Private data with clean title, sourced to your spec.
Tell us what you need. We find owners who never listed it, check title and consent, and deliver graded batches.
Rightmark sources private training data that has never been listed: code with full git history, company archives, de-identified health data, speech, video and robot logs. Rightmark does not take health data yet (patient records, medical imaging or veterinary records), until a HIPAA program and vendor agreements are in place. Every dataset is offered with an ownership pack for its route and arrives in graded batches under the owner’s license. Code is licensed non-exclusively by default; exclusive terms are available at a premium, agreed per deal.
- Private repositories under a standing-rate license are indexed at $150 to $1,500 per repo (Medium confidence, estimated). Typical, per sale. Large repos up to about $10,000 per sale (indicative); history often carries more than half the price. Indicative estimate, not an offer. Final offers depend on the systems you connect, data size and quality, access terms and due diligence. Rightmark,
- Company archives are indexed at $185,000 to $1M+ per company for the profile Operating company, 30+ staff, English records (Medium confidence, estimated); lump sums are usually exclusive for a term. Indicative estimate, not an offer. Final offers depend on the systems you connect, data size and quality, access terms and due diligence. Rightmark,
- A large airline archive of email, chat and code drew a winning bankruptcy-auction bid of $10M (Medium confidence, one reported bid); the sale still needs court approval, and a rival later offered more. TIME, (opens in a new tab)
Updated
What we can source
Private data in every family we source, from owners who have never listed it. Pick a family to see its data types, or a range to open its row in the Price Index.
Times run from the end of scoping to first samples. They are Rightmark planning estimates at Low confidence, indicative and confirmed at scoping. Index ranges come from public reports or are marked as Rightmark estimates, each with a confidence level. Indicative estimate, not an offer. Final offers depend on the systems you connect, data size and quality, access terms and due diligence.
Source for the times: Rightmark planning estimate, Low confidence
Lots we are assembling
Each lot will pool one kind of data from owners, and each owner's title is checked before their data joins. These lots are in preparation: none is available yet, and no lot names an owner or a price. Ask about one and we reply with scope and timing.
See all lots- In preparation
Private product codebases with full history
Private product codebases with their full git history, from software companies and agencies. Where the owner provides one, a test report from their own CI comes with the code.
- In preparation
Agent and automation code from small teams
Independent agent and automation code from small teams and solo developers, pooled into one lot.
- In preparation
Company operating archives
Chat, documents, tickets and wikis from agencies and software companies.
- In preparation
Consented speech for recognition and evaluation
Podcasts with guest releases and business calls recorded with consent, for speech recognition and evaluation.
- In preparation
Aerial 4K video with flight logs
Aerial 4K video with its flight telemetry, from independent pilots.
- In preparation
Small-company operating records
SOPs, supplier records and operations documents from small companies, with no customer or minors data.
The ownership pack
What legal signs off on, in one folder.
Every dataset comes with one, so your counsel can check title, consent and handling before you sign. What it holds depends on the route. Pick one to see its sections, what each shows and an illustrative, redacted sample.
- Built from the owner’s documents and reports, not from a copy of the data
- Sections follow the route: code, company data, health and media differ
- Shared with your counsel under NDA
Sample folder: a code dataset
7 sectionsRepo Check reportContributors, licenses, secrets
- Contains
- Repo Check’s report for each repository: contributor counts, the root license, files with copyleft headers, possible secrets in current files and across the history, and email addresses in the code. Numbers only, produced on the owner’s machine.
- Shows
- Who wrote the code, whether open-source licenses touch it and what needed fixing before anyone else saw it, without exposing the code itself.
Illustrative sampleRedacted. Not from a real dataset. - Repositories
- redacted, full history
- Human contributors
- redacted; the most active wrote redacted of commits
- Root license
- Proprietary
- Files with GPL-family headers
- redacted
- Possible secrets
- redacted in current files, redacted in history
- Email addresses in code
- redacted
- Generated
- redacted, by Repo Check
IP documentsFounders, staff, contractors
- Contains
- The owner’s IP assignments and employment terms for founders, employees and contractors, client consent letters for client work, and any asset purchase agreements or prior licenses.
