Someone offered to buy our company's data. Is it a scam?

It may be genuine: as of October 2026, 25 companies publicly offer businesses a way to be paid for their records. A ten-minute check separates them from scams: who is behind the email, how you’d be paid, and what they want first. Ask in writing for anything missing before you send a file.

How do I check whether the offer is real?

Run these seven checks before you send anything beyond a reply. Together they take about ten minutes.

1. The company exists outside the email. Find its website yourself rather than through the email’s links. The site should name a legal entity, the people who run it and where it is based. The table in the next section shows that several real programs leave gaps here, so a gap is something to ask about.
2. The sender matches a public program page. The email should come from the company’s own domain, and its website should describe the same program. Appen, for one, says all official emails come from @appen.com addresses. A familiar name on an unfamiliar domain fits the first of the FTC’s four signs of a scam: pretending to be from an organization you know.
3. It says what triggers payment. Real programs name the event that releases the money: acceptance of the data at Appen, delivery of the dataset to the buyer at Mercor, approval followed by net 30 to 60 days at Polyshares. An email that promises payment without saying for what is incomplete.
4. You pay nothing to get paid. Appen, Mercor, Polyshares and Troveo each say the business pays no fee, and Corpus describes no fees on its one-time license payment. A request for a valuation, processing or release fee before money reaches you is a reason to stop; being told to pay in a specific way is another of the FTC’s four signs. A published commission on a deal, such as FileYield’s 8% agreement rate for sellers, is a different thing from a fee demanded before any deal exists.
5. No passwords, admin access or full export up front. First steps at real programs run on a description. Corpus starts with a manifest and no credentials or exports, and Polyshares’ intake asks for record counts rather than files. Access or an export comes after a written agreement and a review of a description or sample: Appen agrees terms in writing before anything is extracted, and Mercor lists scoping its project before connecting accounts.
6. It can say who ends up with the data. At least the type of buyer, and that the agreement will list who may use it.
7. It can say how it makes money. A margin, a share of each sale, a fee from the buyer or a referral fee.

If a check fails, ask for the missing piece in writing. A real program can answer in a reply. Pressure to act before you have the answer is the third of the FTC’s signs.

Who are these people?

They range from Appen, founded in 1996, to firms whose websites were registered in 2026. Look the company up the way Data Licensing Report checks every provider it lists: when it was founded, who runs it, where it is, and how it pays. For ten of the providers with profiles on Data Licensing Report, as of October 2026:

Provider	Founded	Leadership named	Headquarters	Payment trigger	Fee to the business
Appen	1996 (source)	CEO Ryan Kolln, CFO Justin Miles	Sydney street address on its About page	Acceptance of the data (source)	None, it says
Avelence	No date published; website registered September 2026 (source)	Founder Yananai A. Chiwuta (source)	United Kingdom; no street address or company number	Set by the partner it introduces (source)	Profile is free; a partner may pay Avelence (source)
Handshake AI	Parent company 2014 (source)	CEO Garrett Lord; no program head named	San Francisco	Not stated; terms set per deal under NDA (source)	Not stated on its program page
Mercor	2023 (source)	CEO Brendan Foody	San Francisco	Wire on delivery to the buyer (source)	None, it says
micro1	2022 (source)	CEO Ali Ansari (source)	San Francisco or Palo Alto; reports differ	Not stated (source)	Not stated
Polyshares	No date published; website registered May 2024 (source)	Three managing partners (source)	No address; a Delaware corporation with a registered agent (source)	Net 30 to 60 days after approval (source)	None, it says
Replay	No date published	None named on its website; its About page’s founder says they started Sunset, run by Brendan Mahony (source, Sunset)	Brooklyn street address in its terms (source)	Set in each engagement’s agreement	Set in each engagement’s agreement
Scale AI	2016 (source)	CEO Francis deSouza (source)	San Francisco	Not stated (source)	Not stated on its program page
Telegraph Lab	No date published; website registered August 2026 (source)	None named on its website (source)	San Francisco; no street address (source)	Milestones in the signed agreement (source)	Not stated
Troveo	Launched 2024 (source)	CEO Marty Pesis (source)	Austin, Texas street address in its privacy policy (source)	A share of each sale of your data (source)	None, it says

A gap in this table is a question, not a verdict. Telegraph Lab, which is affiliated with Data Licensing Report, names no leadership or street address on its website and registered its domain in August 2026; Avelence registered its domain in September 2026. Replay names no leadership on its website, and Avelence and Polyshares publish no street address. Ask any of them for what is missing, as you would ask a company that is not listed. Each profile has the full “Is it legit?” record with sources.

