Handshake AI vs Mercor: send a copy of our data, or connect our accounts?

Handshake AI takes your data as-is and pays firms with 20+ full-time staff and 3+ years, on unpublished timing. Mercor connects to your tools, publishes no size rule, and typically pays 2–4 weeks after signing. Size and access decide fit. Both pay the company and remove personal details on their own side, as of October 2026. Handshake publishes a range and no payment date; Mercor publishes a payment date and no range.

Do we send a copy, or give them access to our accounts?

With Handshake, you send a copy. Its program page says “You decide what data you share,” then “all you have to do is transfer the data as it exists today, and we take it from there”; Handshake removes identifying details and cleans the records before “confidential delivery” to frontier AI labs. The page does not describe connectors or a transfer method (checked October 5, 2026).

With Mercor, you give access. Its program page says “Choose from 100+ supported tools and link your accounts,” then “Our platform extracts and de-identifies data into an asset.” It says “No data leaves your systems until you approve it,” that credentials are “held per session, never shared between connections,” and that it logs every access.

In both cases raw records reach the provider before personal details come out; the exposure differs. With Handshake, an unredacted copy sits on its side until its process runs, so ask who can see it, where it is stored and when it is deleted. With Mercor, an outside system holds access to your accounts while it extracts, so ask which permissions the connectors need and how you revoke them. If policy bars outside systems from connecting to your accounts, Handshake’s model avoids that; if your team has no time to run exports, Mercor’s does.

Will either consider a company our size?

Handshake’s published minimum is 20+ full-time employees and 3+ years in operation; Mercor publishes no size or age rule.

Your company	Handshake AI	Mercor
Fewer than 20 full-time employees	Below its published minimum	No published size rule
20+ full-time employees, under 3 years old	Below its 3-year minimum	No published age rule
20+ full-time employees, 3+ years old	Meets its published minimum	No published rule

Handshake’s wording, “20+ full time employees & 3+ years in operation,” is on its license and referral pages. Mercor’s program page names eight industries instead: legal, healthcare, finance and insurance, professional services, manufacturing, retail and e-commerce, real estate, and logistics and supply chain (both checked October 5, 2026). The missing rule does not mean Mercor takes every company; its criteria come out during scoping. Handshake counts full-time employees, so a contractor-heavy company should ask how it counts. Does my company’s data qualify? sets these rules beside other buyers’.

Which of our tools and records does each name?

Their lists overlap on email, chat and documents and split on business software:

	Tools named as examples
Both	Gmail, Outlook, Slack, Notion, Google Drive
Handshake AI only	Dropbox, Monday.com, NetSuite, QuickBooks, Paychex, ServiceTitan, AutoCAD, Figma
Mercor only	Microsoft Teams, Confluence, Salesforce, GitHub

Handshake’s license page lists “Examples of sources we buy,” plus “+1K more”; Mercor’s program page says it supports “100+” tools (both checked October 5, 2026). Both lists are examples, so ask about any tool that is missing. Mercor also gives example records by industry, such as work orders, QA logs and spec sheets for manufacturing, or shipping manifests, dispatch logs and invoices for logistics; Handshake’s sales job ad names “workflow data, code, support transcripts.” A company on QuickBooks or ServiceTitan will find those on Handshake’s list; one whose records live in Salesforce or GitHub will find those on Mercor’s.

What does each say it pays, and when?

Handshake publishes figures but no payment date, and Mercor the reverse. Handshake’s license page says “Payouts range from $100K to $4M,” and its program page headlines “Earn up to $4M+.” That page’s estimator shows $383,083–$896,969 at its defaults of 100 employees, 10 years and the USA, “an indicative estimate only and is not an offer to purchase your data,” with any payout subject to “the outcome of our due diligence process and your acceptance of our data licensing terms and conditions.” Its pages do not say whether payment is one amount, staged or ongoing, when it arrives, or whether fees are deducted (checked October 5, 2026).

Mercor says “Payment is issued via wire transfer upon delivery of the anonymized dataset to the buyer,” which “typically occurs within 2-4 weeks of the signed agreement, depending on data extraction and processing time.” Compensation “is based on data volume, the tools you connect, and the depth of your data,” and Mercor says it charges no fees and covers extraction, anonymization and transfer costs (program page).

Ask Handshake for the payment trigger and number of days in writing; ask Mercor for a figure after scoping, and what would change it. How do data licensing offers work? covers the steps from estimate to signed figure.

How does each remove personal details, and what stays our responsibility?

Each strips personal details itself, but only Handshake’s page says the legality of the transfer stays with you. Handshake’s program page says it “applies a structured process to remove direct and indirect personal identifiers from all datasets prior to delivery,” that “no de-identification process eliminates that risk entirely,” and that it “documents its methodology for each dataset as part of its standard governance records.” The same paragraph says “Data partners remain responsible for ensuring that their transfer to Handshake AI complies with applicable legal requirements.” Use is limited to “model training and evaluation only,” and “Partner companies are never identified.”

Mercor says “The extraction and anonymization process is fully automated” and “No AI lab buyer or third-party vendor ever sees your raw data” (program page). Its page does not describe its de-identification method, a review of output before delivery, how long it keeps the extracted dataset, or who answers for the legality of the transfer (checked October 5, 2026).

