How to Sell Your Codebase to AI Companies (and What It's Worth)

AI companies do buy private codebases, and they price them by the training tasks a codebase yields, not by its lines. The public prices cluster in a narrow band: a platform that grades repositories starts at a $5,000 baseline per repository, HUD's DataVendor says production-grade codebases " have licensed for up to $20,000 each", and Turing pays $1,000 per qualifying pull request, up to $10K for a modern codebase while pricing legacy code (COBOL, .NET, Java) at $10K to $100K+. The middle half of the public per-repository prices runs from $934 to $24.2K.

This guide is for founders, CTOs, CFOs and counsel of software companies, agencies and closed startups that hold private code and are being asked, or are asking themselves, whether it can be sold for AI training. It covers who buys code and how each buyer prices it, why buyers count tasks rather than lines, what raises a codebase's value and what kills a sale outright, how to prepare a codebase, how a codebase valuation works, and a worked example of a typical startup. It sits beside our guide to RL environments, which explains what buyers turn code into.

This guide is research from public sources, not legal, tax or investment advice.

Contents

1. Who buys private code
2. Why buyers price by tasks, not lines
3. What raises a codebase's value
4. What kills a sale
5. How to prepare a codebase for sale
6. How a codebase valuation works
7. Worked example: a startup codebase
8. Questions people ask
9. What this means for you

Who buys private code

Private code reaches AI labs through four kinds of buyer. The first is data vendors that turn code into training tasks and environments for labs: Turing's Project Lazarus, Mercor, micro1 and others. The second is code marketplaces and brokers that license repositories to many buyers: HUD's DataVendor, Pangea, pre.dev and catalogue sites such as Opendatabay. The third is wind-down services that sell a closing startup's assets, code among them: SimpleClosure's AssetHub, Sunset and Labelbox's programme for defunct codebases. The fourth is labs and large technology companies buying directly, which is rarer and mostly visible through benchmarks, bankruptcy dockets and pilot programmes. Our buyer board lists 13 buyers, marketplaces and brokers that take source code.

Each prices differently, and the unit is the first thing to compare. Some price per repository, adjusted for quality; some per pull request or per task the code yields; some per token (a token is a short chunk of text, roughly a word or part of one, the unit models read); some per company, with code as one part of a whole archive. The table puts the published terms side by side; the sections after it explain each.

Turing's Project Lazarus

Turing is the code buyer with the most detailed public price sheet. In a March 2026 newsletter it priced modern codebases at " $1,000 per PR, up to $10K per codebase" and legacy codebases at typically $10K to $100K+, depending on complexity, and it offered $50 per artifact for tickets, specs, docs and support threads bundled with a codebase. Its Project Lazarus page, read in October, says repositories typically pay $10k to $100k+, depending on quality and complexity, and offers " a single payout of up to $1M" for a company's whole operating record. Its chief executive told The Information that Turing had bought five to ten failed-startup codebases, paying an average in the tens of thousands of dollars each.

Two details matter for a holder. Turing takes "defined rights" and the holder retains ownership of the underlying data, under one agreement, and Turing removes personal data and secrets itself in isolated processing after the holder approves the scope. And its published screen is strict: on its buyer page it asks for large repositories written by people, with tests, which rules out much ordinary product code. The gap between the newsletter cap and the Lazarus page is the gap between a modern web codebase and a large or legacy one, and it is the clearest evidence that scarcity, not size, sets a code price: the same buyer's top legacy price is 10 times its cap on a modern codebase.

HUD's DataVendor, Pangea and pre.dev

The code marketplaces license a repository to several buyers rather than selling it once. HUD's DataVendor judges "whether your rights are clear, how strong demand is, how well documented the asset is, how hard it would be to recreate, and how directly it fits a buyer's need", says it currently sees strong demand for enterprise software codebases, and asks holders to send a README, setup instructions, ticket history, pull-request context and test information, and to "remove secrets, credentials, customer information, and anything you do not have the right to share" - DataVendor docs. It keeps 20% of earnings, the holder never learns who bought, bid or took a sample, and while the marketplace is in beta payouts can be paused.

