Access Models for Licensed Training Data: Delivered Copy, Term Copy, Clean Room or Remote Access

What actually differs between access models

The decisive variable is not where the bytes sit but what survives the end of the license. A model trained on a term copy still carries what it learned after the copy is deleted, so unless the contract requires derived models to be deleted or retrained, a holder who agrees to a term copy is in practice also conceding lasting value in derived weights. Clean-room and remote models shift that boundary by letting the holder approve what exits: a checkpoint, a LoRA adapter, an eval score table, or nothing but aggregate metrics.

Holders tend to accept lower prices for more restricted access because their exposure falls, while your cost rises in compute duplication, export review and slower iteration. Treat that as a hypothesis to test in each negotiation, not a rule. The trade is worth making explicit in your total cost of ownership model rather than discovering it during your first blocked training run.

Comparison table: five access models for SFT, eval and RAG data

Use this table to pick a starting position before the first call with the data holder; the right column is what you should expect to give up.

Illustrative example: invented to show structure; it does not describe an available dataset.

Delivered and term copies: simplest engineering, hardest sell

A delivered copy gives you full freedom to dedupe, filter, tokenize and re-run ablations, which is why most training teams default to asking for it. The holder's objection is that a copy cannot be recalled, so expect heavier diligence on your side: security review, named storage locations and a usage restriction schedule. Delivery typically uses a cross-account bucket pattern described in our guide to cloud bucket cross-account delivery, and the general mechanics are summarized in how licensed data is delivered.

A term copy adds a deletion obligation at expiry. Before you sign, map every place the data will land: raw bucket, tokenized shards, dedupe indexes, eval caches, vector stores and backups. Snapshot retention in object storage and data lakes is the common failure mode, because a "deleted" Parquet file can survive in time-travel history or a replicated backup for weeks. Negotiate explicitly whether model weights, adapters and synthetic data derived from the copy survive termination.

Shared live tables: revocable access without a file transfer

Sharing protocols let the holder grant read access to tables that stay in their storage, so they can revoke access by removing a share rather than chasing deleted copies. Delta Sharing is an open protocol that serves Delta Lake and Apache Parquet data over REST from cloud object storage such as S3, ADLS and GCS [3][4]. On AWS, Lake Formation tag-based access control lets the holder scope grants with key-value LF-Tags such as classification=restricted on databases, tables and columns, so a grant can expose only approved tables or columns [6].

Two cost details matter. If the holder uses an S3 Requester Pays bucket, you pay request and download charges while they pay storage, and anonymous reads are not possible, so every access is attributable [5]. And a revocable share is only revocable for data you have not yet materialized: once your pipeline writes tokenized shards, you hold a copy, so the license must say whether caching is allowed. This model suits RAG, where retrieval and grounding rights are usually licensed separately from training rights and are often ongoing and usage-based [8].

Clean rooms and enclaves: training without receiving a copy

Compute-to-data means your training job runs inside an environment the holder controls, and only approved artifacts leave. The plain-language background is in what a data clean room is and the data clean room glossary entry; privacy architecture is covered in data clean rooms for AI training. This page treats it as a procurement option.

Two variants are common. In a holder-run environment, you ship a container and config, the holder runs it on their GPUs or a dedicated cloud account, and a reviewer approves exports. In a trusted execution environment, the data stays encrypted and keys release only to an attested image: AWS Nitro Enclaves, for example, pass a signed attestation document to AWS KMS so a key policy can require a specific image measurement before decrypting [7]. GPU-heavy fine-tuning inside a TEE needs confidential GPU support, so confirm hardware availability before you agree to this model.

The weak point is the export. Fine-tuned weights can memorize and regurgitate records, so a cautious holder may demand canary or extraction tests on any checkpoint before release; see training-data extraction and memorization risk. Budget for slower iteration: every hyperparameter sweep, data-mix ablation and debugging session now crosses a review boundary.

