This page is general information, not legal, tax or financial advice. Talk to a qualified professional about your situation.
A repository is more than code: it holds the commit history, pull requests, review comments and issues that show how engineers actually worked. Mercor, Troveo and micro1 name code on their pages for companies. Mercor lists repositories, commits, pull requests and issues; micro1 asks for source code documentation, engineering workflows and bug tracking. Mode and Nyne do not name code systems.
What is in it, and what to leave out
Code carries rights from many places, so it needs the most careful inventory:
- Third-party and open-source code vendored into your repositories comes with its own licences. Buyers and your lawyer will want it identified or excluded.
- Code written for clients, usually assigned to them by contract. Agencies and contractors should treat client repositories as excluded unless the contract says otherwise.
- Customer data in repositories: database dumps, test fixtures copied from production, logs. Remove it.
- Secrets: API keys, tokens and passwords in the commit history. Rotate them; deleting the file does not remove them from history.
- Code under a customer’s source-code escrow or IP clause.
Your own proprietary code, design documents and engineering discussions are usually the core of what you can license. The software companies page covers the customer-data line for SaaS businesses.
What GitHub keeps after deletion
- A deleted repository can be restored within 90 days, unless it was part of a fork network that is not empty.
- A deleted organization’s content cannot be restored.
If the company is winding down, archive repositories rather than deleting them, and keep the organization until any licence or sale is done. The data retention clock shows these limits next to other tools.
Before you apply
- List repositories by owner: yours, client-owned, forks of third-party projects.
- Run a secret scan across the history and rotate anything it finds.
- Keep the issues and pull requests, not just a code export. On GitHub they live outside the Git history, so a plain clone does not include them.
What buyers say about source code
Questions people ask
Do buyers want the code or the history around it?
Both. Mercor names commits, pull requests and issues alongside repositories, and micro1 asks for engineering workflows and bug tracking. Review discussions and the issue that led to a change show how engineers work, which a final snapshot of the code does not.
We are not a software company. Is our internal code worth including?
It can add to the package: scripts, integrations and internal tools show how the business runs. It is rarely the main asset for a non-software company; email, documents and tickets usually are.
Can we license code we wrote for clients?
Usually not. Work-for-hire and agency contracts typically assign that code to the client. Check each contract before including client repositories.
Sources
Other kinds of company data
Years of customer, vendor and internal threads. Export before you cancel Google Workspace or Microsoft 365: deleted mailboxes do not come back.
Team chat
Slack and Teams show how decisions were made. Free Slack plans delete history after a year, and only some plans export private channels.
Documents and files
SOPs, proposals, specs and wikis in Drive, SharePoint, Dropbox, Box, Notion or Confluence. Each vendor deletes on its own schedule.
Support tickets
Thousands of real problems and how your team solved them. They are full of customer details, so privacy promises decide what you can include.
CRM and sales records
Deals, accounts and the notes behind them. Valuable to AI buyers, and also to anyone buying your business, so decide which comes first.
Projects and tasks
Jira, Asana and Monday boards record who did what, when and why. Asana's export right after termination lasts only 30 days.
Meeting and call recordings
Recorded calls and transcripts capture decisions as they happen. Only two buyers name them, and consent to recording matters most here.