Leadership and readiness
Fake data marketplaces: how to check if a platform is real
By SourceX Editorial · Updated
Short answer
To check whether a data marketplace is real, confirm the legal entity behind it in state business records, verify named executives and a physical address, and confirm who signs the contract. Walk away from fees to unlock an unnamed buyer, requests for admin credentials, or demands for a full export before a buyer and a signed license exist.
Key takeaways
- A brand name on a website is not a contract party; confirm one registered legal entity behind the site, contract and invoice.
- A fee to verify a supplier or unlock an unnamed buyer is a stop sign; any legitimate charge should appear in written terms that say what it buys.
- Requests for admin logins, API keys or full exports before scope is agreed should end the conversation.
- Terms that grant a platform a perpetual, sublicensable right to uploaded records can make a real company an unsafe partner.
- Every check here runs on public records and documents, so none of it requires sharing a file.
What makes a data marketplace fake or unsafe?#
A fake or unsafe data marketplace is any platform that collects fees, credentials or records from companies without a real, contracted path to a licensee. Some are outright scams. Others are genuine businesses whose terms take far more than a supplier should give.
Three patterns cover most cases. Fee schemes ask suppliers to pay for verification or for access to a buyer who never appears. Harvesting schemes ask for full exports or system access up front and leave suppliers no say over where the records go. Over-reaching platforms are registered companies whose terms of service grant them a perpetual, transferable license to anything uploaded. A related variant is an approach that claims to come from a well-known AI company's data program; confirm it through that company's official channels, not the contact details in the message.
The checks below are designed to surface all three patterns. They take a founder, a controller and counsel a modest amount of effort, and they cost far less than trying to recover records after the fact.
Start with the legal entity behind the platform#
The legal entity is the first thing to verify, because a brand name on a website is not a contract party. Find the company's exact legal name in its terms of service, privacy policy or website footer, then confirm it in public records before the conversation goes further.
- State business entity search, run by the Secretary of State or the equivalent business filing office in the state of formation: legal name, status, formation date and registered agent.
- A certificate of good standing, which you can ask the platform to provide or order yourself; some states charge for status reports.
- Foreign qualification records in the states where the company says it operates, which established businesses usually maintain.
- Federal court records through PACER and state court portals, for lawsuits, judgments or fraud claims naming the entity or its founders.
- USPTO trademark search to see whether the brand is registered and by whom.
- SEC EDGAR, if the company claims to be public or cites securities filings.
- Domain registration lookups through WHOIS or RDAP for the domain's age, keeping in mind that privacy services often hide owners.
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
When should an entity check stop the conversation?#
An entity check should stop the conversation when the name on the website, the draft contract and the invoice do not resolve to one registered company. Mismatched names are sometimes innocent, such as a trade name, but the platform should explain them in writing and point to the filing that connects them.
Status matters as much as existence. An entity listed as inactive, dissolved, forfeited or not in good standing cannot reliably sign or perform a license. A recently formed company is not suspect by itself, since many legitimate platforms are young; a company that cannot be found anywhere is.
Confirm the people, the address and the contract role#
The people behind a legitimate platform are identifiable, reachable and consistent across sources. Ask for the names of the executives, the person who would sign your agreement and the person responsible for security, then check that their work histories, professional profiles and public statements line up.
Watch for signs that are easy to miss in a polished pitch: recently created profiles with few connections, stock photos, titles that differ between the website and email signatures, and no one willing to join a video call. Confirm that the stated address is a real office rather than a virtual mailbox.
Then read the draft agreement to learn what the platform actually is: your agent, a marketplace connecting you to buyers, or a reseller that takes a license and resells it. Watch for perpetual or sublicensable rights to uploads, resale to unnamed parties, no duty to delete, and governing law unrelated to either party.
Follow the money and the files#
Money and files should move only on documented terms: license fees reach the supplier from a named licensee, and records go only to that licensee under a signed license. Any request that reverses either flow, such as money from you to unlock a buyer or records out before a licensee exists, deserves scrutiny.