Remote and time-limited access for evaluation and samples

Remote access is the cheapest way to answer "is this data worth buying" without either side taking much risk. One data marketplace's provider guide, for example, lets sellers offer limited trial subscriptions restricted to a geography or a historical time window instead of the full dataset [1]. NVIDIA's published sample data evaluation license grants non-exclusive, revocable, non-transferable rights solely for evaluation and testing, and bar other uses and distribution, including circumventing technical protections such as encryption or authentication [2].

That anti-circumvention language shapes enclave-style trials: if you script around a viewer's rate limits or export controls, you are likely in breach even if nothing was copied. For sample-stage options such as secure viewing and synthetic stand-ins, see sample access options for sensitive data, and for the paperwork, evaluation licenses and NDAs for dataset samples. For eval sets specifically, remote access also helps contamination control, because the holder never releases the test items to a training pipeline.

Negotiation checklist for a cautious data holder

Bring a concrete proposal rather than asking the holder to choose, and attach it to your license term sheet.

Illustrative example: invented to show structure; it does not describe an available dataset.

access_proposal:
  dataset: "support ticket histories, 2021-2025, redacted"
  use: [SFT, eval]            # RAG grounding licensed separately
  access_model: clean_room    # fallback: term_copy
  environment:
    location: holder_aws_account
    attestation: nitro_enclave_kms_key_policy
    egress: blocked_except_export_bucket
  exports_allowed:
    - lora_adapter            # after extraction test
    - eval_metrics_csv
  exports_forbidden: [raw_records, embeddings, generated_samples]
  term_end:
    data: deleted_or_access_revoked
    derived_weights: retained_perpetual
    outputs: retained
  audit: access_logs_shared_monthly
  documentation: croissant_rai_metadata

Ask the holder to describe the dataset with machine-readable metadata; Croissant-RAI extends Croissant with responsible-AI fields covering provenance and use so the description travels with the data [9]. Then confirm these points in writing:

• Which artifacts may leave the environment, who reviews them, and the test applied (for example, verbatim-match or canary extraction thresholds).
• Whether embeddings, synthetic data and distilled outputs count as derived works or as data.
• Retention of weights, adapters and outputs after term end or early termination.
• Who pays for compute, egress and Requester Pays charges, and whether the holder commits GPU capacity to your jobs.
• Audit evidence: access logs and export records, covered in audit logs for licensed dataset access and access control for licensed training data.
• An upgrade path: the conditions under which a clean-room or eval arrangement converts to a term copy.

Choosing a starting position by use case

Pick the least restrictive model you can defend for the job, then concede toward restriction only when the holder's risk requires it. For eval data, start with remote access: you rarely need the items in your own pipeline, and leakage costs you the benchmark's value. For RAG, start with a shared live table, because freshness matters and grounding licenses are often ongoing and usage-based [8].

For SFT on sensitive operational records, a clean room is often the model a cautious holder will accept first, with a term copy as the negotiated step after a successful pilot. For data you will reuse across many training runs, a delivered copy usually wins on total cost even at a higher license price. The broader process from requirements to renewal is mapped in the AI training data procurement hub, and the AI data hub links the privacy, licensing and delivery guides.

How SourceX fits the access conversation

SourceX sources operational datasets from US companies on request and manages the commercial process, including licensing agreements and ongoing purchases. Every dataset is rights-reviewed for ownership and consents and delivered under a license defining records, uses, term and delivery, with each release approved by the supplying company. Delivery runs through private, access-controlled workflows only after an executed agreement and supplier approval; you can describe the data you need on the buyers page.

Need licensed data with an access model a cautious holder will accept?

Describe the records, the use (SFT, eval or RAG) and the access model you can work with; SourceX looks for US businesses that hold that data and runs Find, Assess, Agree, Transact and Manage, though nothing is contracted until a supplier agrees and a request does not guarantee a match. Pricing and allowed uses are agreed per deal. Start a buyer request at sourcex.si/buyers.