Is Mercor legit? Six things to confirm before you connect anything
Published October 13, 2026
Mercor is legit: it is a real AI training company, and its data program says it will license, package and pay companies for internal records such as email, chat and files, for use by AI labs. For an owner, CFO or office administrator, that can turn records you already keep into a license fee, as long as you know what leaves, in what condition and on what terms before you link an account. This guide answers "is Mercor legit" for companies pitched by Mercor and lists six things to confirm first, drawn from Mercor's own pages and named press as of October 13, 2026. Desert Lakes Solutions represents the company selling its data, not the buyer or intermediary, and is not affiliated with Mercor or any other company that buys or licenses data.
Is Mercor legit for experts and job seekers?
Most Mercor reviews and "is Mercor legit" searches come from experts and job seekers offered paid AI-training work, a separate program. We found no Mercor scam or impersonation guidance page as of October 13, 2026. Its talent documentation says identity checks run through Persona, a third-party verification service. Experts on active projects get a Mercor-issued @mercor.expert work address that, per the docs, is currently restricted to sending to and from @mercor.com addresses, and the Get in Touch page lists [email protected].
Mercor data licensing: what the program says it does
Mercor's data page is headlined "Monetize your data" and says: "We license it, package it, and pay you for it." It lays out four steps:
- Scope. "The more tools you share, the higher your payout will be."
- Connect. "Choose from 100+ supported tools and link your accounts." The page shows Slack, Microsoft Teams, Gmail, Outlook, Google Drive, Confluence, Notion, Salesforce and GitHub.
- Process. "Our platform extracts and de-identifies data into an asset," meaning it strips out details that identify people.
- Payout. "Get paid as soon as processing is complete."
Mercor's target industries include legal, finance and insurance, professional services and healthcare, where it names clinical notes, claims and intake forms. If you run a medical or dental practice, whether patient records can be part of any deal is a question for counsel. Mercor's enterprise page says data monetization is "always opt-in" and shows a mockup marked "Customer approval required." Mercor also pays a referral bonus when someone refers a company that becomes a paid data partner.
What Mercor's pages say, and what they leave out
| Topic | What Mercor's pages say | Not published |
|---|---|---|
| Price | Based on data volume, tools connected and depth of data | Any rate, range or minimum |
| Eligibility | "Check if you qualify" and "Get a quote" buttons | Employee count, years in business or other thresholds |
| De-identification | Automated, on Mercor's platform, after it connects to your tools | Whether data cleaned on your side, or by a party you choose, is accepted |
| Buyers | AI labs; no lab buyer or third-party vendor sees raw data | Which labs buy, and what terms bind them |
Six things to confirm with Mercor before connecting anything
Get each answer in writing before any account is linked.
1. Is it a license, and what do you keep?
Every Mercor page we read uses license wording, and none says whether your company keeps ownership, how long the license runs, whether it is exclusive, or what happens to copies when it ends. Ask Mercor to put those answers in the agreement, along with permitted uses such as AI training and evaluation only, and have your counsel review the terms before you sign.
2. What exactly does the connector reach?
Mercor connects to your accounts directly, and its enterprise mockup adds SharePoint, OneDrive and calendars to the tools above. The data page says "You scope what moves" and "No data leaves your systems until you approve it," but not what the approval step shows, whether it comes before or after extraction, how long a connection stays authorized, or whether raw copies are deleted. Each tool brings its own questions:
- Slack or Teams. A connection may reach direct messages and channels shared with other companies. Whether staff need notice is a question for counsel.
- GitHub. Commit history carries developer names and emails, configuration files can hold passwords or keys, and client-owned code may not be yours to license.
Ask what permissions each connection requests, whether you can limit it by mailbox, folder and date range, and how you revoke access.
3. Who removes identifying details, and when?
Mercor's data page says its platform extracts and de-identifies the data after connecting to your tools, that "the extraction and anonymization process is fully automated," and that engineers oversee the process without manually reviewing data. As the page describes it, your records are cleaned inside Mercor's automated pipeline (its chain of processing steps), so ask whether any raw copy reaches Mercor before that step.