Pangea's code licensing partner quotes the holder's side per repository by depth, from $700 to $1,000 for a light repository to $1,500 to $2,000 for a deep one, per licence, or by the token at $100 per million tokens of source code and $40 per million tokens of git history. It says it has paid $600,000 to holders across 380 codebases, about $1,579 per repository, the only figure on record for what code licences have actually paid on average. pre.dev uses the same per-token rates and shows $6,000 per repository for its example, on a non-exclusive licence paid Net 15. The two bases are not the same: DataVendor's figure is before its share, Pangea's is the holder's side with nothing deducted, so compare offers net.

Closed startups

A shut-down startup's code is usually sold together with its Slack, email and documents, by the wind-down service that closes the company. SimpleClosure's test marketplace recovered about $1 million across nearly 100 deals in its first year, about $10K a deal, against early deals reported at $10K to $100K per company. By October 2026 it had handled over 150 deals, and one founder told MIT Technology Review he had netted roughly $25,000 for his code base and expected about $15,000 more for the workspace data. Labelbox says it " works with fully defunct startup codebases". At the top of the range, Warmly, after agreeing to be acquired by HubSpot, received four offers of up to $300,000 for its codebase and communication records, and turned them all down. Our guide on selling customer data in bankruptcy and the estates page cover who can sign for a closed company.

Labs buying directly

Labs seldom appear as the buyer of record for a repository, but when they do it shows what they want. Scale AI built the commercial part of its SWE-Bench Pro benchmark from 18 proprietary repositories of early-stage startups, " where we contacted the company and purchased their engineering repos". Google's Content Offer Pilot invites holders of large, high-quality datasets in specialised segments such as code repositories to express interest, on non-exclusive terms in which the partner keeps its IP. And in the Spirit Airlines bankruptcy, Google won the auction for the airline's business data and software code for $10 million, a sale still awaiting court approval as of this writing.

Prices on record

Sources: Pangea, light, Pangea, deep, graded platform, pre.dev example, Turing, modern (one PR to its cap), HUD DataVendor (its stated ceiling). Turing's legacy prices of $10K to $100K+ are left off the chart because they would flatten every other bar.

Two warnings about these numbers. Most are ceilings or offers, not averages of closed deals: SimpleClosure's realised average of about $10K a deal sat at the bottom of the range it quoted, and other intermediaries show the same pattern ( headline ceilings are not what deals pay). And they price different things: a light repository on a per-licence basis is not the same asset as a fifteen-year legacy codebase sold once. The source code page keeps the current anchors.

Why buyers price by tasks, not lines

Public code is not scarce. The Software Heritage archive holds over 27 billion unique source files, the open Stack v2 dataset over 3 billion files in 600+ languages, and GitHub hosts 630M repositories. Models are already trained on code like that. A line of private code that looks like a line of public code teaches a model almost nothing new, which is why one buyer's guide puts it bluntly: " A snapshot of source code with no history is worth little to a lab, because there's already a lot of code in the world."

What public code lacks is the record of how work was done: the request, the change that answered it, the review that argued over it, and the test that proved it. Labs train coding agents on exactly that unit, a task: the repository frozen before a change, the issue that asked for it as the prompt, the merged change as the reference answer, and the tests as the verifier. Our guide to RL environments explains how such tasks are used. A codebase is worth what it yields in those tasks, which is why Turing prices modern code per pull request and why buyers of company records say the same thing about links: Sunset's chief executive told Forbes that a Jira ticket tied to a specific code commit is worth more than a standalone document ( Forbes, via Forbes Japan).

Most real engineering work happens out of public view, and that is where the opportunity sits: GitHub reported that 81.5% of contributions in 2025 happened in private repositories. But the same logic cuts the other way on volume. SimpleClosure found that roughly 37% of raw code disappeared once third-party code, generated code and internal duplicates were removed, and its chief executive says a codebase a quarter of the size can be worth double. Net, human-written, linked code is what gets counted.

