Who owns your company's data, and can you sell it?
Usually your company does: Slack, Atlassian, Zendesk and HubSpot all say the customer owns its data. But owning records isn't the same as being free to license them. Data you hold for clients, other companies' confidential information, staff's personal details and your own privacy promises can each limit what you can sell.
Do you or your software vendor own your company's data?
You do, in the terms of the major work tools. Their customer agreements say so in almost the same words, while giving the vendor a license to use the data to run, and sometimes improve, its service.
| Tool | Who owns the data | What else to know |
|---|---|---|
| Slack | "The Customer Data is owned by the Customer" | Its API terms ban apps from using API data to train large language models |
| Jira, Confluence (Atlassian) | "Customer owns all intellectual property and other rights in Customer Data" | Separate terms cover its AI features |
| Zendesk | "Customer retains ownership of all Service Data" | You can export "during and 30 days after" your subscription; Zendesk may use the data to improve its products |
| HubSpot | "You own and retain all rights" to your Customer Data | HubSpot "may also use Customer Data to train our AI models" unless you opt out in your account settings |
Two things follow. Export what you need while your subscription is active, because access ends after a short window. And check how you'd get the data out: a workspace owner's export and an app pulling data through an API can fall under different terms. See selling Slack data to AI.
Do your employees own their work emails and messages?
Generally no, but their personal information inside those messages still has protection. Under US copyright law, a "work made for hire" includes "a work prepared by an employee within the scope of his or her employment", so the company holds the rights in what staff write for work. Work by outside contractors is treated differently and depends on their contracts.
- Personal information: California's privacy law now covers employees' data. Its exemption for employment-related information "expired on December 31, 2022", the state Attorney General says.
- Labor law: "Employee communications about pay, scheduling, and working conditions may be protected concerted activity under Section 7" of the National Labor Relations Act, notes law firm Frankfurt Kurnit Klein & Selz.
- Unions: "Where employees are unionized, the collective bargaining agreement may restrict the sale," the same firm adds. Spirit Airlines' flight attendants' union objected to the sale of its data.
Can you sell data you hold for your clients?
Usually not without their written agreement. If you process data on a client's behalf, as an agency, outsourcer or software provider does, it is theirs under your contract, and the law firm's advice is to "identify data held as a service provider or processor" before any sale.
Your promises count too. "Companies must comply with the privacy statements in effect when the data was collected," the firm notes, so a privacy notice that never mentioned AI training can rule data out unless you get consent. See is selling company data legal.
What about other companies' information in your email?
It isn't yours to license. "Email and chat contain other companies' confidential information, often covered by NDAs and commercial agreements," Frankfurt Kurnit Klein & Selz warns. Suppliers' price lists, partners' plans and anything shared under an NDA has to come out, or the deal has to leave those mailboxes and channels out entirely.
Does copyright protect your company's database?
Only thinly. The US Supreme Court held in Feist v. Rural (1991) that "facts, whether alone or as part of a compilation, are not original and therefore may not be copyrighted", and that "the copyright in a factual compilation is thin."
So the value you'd license sits mostly in control and contracts, not copyright: you hold records nobody else has, and the license decides what the buyer may do with them. That's why the license terms matter more than the word "owner". See data licensing agreement terms.
Who has a claim on each kind of company data?
| Data | Others with a claim | Check before licensing |
|---|---|---|
| Staff, outside senders, NDA partners | NDAs, privacy notice, mailboxes to leave out | |
| Slack or Teams chat | Staff; labor law on pay and conditions | Export route, union agreement, private channels |
| Support tickets | Your customers | Customer contracts, privacy notice, customer personal data |
| CRM records | Customers and prospects | Privacy notice; usually leave out contact details |
| Code | Contractors, open-source licenses | Contractor agreements, licenses of included code |
| Documents and drives | Clients, partners | Client work product, anything under NDA |
How do you confirm you can license your data?
- List each system and what it holds, without exporting anything yet.
- Read each vendor's customer terms and API terms for ownership, export and AI use.
- Mark data you hold for clients, and check those contracts.
- Read the privacy notice and employee handbook in force when the data was collected.
- Decide what stays out: client work, NDA material, HR files, customer personal data.
- Have a lawyer confirm the rest before any buyer sees a sample.
Once the rights are clear, see if your data can sell, or read how to sell company data to AI.
Questions
Who owns my company's Slack messages?
Your company does, under Slack's terms: "the Customer Data is owned by the Customer". Employees' personal information in them is still protected, and Slack's API terms limit using API data to train AI.
Do employees own their work emails?
Generally no: under US copyright law, work an employee prepares within the scope of employment is a work made for hire. Their personal information in those emails is still protected, including under California's privacy law.
Who owns customer data in a SaaS tool?
The customer, in the terms of Slack, Atlassian, Zendesk and HubSpot. Vendors usually get a license to use it to run their service, and some, such as HubSpot, to train their AI unless you opt out.
Can I sell data I hold for my clients?
Usually not without their written agreement. Data you process on a client's behalf is theirs under your contract.
Is a company database protected by copyright?
Only thinly. Facts can't be copyrighted, so a factual database is protected mostly by keeping it confidential and by the contracts you license it under.
Sources
- Slack Terms of Service (effective 17 February 2023) Slack
- Atlassian Customer Agreement (effective 1 October 2026) Atlassian
- Main Services Agreement Zendesk
- Customer Terms of Service (last modified 16 September 2026) HubSpot
- 17 U.S. Code § 101, definitions (work made for hire) Legal Information Institute, Cornell Law School
- California Consumer Privacy Act FAQ California Attorney General
- Feist Publications v. Rural Telephone Service, 499 U.S. 340 (1991) US Supreme Court, via Cornell LII
- Selling company data for AI training: what to know before you say yes (1 October 2026) Frankfurt Kurnit Klein & Selz, law firm
- AI labs are buying data from dead startups to train their models (13 October 2026) MIT Technology Review