Your company’s data can end up with those who train AI: how it happens and 3 things to do right away

Your company’s data can end up with those who train artificial intelligence, and nobody will tell you. It happens when the subscription software you store it in fails or gets acquired: the data passes to the new owner. And today the people training AI models pay for data from real companies.

Why isn’t your data in subscription software safe forever?

Every day a company puts customers, invoices and conversations into subscription software: the ERP, the CRM, Google Drive, WhatsApp. These vendors write that your data is safe.

That promise only holds as long as the vendor stays the same. If the software fails or gets acquired, the data is part of what passes to the new owner.

Who buys company data to train AI?

The market already exists. Startups that shut down are reselling their Slack chats, emails and internal tickets as AI training data.

• Up to $100,000 per company: that is the payout range, from $10,000 to $100,000, reported for the sales handled by SimpleClosure, a firm that helps startups wind down (Gizmodo, April 2026).
• Over 150 deals: that is how many Asset Hub, SimpleClosure’s platform for selling code and workplace data, has handled. The buyers include the labs that build foundation AI models (MIT Technology Review, October 2026).

The reason is simple. To teach an AI model to work like a company, you need conversations, documents and processes from real companies. You won’t find them on the public internet.

Can a bankruptcy really lead to selling sensitive data?

Yes, and it has already happened with the most sensitive data there is. 23andMe, the American DNA testing company, went bankrupt. The bankruptcy court approved the sale of the company, including the genetic data of millions of customers (23andMe press release, June 30, 2025).

The 23andMe case shows the mechanism: when a company goes bankrupt, customer data becomes an asset to be sold along with everything else.

What can you do starting tomorrow to protect company data?

In my view there are three things to do right away.

1. Read your ERP’s terms

Open your ERP’s terms and conditions and look for what happens to your data in case of an acquisition or sale. If the terms say nothing about it, you have a problem.

2. Keep the most sensitive data on open source tools

For the most sensitive data, consider open source tools: software whose code you can download and install on your company’s own systems. There are open source CRMs, analytics tools and document archives that do the same job as the subscription ones. The difference is that the data stays with you.

I do this with analytics. Since October 15, 2026 I’ve been running Plausible Community Edition, the open source version of Plausible, installed with Docker on my own server in place of my plausible.io subscription. Plausible records the visits to my three websites, this one included, and I imported the history I had on plausible.io. Every night an automatic backup saves the database and the configuration, again on my own server. My sites’ statistics no longer go through an outside vendor.

3. If you need a custom tool, have it built properly

Today, with AI, building a custom tool in-house costs far less than it did a few years ago. But it has to be done by people with the right skills: badly built software exposes more data than subscription software does. That’s why in custom software development data security has to be designed from the start, and an app built with AI needs specific security checks before launch.

Who should handle this in your company?

Whoever decides which software the company uses is the person who needs to ask this question. Almost nobody thinks about it when signing up for a subscription.

If you’re the one choosing the tools in your company, now is the time to check where your data ends up.