The hidden data assets inside a typical mid-market company, department by department

Ask a CEO what data the company owns and the answer is usually a shrug toward the IT closet. Ask the heads of support, dispatch, finance and the fleet and you get a different picture: years of records, each in its own system, each describing how the business actually runs. That is the inventory AI developers want, and this is how to take it, one department at a time.

Why the inventory runs department by department

Data accumulates where work happens, and no single person knows all of it. Walking through departments turns "we have a lot of data" into a list with names, systems and years attached. For each department below, look for four things: the systems that hold the data, the volume after five or ten years, what a model could learn from it, and the rights or privacy question to answer before anyone sees it.

Customer-facing teams

Customer support and service

Systems: Zendesk, Freshdesk, Intercom or ServiceNow, live chat tools and the phone system's call recordings. Volume: a 200-person company commonly holds 100,000 to 500,000 tickets after ten years, and a 20-seat phone team can generate tens of thousands of hours of audio a year. What it trains: models that diagnose problems, draft resolutions and understand how customers describe what went wrong, in their own words and accents. The question to ask: what do your terms of service and call consent notices say, and how will names, account numbers and payment details be removed before review? See customer support and call centers.

Sales and marketing

Systems: Salesforce, HubSpot or Dynamics, quoting tools and shared inboxes such as sales@. Volume: ten years of CRM use typically means hundreds of thousands of contacts and millions of activity records, notes and emails. What it trains: models that forecast, summarize and recommend next steps, because the notes are linked to structured outcomes (won, lost, why). The question to ask: do your privacy notices cover this use, and can business contacts be de-identified without destroying the value of the record?

Operations and finance

Operations and logistics

Systems: ERP, order management, warehouse management, dispatch and routing software, and the telematics platform on every truck. Volume: eight years of moving goods often means millions of order lines and shipment events, and a 100-vehicle fleet produces hundreds of millions of location and engine readings over five years. What it trains: forecasting, routing, anomaly detection and planning models, which learn best from records paired with exceptions and outcomes. The question to ask: do customer contracts restrict how shipment data is shared, and does any of it identify individual drivers? See logistics and transportation.

Finance and billing

Systems: accounting software, billing platforms, procurement and expense tools. Volume: millions of invoice lines, payments, disputes and vendor records over a decade. What it trains: document understanding, reconciliation and anomaly detection models. The question to ask: how much is confidential to a counterparty, and can account identifiers be removed while the patterns stay intact?

People and technology

HR and training

Systems: the HRIS, applicant tracking, learning management and the recorded training library. This is where caution matters most. Payroll, performance reviews, medical leave and applicant files identify employees and are governed by employment law, state privacy law and, in some states, biometric privacy statutes. We steer companies away from licensing anything that identifies current or former employees. The asset that is usually licensable is the training material itself: onboarding manuals, procedure guides, recorded training sessions and assessments, reviewed for personal content first. The question to ask: does anything in this set identify a person, and if so, why is it on the list?

Engineering and IT

Systems: Git repositories, issue trackers such as Jira, code review threads, monitoring and infrastructure logs, and the internal help desk. Volume: a 20-person engineering team accumulates tens of thousands of commits, tickets and review comments over five years, plus terabytes of logs. What it trains: coding and operations models that learn how software is actually built, reviewed and kept running. The question to ask: which repositories hold secrets, customer data or trade secrets, and how will they be scoped out? See software and SaaS.

Physical assets and the legal file

Facilities and fleet

Systems: security cameras, building management and energy sensors, dashcams and telematics. Volume: cameras produce enormous footage, but most systems overwrite after 30 to 90 days, so the asset is what you chose to retain: incident clips, inspections and dashcam events. Sensor histories are often kept for years. What it trains: vision models for real-world settings and predictive maintenance models for equipment and vehicles. The question to ask: who appears in the footage, what notices cover recording, and does any state law restrict use of faces or license plates? See automotive and fleet.

Legal and compliance

Systems: contract management, document management, policy libraries and compliance review records. Volume: thousands of executed contracts, templates, policies and audit files over ten years. What it trains: models that read, summarize and reason over long professional documents, which general web text teaches poorly. The question to ask: which documents are privileged or carry confidentiality clauses, and can templates and policies be separated from executed agreements?

The inventory checklist

Work through this list with one department head at a time. Thirty minutes each is usually enough.

• Name every system that has held records for three or more years.
• Note the start date and whether the data is still being added.
• Estimate volume in the system's own units: tickets, hours, records, documents, vehicles.
• Record what outcome fields exist (resolved, won, failed, repaired).
• Flag any personal data about customers, employees or the public.
• Pull the consent language, privacy notice or contract clause that governs it.
• Mark anything privileged, confidential by contract, or a trade secret.
• Identify the owner who can approve a sample under NDA.

What to do with the list

Expect three to five candidate datasets and a surprise or two. Our illustrative range for a typical mid-market dataset is $25K to $1M+, and the actual value depends on uniqueness, quality, rights and buyer demand. Share the inventory through our free estimate, or read the guide to licensing company data first.