Your software vendor wants to use your data for its AI: should it pay you?

What is your vendor actually asking for?#

A software vendor asking to use your data for its AI is usually asking for one of three rights: to process your data with AI models to deliver features to your account, to use your data to improve models that serve all its customers, or to use aggregated or de-identified versions of your data in its own products. The first is a service; the second and third are closer to a data license.

These requests rarely arrive as a negotiation. They appear in updated terms of service, an AI addendum, a new admin toggle or a click-through when someone enables a feature. The person who clicks is often an administrator, not the owner or counsel, and the change may apply to years of records already in the system.

What recent vendor terms and disputes show#

Recent vendor terms and disputes show that AI training rights are often set by a default, a toggle or a terms update, and that public pushback has led several vendors to narrow them. The examples below are drawn from vendors' own documents and dated press reports; terms change, so read the current version for any system you use.

The pattern for an owner is simple: find the setting, find the clause, and record what you decided. Enterprise agreements can differ from the self-serve terms, as GitHub's exclusion of its Customer Agreement customers shows.

• 1HubSpot: its knowledge base describes an AI model training switch that controls whether HubSpot uses an account's customer data to train its AI models.
• 2GitHub: its Terms of Service (Section J) grant a license to use AI-feature inputs and outputs to train models, with an opt-out in account settings; customers under a GitHub Customer Agreement or volume licensing agreement are excluded from that training license.
• 3Zoom: in August 2023, after backlash over earlier changes, Zoom added a sentence to its terms saying it will not use audio, video or chat customer content to train its AI models without consent.
• 4Slack: in May 2024 TechCrunch reported backlash over privacy principles that let customer data train Slack's machine-learning models unless an organization emailed to opt out; Slack said it does not use customer data to train its generative AI large language models.
• 5FTC staff: in February 2024 they warned that quietly adopting more permissive data practices, such as AI training, through retroactive terms changes may be unfair or deceptive.

Decision table: what you give up and what to ask for#

The decision table sorts common vendor requests by what you give up and what is reasonable to ask in return. The right answer depends on how sensitive the records are and how much the vendor's wider product benefits from them.

When should the vendor pay you?#

A vendor should pay, in fees, credits or other concessions, when your records improve a product it sells to others and the rights it wants are broad, long-lived or cover human-generated records that reflect your expertise. Using your data only to serve your own account is part of the service you already pay for.

The SourceX Enterprise Data Value Framework names the traits that make records valuable: uniqueness, domain expertise, human-generated signal, scale, recency, data cleanliness, rights and AI utility. A field service company's diagnosis notes or a software firm's escalation threads score well on several of those, and a vendor that trains on them is taking something with value.

Broad rights granted to a vendor can also reduce what the same records are worth to another buyer, who may care whether they already sit inside a competing product. That cost is invisible on the day the terms change, which is why it belongs in the decision.

Can you grant those rights at all?#

Whether you can grant those rights depends on your own contracts and notices, not only on the vendor's terms. Records in your help desk or CRM often contain your customers' confidential information, and customer agreements may limit how it is used or shared.

Check customer contracts for confidentiality and data-use clauses, your privacy notices for what you told individuals, and employee notices for internal chat and email. If those limit reuse, agreeing to vendor training could put you in breach even though the vendor's terms allow it.

Internal chat and email are a common blind spot. Slack channels and shared inboxes hold employee personal details, customer names and pricing discussions in free text, which is hard to de-identify after the fact and easy to hand over through a single workspace setting.

How to negotiate vendor AI data use#

Negotiating vendor AI data use starts with knowing which vendors hold your most valuable records and what each has asked for. A short, repeatable process keeps the decisions consistent across systems.

Smaller customers often assume they have no leverage, but opt-outs and written confirmations are frequently available on request even when pricing is fixed. Renewal is the natural moment to ask for more, such as a de-identification standard or deletion terms.

• 1List the vendors that hold operating records: help desk, CRM, field service, ERP, project management and chat.
• 2Read each vendor's current AI terms, addenda and admin settings, and note the date you reviewed them.
• 3Turn off training settings you have not decided to allow, and confirm the change in writing where the vendor offers that.
• 4Send your questions: what data is used, for which models, who else receives it and what happens on exit.
• 5Decide vendor by vendor whether to opt out, accept with limits or opt in for compensation.
• 6Record each decision with the person who approved it, so a future acquirer or auditor can see it.

Illustrative: a plumbing company answers its platform's AI update#

Illustrative: a fictional plumbing and HVAC company runs dispatch, estimates and invoices on a field service management platform. The platform's updated terms add a right to train AI models on customer job data to improve features for all users, with the opt-out placed in admin settings.

The owner wants the platform's new AI scheduling assistant but not a general training right over years of technician diagnosis notes. The company opts out of training, confirms in writing that the scheduling feature still works for its own account, and asks for a de-identification standard covering any aggregated use. The platform agrees to the opt-out and the standard, and the company keeps the option to license its job histories through a separate, documented deal.

How SourceX looks at vendor AI requests#

SourceX treats a vendor's request to train on customer records as a data transaction like any other: it involves rights, preparation, approval and delivery, even when the delivery happens through an integration. Data should be licensed on agreed terms rather than given away by default, and the company keeps ownership.

When a company wants to license records on its own terms, the SourceX five-step transaction of Supply, Rights, Preparation, Approval and Delivery gives it a documented path, and a SourceX Evidence Packet records what was licensed and for what use. Keeping vendor training rights narrow preserves that option.