How much work is it to license company data?

Usually little at the start: a short description of your company, then counts of what each system holds. The real work comes at the sample and delivery stage, and how much depends on whether the buyer connects to your systems or you send it a prepared copy.

Where does the work fall, stage by stage?

Most of it falls after a buyer has shown interest. As of October 2026, providers describe the stages like this:

Stage	What you provide	Who usually does it	What providers say
1. Application	A description of the company and its systems, no files	Owner or office manager	Polyshares puts its first step at about two minutes; Troveo’s assessment has 10 questions
2. Inventory	Record counts and date ranges per system	Office manager, with admin access	Polyshares’ intake asks for “The exact count from each tool’s admin page”
3. Scoping	Which systems, years and record types are in	Owner	Handshake AI holds a scoping call on data, de-identification, terms and timeline
4. Sample	A small, de-identified slice, under NDA	IT firm, provider or both	Appen says you review a representative sample pack before anything is licensed
5. Agreement	Signature on written terms	Owner, with a lawyer	Appen agrees terms in writing before anything is extracted
6. Export and delivery	The full licensed scope	IT firm, or the provider through a connection	Troveo’s FAQ: “A short scoping call and a few hours on exports”

Stages 2 and 4 are where Data Licensing Report’s free sample tool saves work. It reads a Slack export, a mailbox (.mbox or .eml) or spreadsheet exports in your browser and builds the inventory: date ranges, volume by month, threads, and people as a count. It then helps you prepare a redacted sample. Nothing is uploaded unless you choose to. Outlook .pst files cannot be read yet; save the messages as .eml first.

Do they connect to our systems, or do we send them something?

Some providers connect and some have you send a copy, and that decides who touches your systems and who sees raw records. As of October 2026:

Provider	How records leave your systems	Where names and identifiers come out
Appen	Appen extracts, read-only, with credentials scoped to the engagement	At Appen; it says no lab sees raw data
Avelence	“Your team controls the export.” The matched partner prepares a separate copy	At the partner Avelence introduces
Handshake AI	You transfer the data as it exists	At Handshake AI
Mercor	You “link your accounts” through its connectors to 100+ tools	In Mercor’s platform; it says no data leaves your systems until you approve it
micro1	Not published: who runs the export, and what access micro1 needs	PII removed “when relevant”, per its FAQ
Polyshares	Nothing moves before an offer; the intake asks for counts, not files	At an unnamed anonymization partner, first
Replay	Replay exports the data	At Replay; it says raw data is used only for de-identification
Scale AI	Scale works inside your environment, with on-premises and VPC options; credentials stay with you	Inside your environment, before extraction
Telegraph Lab (affiliated with this site)	Telegraph Lab coordinates the export, preparation and delivery of an agreed copy	At Telegraph Lab, before the copy is shared
Troveo	You run the exports with its guidance: “No OAuth into your systems. No platform to install.”	At Troveo

If a provider connects, your IT firm’s job is granting access, scoping it and removing it afterwards. In Microsoft 365, an app that reads Teams chats through Microsoft’s export APIs needs permissions such as Chat.Read.All that an administrator consents to. For Slack, ask how the connection fits Slack’s API terms, which since October 10, 2025 say apps offered outside your organization may not “use API Data to train a large language model”.

If you send a copy, your IT firm runs the exports below and you see exactly what leaves. Either way, settle the scope in writing first.

What does my IT firm have to do, and will they bill me 40 hours for it?

Not for a standard export. The hands-on part is a short list of admin steps in each system, set out below with links to the vendors’ own instructions. Much of the elapsed time is the export job itself, which needs nobody watching it: Google says its organization-wide export typically takes 72 hours and can take up to 14 days.

Hours climb when nobody at your company holds the admin role an export needs, when the right license is missing, when departed staff’s data has to be recovered, or when the scope keeps changing. Ask your IT firm for a fixed quote against a written scope: which systems, which mailboxes or channels, which date range, what format, and where the files go.

