Software and IT company records and AI training: a UK guide

Software and IT companies produce the records AI developers want most: code with its full history, tickets, incident reviews, runbooks, and the chat where engineers work through problems. Code is also one of the few kinds of company data with a visible market price.

This guide covers software developers, IT consultancies and managed service providers (MSPs). They are registered under SIC codes such as 62011, 62012, 62020, 62030, 62090, 58290 and 63110 (Companies House). There is no separate SIC code for MSPs. For code in particular, see our guide to selling source code to AI companies.

What software and IT firms hold

• Code and its history. Repositories, commits, pull requests, code reviews, issues and build logs.
• Engineering records. Design documents, runbooks, incident reviews, tickets and wikis.
• Communication. Slack or Teams, email and meeting notes.
• Customer records. Support tickets, CRM and billing.
• For MSPs. Service desk tickets, monitoring alerts, change records and documentation of each client's systems.

The information and communication sector, which includes software, publishing and telecoms, had 191,000 businesses registered for VAT or PAYE in March 2026 (ONS).

Who owns the code

Copyright law treats a computer program as a literary work (CDPA 1988, s3(1)).

• Employees. The company owns code its employees write in the course of their employment, unless an agreement says otherwise (CDPA 1988, s11(2)).
• Contractors. A contractor "will usually retain copyright in any works he produces, unless there is a contractual agreement to the contrary" (IPO). An assignment is effective only "in writing signed by or on behalf of the assignor" (CDPA 1988, s90(3)). If freelancers wrote any of your code, find their signed assignments.
• Client code. Who owns bespoke code for a client depends on the contract. The government's Mid-tier Contract shows both models: under Option 1 the "Buyer owns all New IPR", while Option 3 gives "Supplier ownership of all New IPR with Buyer rights for the current contract only" (Cabinet Office).
• Open-source code. It keeps its own licence. The MIT licence requires its notice to be "included in all copies or substantial portions of the Software" (MIT). GPL-3.0 says "You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy" (GPL-3.0). Exclude or list third-party code, and never promise a buyer exclusive rights in it.

Get this right before you start. If you cannot show you own a piece of code, leave it out.

What must stay out

• Secrets. API keys, passwords and tokens. Under the heading "Separate secret credentials from source code", the NCSC advises scanning repositories for secret keys (NCSC). Scan the whole history, not only the current code, because a key deleted last year is still in old commits. Rotate any key you find.
• Customer data. Production data, database exports, logs, and customer content in tickets.
• Personal data in the history. Commit records carry each developer's name and email address. Chat and tickets name staff and customers. One lawyer has called workplace data like this "legally radioactive", because of the private details in email and calendars (MIT Technology Review).
• Third-party code and assets. Libraries, fonts, images and any code you did not write.
• Live security detail. If the product is still in use, a buyer who gets the code also gets its weaknesses. Weigh that before you license a live product, or license older versions only.

MSPs: client data is not yours

MSPs "often have unprecedented access to clients' IT systems, including their networks, infrastructure, and data", in the government's words (GOV.UK). Most of what an MSP touches is data it processes for clients. A processor may process personal data "only on documented instructions from the controller" (UK GDPR, Article 28). The ICO warns: "If you act outside your instructions or process for your own purposes, you will step outside your role as a processor and become a controller for that processing" (ICO).

So an MSP can license only its own operating records, such as runbooks, procedures and de-identified ticket workflows, and never data from client systems. Treat ticket content as client data unless your contracts say otherwise.

Regulation is also coming. The Cyber Security and Resilience Bill would cover MSPs that are "not a small and micro enterprise". It is not law yet (UK Parliament).

What buyers want

• Replay licenses code and commits, and publishes price bands by company size.
• Grepped connects to GitHub, GitLab and Bitbucket.
• Ooak Data takes code repositories, tickets and documents from trading, closing and closed companies.
• Scale AI names Jira, Confluence, Linear and Notion among its sources.
• Mercor takes GitHub "Repositories, commits, PRs, and issues" (Mercor).

The market for closed startups' code and records is now well reported:

• Forbes reports that deals through SimpleClosure typically pay "between $10,000 and $100,000 per company" (Forbes).
• MIT Technology Review reports "47% of SimpleClosure deals now including code or data sales", more than 150 deals through its Asset Hub, and one founder who "netted roughly $25,000 for his code base" (MIT Technology Review).
• Upstarts Media reports that less common code can fetch top dollar (Upstarts Media).
• Forbes reports that cielo24, a transcription and captioning company that was winding down, sold 13 years of Slack, Jira, email and Google Drive records for "hundreds of thousands of dollars". Forbes does not say the deal included code (Forbes).

If the company is closing

A closing software company can lose its records fast. Cancelled subscriptions start deletion clocks, and Slack's free plan deletes messages and files more than a year old (Slack). Our records deadline check shows how long Microsoft 365, Google Workspace or Slack data has left. Take a full copy of your repositories and cloud accounts before you cancel anything.

If the company is insolvent, its code is company property, and a liquidator or administrator can sell or license it. Our guide to company records in insolvency explains how.

Before you talk to buyers

1. List every repository. Note who wrote each one, and when.
2. Find the assignments. Every contractor who wrote code needs a signed assignment, or their code stays out.
3. Check client contracts. Find out who owns each piece of bespoke code.
4. List third-party and open-source code. Exclude it, or list it with its licence.
5. Scan the full history for secrets. Rotate anything you find.
6. Remove personal data. Commit author details, customer data and logs.
7. MSPs: separate your own records. Leave client data out.

Tydex values a software company's records from basic facts, finds buyers whose criteria fit, and brings you written offers. Get a free valuation.