A request for credentials is the clearest stop sign. Producing exports with your own team keeps control of what leaves, leaves an audit trail, and avoids handing a stranger standing access to customer records in your help desk, CRM or field service system.
| Request | Legitimate version | Red flag version |
|---|---|---|
| Fees | Commissions or service fees disclosed in written terms, with what each one buys | Verification or unlock fees demanded before any buyer is named |
| Early information | Metadata about systems, record types and years of history | A full export before any buyer is identified |
| Samples | A small prepared sample under NDA, after scope is agreed | Raw samples containing personal data, requested by email |
| System access | Exports produced by your own team | Admin logins, API keys or OAuth access to your systems |
| Payment terms | Named payer, schedule and method in the agreement | Crypto, gift cards or payment through an unrelated third party |
| Timing | Clear steps with your approval at each one | Pressure to sign immediately to hold a buyer's place |
The verification checklist#
The verification checklist turns these checks into a record you can file with the decision. Complete it before any meeting where files, fees or signatures are on the agenda, and keep it even when the answer is no.
| Check | Where to look | Stop if |
|---|---|---|
| Legal entity | Secretary of State or state filing office search | No matching entity, or not in good standing |
| Name consistency | Website, contract, invoice and bank details | Different names with no written explanation |
| Executives | Professional profiles, press, prior employers | People who cannot be verified |
| Address | Commercial listings and map imagery | A virtual mailbox presented as headquarters |
| Litigation | Federal and state court searches | Fraud claims or unpaid judgments |
| Contract role and rights | Terms of service and draft license | Perpetual, sublicensable rights to uploads |
| Payment flow | Draft agreement and invoices | Fees to unlock an unnamed buyer, or charges missing from the written terms |
| Data requests | Emails and onboarding forms | Full exports or credentials before scope is agreed |
| References | Calls with past suppliers | No supplier willing to speak |
Illustrative: an HVAC contractor checks a marketplace pitch#
Illustrative: a fictional heating, cooling and water heater contractor that runs on ServiceTitan receives an email from a platform calling itself a data exchange. The pitch offers to list the company's job histories for AI buyers and asks for a verification fee plus a ServiceTitan API key to sync records automatically.
The owner asks the controller to run the checklist. The legal name in the website footer does not match the name on the draft agreement, and neither appears in the business search of the state named in the contract. The terms grant the platform a perpetual, sublicensable license to synced records, and no reference supplier is offered.
The owner declines in writing and shares nothing. Because the estimates, jobs and invoices never left ServiceTitan, there is nothing to recover and no credential to revoke. The company files the completed checklist and later starts a metadata-only fit check through a managed licensing route.
How SourceX answers the same checks#
SourceX expects suppliers to put SourceX through this same checklist before any conversation goes past metadata. The data requests row is answered by the process itself: the first conversation is a fit check that asks which systems you run, which record families exist and how far back they go, and it asks for no files, logins or exports.
On contract rights, the model is a license, not a sale, so the company keeps ownership of its records, and each stage of the SourceX five-step transaction waits for the supplier's approval. On custody, SourceX never hosts multi-TB datasets; large deliveries remain on the seller's systems or travel on encrypted drives. Verified policies are listed in the SourceX trust center.
Frequently asked questions
Are online reviews a reliable way to vet a data platform?
Only as a weak signal. Reviews are easy to fabricate and rarely come from suppliers who completed a license. Public records, a reference call with a past supplier and a careful read of the draft agreement tell you far more. Treat a cluster of glowing, recent, similar reviews as a reason to check harder.
What if we already sent files to a platform we now doubt?
Stop further sharing, revoke any credentials or API keys you issued, and list exactly what was sent and when. Ask in writing for deletion and a certification. Involve counsel early, because your customer contracts or privacy laws may require notifications depending on what the files contained.
Is a platform that hosts data always riskier than one that does not?
Not always. Some legitimate marketplaces host listed datasets as part of their model. Hosting does raise the stakes, so check the security program, who can access stored files, deletion terms and what happens if the platform closes. Keeping records in your own storage until delivery limits exposure.
Who inside the company should run these checks?
Split them by skill. The owner or CEO decides, the CFO or controller checks the entity, invoices and payment flow, IT handles any request for access or credentials, and counsel reads the terms. The effort is small compared with cleaning up after records reach the wrong party.
Does signing an NDA protect us from a fake marketplace?
An NDA helps only if the counterparty is real, solvent and reachable. Signing one with an unverified entity gives a false sense of safety. Verify the entity first, then sign an NDA before discussing anything beyond metadata, and still share no files until a license is in place.
Related resources
- IndustryLegal data
- QuestionDo AI labs buy legal documents?
- QuestionCan I license data anonymously?
- InsightCan roofing contractors sell their data to AI companies?
- InsightCan fire protection contractors license inspection and deficiency data?
- InsightDOJ bulk sensitive data rule: does it apply to licensing data to AI developers?
See if your company qualifies
A short company assessment. No data uploads are needed.