Microsoft 365 (Outlook, Teams, SharePoint, OneDrive)

1. Whoever runs the export needs an eDiscovery role, such as membership of the eDiscovery Manager role group, which a member of the Organization Management role group can assign (Microsoft).
2. Check the license before the quote. Microsoft’s export page says to “assign the eDiscovery user a Microsoft 365 Enterprise E3 or E5 license”, while its Exchange Online service description lists content search on Business plans. On a Business Standard tenant, ask which applies.
3. In the Microsoft Purview portal: create a case, run a search limited to the agreed mailboxes, sites and dates, export, then download. Packages expire 14 days after they are created; mail comes out as .pst or .msg files and Teams chats as HTML transcripts (Microsoft).
4. Old instructions may not work: Microsoft retired classic Content Search on August 31, 2025.

For a single mailbox, the user can export to a .pst file from the new Outlook for Windows under Settings > Files > Export (Microsoft).

Google Workspace (Gmail, Drive, Chat)

1. A super admin account at least 30 days old, with 2-Step Verification on, runs the Data Export tool; organizations with more than 1,000 users contact support first (Google).
2. The tool exports the whole organization’s data, or selected users’, to a Google Cloud Storage bucket, and the export is deleted 60 days after it starts. On Business editions, a full export can run once every 30 days (Google).
3. For a narrower cut by person, search term or date, Vault (Business Plus and above) exports Gmail as .pst or .mbox (Google). One user’s Gmail can also be downloaded through Google Takeout.

Slack

1. A Workspace Owner or Admin exports public channels from the workspace settings. The export is a ZIP of JSON files with links to files, not the files themselves (Slack, Slack).
2. On the Free plan, messages and files more than a year old may already have been deleted (Slack), and the export carries file links only from the last 90 days (Slack).
3. Private channels and direct messages: on Business+, a Workspace Owner applies for the all-conversations export, which the Primary Owner must approve. On Free and Pro, Slack approves only with valid legal process, members’ consent, or a legal requirement or right (Slack).

System	Who can run the bulk export
Microsoft 365	An account with an eDiscovery role, assigned by a member of the Organization Management role group
Google Workspace	A super admin
Slack	A Workspace Owner or Admin for public channels; a Workspace Owner, with Primary Owner approval, for everything on Business+

Does my IT firm own our Microsoft account, or do I?

The data is your company’s: Microsoft tells its customers “You own your data”. Day to day, though, control of the account sits with whoever holds the Global Administrator role, which Microsoft describes as able to reset any user’s password, manage subscriptions and add domains, with access to all administrative features (Microsoft).

Two common setups put that role with the IT firm:

• The IT firm set up the account. Microsoft says “The person who purchased a subscription for your organization and signed up for Microsoft online services is a Global Administrator automatically.”
• The IT firm resells your licenses with delegated admin rights. Microsoft says a reseller partner with these rights can assign the Global Administrator role to its own employees, and recommends a quarterly review of what the partner holds.

To check, open the Microsoft 365 admin center. Settings > Partner relationships lists any partner, and a Billing Administrator or higher can remove a partner’s admin roles there (Microsoft). The Roles page in the same admin center lists who holds Global Administrator. Microsoft recommends giving that role to fewer than five people and keeping two emergency access accounts.

If nobody employed by your company holds Global Administrator, ask your IT firm to set one up before any export work starts, and check what your managed-services agreement says about admin accounts and data when the contract ends. In Google Workspace the equivalent role is super admin; in Slack it is the Primary Owner.

Do I have to clean anything up first?

No. Each program above says it, or a partner, removes names and identifiers, and deleting or tidying records before a buyer has scoped them removes history you may later want to license. Handshake AI says you transfer data as it exists and it cleans records on its side, and Appen says it bears extraction, anonymization, preparation and transfer costs.

What helps instead:

• Write down what is out. Customers under confidentiality terms, HR folders, legal correspondence. Can I leave out certain customers, people or folders? covers how exclusions work, and is it legal covers which documents to check.
• Stop losses while you decide. Don’t delete leavers’ accounts or shorten retention. In Microsoft 365, a removed user’s mail is permanently deleted after 30 days unless a hold or retention policy applies; Does my company’s data qualify? covers what can still be recovered.
• Look before anyone else does. Run one export through the sample tool to see what it holds and how redaction looks on your own records.

Why buyers want these records in the first place is in Why would AI companies want our emails?, and the guide puts every stage in sequence.