Data Licensing Readiness and De-identification
License company data to AI, anonymized before it leaves
Desert Lakes Solutions gets a company ready to license company data to AI: we inventory your systems, export the data, remove or transform what identifies your people and your company, have a second person try to re-identify what is left, and hand you a written record of every step before anything leaves. If you have been offered money for your company data and want to say yes without handing a broker raw, identifiable records, we represent you, not the broker: the anonymization happens here, and is checked here, before anything goes out.
-
Kayla Rathkey
2 reviews
Very fast and amazing excellent service!!!
Response from the owner
Thanks Kayla! Glad we could the new dentist office setup quickly.
-
Luna Chernykh
1 review
Great service! Fast response, professional team, and very helpful. Highly recommend
Response from the owner
Thanks, Luna. Really glad the team was easy to work with.
-
Diana Gomez
Local Guide · 14 reviews · 4 photos
Very Good IT service, reliable and responsive. Clear communication
Response from the owner
Thanks, Diana. Clear communication on IT issues is the goal, so that’s good to hear.
-
Leo Ortiz
1 review
Excellent Customer service, Very Prompt and Professional.
Response from the owner
Thanks, Leo. Appreciate that.
Data de-identification services for selling data to AI companies: what we do, in order
Desert Lakes Solutions gets a company's records ready to license to an AI-training data broker: we inventory your systems, export the data, remove or transform what identifies your people and your company, have a second person try to re-identify what is left, and hand you a written record of every step before anything leaves. If you have been offered money for your company data and want to say yes without handing a broker raw, identifiable records, we represent you, not the broker: the anonymization happens here, and is checked here, before anything goes out. Customer, staff and company names are removed or replaced before release, and the remaining risk is measured and written down. We de-identify business data for AI training on your side of the transfer, in five phases.
Brokers such as Handshake AI pay companies for business records to use in AI training. Handshake's license page lists 20+ full-time employees and 3+ years in operation (Handshake). Its overview page leaves partners responsible for a lawful transfer, says no de-identification process removes re-identification risk entirely, and describes Handshake AI as purchasing operational data, so check your agreement for ownership and exclusivity terms (Handshake). The same page says the de-identification work happens on Handshake's side and all you have to do is transfer the data as it exists today, so identifiable records leave your company before anyone cleans them. We clean them first. Handshake is one buyer among several: micro1, Mercor, Troveo, Appen and others run similar programs, and nearly all of them take your raw export, or connect to your systems, and clean it on their side. The inventory, cleaning and verification we do are the same whichever broker you choose. Desert Lakes is not affiliated with Handshake or any other broker.
Phase 1: Inventory, scope and broker intake
We list every system holding records, usually 10 to 25: Microsoft 365 mail, OneDrive, SharePoint and Teams; accounting (QuickBooks); help desk ticketing systems such as Autotask, ConnectWise or Zendesk; call recordings; payroll; e-signature; customer records system (CRM); legacy databases; scanned paper. For each we record export size, date range by month, contents, whether it exports, and restrictions such as personal information, voice, partner-held data or contract limits.
A separate person checks the cleaning. Regulated or restricted records can stay out; a dental or medical practice can keep patient records out of scope. We document who receives the data and what public information could match it back to you. You get the inventory, the completed broker intake and a sample set cleaned like the full release.
Phase 2: Extraction into a controlled workspace
We pull the exports: Microsoft Purview eDiscovery (Microsoft 365's built-in export tool for mail, chats and files), QuickBooks and ticketing exports and automated data pulls from the vendor's interface, call recordings and legacy files. Everything lands in an isolated, logged workspace the broker cannot reach. Each export is logged with a hash, a digital fingerprint that shows whether the file changed, and raw copies are destroyed on a recorded date.
Phase 3: De-identification
The cleaning is organized around the four stages that published summaries of ISO/IEC 27559:2022, the ISO privacy-enhancing de-identification framework, describe (who receives the data, what the data contains, how easily a record could be matched back to someone, and who is accountable for the process). Techniques are drawn from SP 800-188, published by the US standards agency NIST, and from US Department of Health and Human Services (HHS) guidance. We have not been assessed against either standard and claim no certification. 27559 covers people; removing your company's identity is our extension of the method, in line with NIST SP 800-188, which addresses disclosure risk to companies and sites as well as people. We remove or transform:
- Your company: names, domains, addresses, phone, tax and license numbers, unique product names, signatures, letterhead, and events a web search could match, such as an award or an office move.
- People: employee, customer and vendor names, account and invoice numbers, and mentions in email, ticket notes and transcripts.
- Hidden details: document authors, photo EXIF data (camera and location details inside image files), SharePoint links, tracked changes and email headers.
- Dates and places: dates shifted or cut to the year, geography generalized. Shifted dates fit only HIPAA's expert-review route (Expert Determination); the checklist route (Safe Harbor) keeps just the year.
Names become random placeholders such as PERSON_0412, never derived from the real value. We release scrubbed transcripts, not call audio. Excluding audio is our own practice. Safe Harbor also lists voice prints among biometric identifiers. Items that cannot be cleaned without losing their meaning are excluded and logged.
After verification, the placeholder key is destroyed, which alone does not make data anonymous. Under GDPR, coded data is generally treated as personal data, and always for whoever can re-link it (European Data Protection Board (EDPB) Guidelines 01/2025, adopted for public consultation in January 2025). The EU Court of Justice held in September 2025, under the parallel rules for EU institutions, that pseudonymized data is not personal data in every case and for every person (Case C-413/23 P). Whether GDPR reaches a US company's mailboxes is for counsel.
