Updated 16 Oct 2026

How we check every holder.

A buyer licensing data needs to know it came from the one who holds it. A holder accepts our mandate in one step, and our acceptance is recorded at the same moment, automatically. Then we check the holder, a company or a person, the one who accepted for it and the data itself. We approach no buyer until every check that applies has passed, and if a check fails, the mandate ends that day.

When the checks run

  1. In the moment of acceptance

    Entering a contract with a listed person is itself prohibited, so the holder's name and the name of the person accepting are screened against the sanctions lists before our acceptance is recorded. On a clear result it is recorded at once. A possible match holds our acceptance until a person has looked at it, and a holder in a country we take no holders from cannot accept.

  2. Right after acceptance

    Every other check below starts by itself, and runs again whenever the holder adds what one of them needs.

  3. Every day the mandate is in force

    The sanctions screening and the rights file are checked again each day, and every other check when its evidence is no longer recent or before a step that needs it.

  4. If a check fails

    The mandate ends that day, and we tell the holder in writing what failed. No fee is then due under it, its exclusivity no longer binds the holder and there is no tail, so the holder is free to sell elsewhere. The NDA continues on its own terms. A finding that needs a judgment, such as a name close to a listed one, goes to a person first, who clears it or confirms it, and only a confirmed finding ends the mandate.

  5. If what the checks need from the holder has not come in 30 days

    The mandate ends the same way, by a written notice that names what the checks still need from the holder, so no holder stays exclusive to us while we cannot approach a buyer. The 30 days run from our acceptance: while a possible match holds it, they have not started. A check that waits only on our own review does not count against the holder, and our desk is reminded each day once one has waited more than 2 days. The holder can accept again once it has what the checks need.

What we check

A holder may be a company or a person with no company, a solo founder for one. A person is checked as a person: who they are and that they control the data, not a company register.

