Vetting an AI data buyer: what to check before anything leaves your hands

Many ads lead to a Meta instant form, not a website, so there is often no company to look up. Ask for the legal entity name, a website with a physical address, and a named person you can find on LinkedIn.

Next comes the big one: will they license the data themselves, or pass you to someone who will? Brokers usually earn a commission on the introduction. Some name big buyers like micro1 and Mercor as outlets. Until that buyer confirms it, it is just a claim.

Find out which AI company ends up with the records, and whether they will name it. Ads drop names like Anthropic, OpenAI and Google, but an ad is not an agreement. According to MIT Technology Review, sellers frequently never learn the final buyer's identity.

Ask how they will pull the data. The law firm Frankfurt Kurnit recommends not letting buyers plug straight into your systems. If one insists on connecting, pin down the exact access, and whether it is read-only and expires.

• Any folder, system or record type can be excluded
• You review a cleaned sample before you sign
• Client and employee names are replaced with codes
• Raw files are deleted on a stated schedule after processing
• Who may receive the data, and whether resale is allowed
• What the buyer is liable for if the data leaks

Test security claims wherever possible. Mercor advertises SOC 2 Type II certification, and in March 2026 it reported a breach linked to the compromised LiteLLM project. Weigh both.

Ask when you are paid. Buyers that publish timing usually quote a few weeks after acceptance of the data, though it varies.