Is Handshake AI legit? What companies offered money for their data should know
Published October 8, 2026
Handshake AI is legit. It is the AI data business of Handshake, the career network, with nearly $1 billion in annualized revenue from AI training as of April 2026 (Dealroom), and its data partnership program really does pay companies to license their records to AI labs. The question for a company is not whether the offer is real but what leaves your building and on what terms. If Handshake AI offered you paid AI-training work instead, that is a different program; this guide is for companies offered money for their data. Desert Lakes Solutions represents the company selling its data, not the broker.
If you were offered AI-training work instead
Most people searching "is Handshake AI legit" were offered paid AI-training tasks, not a data deal. That program is also real, and pay and workload vary by project. Handshake publishes its own guidance on how to identify fraud and scams that use its name; use it to check any message you received. The rest of this guide is for companies.
What is the Handshake AI data partnership?
The Handshake AI data partnership is a program where Handshake AI offers to pay established companies for their business records, such as email and accounting history, and passes them with identifying details removed to AI developers for training and testing models. For an owner or CFO, it can turn years of records into a license fee, provided the data leaves in a condition you can defend to customers, staff, and counsel. Desert Lakes Solutions is not affiliated with Handshake or any other data broker, meaning a company that gathers records from many businesses and supplies them to AI developers. We work for the company that holds the records.
Other buyers exist. micro1 and Mercor advertise similar programs, and in August 2026 Google won a bankruptcy auction for Spirit Airlines' deidentified corporate data, meaning data with identifying details removed (Bloomberg Law), with court approval still pending as of early October.
Who qualifies for Handshake data licensing
Handshake's public license page sets the bar at 20 or more full-time employees and 3 or more years in operation. The partner materials sent with Handshake's outreach list 30 or more employees, English-language operations, and operating or wound-down companies. If your headcount sits between the two, ask which threshold applies before you spend time on intake.
What Handshake says it licenses and pays
The public pages and the partner materials differ in places. Get anything found only in the partner materials confirmed in writing.
| Topic | Handshake's public pages | Handshake's partner materials |
|---|---|---|
| Framing | The overview describes Handshake AI purchasing operational data | A license rather than a sale; ownership stays with the company |
| Payment | A published range of $100K to $4M+, labeled an indicative estimate and not an offer; the license page reports $250M paid out to 1K+ partner companies | A view on fit and indicative pricing within two weeks of evaluation |
| Exclusivity | Not addressed | Optional, typically one year, limited to AI training and evaluation |
| Scope | You determine what is shared | Defined jointly; regulated or restricted records can be carved out |
| Process | Intake form with no commitment, then a scoping call | NDA, an intake listing 10 to 25 systems plus samples, evaluation, agreement, transfer |
| De-identification | Identifying details are removed on Handshake's side after you transfer the data as it exists; residual risk acknowledged | Same: Handshake de-identifies internally after transfer |
How the process runs
You submit the intake form, which Handshake says carries no commitment, and a representative schedules a scoping call on data parameters, de-identification, terms, and timeline. The real work is the inventory behind it. Handshake's partner materials describe an intake listing 10 to 25 systems, such as Microsoft 365, QuickBooks, ticketing, call recordings, payroll, customer relationship management (CRM) software, and scanned paper, with an export size, a YYYY-MM date range, contents, exportability, and restrictions for each, such as personal information, voice recordings, partner-held data, or contract limits. Samples sent with the intake should get the same cleaning as the full set.
What happens to the data after it leaves
Handshake says data in the program is scoped, de-identified, and confidential. Its overview acknowledges that no de-identification process removes re-identification risk entirely, and says data partners remain responsible for making sure their transfer meets applicable legal requirements. So responsibility for the legal compliance of your transfer to Handshake stays with you, whoever does the cleaning.
Your records also identify your company, through its name, domains, customers, invoice numbers, letterhead, and project names that turn up in a web search. If anyone downstream can tell whose data it is, the people inside it become easier to find too. De-identification guidance from the National Institute of Standards and Technology (NIST) counts disclosure risk to establishments as well as individuals, so the company's own identity is part of the cleaning. Whether employees need notice before their email is licensed is a question for counsel.
The legal tests buyers are likely to ask about
The three tests come from the Health Insurance Portability and Accountability Act (HIPAA), the California Consumer Privacy Act (CCPA), and the EU General Data Protection Regulation (GDPR). Each of these tests is a judgment for counsel or a qualified expert, and the evidence listed in the last column is what you supply.
| Test | What it asks | What answers it |
|---|---|---|
| HIPAA Expert Determination, 45 CFR 164.514(b)(1) | A qualified person documents that the risk an anticipated recipient could identify someone is very small. Guidance from the U.S. Department of Health and Human Services (HHS) sets no numeric threshold. | Identifier inventory, transformation log, risk measurements, and re-identification attempt, reviewed by a qualified expert |
| CCPA "deidentified," Cal. Civ. Code 1798.140(m) | Information that cannot reasonably be used to infer information about, or be linked to, a particular consumer, plus reasonable measures against association with a consumer or household, a public commitment to keep the data in deidentified form and not to reidentify it, and contracts binding recipients to all of those conditions | Documented measures, a public commitment your company publishes itself, and license terms that bind every downstream recipient |
| GDPR Recital 26 and WP216 (a 2014 EU regulators' opinion on anonymisation) | Can a person be singled out, can their records be linked, and can facts about them be inferred? | A table for each data source showing the singling out, linkability, and inference results |
HIPAA's other route, Safe Harbor, has two conditions: removing 18 listed identifiers, including those of relatives, employers, and household members, and no actual knowledge that what remains could identify someone. HHS says those identifiers must also come out of free text such as email bodies. HIPAA governs health information held by covered entities and their business associates; for other companies it is a benchmark buyers use.
