IP and data asset audit checklist for bankruptcy trustees and receivers

What an IP and data audit gives a trustee or receiver

An intellectual property audit in bankruptcy turns a loose description, such as software, a website and some customer lists, into an asset register a fiduciary can value, sell, license or abandon with confidence. The item most often missed is the operating record: years of support tickets, CRM history, engineering reviews and internal email that AI developers license to train and evaluate agents, provided rights are clean and the data can still be exported.

This checklist is written for chapter 7 trustees, chapter 11 professionals and receivers. It captures what exists, who created it, who holds rights and where personal data sits, using counts and date ranges rather than content, so the results can be shared for qualification without exposing confidential material.

The audit checklist

Registered intellectual property

• Patents and published applications: numbers, owner of record, maintenance status and recorded assignments
• Trademarks: registrations, renewal deadlines and whether the marks are still in use
• Copyright registrations, remembering that most company copyrights exist without any registration
• Chain of title from founders, predecessor entities and acquired businesses

Software, code and technical assets

• Code repositories: hosting account owner, number of repositories, years of commit history, and pull request and review history
• Third-party and open-source components, with their license terms
• Code and content written by contractors, with the assignment agreements covering it
• Source code escrow arrangements and their release conditions

Work made for hire matters here. Material an employee prepares within the scope of employment belongs to the employer, but commissioned work counts as made for hire only in listed categories and only with a signed written agreement, according to the US Copyright Office's Circular 30. Contractor output therefore usually needs a written assignment before the estate can license it.

Domains and digital accounts

• Domain names, registrar, renewal dates and the email address that controls each account
• Cloud, app store and social media accounts, with their billing owners

Contracts that grant or limit rights

• Inbound software licenses and whether they can be assigned
• Outbound licenses, especially any exclusivity already granted
• Customer agreements: confidentiality, data ownership and deletion-on-termination clauses
• Any earlier data licensing or data sharing deal, including any AI-training license

Operational records by system

• Each system's name, record types, earliest and latest dates and approximate volume, expressed as counts
• Who created the records: employees, contractors, clients or the public
• Personal-data flags: customer contact data, employee data, payment data, health information
• Export status: admin access held, export tested, or nobody able to export
• The privacy policy versions in force when the case began

Inventory template

Use one row per asset or system. The rows below are Illustrative and describe a fictional debtor.

At the qualification stage, share categories, counts and date ranges only; never send record contents, samples or screenshots. The data inventory builder helps list systems and records in one place.

How to read the audit results

How privacy rules shape data assets in a bankruptcy estate

Customer data can be sold in bankruptcy, but the debtor's privacy promises constrain it. Under 11 U.S.C. 363(b)(1), if the debtor's privacy policy prohibited transferring personally identifiable information to unaffiliated persons and was in effect when the case began, the trustee may not sell or lease that information unless the sale is consistent with the policy, or the court approves it after appointing a consumer privacy ombudsman, giving notice and holding a hearing, and finds no showing that the sale would violate applicable nonbankruptcy law. When that hearing is required, 11 U.S.C. 332 has the court order the US trustee to appoint a disinterested ombudsman no later than seven days before it.

Scrutiny can be strict. In 23andMe's 2025 bankruptcy, the consumer privacy ombudsman recommended that any transfer of customers' genetic or personally identifiable data be prohibited without renewed opt-in consent, The Record reported. That case concerned consumer genetic data rather than business operating records, but the audit lesson carries over: locate every privacy promise early.

For health information, HHS recognizes two ways to meet the HIPAA de-identification standard, Expert Determination and Safe Harbor, the latter removing 18 specified identifiers (HHS de-identification guidance). Receiverships run under state law and court orders rather than section 363, yet the debtor's privacy promises still matter there. The guide to business records versus personal data in a bankruptcy sale goes further.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Red flags that end the data line of the audit

• The records mainly belong to the debtor's clients, as at many agencies and outsourcers, and those clients have not agreed.
• The main data asset is consumer personal information with no licensing basis.
• An AI-training license already covers the same records.
• Archives were deleted, or nobody can run an export.
• Headcount never reached 50+ full-time employees at peak (contractors excluded).
• Records were generated with AI to sell them.

From audit to introduction

1. Finish the inventory with counts, date ranges, rights notes and personal-data flags.
2. Run the company fit checker for a preliminary, non-binding read.
3. Make the introduction, or apply for the estate; SourceX then reviews size, history, data breadth, rights and the fiduciary's authority to sign.
4. Agree price and terms, and obtain any court approval the case requires before signature.
5. Data is delivered only after an executed agreement and the estate's authorization, under redaction rules agreed before work starts.
6. The estate is paid; any partner reward follows once SourceX receives its fee.

Whether to license or sell outright is a separate decision, compared in licensing data from a bankruptcy estate vs selling it. Trustees can read the role-specific overview of data licensing for chapter 7 trustees.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed. Court-appointed fiduciaries should not assume they may accept any referral reward; raise it with counsel and, where needed, the court before registering.

Next step

Copy the inventory template into the case file and fill one row per system this week. If the results point to a licensing candidate, register as a partner or apply for the estate at sourcex.si/apply. If an interim finance lead is still in place, the interim CFO turnaround checklist covers the same records from the operating side.