By Luis Lopez, AI transportation consultant, CEO of Go Hub.io Holdings Corp and subsidiaries, and host of the Freight Guru Podcast
Freight companies run on software: transportation management systems, warehouse systems, visibility platforms, load boards, document tools and, increasingly, AI assistants. Each of those tools holds shipment records, customer lists, rates, carrier contacts and documents. When the relationship with the software provider ends, or when the provider uses that data in a way the customer did not expect, the question becomes simple and painful: whose data is it? The answer is almost always in the contract. This article covers what to check before you sign.
Why data ownership disputes happen
Most disputes come from one of a few situations:
- A customer leaves a platform and cannot get its historical data out in a usable form.
- A provider aggregates customer data into benchmarks or products the customer did not knowingly agree to.
- A provider uses customer data to train AI models, and the customer objects.
- A data breach exposes customer or partner information, and the parties disagree about responsibility.
- A provider is acquired, and the new owner’s practices differ from what the customer signed up for.
In freight, the stakes are high because rate history, lane data and customer relationships are often the core of the business’s value.
Data rights: ownership vs license
Who owns the data
Look for a clause stating that the customer owns its data. Define “customer data” broadly: information the customer enters, uploads or transmits, plus records generated from it, such as shipment histories and documents. A narrow definition can leave generated records in a gray zone.
What license the provider receives
The provider needs some license to process customer data to deliver the service. The question is how broad that license is. A license limited to providing the service to the customer is very different from one that allows the provider to use data “to improve its products,” “for analytics,” or “for any lawful purpose.”
Aggregated and de-identified data
Many contracts allow the provider to create aggregated or de-identified data and use it freely. That can be reasonable, but check how de-identification is defined. In freight, a combination of lanes, volumes and dates can sometimes identify a shipper even without its name. Ask whether aggregated data can be sold or shared with third parties, including competitors.
AI training on customer data
This is now one of the most important clauses to read. Questions to answer:
- Does the provider use customer data to train or fine-tune AI models?
- Are those models used only for this customer, or for all customers?
- Can the customer opt out, and does opting out reduce functionality?
- Does the provider send customer data to third-party AI services, and under what terms?
- If the customer leaves, is its data removed from training sets going forward, and what happens to models already trained?
A model trained on your rates and lanes could, in principle, inform recommendations for other users. Whether that is acceptable is a business decision, but it should be a decision made with eyes open. For more on vetting providers, see how to evaluate an AI vendor for trucking and logistics.
Export on termination
The day a contract ends is the worst time to discover you cannot get your data. Check for:
- Format: a standard, machine-readable format, not just PDFs or screenshots
- Scope: all data, including documents, attachments, audit logs and custom fields
- Timing: a defined export window after termination, long enough to migrate
- Cost: whether export is included or billed separately
- Assistance: whether the provider will help with migration and on what terms
- Deletion: when the provider will delete data after export, and whether it will certify deletion
It is also worth testing export during the relationship, not only at the end. A trial export early on shows whether the format is actually usable.
Confidentiality
Freight data includes information about third parties: customers’ consignees, carriers’ contact details, rate confirmations, and sometimes driver information. A good confidentiality clause covers all of it, restricts provider employees and subcontractors, and survives termination. Check whether the provider can disclose your use of the platform publicly, such as listing you as a customer, and whether you can refuse.
Also check subprocessor terms. Many software providers rely on hosting, analytics and AI subcontractors. You should be able to see who they are and be notified of changes.
Security and breach responsibility
Contracts should describe the provider’s security obligations in meaningful terms and require prompt notice of incidents affecting customer data. Look at who pays for investigation, notification and remediation costs after a breach on the provider’s side. These issues overlap with insurance; see cyber liability for trucking and logistics for how coverage generally works.
Liability caps
Most software contracts cap the provider’s liability, often at a multiple of fees paid over a recent period, and exclude indirect or consequential damages. In a data dispute, those terms can matter more than anything else. Lost business from a data breach or a botched migration may be classified as consequential and excluded entirely.
Points to negotiate where possible:
- A separate, higher cap for breaches of confidentiality and data protection obligations
- Carve-outs from the consequential damages exclusion for data breaches caused by the provider
- Indemnity for third-party claims arising from the provider’s handling of data
The structure of indemnity and limitation provisions is covered in more depth in indemnity clauses in freight contracts.
Change of control and amendments
Software providers are acquired regularly. Check whether the provider can assign the contract without consent and whether it can change data terms by updating an online policy. A contract that lets the provider change key terms unilaterally offers less protection than it appears to.
A short pre-signing checklist
- Customer owns its data, defined broadly.
- Provider license is limited to delivering the service, or the broader uses are clearly listed.
- Aggregated data use is defined and restricted.
- AI training terms are explicit, with an opt-out.
- Export format, scope, timing and cost are defined.
- Deletion after termination is certified.
- Confidentiality covers third-party information and survives termination.
- Subprocessors are disclosed.
- Liability caps and exclusions are reviewed for data scenarios.
- Unilateral amendment and assignment rights are limited.
As an AI transportation consultant, the first thing I look at in any software agreement is the AI training and export language, because those are the clauses most likely to surprise a freight company later. AI contract review tools can help find these clauses quickly, as discussed in AI contract review for freight agreements, but the business decisions and negotiation still belong to people, ideally with counsel involved.
For more conversations on freight and AI, subscribe to the Freight Guru Podcast.
About the author: Luis Lopez is a Miami-based AI transportation consultant and logistics entrepreneur, the CEO of Go Hub.io Holdings Corp and subsidiaries, and host of the Freight Guru Podcast.
This article is general information for the freight community, not legal advice. Talk to a transportation attorney about your specific situation.