- Shows
- How the owner holds the rights of the people who wrote the code, through employment terms or signed assignments, so your counsel can check the chain of title.
Illustrative sampleRedacted. Not from a real dataset. Illustrative sample: IP documents Contributor Role Years Rights basis redacted Founder redacted to redacted IP assignment, signed redacted redacted Employee redacted to redacted Employment contract, IP clause redacted Contractor redacted IP assignment, signed redacted redacted Agency redacted Statement of work, IP clause Never-public evidenceNever public, never forked
- Contains
- The owner’s statement that the code was never public or forked, with Repo Check’s count of publishable package manifests and its squashed-history flag.
- Shows
- Whether your models may have seen the code already.
Illustrative sampleRedacted. Not from a real dataset. - Owner statement: never public, never forked; signed redacted
- Package manifests that could be published: redacted
- Squashed history: no
Open-source disclosureComponents and licenses
- Contains
- A component list from lockfiles or an SBOM, with every copyleft component flagged, then excluded or disclosed.
- Shows
- Which open-source components come with the code and under which licenses, so copyleft cannot surprise you later.
Illustrative sampleRedacted. Not from a real dataset. Illustrative sample: Open-source disclosure Component License Where Action redacted MIT billing/api Disclosed redacted GPL family tools/export Excluded redacted Apache family mobile/ios Disclosed ScreeningSanctions, ultimate owners
- Contains
- Our check of the owner against US and EU sanctions lists, including the owners those lists reach through their ownership rules.
- Shows
- The licensor is not on US or EU sanctions lists, and the owners reached through those lists’ ownership rules were checked too.Sources: OFAC, (opens in a new tab); Council of the European Union, (opens in a new tab)
Illustrative sampleRedacted. Not from a real dataset. - Licensor
- redacted Ltd, United Kingdom
- US sanctions list
- No match
- EU consolidated list
- No match
- Owners checked under the ownership rules
- redacted checked, no match
- Checked
- redacted
Tax paperworkW-8BEN-E or W-9
- Contains
- The owner’s W-8BEN-E or W-9, collected before payout.
- Shows
- Who the licensor is for tax purposes, so payments can be made, withheld and reported correctly.
Illustrative sampleRedacted. Not from a real dataset. - Form
- W-8BEN-E
- Entity
- redacted Ltd, United Kingdom
- Received
- redacted
- Status
- Complete
Data cardContents, dates, known gaps
- Contains
- Contents, dates, languages, formats and known gaps on one page, built from Repo Check’s numbers and the owner’s answers.
- Shows
- What is in the set, and what is not, so your team can judge fit before any batch arrives.
Illustrative sampleRedacted. Not from a real dataset. - Repositories
- redacted
- Languages
- Python redacted, TypeScript redacted, Go redacted
- Years
- redacted to redacted
- Commits
- redacted
- Test frameworks
- Found in redacted of redacted repositories
- Known gaps
- Early history squashed in one repository
Sample folder: a company archive
7 sectionsAuthorityEntity, signatory, approvals
- Contains
- The licensing entity, its signatory and any board approval needed, for each business entity whose records are in scope.
- Shows
- That the company can license its records, and that the person signing can bind it.
Illustrative sampleRedacted. Not from a real dataset. - Entity
- redacted Ltd, England and Wales
- Signatory
- redacted, chief executive
- Board approval
- Recorded in the minutes, redacted
- Entities in scope
- redacted of redacted; one subsidiary is excluded
Scope noteWhat is in, what is out
- Contains
- What is in and what is out, such as HR, legal privilege, direct messages and regulated queues, with any redaction rules.
- Shows
- Exactly which records the license covers. Records left out are outside the license.
Illustrative sampleRedacted. Not from a real dataset. Illustrative sample: Scope note System In scope Out of scope Email Team mailboxes, redacted to redacted HR, legal, the board Chat Public channels Direct messages, private channels Tickets Support and engineering queues Payments queue Docs Wiki and runbooks Contracts folder System inventorySystems, years, volumes
- Contains
- Every system in scope, with its admin owner, years covered, users or mailboxes and rough volumes, filled in by someone technical.
