Monetising company data: how to export and secure it, and what buyers check

Many companies hold data that nobody opens any more: email archives, closed tickets, ERP history, years of engineering revisions. These are exactly the datasets AI labs are interested in, because they show how work in companies actually gets done. This article describes how much of it a typical company holds, how to export and secure it, and what buyers check.

How much data does a company hold?

More than most people think: a company with 100 employees receives around 4.5 million emails in six years.

The calculation rests on official and representative figures. Employees in Germany receive an average of 53 emails a day at their work address.^[1] In companies with 50 to 249 employees, 64.9 percent of employees have internet access for work.^[2] A company of that size has around 100 employees on average.^[3] Under German law, business letters must be kept for six years, accounting vouchers for eight and books for ten.^[4][5] Using the shortest of these periods and 220 working days a year:

Scaled up to all 84,701 companies with 50 to 249 employees in Germany^[3], that is around 384 billion emails within the retention period, plus around 870 billion in companies with 250 or more employees. For comparison: in the latest snapshot of Common Crawl, the open web archive that many AI training datasets are built on, 5.8 percent of 2.17 billion pages are in German, around 125 million.^[6][7] Counted in documents, the email archive of a single mid-sized company therefore equals a good 3.6 percent of that, and the archives of all German mid-sized companies around 3,000 times as much.

Public text, meanwhile, is running short. Epoch AI estimates the stock of usable public text at around 300 trillion tokens and expects language models to have used it up between 2026 and 2032.^[8] At the same time, more and more websites block AI crawlers: according to the Data Provenance Initiative, within one year more than 5 percent of all tokens in the C4 training dataset and more than 28 percent of its most important sources were blocked through robots.txt.^[9] Internal company data were never public and are therefore in none of these datasets.

Step 1: Take stock

Before anything is exported, it is clear which systems exist, which periods they cover and what stays excluded.

• Systems: email, ticketing, ERP and accounting, CRM, file shares, CAD and PDM systems, code. Decommissioned systems count too, as long as an export or a backup exists.
• Period: From when to when do the data run, and were there system changes or gaps?
• Connection: Can cases be followed across several systems, for example from an enquiry by email through the order in the ERP to the ticket?
• Exclusions: Personnel files, health data, professional secrets and documents covered by confidentiality agreements with third parties are excluded or handled separately.
• Authority: Who may decide about the data? In an operating company the management, in insolvency the administrator.

Step 2: Export, system by system

With the systems’ standard tools, in the native format and with all metadata. Printouts and PDF exports lose exactly the details buyers need.

Large mailboxes take time. Microsoft cancels exports that run longer than seven days and recommends splitting large exports by date range or source.^[10] What else to consider for engineering data is covered in the article Engineering data for AI training.

Step 3: Secure and verify

Like any backup: stored separately, protected against overwriting, encrypted and tested to show that everything can be restored.

The German Federal Office for Information Security sets out the requirements in module CON.3 of its IT-Grundschutz Compendium.^[19] For exports intended for sale, that means:

• Store separately: backup media belong in a different location from the systems they back up, ideally in a different fire compartment (CON.3.A12).
• Protect against overwriting: write access only for authorised backups (CON.3.A14).
• Encrypt, and back up the keys separately (CON.3.A13).
• Test restores: check that the data can be restored correctly and within a reasonable time (CON.3.A15).
• Record checksums: note a SHA-256 hash for every export file. This makes it possible to show later that a copy is unchanged.

Transferring large datasets over the internet takes time: one terabyte needs around 22 hours at 100 Mbit/s upload and around 44 hours at 50 Mbit/s. That is why we anonymise locally at the seller, and only the anonymised export leaves the premises. How that works is described under Anonymisation.

Which formats buyers expect

Open, documented formats, one record per case and a description of the dataset.

• Email: EML or MBOX with complete headers. Message-ID and reply references make it possible to rebuild entire threads.^[14]
• Tickets and cases: JSON with one case per line, including comments, status changes and timestamps. Zendesk already delivers its JSON export line by line, whereas its CSV export contains no comments.^[16]
• Tables: CSV with a column description, for large volumes also columnar formats such as Parquet.^[17]
• Code: Git repositories with full history.^[18]
• Engineering: native formats with parameters instead of exports.

Every dataset needs a description. In research, the data sheet proposed in Datasheets for Datasets has become the norm: provenance, purpose, composition, collection and limitations of a dataset.^[20] For machine-readable descriptions there is Croissant, a metadata format from MLCommons based on schema.org that major dataset platforms such as Hugging Face, Kaggle and OpenML support.^[21][22] With us, every delivery includes an anonymous data sheet and an audit report on the anonymisation.

What buyers check

Verifiable rights, connected cases with an outcome, enough history and documented anonymisation. Volume alone rarely decides.

Since August 2025, providers of general-purpose AI models in the EU must have a policy to comply with copyright law and publish a summary of their training content using a Commission template.^[23][24] Buyers therefore need datasets whose provenance and rights they can document.

Volume is secondary. Labelbox writes that value depends less on volume than on how authentically the data capture real work.^[25] German-language datasets are also scarce: German makes up only 5.8 percent of the open web.^[6]

Whether anonymised data are still personal data is judged from the recipient’s perspective: according to the CJEU, pseudonymised data are not personal data for a recipient who cannot restore the link with reasonable effort.^[27] That is why buyers never receive the mapping table, and it is deleted after the handover.

What a dataset can earn

Published ranges run from around USD 50,000 to more than USD 2 million per dataset.

micro1 quotes USD 100,000 to 500,000 for qualified partnerships, USD 500,000 to 2 million for large or ongoing datasets and more than USD 2 million for highly unique data.^[26] Labelbox quotes around USD 50,000 for smaller, targeted datasets up to more than USD 1 million for large partnerships, as an upfront fee at signing plus a share of later use.^[25] How we estimate a dataset is described in the article What is company data worth?

Checklist before the first call

1. List systems and periods, including decommissioned ones.
2. Clarify who may decide about the data.
3. Define exclusions and check contracts with customers and suppliers for confidentiality agreements.
4. Test the export route on a short period.
5. Secure exports as a copy: separately, encrypted, with checksums.
6. Describe the dataset briefly: systems, period, volume, typical cases.