Phase 4: Verification by someone who did not do the cleaning
A second person who did not clean that source works only from the candidate release and a list of your known names, domains and numbers:
- Searching the release for every string on that list, logging each hit and sending it back for cleaning.
- Re-measuring how many records share each combination of traits, to check whether any record still stands out.
- Sampling free text at random and in high-risk spots, and counting leftover identifiers per source.
- Scanning every released file for leftover author, company, file path or location fields.
- A time-boxed attempt modeled on the UK Information Commissioner's Office (ICO) motivated intruder test, where a competent outsider with web search, public records and generative AI tools tries to work out who you are.
Failures go back for cleaning and are re-checked on a fresh sample. You get a written statement of the risk that remains.
Phase 5: The data licensing readiness package and transfer
The release ships with documents for your counsel and the broker: a data dictionary, the identifier inventory, the transformation log, the chain-of-custody log (who handled each export and when), the verification report, the residual-risk statement, the key destruction record, and a perimeter document stating scope, conditions of use and the contract terms your counsel should require. Transfer runs by an agreed secure method with a hash manifest (the list of file fingerprints) and a receipt.
The Article 29 Working Party, the EU privacy regulators' advisory group before the GDPR, said anonymisation is not a one-off exercise, so we reassess each year or when something changes, adding new periods with fresh placeholders. After any exclusivity term ends, the same package can go to a second broker.
The legal tests buyers and their lawyers ask about
We describe what was done and measured; the legal conclusion belongs to your counsel or a qualified expert.
| Test | What it asks | What the package gives counsel |
|---|---|---|
| HIPAA, 45 CFR 164.514(b) | Safe Harbor: remove 18 listed identifiers, the employer's included, with no actual knowledge that the rest could identify someone. Expert Determination: a qualified expert documents that risk is very small for the anticipated recipient; HHS sets no fixed number. For most companies outside healthcare, it is a benchmark buyers use, not a rule that governs the data. | An identifier inventory mapped to the 18 categories, and an evidence file for a qualified expert's review. |
| CCPA, Cal. Civ. Code 1798.140(m) | Information that cannot reasonably be used to infer information about, or be linked to, a particular consumer, plus reasonable measures against association with a consumer or household, a public commitment to maintain and use the information in deidentified form and not to attempt to re-identify it, and contracts binding every recipient to the whole definition. | Documented measures, the contract terms in the perimeter document, and draft commitment wording for your counsel to approve and you to publish. |
| GDPR Recital 26 and WP216 | Recital 26 asks whether a person can be identified by any means reasonably likely to be used, such as singling out. The Article 29 Working Party's 2014 opinion (WP216), written before the GDPR applied, tests each technique for singling out, linkability and inference. In July 2026 the EDPB adopted draft anonymisation guidelines (adopted 8 July 2026, open for consultation until 30 October 2026) that apply three similar criteria: no record isolation, no linkage and no inference. | A results table for each test and data source, covering both the WP216 criteria and the EDPB 2026 draft criteria, and a record of what was removed versus replaced. |
Why a managed IT and compliance firm does this work
We administer Microsoft 365, QuickBooks and ticketing systems for clients, so we have the access and export tooling. The Microsoft Purview sensitivity labeling (tags that mark which files are confidential) and permissions work behind a Microsoft 365 Copilot rollout is much the same inventory work a clean data license needs, and our HIPAA, SOC 2 and cyber insurance practice is where the evidence habits come from. We work for the company selling the license, not for the broker. To walk through which of your systems would qualify, book a discovery call.
Frequently asked questions
We were offered money for our company data. Is it legit?
Often, yes. Handshake AI, micro1 and Mercor all run real programs that pay companies for operational records. A real offer is not the same as a safe deal: what matters is what leaves, in what condition, and under what terms. We represent you in that conversation, not the broker.
Do we need to de-identify our records if the broker also cleans them?
Brokers may clean data once it arrives, but Handshake's own overview page leaves data partners responsible for their transfer meeting applicable law. Cleaning on your side keeps names, customers and your company identity under your control before anything leaves, and gives you a written record of what was removed and checked.
Can de-identified data be traced back to us?
Some risk can remain, and Handshake's own overview page says no de-identification process removes it entirely. What we do is measure it: a second person attempts re-identification using public sources, the results are written down, and a residual-risk statement is written for the named recipients. We reassess each year or when recipients change.
Can this support a HIPAA Expert Determination?
Yes. A qualified expert makes that determination under 45 CFR 164.514(b)(1), and HHS says no specific degree or certification is required. We prepare everything the expert needs to review: the identifier inventory, the transformation log, the risk measurements and the documented re-identification attempt, so the review is quick.
Do we have to include email and Teams chats?
Scope is your call, system by system, and Handshake's license page says the seller decides what is shared. You can start with accounting, ticketing and CRM, then decide on mailboxes after seeing the cleaned samples. Anything left out goes in the scope register, and the perimeter document tells the broker what is excluded.
How long does an engagement take?
Free text drives the timeline. Tables from accounting, ticketing and CRM move faster because the rules are repeatable and logged per column. Mailboxes, chats and scanned paper take longer because they need automated detection plus human review. You get a written schedule by system once the inventory is finished.
Can we license the same data to more than one broker?
That depends on your agreement. If a license includes an exclusivity period, the documented package can be offered to another broker once it ends. We rerun the context and risk assessment first, because a new recipient and any newly public information about your company change the risk picture.
Ready to sell data to AI companies, anonymized first?
If a broker has approached you, or a peer was paid for their records, Desert Lakes Solutions offers a no-pressure discovery call to walk through which of your systems would qualify and what should stay out, before you sign anything.
Call (855) 737-9500 / (480) 573-3349
Email [email protected]
15-minute response on critical issues, 24/7. Onboarding in two to three weeks.