- Shows
- What the archive holds and how far back it goes, before anyone connects to it.
Illustrative sampleRedacted. Not from a real dataset. Illustrative sample: System inventory System Admin owner Years Volume Email redacted, IT redacted to redacted About redacted messages Chat redacted, IT redacted to redacted About redacted messages Tickets redacted, support redacted to redacted About redacted tickets Code redacted, engineering redacted to redacted redacted repositories Prior commitmentsEarlier licenses, vendor terms
- Contains
- Earlier data licenses and exclusivity promises, customer contracts that restrict use of their information, and vendor contracts that claim training rights over the data.
- Shows
- Whether an earlier promise or a customer contract limits this license, and what was left out because of it.
Illustrative sampleRedacted. Not from a real dataset. - Earlier data licenses: none
- Exclusivity promised to anyone: none
- Customer contracts that restrict use: redacted; those customers’ records left out
- Vendor terms that claim training rights: none found
Lawful basis and staff noticeUK and EU archives
- Contains
- Where UK or EU people appear in the records: the owner’s lawful basis, the notice given to staff about the use of work records, and the transfer terms for data leaving the UK or EU.
- Shows
- For an archive with UK or EU people in the records, we collect these before anything is licensed. Your counsel confirms what applies.
Illustrative sampleRedacted. Not from a real dataset. - People in the records
- UK and EU staff
- Lawful basis
- Assessment dated redacted
- Staff notice
- Sent redacted
- Transfer terms
- Standard contractual clauses, signed redacted
ScreeningSanctions, ultimate owners
- Contains
- Our check of the owner against US and EU sanctions lists, including the owners those lists reach through their ownership rules.
- Shows
- The licensor is not on US or EU sanctions lists, and the owners reached through those lists’ ownership rules were checked too.Sources: OFAC, (opens in a new tab); Council of the European Union, (opens in a new tab)
Illustrative sampleRedacted. Not from a real dataset. - Licensor
- redacted Ltd, England and Wales
- US sanctions list
- No match
- EU consolidated list
- No match
- Owners checked under the ownership rules
- redacted checked, no match
- Checked
- redacted
Tax paperworkW-8BEN-E or W-9
- Contains
- The owner’s W-8BEN-E or W-9, collected before payout.
- Shows
- Who the licensor is for tax purposes, so payments can be made, withheld and reported correctly.
Illustrative sampleRedacted. Not from a real dataset. - Form
- W-8BEN-E
- Entity
- redacted Ltd, England and Wales
- Received
- redacted
- Status
- Complete
Sample folder: a health dataset
5 sectionsRightmark does not take health data yet (patient records, medical imaging or veterinary records), until a HIPAA program and vendor agreements are in place.
De-identificationSafe Harbor or Expert Determination
- Contains
- A Safe Harbor attestation or an Expert Determination report, or for UK and EU data an anonymization assessment.
- Shows
- That the data was de-identified to a recognized standard before it was licensed, and for which uses and recipients.
Illustrative sampleRedacted. Not from a real dataset. - Method
- Expert Determination
- Expert
- redacted, statistician
- Finding
- Very small risk of re-identification
- Report dated
- redacted
- Applies to
- The fields and recipients named in the report
Rights and agreementsBAAs, vendor terms, approvals
- Contains
- Business associate agreements and vendor contracts that allow de-identification and licensing, with consents or ethics approvals where they are needed.
- Shows
- Which agreements allow de-identification and licensing, and where consent or an ethics approval was needed.
Illustrative sampleRedacted. Not from a real dataset. Illustrative sample: Rights and agreements Document Party Allows Business associate agreement redacted, records vendor De-identification by the provider Vendor contract redacted, imaging archive Licensing of de-identified data Ethics approval redacted, review board Research use, reference redacted Data dictionaryFields, codes, stripping notes
- Contains
- Every field and code system, with notes on how identifiers were stripped from metadata such as DICOM headers.
- Shows
- What each field means, and that identifiers were removed from metadata as well as from the visible record.
