Mercor business data program review: how it works and pays

Mercor pulls de-identified data from the tools a business already uses, such as Slack, Gmail and Salesforce, and its program page says it pays by wire transfer on delivery of the anonymized dataset to the buyer, typically within 2–4 weeks of the signed agreement, as of October 2026. It publishes no price range, so a quote is the first figure an owner sees.

How is Mercor’s data program different from its contractor business?

Mercor’s core business pays people, not companies. TechCrunch described Mercor in October 2025 as a marketplace that pays former professionals in fields such as finance, consulting and law to produce training data for AI labs, with about $500 million in annualized recurring revenue. In the same article, CEO Brendan Foody said labs’ customers “don’t want to give them data to automate large portions of their value chains,” so labs hire contractors who previously worked at those companies. The data program asks the company itself to license its records: “We license it, package it, and pay you for it.”

Mercor’s dealings with individuals have also drawn reporting. Gizmodo, summarizing a Wall Street Journal report, wrote in April 2026 that Mercor had approached individual professionals, including visual-effects artists, for materials from their past work; Mercor told the Journal it “does not buy intellectual property.” That reporting concerns individuals. In the business program, the counterparty is the company that holds the records.

Mercor’s “Get a quote” button opens a general partner form that also covers its human expert data services and asks only for a work email, so it helps to say in the first message that the inquiry is about licensing company data.

When does Mercor pay, and what sets the amount?

Mercor says payment is issued by wire “upon delivery of the anonymized dataset to the buyer,” typically within 2–4 weeks of the signed agreement, “depending on data extraction and processing time” (program page). The trigger is delivery, not signing, so the payment date moves with extraction.

On the amount, Mercor says compensation depends on data volume, the tools connected and the depth of the data, and that “the more tools you share, the higher your payout will be.” It says it covers extraction, anonymization and transfer costs and takes no fees or deductions from the payment. The page describes a single payment and does not mention a revenue share; upfront payment versus revenue share explains how the two models split timing and risk.

Because pay rises with each tool connected, Mercor’s Scope step is where price and exposure trade off. A data inventory that lists which tools hold how many years of history shows what each added connection would contribute before the company approves it.

What does connecting tools to Mercor involve?

Mercor describes four steps: Scope (choose the tools and data), Connect (link accounts), Process (its platform “extracts and de-identifies data into an asset”) and Payout. It says it supports more than 100 tools and names Slack, Microsoft Teams, Gmail, Outlook, Confluence, Notion, Drive, Salesforce and GitHub (program page).

Mercor works through account connections rather than a file the company exports. It says “no data leaves your systems until you approve it,” that extraction and anonymization are automated, and that no AI-lab buyer or third-party vendor sees raw data. It also says it holds credentials per session, logs every access, is SOC 2 Type II certified and manages encryption keys in AWS KMS. The page does not describe its de-identification method, name the labs that receive the data, or say how long Mercor keeps the extracted dataset (checked October 2026).

Has Mercor had a security incident?

Yes. Cybernews reported on April 1, 2026 that Mercor confirmed it was “impacted by a supply chain attack involving LiteLLM,” an open-source software package, after a hacker group claimed to hold about 4 terabytes of Mercor data, including source code. Mercor said its security team “moved promptly to contain and remediate the incident” and that it was investigating with third-party forensics experts. The report did not say whether data from businesses in the licensing program was involved.

Mercor’s data program depends on access to a company’s accounts, so an owner considering it can ask three things: what Mercor changed afterward, how connector credentials are stored and revoked, and whether its SOC 2 Type II report covers the period since.

Does Mercor buy data from companies that are closing or being acquired?

Mercor’s program page lists industries rather than company status: legal, healthcare, finance and insurance, professional services, manufacturing, retail and e-commerce, real estate, and logistics and supply chain. Reporting shows it also pursues archives from companies in transition. Bloomberg Law reported that Mercor’s $7.5 million offer was named the backup bid when Google was named the winning bidder, at $10 million, for Spirit Airlines’ de-identified business data in an August 2026 bankruptcy auction; the sale still needed court approval as of late September 2026. AI Weekly, summarizing The Information, reported that Mercor offered to buy or license Warmly’s codebase and task records eight days after the startup agreed to be acquired by HubSpot. The market page tracks the Spirit sale.

What should an owner ask Mercor before connecting any tools?

Mercor’s program page leaves contract terms to the agreement. It does not cover these points (checked October 2026):

• Rights. Whether the deal is a license or a sale, whether it is exclusive, and whether the same data can be licensed elsewhere.
• Recipients. Which AI labs receive the dataset, and what uses are permitted.
• Price. How each tool and each year of history changes the payout, and whether the figure is fixed at signing.
• Payment risk. Whether payment depends on the buyer accepting the dataset, and what happens if extraction runs past four weeks.
• Review. Whether the company can inspect the de-identified output before delivery, and when Mercor deletes it.
• Access. Which account permissions the connectors need, and how to revoke them.

With no published range, a Mercor quote has no public reference point, which makes a second proposal the practical comparison; see how offers work.