There is also a ceiling set by machines. Together AI generated 258,000 test-verified coding-agent trajectories for $130k in compute, about 50 cents each. What a model can generate for itself is worth about what it costs to generate. What it cannot generate is real engineers' changes to real private systems, reviewed and tested over years.

What raises a codebase's value

The buyers that publish criteria name the same few things, and our valuation weights each by how many code buyers name it in their own words. Tests that run in CI come first, because the tests are the verifier for every task built from the code; Turing screens for tests on its buyer page, and HUD asks for test information with every codebase. Reviewed changes tied to their tickets come next: Turing asks for " Source code, reviews, tickets, and the iteration history behind what shipped", Mercor for " GitHub Repositories, commits, PRs, and issues", and Collinear says its price rises with pull requests with their tickets, several years of history, human-written code and the same work visible across several tools.

Scarce languages and legacy systems carry the largest premium on record. Turing's legacy price for COBOL, .NET and Java is 10 times its modern cap, and SimpleClosure reports that less common languages such as Ruby or C++ can fetch top dollar, better still with Jira, Linear or Figma context. Legacy code is scarce in training data and abundant in the world: one vendor survey estimated 775 to 850 billion lines of COBOL in daily use, which is why agents that can maintain it are worth training.

Years of history and an unusual domain raise the price because they hold more, and more varied, real work. Turing's own page says " A fintech's fifteen-year operating history is worth more than a six-month side project", and " What you receive scales with how complete, rare, and well-preserved the record is." A fintech ledger, a logistics routing engine, industrial control software or a scientific code base teaches more than another web app.

The company's other records alongside the code raise it further. Turing has offered $50 per artifact for tickets, specs, docs and support threads bundled with a codebase, and whole operating records with code inside sell per company rather than per repository: micro1's partnerships run from $100k+ to $1M+, and Turing offers up to $1M in one payment for an operating record. A company that sells its code alone leaves that on the table; our software companies page lists what buyers ask software companies for.

What kills a sale

Some problems lower a price. Others stop a sale until they are fixed, because no responsible buyer will take the code and no holder should warrant it. Buyers' contracts make the holder warrant that it owns what it licenses, and buyers have been burned: Surge AI's head of environments described being offered a large company's codebase for millions of dollars by a group that had " illicitly obtained a copy of the codebase". The checks below are the ones that most often stop a code sale. They are why a rights file, the written record of who owns what, comes before any conversation about price.

Open-source licence obligations

Most codebases contain open-source code, and its licence travels with it. Permissive licences (MIT, Apache, BSD) mostly ask for attribution. Copyleft licences such as the GNU GPL and the AGPL go further: a program based on GPL code may be passed on only under the GPL. A company cannot license GPL-covered code to a buyer on its own private terms, because the terms are not the company's to set. Breaches are litigated as contract claims: in the Copilot litigation, the open-source licence contract claims continue in the district court after the Ninth Circuit ruled on a separate claim. The fix is a licence scan (a software bill of materials listing every component and its licence) and splitting off copyleft and vendored code so that only the company's own code is warranted.

Third-party code inside the tree

Beyond open source, a repository can hold vendor SDKs, code copied from documentation or answers sites, licensed libraries and generated files. None of it is the company's to license, and buyers strip it first. The gap can be large: an engineering archive Hilco is selling holds about 1.25 million lines of company-authored code, against about 6.0 million lines once the vendor SDKs in it are counted. Measure what is net and proprietary, and price that.

Secrets in the git history

Passwords, API keys and tokens committed years ago stay in the git history even after the current files are cleaned, and a buyer that receives the history receives the secrets. HUD tells holders to remove "secrets, credentials, customer information" before listing; Turing removes secrets itself in isolated processing. GitHub's own guidance is that the first step is to revoke or rotate the secret, and that rewriting history to remove it requires careful coordination and has side effects - GitHub Docs. For a sale, do both: rotate every secret found, then deliver a copy whose history has been rewritten without them (with a tool such as git-filter-repo). Our valuation holds code with credentials in it at nothing until they are out, because that is how a careful buyer treats it.