Illustrative sampleRedacted. Not from a real dataset. Illustrative sample: Data dictionary Field Type Notes age_band Text Banded ages; the oldest ages grouped dx_codes Diagnosis codes Up to redacted per encounter note_text Text Names, dates and places replaced dicom_header Stripped Burned-in text checked ScreeningSanctions, ultimate owners
- Contains
- Our check of the owner against US and EU sanctions lists, including the owners those lists reach through their ownership rules.
- Shows
- The licensor is not on US or EU sanctions lists, and the owners reached through those lists’ ownership rules were checked too.Sources: OFAC, (opens in a new tab); Council of the European Union, (opens in a new tab)
Illustrative sampleRedacted. Not from a real dataset. - Licensor
- redacted Health LLC, Ohio
- US sanctions list
- No match
- EU consolidated list
- No match
- Owners checked under the ownership rules
- redacted checked, no match
- Checked
- redacted
Tax paperworkW-8BEN-E or W-9
- Contains
- The owner’s W-8BEN-E or W-9, collected before payout.
- Shows
- Who the licensor is for tax purposes, so payments can be made, withheld and reported correctly.
Illustrative sampleRedacted. Not from a real dataset. - Form
- W-9
- Entity
- redacted Health LLC, Ohio
- Received
- redacted
- Status
- Complete
Sample folder: an audio or video set
6 sectionsReleasesConsent that names AI training
- Contains
- Releases from the people whose voices or faces are the data, naming AI training, with any limits they set.
- Shows
- Who agreed to AI training, in writing and on what terms. Biometric laws such as the Illinois BIPA can require written consent; your counsel confirms what applies.Source: Biometric Update, (opens in a new tab)
Illustrative sampleRedacted. Not from a real dataset. Illustrative sample: Releases Person Release covers Signed Limits redacted AI training and evaluation redacted No voice cloning redacted AI training and evaluation redacted None redacted AI training only redacted No use in ads Rights recordOwner and license per collection
- Contains
- Who owns each collection, and the contract or license it was made under, such as a production contract or a creator agreement.
- Shows
- Where the rights in each file come from, and what was left out because the owner does not hold them.
Illustrative sampleRedacted. Not from a real dataset. Illustrative sample: Rights record Collection Made under Years Rights basis Studio sessions Production contract redacted to redacted Owner, work for hire Field footage Creator agreement redacted Licensed in; AI training allowed Library music Music license redacted Left out: no AI training rights Never publishedUnused, unreleased
- Contains
- The owner’s statement of what was never published, such as outtakes and unused footage, and of what was.
- Shows
- Whether your models may have seen the material already.
Illustrative sampleRedacted. Not from a real dataset. - Owner statement: unpublished; signed redacted
- Published cuts: redacted titles, left out
- Unused footage: redacted hours
- Recorded redacted to redacted
Data cardHours, formats, languages
- Contains
- Hours, formats, languages, dates and known gaps on one page, from the owner’s answers.
- Shows
- What is in the set, and what is not, so your team can judge fit before any batch arrives.
Illustrative sampleRedacted. Not from a real dataset. - Hours
- redacted
- Formats
- Ultra HD and HD video, studio audio
- Languages
- English redacted, Spanish redacted
- Years
- redacted to redacted
- Known gaps
- No transcripts for redacted
ScreeningSanctions, ultimate owners
- Contains
- Our check of the owner against US and EU sanctions lists, including the owners those lists reach through their ownership rules.
- Shows
- The licensor is not on US or EU sanctions lists, and the owners reached through those lists’ ownership rules were checked too.Sources: OFAC, (opens in a new tab); Council of the European Union, (opens in a new tab)
Illustrative sampleRedacted. Not from a real dataset. - Licensor
- redacted Studios Ltd, Ireland
- US sanctions list
- No match
- EU consolidated list
- No match
- Owners checked under the ownership rules
- redacted checked, no match
- Checked
- redacted
Tax paperworkW-8BEN-E or W-9
- Contains
- The owner’s W-8BEN-E or W-9, collected before payout.
- Shows
- Who the licensor is for tax purposes, so payments can be made, withheld and reported correctly.
