Selling your codebase and engineering records to AI: what buyers want from a software company

Why AI companies want to buy software company data

AI labs are training models to write, review and ship code, and to work as agents inside real engineering teams. Public open-source code is already in every training set. What labs cannot download is the private record of a team building a commercial product for years: the bug report, the Slack thread where someone found the cause, the pull request that fixed it, the reviewer who asked for a test, the CI run that failed and then passed, and the incident postmortem that explained why it broke in the first place.

That record has three things buyers rank highly:

• Outcomes are built in. A pull request is merged or rejected. A test passes or fails. An incident is resolved or reopened. A lab can check a model's work against the result your team actually reached, which is the hardest kind of training data to make from scratch.
• The records connect. Issue keys in commit messages, PR links in tickets and incident IDs in postmortems tie systems together. One data marketplace lists its value factors as uniqueness, years of history, how connected your systems are, whether the data shows outcomes, and clean rights (source: program terms, Regulr buyer directory).
• Almost everyone works at a desk. Engineering, product, support, sales and finance all work in software tools, so nearly every person on payroll produces records a buyer can use.

The same marketplace's SaaS guide is blunt about history: “five years beats five months”. Its code guide says “a snapshot with no history is worth little” to buyers, and that C++, C#, Go and Rust are the languages buyers ask for first, with extra credit for high-quality code written by on-shore teams before large language models (source: program terms, Regulr buyer directory). If your product is old, complex, back-end heavy and built in-house, you are close to the profile buyers describe.

AI buyers that name software and SaaS companies

These are the programs in our registry whose own pages name software, SaaS or technology companies, shown by type. Each cell is the program's own published term; our buyer directory lists the programs and links to where each says so.

The table understates demand, because several programs buy code without naming an industry at all. Buyer program F prices standalone codebases separately and sets a 50K-line minimum, Buyer program P lists “code and PRs” among the records it buys, Buyer program N buys codebases to build training environments and benchmarks, and Marketplace C lists codebases and GitHub among its sources (source: program terms, Regulr buyer directory). One data marketplace publishes guides written for SaaS companies and for code specifically. Our buyer directory lists every program we track and links to their published terms.

What engineering data AI buyers value (PRs, issues, incidents)

The pattern across buyers is the same as in every other industry: they want what your people wrote, decided and resolved. In a software company that is most of what lives in your engineering tools.

Two caveats. Product analytics and usage data describe your customers' behavior, so they need the same review as customer content. And a buyer's connector app pulling straight from a vendor's API can run into that vendor's terms, which is why owner-run exports are the safer path. Our guide to GitHub, Slack, Jira and Linear data export goes system by system.

Selling source code to AI companies: the checks that come first

Source code is the most valuable asset most software companies hold, and the one with the most rights questions. Ownership is rarely the problem for code your employees wrote. The work is in the edges.

• Contractor and agency code. Under US copyright law, work an employee writes within the scope of the job is a work made for hire owned by the employer, but commissioned work only qualifies in nine listed categories with a signed agreement (source: 17 U.S.C. 101, work made for hire (Cornell LII)). A transfer of copyright is not valid without a signed writing (source: 17 U.S.C. 204, transfers in writing (Cornell LII)). Code written by freelancers or an outside dev shop without a signed assignment may not be yours to license. One data marketplace says buyers need every contributor, contractors and agencies included, to have assigned their work to the company (source: program terms, Regulr buyer directory).
• Open-source code inside your repos. Vendored libraries and copied snippets keep their own licenses. The GPL defines conveying as any propagation that lets others make or receive copies, and says you may not impose further restrictions on the rights it grants (source: GNU General Public License v3). The AGPL adds obligations when modified code serves users over a network (source: GNU Affero General Public License v3). Third-party code is not yours to license exclusively, so buyers typically ask for a dependency inventory and leave vendored code out or flag it.
• Secrets in history. API keys and credentials committed years ago are still in the git history. They are removed or the repo history is rewritten before delivery, and any exposed secret is rotated first.
• Customer-specific code. Custom work you built for one customer under a services contract may belong to that customer, and customer configuration files can contain their data.

Our guide to selling source code to AI companies covers what buyers pay for in a codebase, the ownership and open-source checks in more detail, and how a code-only sale compares with a full license.

Who qualifies to license software company data for AI training

Software companies clear headcount gates more easily than most industries because there are no field crews, drivers or warehouse staff to subtract. These are the published gates that matter most.

Years of history and one set of tools

In our view the strongest candidates have five or more years of git history on one host, with the issue tracker and chat history kept for the same period. Squashed or rewritten history, a repo re-created during a migration, or a Slack workspace that dropped to the free plan all cut the record short. The fixable version of this is common: the old repo or archive often still exists somewhere.