Recital 26 names singling out; the three-part test comes from a 2014 Article 29 Working Party opinion, not the GDPR text. In July 2026 the EDPB adopted draft anonymisation guidelines with three similar criteria, no record isolation, no linkage and no inference, open for consultation until 30 October 2026. Pseudonymized data (names swapped for codes) is the hard case. January 2025 guidelines from the European Data Protection Board (EDPB), issued for consultation, treat it as personal data, while the EU Court of Justice held in September 2025 that it need not be treated as personal data in every case and for every person. In practice it is generally treated as personal data, and always for whoever can re-link it. Whether GDPR reaches your records is a question for counsel.
How to sell data to AI companies: what to settle before you reply
- Set carve-outs with counsel. Regulated records, partner-held data, and contractually limited records are the usual candidates. HIPAA's Safe Harbor list names voice prints as biometric identifiers, so our practice is to release scrubbed transcripts, never audio.
- Read the agreement. Look for sale or license language, ownership, exclusivity, who de-identifies and when, whether no-reidentification terms flow down to every lab, and whether records are returned, deleted, or kept in use when the term ends.
- Ask what the fee covers. One delivery or a term with refreshes, who pays for extraction and cleaning, and what exclusivity blocks.
- Clean before transfer. Handshake's overview says its preparation happens on its side and all you have to do is transfer the data as it exists today, so without this step the raw records leave first. Clean them before they go and identifiable records do not have to leave the company.
- Keep the paper trail. The verification report and residual-risk statement, a plain summary of the identification risk that remains, answer a customer, regulator, or insurer who asks later.
How Desert Lakes prepares records for a data license
Our data licensing preparation service covers the company side of the deal. We already administer Microsoft 365, QuickBooks, and ticketing for clients, so the access and export tooling exist. The Microsoft Purview sensitivity labels (tags that mark a file or email as confidential) and permissions behind our Copilot rollouts already show which mailboxes and sites hold regulated or confidential material, and our HIPAA, SOC 2, and cyber insurance practice supplies the documentation discipline.
- Inventory and extraction. The broker intake and samples, then exports through Purview eDiscovery, Microsoft's tool for exporting mail and files, automated exports from QuickBooks and ticketing systems through their programming interfaces (APIs), and call recording exports, each logged.
- De-identification. Organized around ISO/IEC 27559:2022, an international standard for de-identifying personal data, with techniques classified in ISO/IEC 20889, its companion list of de-identification methods. We remove or transform identifiers of people and of the company, from names and account numbers to signatures, metadata, and free-text mentions. The standard is written for personal information; removing the company's identity is our extension of it. We have not been assessed against either standard.
- Verification. A second person who did not clean that source makes a documented re-identification attempt in the style of the motivated intruder test used by the UK data regulator (a reviewer tries to identify people or the company using public sources), measures residual risk, samples the free text, and writes a determination.
- Packaging. Data dictionary, identifier inventory, suppression and transformation log, residual-risk statement, and a perimeter document for the broker (a short statement of what is in and out of the release and the conditions of use), refreshed yearly.
Where a HIPAA Expert Determination is needed, we prepare the evidence the qualified expert reviews. We destroy the pseudonym key (the table that maps codes back to real names) after verification, but under the EDPB guidelines that step alone does not make data anonymous, so the result rests on the verification, not on the key.
Frequently asked questions
Is Handshake AI a scam?
No. Handshake AI is the AI data business of Handshake, the career network, and its data partnership program pays real companies for their records. Being real is not the same as being safe for you: what leaves your company, in what condition, and under what terms is the part to get right before you reply.
Is the Handshake AI data partnership a sale or a license?
It depends on which Handshake document you read. The partner materials describe a license, with ownership staying with your company, while the public overview says Handshake purchases operational data. The agreement you are offered decides it, so have counsel confirm ownership, permitted uses, exclusivity, and what happens to the data when the term ends.
How much do AI companies pay for business data?
There is no fixed rate. Handshake publishes a payout range of $100K to $4M+ and says it is an indicative estimate, not an offer, with the amount tied to the sources shared, their volume and quality, due diligence, and acceptance of its licensing terms. micro1 advertises payment tiers as well. Treat any published figure as a starting point until terms are in writing.
Can we license the same records to another broker later?
Possibly. Read the exclusivity clause first, because it sets how long and for which uses you are tied to one broker (the company that passes your records to AI developers). After it ends, a documented package can be refreshed and offered elsewhere, with a fresh risk assessment and new pseudonyms (codes replacing names) so the two releases cannot be joined.
Handshake AI is legit; make the deal safe
So, is Handshake AI legit? Yes. Whether the deal is safe for your company depends on the work before you reply: an accurate inventory, clear carve-outs, an agreement you have read, and de-identification you can document. If you would like to see what that takes for your company, Desert Lakes Solutions offers a no-pressure discovery call to walk through your systems and what a clean license package needs. Book a discovery call.
