Chain of title, rights, privacy
Provenance you can put in front of counsel
A court sale or a signature passes title, but it doesn't erase privacy promises, employment law or third-party contracts. Those follow the data. So we check them before a lot is offered, and we write down what we found.
1. Authority to sign
We confirm who can license the data: an authorized officer of an active or dissolved company, a bankruptcy trustee with court approval, or an assignee in an assignment for the benefit of creditors.
2. The right to license
We look for content the company doesn't own outright: client-confidential material, data under NDAs, licensed third-party data, and platform terms. Slack's API terms, for example, bar third-party apps from using API data to train a large language model, so chat comes from the owner's native export.1
3. Privacy and consent
We review the privacy policy and notices in force when the data was collected. HR, medical and payment data and consumer databases are excluded by default. EU and UK personal data needs its own lawful basis. Employee communications get extra care.
4. De-identification
Personal identifiers are removed before delivery under a method agreed per lot. Public deals set useful precedents: in Spirit Airlines' bankruptcy, each transfer required a de-identification agent's certification under California's standard.2
The provenance pack
What travels with each lot, so your counsel and data team can review it:
- Authorization: board or officer approval, or the court order or assignment
- Source systems, export method and date ranges
- Inclusions and exclusions, with reasons
- The privacy policy and notices that applied
- De-identification method, who performed it, and any certification
- Restrictions on use, re-identification and onward transfer
- A named contact for diligence questions
Some companies won't clear. When rights or consent are unclear, we leave that data out or walk away.
Common questions
What if a company's privacy policy never mentioned AI training?
That's common, and it shapes what can be included. Personal data collected under a policy that didn't cover this use is excluded or de-identified, and consumer data is left out by default. Counsel on both sides should review each lot.
Can you deliver data from a bankruptcy estate?
Only with the authority the case requires. In a US bankruptcy that usually means a sale approved by the court, and where personal data is involved the court may appoint a consumer privacy ombudsman first (11 U.S.C. § 363(b)(1) and § 332).
Who performs de-identification?
It's agreed per lot and named in the provenance pack: our process, the buyer's own tools, or an independent de-identification provider.
- Slack, API Terms of Service (provision on training large language models).
- Stretto Research Suite, "The Spirit Airlines deidentified data sale", Sept 13, 2026.
Tell us your diligence bar
Include your de-identification and documentation requirements in your brief.