How many software companies fit, for context

The Census Bureau's 2022 business counts show 2,094 software publishers (NAICS 511210) and 1,827 data processing and hosting firms (NAICS 518210) with 20 to 199 employees, about 3,900 in total (source: Census, Statistics of US Businesses 2022). Custom programming shops and IT service firms are counted separately, and their client work raises different questions, covered in our guide for MSPs and IT services firms.

What buyers advertise paying for a codebase and engineering data

Prices for software records split into two groups: code on its own, and the full operating record. These are advertised figures, not offers.

• Code on its own. Buyer program F lists standalone codebases at $10K to $100K+. One data marketplace's code guide reports closure deals for code from about $10,000 to $100,000 and says one platform lists a $5,000 baseline per repository (source: program terms, Regulr buyer directory). MIT Technology Review reported one shut-down crypto startup's codebase selling for roughly $25,000, with its workspace data expected to bring about $15,000 (source: MIT Technology Review, data from shut-down startups (Oct 13, 2026)).
• The full operating record. Marketplace A, which names Software and SaaS, advertises “$250K+ Typical company deal”. Buyer program A advertises $100K+ for a qualified partnership and $1M+ for highly unique data, and Buyer program M tiers its offers at $10K to $100K for 20 to 50 employees and $100K to $1M for 50 to 250 (source: program terms, Regulr buyer directory).

In our view the gap between those two groups is the main pricing lesson for a software company: code alone sells, but code with the tickets, reviews, incidents and discussion around it is what the larger figures describe. Treat estimators with care. Several share one formula, so they are not independent valuations. Our data value checker walks through the factors that move a price.

Customer data under DPAs and SaaS terms stays out

This is the line that matters most for a SaaS company. Your customers' data sits in your production database, your logs, your support tool and your analytics. It is in your systems, but it is not yours to license.

• Your customer agreements and DPAs. Most B2B SaaS contracts limit what you may do with customer data to providing the service. Under GDPR Article 28, a processor must process personal data only on documented instructions from the controller, and a processor that decides its own purposes is treated as a controller for that processing (source: GDPR Article 28, processors).
• Pseudonyms do not fix it. One data marketplace's SaaS guide says customer-contract restrictions “apply even after names and personal details are replaced with pseudonyms”, and that product usage data and customer records are often out of scope entirely (source: program terms, Regulr buyer directory).
• What usually stays out. Production customer content and databases, database dumps with rows, customer files in support attachments, logs with customer payloads, card data, and any health or financial data you process for customers.
• What usually stays in. The company's own work: code, tickets, PRs, incidents with customer names replaced, specs, runbooks, internal chat, and sales and support threads with customer identities removed.

HR, recruiting and compensation records also stay out, as do secrets, credentials, vulnerability reports and security audit evidence. You approve the scope, and each exclusion is named in the contract.

Investor, board and lender consent for venture-backed companies

For a venture-backed company, the question is often less about the buyer and more about your own cap table. In our reading of common venture financings, three documents can matter:

• The charter. Protective provisions in favor of preferred holders often require their approval before the company sells or exclusively licenses all or substantially all of its assets, including IP.
• Investor agreements. Information rights and confidentiality terms may limit sharing board materials and investor updates, which is one reason buyers rarely see them.
• Loan agreements. Venture debt and revenue-based loans commonly take a lien on IP and restrict selling or licensing it outside the ordinary course without the lender's consent.

None of this blocks a license, but it decides who signs. A nonexclusive license of a de-identified copy is a smaller ask than an outright sale of the codebase. Founder-owned and bootstrapped companies have the cleanest path, since the founders are the approval. Read your own documents and get the consents in writing before you sign with a buyer.

GitHub, GitLab, Jira, Linear and Slack: what the terms say

The vendor terms we read on October 18, 2026 mostly confirm that the company owns its content. The limits are on how data leaves and how long it stays.

• GitHub. Section D.3 of GitHub's terms says “You own Your Content.” Section D.4 licenses GitHub to store and copy it to run and improve the service, including by training AI features, and Section E.2 says GitHub treats private repository contents as confidential (source: GitHub Terms of Service (effective Apr 27, 2026)).
• Atlassian (Jira, Confluence, Bitbucket). The Atlassian Customer Agreement (Section 13) says the customer owns all intellectual property and other rights in customer data (source: Atlassian Customer Agreement (effective Oct 1, 2026)).
• Linear. Section 10.2 of Linear's terms says the customer owns its user submissions, licensed to Linear for the sole purpose of providing the service (source: Linear Terms of Service (effective Jun 9, 2026)).
• Slack. Free and Pro workspaces export public channels only; private channels and DMs need Business+ or Enterprise (source: Slack Help Center, export your workspace data). Slack's API terms say apps used outside your organization may not use API data to train a large language model or bulk export message and file data (source: Slack API Terms of Service (effective Oct 10, 2025)), which is another reason to use your own export rather than a buyer's app.