Illustrative sampleRedacted. Not from a real dataset. - Form
- W-8BEN-E
- Entity
- redacted Studios Ltd, Ireland
- Received
- redacted
- Status
- Complete
License terms
Set route by route, in writing, before anything moves.
- Named use
- Each license names its permitted use, usually training and evaluation. Redistribution or resale of the source material needs separate terms, set per route.
- Exclusivity by route
- Code is non-exclusive by default. Company-archive lump sums are usually exclusive for a term; non-exclusive revenue share is the alternative. Exclusive terms carry a premium, agreed per deal.
- Defined scope
- Every license sets the data types, date ranges and term it covers, and whether datasets you derive from the data are included.
- Delivery
- Batches come from the owner’s systems, through connections the owner’s admins approve and can revoke or exports they upload, and on code routes through a licensing partner chosen per deal. Each arrives graded, with metadata, and you scan again on receipt. Anything an owner shares with us is stored privately and deleted on request.
- Deletion
- Each license sets out deletion at the end of the term, and we ask you to certify it.
How buying works
From request to deletion, in writing at every step.
Request
Send the specification below. We reply with what we can source, volumes and timing.
Scope
A written scope by email: families, filters, formats, de-identification standard, volume, exclusivity and delivery cadence. Sample timing is confirmed here.
Evaluate samples
Reports, such as Repo Check numbers or a system inventory, and representative scrubbed samples under NDA, for evaluation only, so your team can test fit first.
Indicative, confirmed at scoping
Sign
You sign a license with the owner, or on code routes with a licensing partner chosen per deal. It sets use, scope, term, exclusivity, delivery and deletion. Nothing is licensed until the owner signs.
Receive graded batches
Batches come from the owner’s systems, through access the owner’s admins approve, with metadata and the ownership pack. You scan again on receipt.
Delete
At the end of the term you delete the licensed copy, and we ask you to certify deletion.
Request data
Tell us what you need. We reply with what we can source, volumes and timing.
Prefer email? Write to hello@rightmark.ai.
Security and compliance
Owners stay in control, and the checks come first. Before signing you see reports and samples under NDA; batches then come from the owner’s systems through access the owner’s admins approve, and anything shared with us is stored privately and deleted on request. Personal details are masked before anything reaches an AI lab, health data is de-identified under HIPAA Safe Harbor or Expert Determination, and we screen each owner and each buyer against sanctions lists before a license is signed. Rightmark does not take health data yet (patient records, medical imaging or veterinary records), until a HIPAA program and vendor agreements are in place.
Source: HHS, (opens in a new tab)
See who holds the data at each stepWhat owners and their counsel may ask you for
- A security report, SOC 2 Type II or equivalent
- Encryption, key management, access logging and data residency
- A data processing agreement, with retention and deletion terms
- The owner’s right to review representative samples before use
- Breach notification terms
Review the evidence before you sign or receive data
Buyer due diligence should answer a simple question: can this licensor grant the defined rights, and can your team receive and use the defined data under the agreement? Review title, authority, scope, privacy, technical evidence, sanctions, samples, transfer controls and deletion. This checklist is a review aid, not legal clearance, a security certification or a guarantee that a dataset will improve a model.
An ordered review
- Confirm the licensor and authority. Identify the legal entity, signatory role and any board, liquidator, trustee or client approval. A person who can export a system is not automatically authorized to grant a license.
- Read the scope note. Match systems, years, formats, languages, linked records and exclusions to the license. Check that HR, legal privilege, direct messages, customer-restricted material and secrets are explicitly out when they are not part of the deal.
- Trace title. For code, review assignments, employment terms, client permissions and open-source disclosures. For archives, review the entity’s authority, supplier terms and earlier licenses. The ownership pack should show what the evidence covers and where it stops.
- Check privacy and consent. Ask which personal fields are present, what masking or de-identification was applied, what notice or lawful-basis work was done where relevant, and what releases cover voices, faces or other identifiable material. Ask counsel to check the jurisdiction.
- Check sanctions and ownership. OFAC says its 50 Percent Rule can treat entities owned 50 percent or more, directly or indirectly, in aggregate by blocked persons as blocked, and it urges due diligence on ownership stakes. See FAQ 401 OFAC, (opens in a new tab). Use the current applicable lists and process, not a static screenshot.
