PII discovery beyond regex
Structured fields, free text, and embedded documents scanned for direct identifiers and the quasi-identifiers that re-identify people in combination — with human-sampled QA on what automated passes miss.
Services Training-Data Scrubbing
Training Data PII & Secret Scrubbing
Turn your data into a premium asset — clean, documented, and priced with confidence.
Training data is an asset buyers pay real money for — and clean, well-documented data commands a premium. We scrub PII and embedded secrets from your datasets, document rights and provenance, and prepare the CCPA/GDPR footing a serious buyer's counsel will demand — including guidance on what your data is actually worth.
Got it — we're on it.
Check your email.
Something went wrong. Try again, or email hello@ysecurity.io.
What is training-data scrubbing for sale preparation?
Training-data scrubbing is the work of making a dataset legally and technically sellable for AI training: finding and removing personal information — names, contact details, identifiers, and the quasi-identifiers hiding in free text — stripping embedded secrets like API keys and credentials, verifying you actually hold the rights to sell what's in it, and packaging the result to meet CCPA's rules on selling personal information and GDPR's bar for anonymization. Buyers' diligence teams pay premiums for clean, well-documented datasets; sale preparation is what makes your asking price stick.
What you get
Secret and credential scrubbing
API keys, tokens, passwords, and internal endpoints found and stripped — and anything still live flagged immediately for rotation. It's the security-firm rigor sophisticated buyers notice, and pay for.
The legal wrapper, engineered
CCPA sale/sharing analysis with opt-out reconciliation, GDPR anonymization-versus-pseudonymization determination, and provenance documentation — built with your counsel, in evidence they can hand across the table.
A sale-ready package, priced
Data card, scrub methodology report, rights and consent lineage, plus pricing guidance: how licensing is typically structured, and how cleanliness and provenance move what buyers will pay. We'll help you set the number and defend it.
How it works
- 1
Assess
Free assessment, then ~1–2 weeks.We inventory the dataset, sample-scan for PII and secrets, and review rights and consent lineage. You get the real scope: what has to come out, what the legal wrapper needs, and what that means for price.
- 2
Scrub
Sized to the dataset.The pipeline runs — detection, removal or transformation, secrets stripped, live credentials rotated — with sampled human QA and a re-identification review before anything is called clean.
- 3
Package
Through the close.Data card, methodology report, and compliance documentation assembled; pricing guidance delivered; and we sit with you through buyer diligence questions until the deal signs.
Training Data PII & Secret Scrubbing questions, answered
Is anonymized data really outside GDPR and CCPA?
Truly anonymized data is outside GDPR — but the bar is high: if individuals can reasonably be re-identified, it's still personal data, and pseudonymization doesn't clear it. CCPA similarly excludes properly de-identified data only when specific safeguards and commitments are in place. We engineer to the actual legal bar and document how — so when your buyer's counsel asks exactly this question, the answer is ready.
Do we have to honor opt-outs before selling?
Under CCPA, yes — consumers who opted out of sale or sharing must be excluded, and sale triggers notice obligations. We reconcile your suppression lists against the dataset as part of the scrub, so the version that ships is the version you're allowed to ship.
What does the pricing guidance cover?
What buyers of training data actually pay for — scale, uniqueness, rights cleanliness, documentation — and how deals are structured: per-record or per-token pricing, exclusive versus non-exclusive licenses, usage restrictions. You get a defensible asking price and the reasoning to hold it in negotiation.
What happens if you find live secrets in the data?
We flag them to you immediately — before the scrub proceeds — so you can rotate credentials right away. It's one of the most common findings in code and support-ticket datasets, and finding them early keeps your systems safe and your sale process smooth.
Can you handle code datasets?
Yes — code is home turf for a security firm. Code datasets have their own checklist: embedded secrets, license lineage, third-party fragments. The scrub covers all three, and the methodology report says so explicitly, because sophisticated buyers ask.
What does the service cost?
The assessment is free and produces a fixed scope: volume, formats, and PII density drive the effort, so we quote after the sample scan rather than guessing. Ongoing work is billed like everything we do — 15-minute increments with an optional monthly cap.
Clean, documented, and priced right — that's a dataset buyers compete for.
Sell the data, keep the trust
Send your company email and we'll come back with your sale-readiness assessment.