Security & privacy
How we handle your data, step by step
Owners ask us the same thing first: what happens to our data? Here's the plain answer. The specifics go into the agreement you sign before we touch anything.
Read-only or exported access
We never need write access to your systems. We work from read-only credentials or from exports your team creates, and you can revoke access at any time.
A signed agreement first
Nothing is accessed until a written agreement covering confidentiality, scope and handling is signed.
You set the scope
Include or exclude whole systems, specific channels, folders, mailboxes or record types. Anything excluded stays out.
De-identified before anything leaves
Names, emails, phone numbers, addresses, account numbers and customer names are removed or replaced with consistent placeholders before data leaves the environment you approve.
Redacted previews for buyers
Buyers evaluate a description and redacted samples, never your raw data, before any sale is agreed.
You approve buyer, price and terms
You see who the buyer is, what they're paying and the terms of use. Nothing is delivered without your signature.
Encrypted in transit and at rest
Data is encrypted in transit (TLS) and at rest while it's being prepared and delivered.
Deleted at project end
Our working copies are deleted when the project ends, as set out in your agreement.
Use limits in writing
The license states what the buyer may and may not do with the data, including any exclusivity and duration.
Your contracts
Check what you've already promised
Customer contracts, privacy notices, vendor terms and industry rules can restrict how your company's data may be used. Checking those obligations is your responsibility as the data owner. We'll help you spot what usually needs excluding, and we recommend having your counsel review the scope before you sign.
Some data is excluded by default: health information subject to HIPAA unless it goes through a compliant de-identification process, payment card data, credentials and secrets, and anything you mark as off limits.
The honest part
No de-identification method is perfect
We reduce re-identification risk in layers: automated removal and replacement of identifiers, scanning of free text, human review of samples, exclusions you choose, and contractual limits on what buyers may do. That lowers the risk substantially, but no method can promise zero risk, and we won't pretend otherwise.
If a dataset feels too sensitive after you've seen the redacted preview, you can narrow the scope or walk away. Questions? Write to offer@getdataoffer.com.
Now you know. Find out what yours is worth.
Rough estimates are enough: which systems you use, roughly how much is in each, years of history, headcount and years in business. No upfront cost, no equity, no commitment, and nothing is shared until you approve the buyer, price and terms.