Our guide to exporting from GitHub, GitLab, Jira, Linear and Slack covers each export, what it leaves out (GitHub migrations, for example, do not carry Actions workflow run history), and the retention windows after you cancel.

If you are selling your SaaS company

Founders looking to sell a SaaS business usually list it with an M&A advisor or a marketplace and wait for a buyer who wants the revenue. A data license is a separate track, and the timing between the two matters.

• Before a sale. A license of a de-identified copy is one more contract an acquirer will read in diligence. Exclusivity is the term to watch: one buyer program is exclusive by default, another publishes perpetual exclusive licenses, and one requires 24 months of seller exclusivity (source: program terms, Regulr buyer directory). An acquirer may want the right to license the same records itself.
• After a sale. The records usually belong to the new owner, so the decision is theirs.
• Instead of a sale. One data marketplace says operating companies can license a retired product line or a replaced legacy system without touching the live product (source: program terms, Regulr buyer directory). That suits a company that retired a product and still holds its code and history.

If you are shutting down your startup

Shutting down a startup is where code and workspace sales have grown fastest. MIT Technology Review reported that 47% of one wind-down service's deals now include code or data sales, across more than 150 deals (source: MIT Technology Review, data from shut-down startups (Oct 13, 2026)). A dissolved Delaware corporation continues for three years to wind up, including to “dispose of and convey their property” (source: Delaware Code Title 8, Section 278), so the company can still sell what it owns.

Several programs accept companies that are winding down or closed, and one runs a separate form for defunct companies with 50+ employees at peak (source: program terms, Regulr buyer directory). The clock is the problem: Atlassian keeps paid product data for 60 days after deactivation, and Slack's free plan shows only 90 days of history and deletes content older than a year (source: Atlassian Customer Agreement (effective Oct 1, 2026), Slack Help Center, message and file history on free workspaces). Our guide to shutting down a startup and selling its code and records covers the order of operations.

How a software company data deal runs, step by step

1. Inventory. List your repos and their first commit dates, your issue tracker, CI, chat, docs, support and CRM tools, and how far back each goes. Nothing leaves your systems at this stage.
2. Rights check. Confirm contractor assignments, list open-source and vendored code, find customer-specific code, and read your charter, investor agreements and any loan agreement.
3. Scope. Customer content, HR records, secrets and security evidence are the usual exclusions. You approve the scope, and it is written into the contract.
4. De-identification. Committer names and emails, reviewer handles, customer names in tickets and incidents, and employee names in chat are replaced with consistent tokens, so a ticket still links to its pull request without naming anyone. Secrets are stripped from history.
5. Offers. Buyers review a sample or a description and make an offer. One program says it makes an offer within one to two weeks of intake, and another promises a quote within 48 hours (source: program terms, Regulr buyer directory).
6. Terms. Price, payment schedule, exact scope, exclusivity, permitted uses, deletion at the end of the term, and the warranties you give about owning the code.
7. Delivery and payment. The records go from your systems to the buyer you chose. With Regulr, they never pass through us.

The best position is more than one written offer, because buyers price the same repos and tickets very differently and their exclusivity terms differ even more. That comparison is the work Regulr does for the seller. Start with how Regulr takes a company's records to several buyers, or see how other desk-heavy firms approach it in our guides for freight brokers and accounting firms.

Frequently asked questions

Sources

Program terms checked against their own pages on October 15, 2026; our buyer directory lists the programs and links to their published terms. GitHub, Slack, Atlassian and Linear terms, the GNU licenses, GDPR Article 28, 17 U.S.C. 101 and 204, Delaware Code Section 278 and the MIT Technology Review article were read on their own pages on October 18, 2026.

1. program terms, Regulr buyer directory
2. GitHub Terms of Service (effective Apr 27, 2026)
3. Slack Help Center, export your workspace data
4. Slack API Terms of Service (effective Oct 10, 2025)
5. Slack Help Center, message and file history on free workspaces
6. Atlassian Customer Agreement (effective Oct 1, 2026)
7. Linear Terms of Service (effective Jun 9, 2026)
8. GNU General Public License v3
9. GNU Affero General Public License v3
10. 17 U.S.C. 101, work made for hire (Cornell LII)
11. 17 U.S.C. 204, transfers in writing (Cornell LII)
12. GDPR Article 28, processors
13. Delaware Code Title 8, Section 278
14. MIT Technology Review, data from shut-down startups (Oct 13, 2026)
15. Census, Statistics of US Businesses 2022