  • The company exists and can still sell
    For a company
    Its registration number is looked up in the official register (name, status, legal form, address, date of incorporation, officers). Where the register has no free lookup, the holder adds the register's own extract and we read it, then cross-check it against what is public. A company being wound up, in an insolvency procedure or dissolved can still sell for as long as its law allows, through the person that law names; one dissolved past that time cannot, and the data is then sold by whoever it passed to before the company closed.
    For a person
    Does not apply. A person holds the data, not a company, so there is no company register to read: who they are and their control of the data are checked instead.
  • The signer can bind it
    For a company
    The signer is listed in the register as a director, partner or member, or a listed officer has authorised them in writing (a board resolution or power of attorney the holder adds). For a company being wound up, in an insolvency procedure or dissolved, the signer is the person the law lets act for it then: its liquidator, administrator, trustee or curator as the register or the document appointing them names them, or its directors where the winding up is theirs.
    For a person
    The person accepting is the holder. A person accepts for themselves: the full name typed at acceptance is the holder's own, signed in with a confirmed address. Anyone accepting for them adds the holder's signed power of attorney.
  • The signer is who they say they are
    For a company
    The signer signs in with a confirmed address at the company's own domain, or confirms a link sent to one; failing that, the person behind their address is looked up and must be the named signer, or the GitHub or GitLab account in their own name carries a one-time code we give them. For a company that has closed we never ask for an address at its domain.
    For a person
    The holder is who they say they are. One of three proofs: an address at the holder's own website, confirmed by opening a link we send; the GitHub or GitLab account the data lives in, whose public profile shows the holder's name and carries a one-time code we give them; or a lookup of the address the holder signed in with, which finds the same named person.
  • The brand belongs to that company
    For a company
    The holder says how the brand relates to the company (the same name, a trading name, or a separate company). We read the brand's own site and terms for the company's name, number and address, the domain's registration, and what the records themselves name. For a company that has closed, the site as the Wayback Machine archived it before it closed.
    For a person
    The brand belongs to the holder. Only when the lot carries a brand or a website: the site names the holder, its domain is registered to them, or they confirm an address at it. For data that came from a company that has closed, the site as the Wayback Machine archived it names that company, and the document that passed the data to the holder is on record.
  • The records name the holder
    For a company
    When the holder measures its exports, the reader on their computer also picks out who the records belong to: the mailbox's own domain and the issuer and buyer named on its e-invoices. Only those names reach us, with counts. They must be the signing company or the brand it declared. They are in the files, so they work the same for a company that has closed. For code, the GitHub or GitLab organisation that owns the repositories shows it instead: its public profile carries a one-time code we give the holder. Records that name a closed company the data came from are the holder's once the document that passed them is on record.
    For a person
    The holder controls the data. For code, the GitHub or GitLab account that owns the repositories carries a one-time code we give the holder in its public profile, which shows the account is theirs. For other data, the account it was exported from is the address the holder signed in with, or the mailbox the reader measured is at the holder's own domain, where they confirmed an address. For data that came from a company that has closed, the document that passed it to the holder, with records that name that company.
  • The rights file settles the right to sell
    For a company
    The rights file answers every question that decides whether the lot can be sold: whose each part is, which contracts limit it, who appears in it and whether they agreed. A question answered no means part of the lot may not be the holder's to sell, and a person looks at it before anything goes further.
    For a person
    The rights file answers every question that decides whether the lot can be sold: whose each part is, which contracts limit it, who appears in it and whether they agreed. A question answered no means part of the lot may not be the holder's to sell, and a person looks at it before anything goes further.
  • The dates line up
    For a company
    The records cannot start before the company existed, unless a document shows they passed to it (a conversion, a transfer of the business or an asset purchase).
    For a person
    Does not apply. A person's data has no date of incorporation to compare it with.
  • Who controls it is known
    For a company
    Everyone holding 25% or more, from the register where it publishes them, otherwise as the holder states them; each is screened like the company.
    For a person
    Does not apply. A person holds the data themselves, so there are no beneficial owners to name.
  • No one is on a sanctions list
    For a company
    The company and the signer are screened at the moment of acceptance, before our acceptance is recorded; then, with the brand, the officers and the beneficial owners, right after it and every day while the mandate is in force. Against the United States consolidated list (OFAC and the export lists), the UN Security Council list, the UK sanctions list and the EU consolidated list, each refreshed every day.
    For a person
    The holder is on no sanctions list. The holder, by name and country, and anyone accepting for them are screened at the moment of acceptance, before our acceptance is recorded; then, with any brand, every day while the mandate is in force. Against the United States consolidated list (OFAC and the export lists), the UN Security Council list, the UK sanctions list and the EU consolidated list, each refreshed every day.
  • It is not in an embargoed country
    For a company
    The company's country and address, and its beneficial owners' countries, against the countries and regions under comprehensive sanctions and the countries the US rule on sensitive personal data names.
    For a person
    The holder is not in an embargoed country. The country the holder lives in and the address given at acceptance, against the countries and regions under comprehensive sanctions and the countries the US rule on sensitive personal data names.
  • Nothing adverse in the news or the courts
    For a company
    A search of news, court and regulator records for the company, the brand and the signer: fraud, litigation over data or contracts, insolvency, data breaches, regulatory action.
    For a person
    A search of news, court and regulator records for the holder and any brand: fraud, litigation over data or contracts, bankruptcy, data breaches, regulatory action.
Who a person is.
One of three proofs: an address at the holder's own website, confirmed by opening a link we send; the GitHub or GitLab account the data lives in, whose public profile shows the holder's name and carries a one-time code we give them; or a lookup of the address the holder signed in with, which finds the same named person. A person accepts for themselves; anyone accepting for them adds the holder's signed power of attorney.
That a person controls the data.
For code, the GitHub or GitLab account that owns the repositories carries a one-time code we give the holder in its public profile, which shows the account is theirs. For other data, the account it was exported from is the address the holder signed in with, or the mailbox the reader measured is at the holder's own domain, where they confirmed an address. For data that came from a company that has closed, the document that passed it to the holder, with records that name that company.
The one-time code.
It is shown in the holder's workspace, works only for that lot and that account, and can be removed from the profile once the check has passed.

When the company has closed

Much of the data we sell was held by companies that have closed, and closing rules no holder out by itself. The law of the country the company was registered in says who may still sell what it owned, and for how long. We read the company's standing from its register and apply that law; a check fails only when the company was dissolved past every time limit its law gives, and the data did not pass to anyone before it closed.

