Selling a software company: separating customer data from licensable internal records

The short answer for software M&A advisors

Separate the two before anyone talks about value. Customer data, meaning whatever customers upload, type or generate inside the product, is governed by the master subscription agreement, the data processing addendum and the privacy promises the company made. Absent clear contractual permission, treat it as off the table for AI training.

Internal records the company created to build and run itself are different. Employee-written code and its review history, issue trackers, incident postmortems, architecture decisions and support playbooks may be licensable, subject to contracts, contractor terms and redaction.

The split matters because AI labs and data buyers want the internal side. Agents that write and review code, triage tickets or run incident response learn from records of how real engineering and support teams worked, step by step and with outcomes. A software company with years of that history may hold an asset the sale process never prices. It depends on the contracts, so treat what follows as a framework for questions to counsel, not a conclusion.

What the law and regulators say about ownership and promises

Four points from primary sources shape the analysis.

• Employee work belongs to the company. The US Copyright Office's Circular 30 on works made for hire explains that work an employee prepares within the scope of employment is a work made for hire, so the employer is the author and owner. The statutory definition sits in 17 U.S.C. section 101.
• Contractor work does not follow automatically. Under the same definition, commissioned work is made for hire only in listed categories and with a signed written agreement. Code from freelancers or outsourced teams belongs to the company only if a written assignment says so.
• Rights can be split. 17 U.S.C. section 201 lets ownership be transferred in whole or in part, and lets any exclusive right be transferred and owned separately. That is the basis for licensing a defined set of records for AI training while the company, or its buyer, keeps everything else.
• Customer promises are enforceable. FTC staff have written that commitments not to use customer data for undisclosed purposes, such as training models, are enforceable wherever they appear, including privacy policies, terms of service and marketing. A separate staff post warns that quietly changing terms to allow AI training after the fact may be unfair or deceptive. Both are staff guidance, not rules.

Copyright is only one layer. Contracts, privacy law and confidentiality duties can still restrict records the company owns outright.

Which records sit on which side of the line

Use this table in the first diligence pass. Each row is a starting assumption to test against the actual contracts.

The guide on telling company data apart from customer-owned data works through the gray rows, and the page on how long companies keep support tickets explains why ticket depth matters.

How deal timing changes who decides

The same records can be licensed before a process starts, carved out in the deal, or licensed by the buyer after closing. What changes is who signs and who must be told.

If a license already exists, the guide on disclosing a data license in due diligence covers how buyers usually ask about it.

A five-step separation process before any introduction

1. Map systems by record class. List the product database, code hosting, issue tracker, support desk, CRM, chat and document tools, with years of history for each. Describe them; do not export anything.
2. Pull the contract stack. Collect the standard MSA, DPA and order form templates, plus any negotiated enterprise terms with unusual data clauses.
3. Trace privacy promises over time. Check what the privacy policy and terms said in each period the records cover, not only today.
4. Confirm contractor assignments. Identify every outsourced or freelance engineering relationship and whether signed IP assignment language exists.
5. Settle redaction rules first. De-identification and redaction requirements are agreed with the company before any work begins, and records leave only under an executed agreement the company has authorized.

The sponsor for a SourceX introduction is the owner, CEO, CFO or another authorized representative. On fit, the company needs to be based in the US, with 50+ full-time employees at peak (contractors excluded), a documented track record of several years and clear rights to whatever it would license. The who qualifies page has the detail.

Securities questions advisers ask

Registered M&A professionals sometimes ask whether a data-licensing introduction fits within their broker status. The M&A broker exemption in Exchange Act section 15(b)(13) is narrow: it concerns brokers effecting securities transactions solely in connection with transferring ownership of an eligible privately held company within the statute's size limits. It does not address data-licensing introductions, so do not rely on it in either direction. Ask your firm's compliance counsel how referral income from a commercial introduction should be treated and disclosed.

What sell-side advisers can tell the client

The M&A advisor partner page shows where this fits across a mandate, and the page on security risks owners raise helps with the objections that usually follow.

Rewards and disclosure for advisers

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. A reward is payable only after the buyer pays and SourceX receives its fee, it is never deducted from what the client receives, and no reward is guaranteed. Tell the client about the referral relationship in writing, and check your engagement letter for terms that limit outside compensation or define which transactions earn a success fee.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Next step

Run the record-class table on one current software mandate. If the internal side looks deep and the contracts look workable, register as a partner and introduce the owner, or have the CEO apply at sourcex.si/apply using your referral link.