Code written for customers under contract

Agencies, consultancies and software firms that build for customers often do not own what they built. Many development contracts assign the deliverables to the customer, or license them back to the developer on narrow terms. Code written for a customer can be licensed only where the contract leaves it to the developer or the customer agrees in writing. Read every customer contract that touches a repository before listing it.

Contractors and founders without IP assignment

US copyright law gives the company code its employees write in the course of their jobs: under the Copyright Act a work made for hire includes "a work prepared by an employee within the scope of his or her employment", and for such a work the employer is considered the author and owns the copyright unless a signed writing says otherwise. Contractors are different. Commissioned work counts as made for hire only in a short list of categories, and only with a signed agreement; ordinary contracted software rarely fits. Otherwise the copyright stays with the person who wrote it, and a transfer is not valid unless it is in writing and signed. The same applies to code a founder wrote before the company existed. The fix is a signed assignment from every contributor whose paperwork is missing, collected before the sale, with any gaps listed and the code excluded until they are closed.

Personal data in code, fixtures and history

Code carries more personal data than people expect: authors' names and email addresses in every commit, customer records copied into test fixtures and seed databases, names in ticket text and comments. These have to be removed or replaced before delivery, and the history pseudonymised so that no author can be identified. The de-identification standard describes how, and the guide to employee emails and chats covers the employee side.

Publishing, or handing over code before terms

Two self-inflicted mistakes end sales. Publishing any part of the code, or tasks built from it, removes what makes it valuable; a buyer that has the code has little reason to pay for it. And a sample is itself a disclosure: one law firm advises that " Do not share sample data before this review, since a sample itself could be a disclosure". Show statistics and a small, cleaned sample under a confidentiality agreement, never the repository.

Export rules and foreign buyers

Source code can be export-controlled. Under the Export Administration Regulations, an export includes releasing or transferring source code to a foreign person in the United States, which the rule calls a "deemed export". Code for encryption, defence or other dual-use products may need a licence before it goes to a buyer abroad or to a buyer's foreign staff. Personal data in the code or its history raises separate rules: US law bars a data broker from making US individuals' sensitive personal data available to any entity controlled by a foreign adversary. Every buyer should be checked before anything is sent.

How to prepare a codebase for sale

Preparing a codebase takes days to weeks of engineering and legal time, and almost all of it can be done before any buyer is involved. Done first, it shortens the sale and keeps the holder in control of what is disclosed; done after a buyer's diligence finds the problems, it costs leverage. The steps below follow the order a careful holder works in.

1. Inventory the repositories. List every repository, who wrote it (employees, contractors, an agency), whether it was written for the company or for a customer, and whether any part was ever public: a fork, an open-sourced module, a published package.
2. Build the rights file. Collect employees' invention assignment agreements, contractors' assignments and the customer contracts that touch the code, and record who has authority to approve the licence (usually the board, and shareholders too where the code is all or substantially all of the company's assets).
3. Scan for secrets across the full history. Every branch and tag, not just the main branch. Rotate everything found, then plan the history rewrite for the delivered copy.
4. Scan licences and strip what is not yours. Produce a software bill of materials, split off copyleft and vendored code, remove generated files and duplicates, and count what is left.
5. Review the history for people. Pseudonymise authors' names and emails, remove customer data from fixtures and test databases, and flag tickets that quote customers. Note which commits name an AI assistant as co-author; some buyers screen them out.
6. Export the code with its links. Pull requests with their review comments, the tracker with its ticket keys, and the links between them. Standard tools lose some of this: a GitLab project export leaves out issue links, and a GitHub organisation migration archive is deleted after seven days.
7. Make it build. A Dockerfile and a CI pipeline that pass on the main branch, so a buyer can run every task as delivered.
8. Measure it and value it before talking to buyers (see the next section), so the first number in the conversation is yours.
9. Approach several buyers with the same datasheet. Refuse 48-hour deadlines ( buyers price on different theses), compare offers net of each platform's share, and read the grant: some buyers' terms take a perpetual licence with the right to sublicense through multiple tiers, which is a resale right for one fee. The offer check tests an offer against the market, and negotiating a sale covers the terms.