Who does the cleaning carried a price in at least one public sale. In the August 2026 bankruptcy auction of Spirit Airlines' deidentified data, Mercor bid $5.2 million with a third party doing the de-identification, and offered $7.0 million, then $10.0 million, "each conditioned on completing deidentification with its own tools rather than through a third party" (Chapter 11 Cases). Google was named the successful bidder at $10 million. Google's terms have Spirit deliver the data for de-identification to parties "acceptable to or designated by Buyer," so the buyer picks who does the cleaning, and require "referential integrity across the data set," meaning records still link to each other after cleaning (The Next Web). A hearing on the sale, first set for October 14, 2026, has been moved to November 6 (Skift; AI Frontier News), and the court's approval was still pending as of October 13, 2026, after the privacy ombudsman recommended approval (The Next Web), so check for the court's ruling.
Ask whether you can clean the data first or name who does it, and whether your company's own identity (its name, domains and customer names) comes out too.
4. When are you paid, and what triggers it?
Mercor's data page gives two payment triggers: "Get paid as soon as processing is complete," and a wire transfer "upon delivery of the anonymized dataset to the buyer," typically within 2 to 4 weeks of the signed agreement. Ask which one the agreement uses, what happens if no buyer takes the dataset, and whether the fee recurs with refreshes.
5. Who buys it, and what terms follow the data?
No Mercor page names the AI labs that buy. Ask which buyers will receive your dataset, and whether each one is bound by contract to keep it de-identified, never attempt to re-identify it, and use it only for the agreed purpose. Under California's privacy law, a business that holds deidentified data must contractually obligate recipients to comply with the same limits; ask counsel how that applies to your agreement. Our guide to the Handshake AI data partnership walks through it.
6. How is the connection secured, and what happened in April 2026?
The data page cites a SOC 2 Type II report, an outside auditor's review of its security controls over a period of time, and encryption keys held in AWS Key Management Service, Amazon's key-storage service. In early April 2026, Mercor confirmed it was "one of thousands of companies" hit by the LiteLLM supply-chain attack, in which malicious code in an open-source component harvested credentials (Fortune). The Lapsus$ group claimed up to 4 TB of data, including Slack and internal ticketing data; those are the attacker's claims as Fortune reported them, not contents Mercor confirmed. Mercor said it moved to contain and remediate the incident on discovery, and a third-party forensic investigation began (Security Magazine). The reports we read do not say whether data-program records were involved.
Ask for the current SOC 2 Type II report and whether it covers the data platform, a summary of the forensic findings, and how long raw extracts stay on Mercor's systems. Our compliance practice can help you read it.
How Desert Lakes prepares a company to license its data
Our data licensing preparation service works on your side, before anything is connected. We inventory each system, remove identifiers of people and of the company itself, have a second person who did not do the cleaning make a documented re-identification attempt, and write down what was released and what stayed out.
Frequently asked questions
Is Mercor a scam?
No. Mercor is an established AI training company, and its data program is a real offer to license company records to AI labs. Its pages do not publish a price, a license term, exclusivity terms or buyer names, so get those in writing before you connect any account.
Does Mercor buy company data or license it?
Mercor's own pages describe a license: it says it will license, package and pay for your data, and manage licensing on your behalf. They do not say whether you keep ownership, how long the license runs, or whether it is exclusive. The agreement decides those points, so have counsel confirm them before you sign.
How much does Mercor pay for company data?
Mercor publishes no price. Its data page says compensation is based on data volume, the tools you connect and the depth of your data. The same page says you are paid as soon as processing is complete, and also that the wire goes out when the anonymized dataset is delivered to the buyer, so ask which one your agreement uses.
Can we limit what Mercor's connectors can see?
Mercor's data page says you scope what moves and that no data leaves your systems until you approve it. It does not say what permissions each connector requests or how long a connection stays authorized, so ask whether you can limit access by mailbox, folder and date range, and whether you can clean the data on your side first.
Is Mercor legit? Yes; get the six answers before you connect
So, is Mercor legit? Yes: the company and its data program are real. Ownership, scope, who cleans the data, the payment trigger, the buyers and security decide whether the deal is safe for your company. If you would like to see what a clean, documented release would look like, Desert Lakes Solutions offers a no-pressure discovery call to walk through your systems, what should stay out, and the questions to put to Mercor. Book a discovery call.