- Inspect the representative sample. Confirm that the sample matches the scope, is masked where required, carries metadata and is approved for the review. A sample is evidence of shape, not proof that the full archive is identical.
- Agree the transfer path. Confirm whether delivery is a native export or a scoped connection that the owner’s administrators approve. Define access, encryption, logging, testing, revocation and the person who handles an incident.
- Define use and derived data. Read permitted use, sublicensing, own use, labels, embeddings, synthetic rewrites, evaluation sets and retention. Do not infer rights from a sales summary.
- Set deletion evidence. Define the end date, deletion scope, backup treatment and the form of a deletion certificate. Include what happens to derived data.
- Record the decision. Keep a dated review note with open questions, accepted risks, excluded records, approvers and the exact contract version.
General information, not legal advice.
Evidence matrix
| Check | Evidence to request | Stop when |
|---|---|---|
| Title and authority | Ownership pack, agreements, approvals | The signatory or rights chain is unresolved |
| Scope | System inventory, scope note, data card | The sample or contract covers a wider set than approved |
| Privacy | Masking method, notice or lawful-basis review, consent records | The proposed use cannot be explained to affected people |
| Technical quality | Scan reports, history state, component list, export manifest | The report does not match the delivered material |
| Sanctions | Dated screening record and ownership information | A party or reached ownership interest needs escalation |
| Security | Transfer design, access roles, logs, incident path | The delivery route has unowned access or no revocation plan |
| Deletion | Contract clause, retention schedule, certificate process | End-of-term duties are vague |
A synthetic sample review
For a fictional “Sample A” code archive, a reviewer might record: full history report received; one open-source component marked for exclusion; no raw credentials in the reviewed sample; client integration excluded pending permission; data card states the covered years and known gaps; deletion clause names the licensed copy and certificate. The record does not say that the entire repository is clear or that every future derivative is covered. Those questions stay with the contract and counsel.
For a fictional workplace archive, the review could approve public team channels and support queues for a masked sample, leave direct messages and HR records out, and require a lawful-basis and staff-notice review for UK or EU people. The UK Information Commissioner’s Office guidance on data protection by design Information Commissioner’s Office (UK), (opens in a new tab) says privacy measures should be built into the lifecycle and that access should be limited to those who need it. The exact legal analysis remains jurisdiction-specific.
Keep the review bounded
Do not request a private archive just to answer an open title question. Start with reports and a redacted sample under NDA. If a check fails, narrow the scope or stop. Health records remain status-only under the current Rightmark Trust status. Do not treat this checklist as health-data intake.
When the evidence is ready, use the buyer workflow and read the Trust page alongside your counsel’s review. A clean packet supports a decision. It does not create a buyer commitment, a price, a certification or a guarantee of an outcome.
Buyer counsel answers: title, scope, samples, and deletion
This library is a diligence aid, not legal advice or a certification. Confirm facts and contract language for each record.
What title should we ask for?
Ask the owner to identify the rights chain for the exact material in scope. That can include employment and client agreements, platform terms, prior licenses, performer or model releases, and third-party elements. The owner should warrant only the rights the agreement covers, with exclusions visible in the schedule.
What should the scope schedule contain?
Name the systems or collection groups, date range, data type, format, unit definition, allowed uses, excluded uses, territory, term, access method, retention, and deletion route. Separate training, fine-tuning, retrieval, display, evaluation, and synthetic-output rights. Do not rely on “AI use” as one undifferentiated permission.
Can we see a sample before signing?
A sample should show shape, fields, labels, masking, and known limitations without disclosing unnecessary personal or confidential material. Record its provenance and whether it is representative.
Is de-identification a legal clearance?
No. HHS describes Safe Harbor and Expert Determination as HIPAA methods and notes that residual risk remains a consideration HHS, (opens in a new tab). GDPR Article 4 defines personal data broadly Official Journal of the European Union, (opens in a new tab) and Article 9 treats health data as a special category Official Journal of the European Union, (opens in a new tab). A buyer should ask which identifiers remain, how re-identification risk was assessed, and how deletion reaches copies and derived material. Counsel must decide whether the answer fits the use.