How a codebase valuation works

The codebase valuation prices code the way buyers do: per repository, per reviewed change, per token, and as a company's whole code base. It starts from the 25 code prices on record in the price ledger, multiplies each by how many of that unit the code holds, and leaves out any buyer whose own published rules would not take the code (Turing's rules on size, human authorship and tests among them). The pessimistic and optimistic cases are the prices a tenth of the weighted records fall below and lie above; the base sits between them.

Where the base lands follows what code buyers ask for in their own words: tests that run in CI, changes reviewed in pull requests, changes tied to their tickets, code written by people, code never public, and the size of a repository. Each criterion's weight is the share of code buyers on the buyer board whose published words name it, so the weights move when buyers change what they say. Each is scored from your answers or, better, from your code measured on your own computer: you pick the folder that holds the repositories and add a saved git log, the files are read locally, and only counts leave (lines, test files, reviewed commits, commits that name a ticket, commits co-authored by an AI assistant).

The valuation applies the gates in the previous section instead of hiding them in a discount. Code with credentials in it is held at nothing until they are removed and rotated, and the report shows the value once they are out. Code written for customers is held until they agree; public code is not sold; copyleft code is split off; commits an AI assistant wrote are left out of the tasks; and every buyer is checked against export and data-transfer rules. Each gap comes with the step that closes it (export the pull requests, include the tests and CI, make it build, add the tracker, complete the rights file) and what that step would do to the base.

The report shows three licence scenarios: one non-exclusive licence (the base figure), one exclusive licence, which environment builders put at roughly 4 to 5 times a non-exclusive one and which ends every other sale, and an evaluation-only licence, which lets a buyer test models on the code without training on it and can be sold beside a training licence. It ends with our honest view of the route: a single repository with nothing else is usually best sold directly to a platform that grades and lists repositories, and the report says so; codebases with their tickets and history, scarce languages, or a whole company's records are where competing offers through an agent make a difference. Our page on selling direct or through us sets out the trade-off.

Worked example: a startup codebase

Example. Take a 25-person B2B software startup, six years old, winding down. It holds 12 private repositories on GitHub: the main product (TypeScript and Python, with tests in CI and most commits naming a Jira ticket), a mobile app built by an outside agency, an infrastructure repository, several internal tools, and a fork of an open-source library under the AGPL. A secret scan finds an old cloud key from 2021 in the main product's history. The company also has its Jira, Confluence and Slack.

Step 1: what is the company's to sell. The employees' code belongs to the company as work made for hire. The agency's mobile app does not, unless the agency contract assigned it in writing; if it did not, the startup asks the agency for a signed assignment now, or leaves the app out, because a transfer of copyright is not valid unless it is in writing. The AGPL fork is split off or delivered with its licence, never warranted as the company's own. After removing vendored and generated code, the company should expect its net line count to fall, as it did by about 37% across the codebases SimpleClosure measured.

Step 2: clear the blockers. The cloud key is rotated at once and removed from the history of the copy that will be delivered; until then, the valuation holds the code at nothing. Customer records copied into the test database are deleted, and authors' emails are pseudonymised.

Step 3: see what each route pays. On a marketplace, the main product alone could license for up to $20,000 on DataVendor (before its share), or for $700 to $1,000 to $1,500 to $2,000 per licence through Pangea, licensed again to further buyers. Priced by tasks, a modern codebase with many qualifying pull requests reaches Turing's $10K cap after ten of them. Sold as a closing company's whole record, with Jira, Confluence and Slack, comparable sales run from about $25,000 for a code base plus about $15,000 for workspace data at one small startup, to offers of up to $300K for a larger one's code and communication records.

