement letter. You can ask any buyer we introduce to confirm it in writing. |
The buyer wants the workflow: what came in, what was decided, how it ended. The buyer does not need, and under the license may not keep, the people. Replacement keeps the record readable; removal is used where replacement is not safe.
No de-identification method removes re-identification risk entirely. That is why the license names the method and the verifier rather than promising an outcome, and why your counsel reviews it. Regulated material (health records, privileged client work, payment data) is excluded from the manifest, not de-identified.
The same replacement is used everywhere the person appears, so a thread still reads as one conversation. Fictional example; names, numbers, and company are invented.
A buyer who will not accept these does not get manifests from us. They are standard enough that a serious buyer rarely objects, and specific enough that your counsel can check each one.
Not "industry standard." The license states what is redacted, what is transformed, and how consistency is kept, so your counsel can evaluate it and the buyer can be held to it.
A named person or process confirms de-identification was applied to the supplied copy before it reaches any training pipeline, with a written record.
The license sets a term from delivery. When it ends, the buyer deletes the supplied copy and sends a deletion certificate signed by a named person.
Your records go to one buyer and stop there. Passing them to a partner, a vendor, or a dataset marketplace is a breach, not a grey area.
What the buyer may build with the records is written down. A license to train a support agent is not a license to build a competitor to your business.
You, or an independent reviewer, can confirm the buyer did what the contract says. Rarely exercised; its presence changes behavior.
The manifest is built from a conversation. Everything on this list is unnecessary for pricing and dangerous to hand over before a signed license. Refuse it from anyone, including us.
Seven questions. A one-page manifest. A first offer in 24 to 48 hours.
Measured from a complete data manifest. A first offer is a process target, not a guarantee; buyers decide eligibility, price, and terms.