What sanctions or country checks apply?
Screen the contracting parties, ownership, access path, and relevant jurisdictions under the rules that apply to the transaction.
How is transfer controlled?
For connected-product data, the EU Data Act adds access and security context Official Journal of the European Union, (opens in a new tab). The contract should say what happens when a connection is revoked or the term ends.
What happens to derived data?
Define derived data before signing. Ask whether it includes transformed files, embeddings, labels, evaluation outputs, model checkpoints, backups, and logs. Do not assume that deleting the source file deletes every downstream artifact.
General information, not legal advice.
Buyer diligence table
| Question | Evidence to request | Escalate when |
|---|---|---|
| Sample | Scrubbed manifest and provenance | Sample is not representative or lacks exclusions |
Documents on request
Your legal team can read our paperwork before you send a specification. Tell us which documents you need and we send them.
Questions from buyers
For data leads and the legal teams who sign off.
What private data can Rightmark source?
Code with full git history, operational company archives, de-identified health data, speech and call audio, unused and first-person video, images, books and expert documents, and robot and sensor logs. Rightmark does not take health data yet (patient records, medical imaging or veterinary records), until a HIPAA program and vendor agreements are in place. Tell us the spec and we source it from owners who have never listed it.
How do you prove title and consent?
With an ownership pack whose contents follow the route. For code: the owner’s IP documents, with Repo Check’s contributor, license and secrets checks. For company archives: the owner’s authority to license, a scope note and a system inventory. For audio and video: releases that name AI training. We screen each owner against sanctions lists before a license is signed and add the result to the pack, with the owner’s tax paperwork.
What comes with each dataset?
The ownership pack for its route and a data card describing contents, dates, languages, formats and known gaps. Code also comes with open-source disclosure and evidence that it was never public. Data arrives in graded batches with metadata, from the owner’s systems.
Is the data de-identified?
Personal details are masked or removed before anything reaches an AI lab, and health data is de-identified under HIPAA Safe Harbor or Expert Determination before it is licensed. Rightmark does not take health data yet (patient records, medical imaging or veterinary records), until a HIPAA program and vendor agreements are in place. Where voices or faces are the data, the people in it consented to AI training. For UK and EU archives we also collect the owner’s lawful basis, the staff notice and the transfer terms before anything is licensed; your counsel confirms what applies. Under the license you scan again on receipt.
Sources: HHS, (opens in a new tab); Biometric Update, (opens in a new tab)
Can we license data exclusively?
Yes, by agreement, with a defined term and scope. Code is non-exclusive by default; company-archive lump sums are usually exclusive for a term. Exclusive terms carry a premium, agreed per deal.
Do you supply scraped or synthetic data?
No. We source private data from its owners. On code, the ownership pack carries the owner’s statement that the code was never public, with Repo Check’s package and history checks.
How soon can we see samples?
Indicatively, from the end of scoping: 1 to 4 weeks for code; 2 to 6 weeks for company archives, audio and video; 3 to 8 weeks for documents; 2 to 8 weeks for robotics; and 2 to 4 months for health data, where de-identification and contracts come first. Rightmark does not take health data yet (patient records, medical imaging or veterinary records), until a HIPAA program and vendor agreements are in place. These are Rightmark planning estimates at Low confidence; timing is confirmed at scoping. Indicative estimate, not an offer. Final offers depend on the systems you connect, data size and quality, access terms and due diligence.
Source: Rightmark planning estimate,
Will we know who the owner is?
Yes, under NDA. The ownership pack identifies the licensor and its title documents to your legal team. You sign the license with the owner, or on code routes with a licensing partner chosen per deal. We never name owners publicly, and each license can restrict publicity without the owner’s consent.
Can we run our own assessment on the code?
By agreement. The owner can run your tool on a copy in an isolated environment, or we run it in an isolated workspace under NDA on a temporary working copy that is deleted when the run ends. The owner reviews the report before it reaches you, because these reports can include file paths, contributor names and snippets flagged as possible secrets.