Step 4: choose. If the startup wanted to sell only the main repository, the honest advice is to list it on a platform that grades repositories. It has more than that: years of linked tickets, reviews and the team's discussions around them, which is exactly what buyers of company records pay for. That is the case for one datasheet in front of several buyers, a non-exclusive licence by default, and exclusivity only for a defined field and period at a multiple. Our guide on how much company data is worth covers the whole-company valuation.

Questions people ask

Can I sell my company's source code to AI companies? Yes, if the company owns it, it was never public, and it is free of credentials and other people's code. Vendors such as Turing, marketplaces such as HUD's DataVendor and Pangea, and wind-down services such as SimpleClosure all buy or license private code. The check that most often stops a sale is ownership: customer contracts and contractors without assignments.

How much is a codebase worth to AI companies? Published per-repository prices run from $700 per licence to $20,000, with legacy code at $10K to $100K+. The middle half of public per-repository prices is $934 to $24.2K, and the one published average of licences actually paid is about $1,579 per repository. A code base sold with a company's other records is priced per company and can be worth far more.

Who buys source code for AI training? Data vendors that build training tasks for labs (Turing, Mercor, micro1), code marketplaces (HUD's DataVendor, Pangea, pre.dev), wind-down services for closed startups (SimpleClosure, Sunset, Labelbox) and, occasionally, labs directly: Scale bought 18 startups' repositories for a benchmark. Our buyer board lists them with their terms.

Can I sell code that contractors wrote? Only if they assigned it to the company in a signed writing, or the work qualifies as made for hire, which ordinary contracted software rarely does. A copyright transfer is not valid unless it is in writing and signed. Collect the missing assignments before the sale or leave that code out.

What happens if my repository contains GPL code? The GPL-covered code is not yours to license on your own terms, so it has to be split off or delivered under its own licence, and only your own code is warranted. Run a licence scan before you approach a buyer; buyers will. See open-source licences above.

Do I have to remove secrets from the git history before selling? Yes. Rotate every secret first, as GitHub advises, then deliver a copy whose history has been rewritten without them. HUD asks holders to remove secrets and credentials before listing, and our valuation holds code with credentials in it at nothing until they are out.

Can a shut-down startup sell its codebase? Yes, and it is a common sale: Turing bought five to ten failed-startup codebases and SimpleClosure has handled over 150 deals. Whoever has authority for the closed company (its officers, or a trustee in bankruptcy) signs, and the accounts that hold the code must stay open long enough to export it. The estates page covers authority.

Will selling our code give away our trade secrets? It can, so scope the licence. Buyers such as Turing take defined rights while you keep ownership, and you can exclude repositories you consider core, restrict use to training, and require deletion of the copy at the end of the term. Material that is privileged or a trade secret you want to keep is excluded or restricted by contract.

What this means for you

Start with what you own, not with what a buyer offers. Inventory the repositories, collect the assignments, scan for secrets and licences, and export the code with its pull requests and tickets before the accounts or archives expire. The readiness check lists what to prepare; the codebase valuation measures the code on your own computer and prices it from the records, with the gates and the steps that raise the figure; the source code page keeps the current prices and buyers.

Then decide the route. A single clean repository is usually best listed directly on a platform that grades repositories. A codebase with years of linked tickets and reviews, a scarce language or legacy system, or a whole company's records behind it is worth putting in front of several buyers with one datasheet. Our guides to what labs buy, data licensing agreements, training data provenance and selling company data to AI labs cover the next steps, and the licence terms page explains the clauses to read.

AIData.Broker acts as the holder's agent: the holder itself licenses or sells its data to the buyer, and we do not take ownership of it. Only the holder pays us, a fee fixed in the mandate, only if a sale closes, and we run sales only for holders based in the United States; the pricing page has the terms.