Definitions and comparisons
Defunct-startup data sales vs operating-company licensing: what's different?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Defunct-startup data sales and operating-company licensing differ in who stands behind the data. A shuttered startup often sells a raw archive of Slack, email and tickets once, with thin rights review and nobody left to answer questions. An operating company licenses defined, prepared records under contract, keeps ownership and can repeat the deal. Documented rights are the dividing line.
Key takeaways
- A closed startup selling its archive usually transfers a copy once; an operating company licenses scoped records and keeps ownership.
- Rights review is the widest gap, because workspace exports mix employee messages, customer content and third-party code the seller may not control.
- Employee notice and privacy preparation get harder once the team is gone, since nobody remains who knows what the records contain.
- A company that is winding down can still license on operating-company terms if it preserves exports and keeps an authorized signer before systems are shut off.
What is a defunct-startup data sale?#
A defunct-startup data sale is a closed company, or the person winding it up, selling a copy of its internal archives to an AI developer or a data intermediary. The archives are usually whatever was exported before shutdown: a Slack workspace, Google Workspace or Microsoft 365 mailboxes, Jira or Linear tickets, GitHub repositories and Notion or Confluence pages.
The appeal is plain. The company is gone, the archive costs money to keep, and AI developers value real workplace conversations about building and running a product. The sale is often a one-time transfer of a copy, sometimes with few promises beyond the seller's statement that it owned the data.
These deals draw scrutiny because of what they can leave unresolved: employees who never expected their messages to be used this way, customers whose content sat in shared channels, and contracts that promised deletion when a relationship ended.
What did the 2026 reporting on these sales describe?#
The 2026 reporting described closed companies' workplace archives becoming a source of AI training data. Forbes reported on April 16, 2026 that after the former CEO of cielo24 used the wind-down firm SimpleClosure to close the company, its remaining records, including years of internal chat, project-tracking tickets and emails, became items for sale to AI developers.
The same report said such records are fed into reinforcement learning gyms, simulated workplaces where AI agents practice tasks on real company documents and messages. It also said SimpleClosure kept parts of its Asset Hub tool in beta while it refined how it strips personally identifiable information, and it quoted a privacy advocate who called the privacy issues substantial.
Later coverage showed the terms can be tighter. Forbes reported in August 2026 that wind-down service startups now offer to buy closing companies' data for AI training, and reporting on the bankruptcy auction of Spirit Airlines' internal business data described exclusions for passenger profiles, loyalty records and privileged legal material, removal of personal information by a third party before delivery, and a bar on re-identification. The dividing line is documentation, not whether the company still operates.
How is operating-company licensing different?#
Operating-company licensing is a contract under which a going concern grants an AI developer limited rights to use defined records while keeping ownership. The license states the permitted use, the term, any exclusivity, deletion at the end, and what the supplier prepared and warrants.
Because the company still operates, it has people who know the systems, customers it wants to keep and a brand it wants to protect. That raises the bar on preparation, but it also makes the supplier credible: someone can answer a buyer's questions, sign warranties and stand behind them for the life of the license.
Side by side: where the two approaches diverge#
The two approaches diverge most on rights, privacy and what happens after delivery. The table compares typical patterns; individual deals vary in both directions.
| Factor | Defunct-startup archive sale | Operating-company license |
|---|---|---|
| Seller situation | Company closed or closing; a former founder, officer or wind-down agent acts | Going concern with leadership, staff and customers |
| Who signs | Whoever still has authority, which can be unclear after dissolution | An authorized officer, with board or investor consent where needed |
| Rights review depth | Often limited to a statement of ownership | Record-by-record review of customer contracts, vendor terms, notices and NDAs |
| Privacy preparation | Sometimes a raw export, sometimes basic name removal | Personal and confidential details removed and reviewed before delivery |
| Employee notice | Former staff often unreachable or never told | Employees can be told and policies checked before any delivery |
| Buyer terms | Transfer of a copy with few continuing obligations | Permitted use, term, deletion, audit and confidentiality terms |
| Repeatability | One sale; the archive stops growing | Further packages as new records accumulate |
Where archive sales tend to run into trouble#
Archive sales tend to run into trouble in content nobody reviewed. A workspace export mixes material the company owned outright with material it only held on someone else's behalf.
Credentials are the easiest problem to catch with tooling. Gitleaks, an open-source secret scanner, flags passwords, API keys and tokens in git repositories and files, and a tool like it should run over any code or chat archive before it leaves. Platform terms are the next check: Slack's API terms bar apps offered outside a customer's own organization from using API data to train large language models or bulk exporting message data without a separate agreement, so a buyer's connector app is not a shortcut around the workspace's own export. The other problems below need people who understand the contracts behind the records.
- Shared channels with customers or partners, such as Slack Connect, where the other side's messages and files sit in the export.
- Direct messages that employees reasonably treated as private conversations.
- Customer files, screenshots and logs pasted into tickets during support work.
- Code from contractors without written assignments, customer code, and open-source components under licenses with conditions.
- Credentials, API keys and tokens committed to repositories or pasted into chat.
- Customer contracts and data processing agreements that required deletion or return of data when the relationship ended.
