When Your Vendor Dies, Who Inherits Your Data?

This month a bankruptcy court auctioned the inner life of a dead airline, and Google paid ten million dollars for it. Roughly one hundred million internal emails. Half a billion Teams messages. Payroll records reaching back decades, customer service call recordings, financial audits, the source code. The buyer's stated purpose is training AI models. And the part that should reach every leader's desk is simpler than the numbers. None of the contracts that governed that data survived the company that signed them. When a business fails, everything it knows becomes an asset of its estate, and the estate's job is to sell assets. We call this the data estate, and your company's information is sitting inside more of them than you think.

What actually happened with the Spirit Airlines data?

A failed company's entire digital interior went to the highest bidder, and the bidding was competitive.

When Spirit Airlines shut down and entered wind-down, its data went on the block alongside its planes and gates. Google opened the bidding, an AI data company countered, and Google won at ten million dollars. The sale was scrubbed of personal identifiers, and the customer and loyalty lists were excluded, though excluded doesn't mean protected. The estate retains the right to sell that customer list separately to buyers in travel and hospitality. The flight attendants' union has objected to the sale over the risk that scrubbed records can be pieced back together. And this isn't a one-off born of one airline's collapse. A quiet industry of wind-down firms now brokers the same trade at startup scale, selling the Slack and email histories of dead companies to AI labs, deal after deal, at five and six figures each. There is now a functioning market for what defunct companies knew, and AI training demand is what created it.

What is the data estate?

It's everything a company holds, including what it holds about you, converted into sellable assets the moment the company fails.

Every promise a vendor made you lives inside an entity: the data processing agreement, the deletion commitments, the confidentiality terms, the security addendum. When the entity dies, the contract dies with it, and what you hold instead is a claim against an estate whose administrators are legally obligated to maximize value for creditors, and the data your vendor accumulated about your business is part of that value. We've written about the availability clause, the way access to AI services can end on a timeline you don't control. The data estate is its mirror image. Instead of losing access to something you use, you lose custody of something you handed over, and it persists on terms you never agreed to, under an owner you never chose. It also gives the harm lag its sharpest example yet. The exposure was created years ago, in a routine vendor decision, and the cost arrives later, at an auction you don't attend.

Why does this matter to your company specifically?

Because your data currently sits inside vendors that can fail, and the failure rate in your AI stack is the highest in your whole vendor portfolio.

Count what your vendors hold. Your CRM holds your customer relationships. Your support platform holds years of tickets. Your AI tools may hold prompts, documents, workflow context, and account history, and if you've adopted tools from young AI startups, you've placed data inside companies with venture-scale mortality rates in a market that is consolidating fast. When one of them fails, its estate holds your usage history, your uploaded context, your account records, and whatever else retention permitted, and the most motivated buyers of a dead AI company's assets are other AI companies. The exposure runs in a second direction too, and it's worth one uncomfortable sentence. Your own company's retained data is your own future estate, and your retention policy is the draft of what it will someday contain. What you keep is what can eventually be sold, subpoenaed, breached, or inherited, which is an argument for keeping less that has nothing to do with storage costs.

Doesn't deidentification solve this?

It narrows one kind of harm. Deidentification protects individuals. It does not protect your company.

Privacy law and the scrubbing it requires are built around people: names, identifiers, personal records. Your company's confidential information is a different category, and almost nothing equivalent guards it in an estate sale. The emails a vendor's team exchanged about your account, the pricing you negotiated, the contract terms, the technical details of your integration, the strategy you disclosed in a support thread, none of that is personal data, so none of it gets scrubbed. It's simply corporate information inside someone else's corpus, sold as an asset to a buyer whose plans for it you'll never see. And even on the personal side, the protection is contested. Scrubbed records that preserve behavior over time carry real re-identification risk, which is exactly what the union objections in the Spirit sale argue. This is the floor beneath the exposure floor. The strongest contract has a bottom, and a bankruptcy can drop it out entirely.

How do you keep your data out of someone else's estate sale?

Treat vendor mortality as a data risk, and manage it with the same discipline you apply to vendor security.

Four moves cover most of the exposure. Start with an inventory. List which vendors hold what, because the companies most surprised by estates are the ones that never mapped their own trail. Add financial health to vendor diligence, since a struggling vendor is a data risk in a way a struggling office-chair supplier is not, and weight that risk by how sensitive the data you'd leave behind is. Have counsel press for insolvency terms in the contracts that matter: data destruction or return triggered by bankruptcy or acquisition, and a bar on transferring your data as an asset, knowing these clauses are imperfect against an estate but far better than silence. And shrink what there is to inherit: retention limits, zero-retention options where a vendor offers them, shorter log windows, and for genuinely sensitive workloads, architectures where the data never leaves your walls at all, because the only data guaranteed to stay out of an estate is data that was never in the building. The Spirit sale set a public price on a dead company's inner life. The market now knows what it's worth. Your move is making sure your company's information isn't part of anyone's liquidation math.

If you want your AI stack built so your data can't be inherited, start with an AI Blueprint or reach us at contact@theyor.com