Ask Handshake for the methodology record for your dataset, and Mercor for a written description of its method. Ask both to show you a de-identified sample before full delivery. Look for a clause on the transfer’s legality in Mercor’s agreement, and see Is it legal to sell company emails and records? for what to check with your own lawyer.

Can we license the same data to Handshake AI and Mercor?

Their pages leave it open: neither agreement is public, and neither says whether the license is exclusive (checked October 5, 2026). Handshake’s payouts depend on its unpublished “data licensing terms and conditions.” Mercor’s page says “We license it, package it, and pay you for it” and states no limits on use. Because both name the same email and chat tools, both may ask for the same Slack or Gmail history; ask each whether licensing it to the other would breach its terms. Am I selling my data or licensing it? covers exclusivity and licensing to more than one company.

Why might either contact us, or our employees?

Both sell outbound and pay referrers. Handshake’s SDR job ad describes “high-volume outbound (calls, email, LinkedIn),” and its referral page pays a $10K bonus “when their deal closes.” Mercor pays a bonus for a referred company “when they go live and start earning,” but its program page gives no amount (checked October 5, 2026). Mercor also approaches companies on its own. When HubSpot agreed to acquire Warmly, Mercor offered eight days later to buy or license Warmly’s codebase and task records, according to AI Weekly’s August 2026 summary of a report in The Information. If a contact recommends either, ask whether a bonus depends on your signing.

Both have also sought material from individuals, outside these company programs. A Handshake AI program for individuals pays $6 a page, capped at $30,000, for documents they own or are authorized to share, Business Insider reported in August 2026. Gizmodo, summarizing a Wall Street Journal report in April 2026, wrote that Mercor had asked professionals, including visual-effects artists, for materials from past work; Mercor said it “does not buy intellectual property.” If staff mention such offers, start with your confidentiality agreements, and ask either provider whether it also takes submissions from your current or former employees.

How long has each been doing this?

Handshake, the careers network, was founded in 2014; its AI data business had launched about a year before January 2026 and supplied data to eight top AI labs, including OpenAI, TechCrunch reported. The company-data program is newer: a job ad calls it “a zero-to-one build” hiring its first 5–10 reps, and the license page shows “$250M Paid out to partners” without saying who the partners are.

Mercor was founded in 2023, and TechCrunch put its contractor marketplace at about $500 million in annualized recurring revenue in October 2025. Its most visible company-data record is the Spirit Airlines bankruptcy. After Google was named the winning bidder at $10 million in August 2026, Mercor’s $7.5 million offer stood as the backup bid (Bloomberg Law); the sale still needed court approval as of late September 2026 (Moneywise). Neither publishes a completed company-data deal with its price.

Has Handshake or Mercor had a security incident?

Each has a reported incident, of a different kind and year. On March 31, 2026, Mercor told TechCrunch it was one of thousands of companies affected by a compromise of LiteLLM, an open-source project, and that it “moved promptly to contain and remediate the security incident.” The Lapsus$ group claimed to hold about 4 terabytes of Mercor data (Cybernews, April 1, 2026). TechCrunch reported on April 9 that Meta had paused its contracts with Mercor, citing Wired, and that five contractors had sued over alleged exposure of their personal data, citing Business Insider. These reports did not say whether records from companies licensing data to Mercor were involved.

The Review, the University of Delaware’s student newspaper, reported in February 2020 that an unauthorized party posing as a company on Handshake downloaded the resumes of 8,029 University of Delaware students and alumni, which they had made visible to employers on the site. The report concerned Handshake’s careers network, years before its AI data business launched.

Mercor’s data page cites SOC 2 Type II; Handshake’s trust portal lists a SOC 2 Type II attestation for the company, with the report available on request. Neither says which systems or period its report covers (checked October 5, 2026). Ask both for the current report, and ask Mercor what it changed after March 2026, since its connectors would hold access to your accounts.

What should we ask Handshake AI and Mercor?

Ask both for the figure and payment terms in writing, and for what the license and the law require of you:

1. What is the figure, in writing, and can due diligence change it after we transfer data?
2. What triggers payment, how many days after is it due, and is any of it staged or ongoing?
3. Is the license exclusive, for how long, and which AI labs receive the data?
4. Who answers for the legality of the transfer, and what notice do our employees and customers need?

When does Handshake AI fit better than Mercor?

When your company meets its size and age minimum, uses software it names, or would rather send a copy than connect its accounts.

• You have 20+ full-time employees and 3+ years in operation, and want a published range, $100K to $4M, to measure a quote against.
• Your records sit in accounting, payroll, field-service or design software it names, such as QuickBooks, NetSuite, Paychex, ServiceTitan or AutoCAD.
• Your policy bars outside systems from connecting to your accounts, and you would rather transfer a copy.
• You want a written de-identification methodology for your dataset, which Handshake says it keeps.

When does Mercor fit better than Handshake AI?

When your company is smaller or younger than Handshake’s minimum, works in the tools Mercor names, or wants a known payment date without running exports.

• You have fewer than 20 full-time employees or fewer than three years in operation, which Handshake’s published minimum excludes.
• Your records are in Salesforce, GitHub, Microsoft Teams or Confluence, which Mercor names.
• You want a published payment trigger and timeline: a wire on delivery, typically 2–4 weeks after signing, with no fees.
• Your team has little time for exports and you accept automated extraction through connectors, after hearing what Mercor changed since March 2026.