What an operating company can offer that a closed startup cannot#
An operating company can offer context, which buyers value alongside volume. The people who wrote the tickets and reviewed the code can explain what a field means, which projects were abandoned and which outcomes were recorded reliably.
It can also choose its scope. Instead of handing over a whole workspace, it can license linked engineering issues, code reviews and support outcomes, exclude direct messages and customer channels, and add packages as records accumulate. The SourceX Enterprise Data Value Framework counts rights and data cleanliness among the drivers that increase value, and preparation cost and privacy burden among those that reduce net value, so a scoped package with documented rights usually compares well with a raw workspace dump.
Illustrative: two companies with similar engineering archives#
Illustrative: a fictional marketing analytics startup closes after its last funding round falls through. The former CEO holds a Slack export, a Jira instance and a GitHub organization, and a data broker offers to buy all of it. Several of the busiest Slack channels were shared with customers, and nobody remaining knows which repositories contain customer code.
A fictional vertical software company for commercial printers holds similar records: Jira issues linked to GitHub pull requests and Intercom conversations. It runs a rights review, excludes customer channels and direct messages, tells employees what is being licensed, and licenses the linked issue history for a defined term with deletion at the end.
The outcomes differ on rights, not records. The startup's buyer asks for an indemnity the former CEO cannot back, and the deal stalls. The software company signs and keeps the option of a later package as new issues are resolved.
If your company is winding down, act before systems go dark#
A company winding down can license on operating-company terms if it acts before subscriptions lapse. The window that matters is while systems are still paid for, admins still have access and someone with authority can sign.
Check what each export will actually contain. Slack lets owners and admins on every plan export public channels, but exports that include private channels and direct messages are limited to the Business+ and Enterprise plans and require owners to apply, and the export holds links to files rather than the files themselves. Free workspaces lose messages and files older than one year, and Slack's customer terms allow it to delete customer data after a subscription ends.
- Export workspaces, the help desk, the CRM and repositories while admin access still works.
- Keep a named officer or wind-down agent with authority to approve a license.
- Retain the contracts, privacy notices and employee policies a rights review will need.
- Keep one or two people who know the systems available to answer questions.
- Decide what to exclude, such as direct messages and customer channels, before anything is offered.
How SourceX approaches both situations#
SourceX runs closed and operating companies through the same SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. For a closed company the extra work sits mostly in Supply and Approval, confirming which exports survived and who can still sign. The first conversation needs no files; the fit check asks only which systems existed, what years they cover and which record families they hold.
The SourceX Evidence Packet ties together the five things a buyer will ask about: provenance, licensing rights, permitted use, the privacy record and release authorization. In a wind-down, the release authorization is where the signer's authority, and the document granting it, gets written down.
Frequently asked questions
Is it legal for a closed startup to sell its Slack messages?
There is no single answer. Whether a sale is permitted depends on what the workspace contains, the company's employee policies and notices, customer contracts, the privacy laws that may apply and who holds authority after closure. Each sale should be assessed with counsel; the gaps usually sit in material the company held but did not own.
Do former employees have to be told?
It depends on the company's policies, what employees were told about workplace communications and the laws that may apply. Many companies choose to notify staff and exclude direct messages regardless, because it lowers both legal and reputational risk. A closed company may find notice harder, which is one reason to plan before shutdown.
Do buyers value an operating company's records more?
No price list exists for this, and value only becomes clear once a buyer engages. Buyers generally prefer records with documented rights, careful preparation and someone who can answer questions, because those lower their own risk. Volume alone rarely makes up for unclear rights.
Can a startup that already sold its archive license it again?
Possibly, if the first deal did not grant exclusivity or transfer ownership. Read the earlier agreement closely: a transfer of the archive itself, rather than a license, may leave nothing to license, and an exclusivity clause can block later deals for its term.
Who can sign for a company that has already dissolved?
In many US states a dissolved company can still wind up its affairs, and its officers or directors may act for that purpose. The details vary by state and by the dissolution documents. Confirm authority with counsel before any license is signed.
Sources
- Gitleaks is an MIT-licensed tool for detecting secrets such as passwords, API keys and tokens in git repositories, files and stdin. Source
- Forbes reported on April 16, 2026 that after cielo24's former CEO used SimpleClosure to close the company, its internal chat, project-tracking tickets and emails became items for sale to AI developers; such records feed reinforcement learning gyms; SimpleClosure's Asset Hub was partly in beta while it refined PII stripping; and a privacy advocate called the privacy issues substantial. Source
- Forbes reported on August 19, 2026 that startups now offer to buy wind-down companies' data for AI training. Source
- Reporting on the Spirit Airlines data sale says it excludes passenger profiles, loyalty records and privileged legal materials, that a third party would strip personally identifiable information before delivery, and that the agreement bars re-identification. Source
- Slack's API Terms state that a provider of an application offered outside its own organization may not use API Data to train a large language model or bulk export Slack message and file data except where an additional agreement expressly allows it. Source
- Owners and admins on all Slack plans can export public channels; exports of private channels and direct messages are available only on Business+ and Enterprise and owners must apply; the export includes links to files rather than the files themselves. Source
- Slack says messages and files more than one year old are permanently deleted from free workspaces. Source
- Slack's Customer Terms say that after subscriptions end, Slack may, unless legally prohibited, delete all Customer Data. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.