Personal data
Automated detection, then human review of a sample. Names become stable pseudonyms so threads still make sense. Emails, phone numbers, addresses and ID numbers are removed. We measure the residual rate and put it on the data card.
Trust and process
Clean title first. Clean data second. Then a license.
This page sets out how we work with operating companies and with closed, winding-down or acquired ones. It describes our process, not a legal guarantee.
Chain of title
Who can sign depends on where the company is.
Company statusWho signsWhat we ask for
OperatingThe owner or CEO, with board approval where the company has a boardOwner or board approval of a non-exclusive license of a cleaned copy
Winding downThe company, with board approvalBoard resolution authorizing the sale or license
DissolvedDirectors or a wind-down officer, as state law allowsDissolution records and authority to dispose of assets
Assignment for the benefit of creditorsThe assigneeAssignment deed and the assignee's sale authority
BankruptcyThe trustee or debtor in possessionCourt approval of the sale
ReceivershipThe receiverThe appointing order and court approval of the sale where required
AcquiredWhoever holds the assets under the dealDeal documents showing who owns the archive
In every case we also check for lender liens, confirm IP assignments from employees and contractors, and review customer contracts and the privacy policy in force when the data was collected. An operating company keeps its originals: Codicilla receives a cleaned, de-identified copy under a non-exclusive license by default.
Cleanup
What happens to company data before anyone licenses it.
Secrets
Code, config, email and chat are scanned for API keys, tokens, passwords and private keys. Anything found is removed before packaging.
Open-source licenses
Repositories are scanned for license terms. Copyleft code such as GPL and AGPL is removed. Permissive code is kept with its notices.
Public duplicates
Code and text that already exist in public sources are measured and removed, and the overlap rate is reported.
Default exclusions
Health records, payment card and bank account data, and children's data. Customer data under NDA or confidentiality terms without consent. Direct messages, private channels, personal mailboxes, HR, legal and board material, raw call recordings, and content from people in the EU and UK.
Consent
Where the review calls for it, employees and former employees receive notice and can opt out. Their authored content is removed if they do.
What we will not take
A short list we do not negotiate.
- Health records
- Payment card and bank account data
- Data about children
- Student records
- Customer data held under NDA or confidentiality terms, unless the customer consents
- Anything from a company that cannot show authority to sign
- Data already sold or exclusively licensed to someone else
Cross-links
Cleanup should not cut the threads.
The most useful records connect their parts: a customer ticket, the email thread it started, the work that fixed it, and the document that changed as a result. Pseudonyms are stable across systems and identifiers are mapped, not dropped, so those links survive cleaning. The data card reports how much of the data stays linked.
Questions about the process?
Owners, counsel and trustees are welcome to ask for the full checklist.