Guide · Red flags
Red flags when someone offers to buy your company's data
Updated 2026-10-16
This guide is general information, not legal advice. Have your own counsel check your contracts and employee notices.
1. An exploding 48-hour offer
What it looks like. A six-figure offer that expires in a day or two, often reaching a business-unit head or founder before anyone in legal has seen it.
Why it is a flag. Pressure is how you skip diligence. Business Insider's reporting describes owners getting exactly this kind of offer, and nothing about a real, repeatable program needs an answer in 48 hours.
What to do. Ask for the deadline in writing and decline to meet it. Get the offer terms on paper, ask a lawyer to read them, and ask at least one other buyer for a comparison. A serious buyer will wait.
2. No legal entity shown
What it looks like. A site or message that does not say which company will sign the agreement, where it is registered, or who ultimately receives the data.
Why it is a flag. You cannot enforce a contract, a deletion promise or a payment date against a name you cannot identify. Commentators have noted that some programs' public terms name no end buyer or exclusivity.
What to do. Ask who the contracting party is, who the end buyer is, and where each is registered. Look the company up in the public register for its country. If the answers are vague, stop.
3. Upfront fees
What it looks like. A charge to evaluate your data, to list it, to join a program or to unlock an offer, before any money has reached you.
Why it is a flag. Buyers and the brokers who work with them are paid out of the deal. Legitimate programs publish referral fees that buyers pay; they do not ask the company that holds the data to pay to be considered.
What to do. Do not pay. If someone wants a fee, ask them to explain in writing who it is paid to and what is refunded if there is no deal, then compare with free options on our buyer list.
4. Requests for passwords or admin credentials
What it looks like. Being asked to send an admin login, an API token, or a workspace invitation with owner rights, "so we can take a look".
Why it is a flag. Anyone with admin access can read everything, not only the records you meant to share, including customer data and private messages you have no right to license. Credentials passed by email are also easily stolen.
What to do. Refuse. Programs that handle this well have you sign in to the approved systems yourself, or run the export for you under your own control. Share nothing before an agreement is signed, and then only what the agreement lists.
5. Being asked to sell rights you do not hold
What it looks like. A request that includes your clients' data, records covered by confidentiality agreements, or open-source code your company did not write.
Why it is a flag. Licensing material you do not own can make you liable for far more than the sale price. CRM records and client files are the usual trap, because they hold other people's information.
What to do. Exclude anything that is not clearly yours and ask your lawyer to check the rest against your contracts. Our legal checklist lists what to bring.
Sources
- AI labs are offering companies big money to hand over their employees' private Slack DMs and emails, Business Insider, 13 October 2026.
- micro1 Offers $100K+ for CRM Records That May Not Be Yours to Sell, beri.net, 10 October 2026.
Not sure whether an offer is real? See how a normal deal works and compare.