  • England and Wales
    Being wound up
    Its liquidator: once a liquidator is appointed, the directors' powers end.
    In an insolvency procedure
    Its administrator or liquidator, as the register lists them.
    Dissolved
    It can sell nothing itself until it is restored to the register (by the court on the application of a former director, member, liquidator, creditor or anyone with an interest; or by Companies House on a former director's or member's application, for a company the registrar struck off), and then those who act for it accept, within six years of its dissolution.
  • The Netherlands
    Being wound up
    Its liquidator (vereffenaar), who is its directors unless someone else is appointed.
    In an insolvency procedure
    Its bankruptcy trustee (curator).
    Dissolved
    It can sell nothing itself until the court reopens its liquidation on the request of anyone with an interest and appoints a liquidator (vereffenaar), who sells for it; the law sets no time limit for that.
  • Germany
    Being wound up
    Its liquidators (Liquidatoren), who are its managing directors unless others are appointed.
    In an insolvency procedure
    Its insolvency administrator (Insolvenzverwalter).
    Dissolved
    It can sell nothing itself until the court appoints a liquidator for a supplementary liquidation (Nachtragsliquidation) on the request of anyone with an interest, and that liquidator sells for it; the law sets no time limit for that.
  • Delaware
    Being wound up
    Its directors, unless the Court of Chancery has appointed trustees or receivers.
    In an insolvency procedure
    Its bankruptcy trustee, or its board as debtor in possession, with the court's approval of any sale outside the ordinary course; or the assignee under an assignment for the benefit of creditors.
    Dissolved
    For three years it may still sell what it owned, through its directors, winding up its affairs; after that, the Court of Chancery appoints trustees or receivers for it, at any time, on the application of a creditor, a stockholder, a director or anyone who shows good cause; the law sets no time limit for that.
  • US states that follow the Model Business Corporation Act
    Being wound up
    Its directors, winding up its affairs.
    In an insolvency procedure
    Its bankruptcy trustee, or its board as debtor in possession, with the court's approval of any sale outside the ordinary course; or the assignee under an assignment for the benefit of creditors.
    Dissolved
    It may still sell what it owned, through its directors, winding up its affairs, with no time limit; a company dissolved by the state for a missed filing is reinstated by the state, which takes effect as if it had never been dissolved.
Data that passed on before the company closed.
It belongs to whoever it passed to, who is then the holder and accepts in its own name. The evidence is an asset assignment or sale agreement the company signed before it closed, its liquidator's transfer of its assets to its members (a distribution in specie), or a sale by its liquidator, administrator, trustee or curator.
Without the company's email or website.
We never ask for an address at a closed company's domain. Who the person accepting is comes from a lookup of the address they sign in with, or a one-time code in the GitHub or GitLab account in their own name; the brand from the site as the Wayback Machine archived it before the company closed; and whose records they are from the names in the exports themselves.
Another country.
Where we have not set out the law, a closed company is never failed on time alone: the holder adds the document that gives someone the power to sell for it now.

What each step needs

Our acceptance

The holder and the person accepting for it are screened against the sanctions lists in the moment of acceptance. On a clear result our acceptance is recorded at once; a possible match holds it until a person has looked at it.

Sanctions screening.

Approaching buyers

Every check that applies to the holder has passed, on recent evidence. Until then we approach no buyer and send no datasheet.

The company's record, the signer's authority, the signer's identity, sanctions screening, the country, the brand, the beneficial owners, the public record, whose records they are and the rights file.

Agreeing a licence

Every check again, the dates included, run again first where its evidence is no longer recent.

The company's record, the signer's authority, the signer's identity, sanctions screening, the country, the brand, the beneficial owners, the public record, whose records they are, the rights file and the dates.

Where the evidence comes from

We read the official register ourselves wherever it publishes a free service: Companies House, Registre national des entreprises (INSEE Sirene), Brønnøysund Register Centre, Finnish Patent and Registration Office (YTJ), ARES (Czech business register) and ACRA (Accounting and Corporate Regulatory Authority), plus GLEIF for a Legal Entity Identifier and the EU's VIES for a VAT number.

Where a register has no free lookup (Suruhanjaya Syarikat Malaysia (SSM), The Secretary of State of the state of formation, Handelsregister, Kamer van Koophandel (KVK), Ministry of Corporate Affairs (MCA), ASIC and Corporations Canada or the provincial registry, and others), the holder adds the register's own extract. We read it for its facts, keep those and a fingerprint of the file, and do not keep the file itself.

For code, we read the public profile of the GitHub or GitLab account or organisation that owns the repositories, through the host's own public interface, for its name and the holder's one-time code.

Sanctions lists

Screening covers the holder, the person accepting for it, its brand and, for a company, its officers and beneficial owners, against the US Consolidated Screening List, the UN Security Council Consolidated List, the UK Sanctions List and the EU Consolidated Financial Sanctions List, each read from its publisher every day. A screening against a list more than three days old does not count as clear.

What reaches us from the records

The records stay on the holder's computer: their browser measures them and sends counts. For the check of whose records they are it also sends who the records name as their own: the domains the mailbox writes from and to, and the companies named as issuer and buyer on its e-invoices, the few most frequent of each with how often they appear. A name that reads as a person's is dropped on the holder's computer and is not sent.

Those names have to be the company that accepted, or the brand it declared. Records that name another company as theirs are not ours to sell, whoever offers them.

Verified data is easier to sell. Data nobody verified can become a legal problem for a buyer.

Value your dataSee the licence terms
How we verify every data holder | AIData.Broker