If the company that emailed you is not in the buyers directory, run the same checks. The directory lists the programs with a public page that Data Licensing Report has found, and is re-checked monthly; a new program may not be in it yet.

How did they find me?

The providers’ own job ads and referral programs point to two routes: a target list worked by a sales team, or an introduction from someone who is paid if your company signs.

Several providers hire people to contact companies directly. A Handshake AI job ad asks sales reps to “run high-volume outbound (calls, email, LinkedIn) against a target account list”, and Replay’s ad for the same role targets “healthy, ongoing companies with no urgent trigger pushing them to say yes”. Replay is also hiring an engineer to “build enrichment and list-building pipelines” that surface target companies.

Others pay for introductions, as of October 2026:

• Handshake AI pays $10,000 when a referred company’s deal closes.
• Scale AI pays up to $50,000 if it signs a partnership with the company.
• micro1 pays up to $50,000 once the company reaches revenue milestones.
• Telegraph Lab, affiliated with Data Licensing Report, pays $10,000 per completed deal, or 20% of the business’s licensing payments to approved partners, who introduce businesses by email.
• Miro Advisory recruits accountants, attorneys, M&A advisors and business brokers as referral partners.

So the email may come from, or follow a tip from, an adviser you already know. Data Licensing Report is paid this way too, and How we make money explains the arrangement. Ask the sender where your company’s name came from, and whether anyone is paid if you sign, and by whom.

Who’s the end buyer?

Usually an AI lab or another AI company that the firm writing to you does not name publicly. As of October 2026, none of the ten providers in the table above publishes the names of the AI companies that receive business data. They describe the buyers instead, and how much they commit to varies:

• Handshake AI: the prepared dataset goes to frontier AI labs for training and evaluation, under contractual confidentiality.
• Replay: data goes only to frontier AI and data labs, never to foreign adversaries or through brokers.
• Polyshares: it does not say which labs receive a record, and says resale or use beyond the license is not permitted.
• Telegraph Lab: the agreement names the authorized recipients and permitted uses, including any access by frontier AI labs.
• Troveo: buyers evaluate the data anonymously and are introduced to you only after an agreement is signed.

The buyer is named when an AI company buys directly, as Google does through its pilot program, or when a court sale is public, as with Spirit Airlines’ data. If the firm cannot name the buyer, ask for the type of buyer in writing, and for an agreement that lists the permitted recipients and uses and bars resale beyond them. Am I selling my data or licensing it? covers those terms, and What does “anonymized” mean? covers what the buyer receives.

What do they make on the deal?

Few firms publish what they make; it depends on how each is paid. As each describes its model, as of October 2026:

How the firm is paid	Examples	Amount published
It pays you, then licenses the prepared data to AI companies	Appen, Mercor, Polyshares, Telegraph Lab	No; what the AI company pays the firm is not published
It takes a share of each sale it makes for you	Troveo; Replay pairs upfront cash with a revenue share	No; neither publishes the percentage
The buyer pays it for introducing you	Avelence; License My Data says it is paid “out of the transaction”	No
It takes part of the deal when it closes	Sell My Business Data says it participates only when a deal closes	No
It charges the seller a commission	FileYield, 8% for sellers	Yes
A third party is paid for introducing you	Handshake AI, micro1, Scale AI and Telegraph Lab, listed above	Yes

Ask what the firm earns if you sign, and who pays it. The way to test a single offer is a second one for the same records: the offer benchmark lays out the one you have, and They offered us $75K for our data. Is that a good offer? covers what to compare. For what is being paid across the market, see Are AI companies really paying businesses for their data?