Your Customer Data Is Your SaaS Vendor's Most Valuable Asset. Here's the Proof.

Every article about SaaS data ownership tells you the same thing: read your contract, check the ownership clause, make sure you can export. Useful, and it stops one step short of the thing that matters.

Nobody tells you what your customer data is actually worth to the company holding it.

I went and found the number. It's public, it's been sitting in an SEC filing since 2022, and it is the clearest statement anyone has ever made about what the tools you run your business on are really accumulating.

In 2021, Intuit bought Mailchimp for $12 billion. Mailchimp had spent two decades building email software millions of businesses ran on. When the accountants opened up the purchase price and assigned a value to each piece of what was bought, the software came in at $900 million.

The list of who Mailchimp's customers were came in at $3.16 billion.

The code was the cheap part.

Does your SaaS vendor own your data?

Let me kill the bad version of this argument first, because it gets repeated constantly and it's wrong.

Your vendor is not putting your customer data on their balance sheet as an asset. They can't. Accounting rules prohibit it — IAS 38.63 explicitly bans recognizing internally generated customer lists, brands, and mastheads, on the logic that you can't separate the cost of building them from the cost of running the business at all.

So while the pile is being built, there's no line item. Nobody is booking you as an asset today. And contractually, most agreements do say you own your data.

That's exactly why the Mailchimp number matters. A sale is the only moment anyone is forced to write the number down. The rest of the time, ownership on paper and value in practice are two completely different questions.

How customer data becomes vendor equity

Here's the mechanism. None of it is a secret — it's the standard way software companies get valued.

Your data makes you hard to leave. Every conversation, every record, every workflow you've built inside a tool is a reason not to move. That isn't a conspiracy. It's just what happens when you use something for three years.

Hard to leave shows up as net revenue retention. NRR is the number investors use to measure whether customers stay and spend more. It's the cleanest available proxy for how deep the hooks go.

NRR sets the multiple. Public software companies with NRR below 90% trade around 1.2x revenue. At 100–110%, around 6x. Above 120%, 8x and up. The relationship is nonlinear, so the gap between a sticky company and a leaky one isn't a rounding error — it's most of the valuation.

The multiple is what gets sold. Not to you. To investors.

flowchart TD
    A[Your customer context] --> B[Switching costs]
    B --> C[Net revenue retention]
    C --> D[The multiple]
    D --> E["Sold to investors<br/>at every round"]
    D --> F["Sold to an acquirer<br/>at the end"]

That's the whole machine. Your business generates context, the context becomes retention, retention becomes the number on the term sheet.

What a customer list is worth: the Mailchimp numbers

Intuit acquired Mailchimp on November 1, 2021, for $12.0 billion — $5.7 billion in cash and 10.1 million shares worth roughly $6.3 billion. Under acquisition accounting, a buyer has to allocate that price across everything identifiable it just bought and disclose it.

Straight from Intuit's 10-K:

• Customer lists — $3.16 billion, assigned a thirteen-year useful life.
• Purchased technology — $900 million, nine years.
• Trade names and trademarks — $280 million, ten years.

Total identifiable intangibles, $4.34 billion. Goodwill came to $8.1 billion.

pie showData
    title Identifiable intangibles — Mailchimp acquisition ($M)
    "Customer lists" : 3160
    "Purchased technology" : 900
    "Trade names" : 280

Read the useful life again. Thirteen years. The relationship between Mailchimp's customers and their customers gets amortized quarter by quarter, like a delivery van.

And this isn't one strange deal. Salesforce's customer relationships intangible went from $3.5 billion in 2021 to $8.7 billion by 2026. Every acquisition adds another customer base to the stack.

Nobody waits for the acquisition

The mistake I made when I first started pulling these numbers was framing this as an exit story. It isn't.

Nobody waits for an exit to collect. Every priced round values the same accumulated context. Every secondary lets insiders sell against that valuation. Every growth check buys a slice of it. The company doesn't have to change hands for the asset to pay out — it only has to change hands for the number to become public.

So the version that actually affects you isn't "someday my vendor might get bought." It's that right now, this quarter, the context your business generates is part of what somebody else's equity is worth.

What your SaaS contract already permits

You don't have to take my word for any of this. Go read your own agreements.

Secondary use. Most SaaS contracts permit the vendor to use aggregated or de-identified customer data to improve products, build benchmarks, and develop new offerings. Perpetually. With no audit right for you.

Business transfer. Most privacy policies state that customer data may transfer in a merger, acquisition, or sale of assets. The party holding your customer conversations in five years is a party you never evaluated.

Sub-processors. Every enterprise vendor publishes a sub-processor list. It's usually somewhere between eight and twenty companies. Your customer's phone number is on all of them.

None of that is hidden. It's published. It's just never described to you the way it's described to investors.

Why 2025 made this worse

Here's the part that makes this urgent rather than academic.

The SaaS Capital Index fell from 7.0x to roughly 3.8x ARR as investors discounted companies with thin proprietary data moats. Bain reported that one in five strategic buyers walked away from a 2025 software deal over AI exposure — either the product was replaceable by a general-purpose model, or the moat claimed in the pitch didn't survive diligence.

The diligence question is now blunt: what data do you hold that a general model can't replace?

Think about what that does to the incentive. Every software company now has a sharper reason to accumulate more of your business context, not less. The pressure runs one direction, and it isn't yours.

The self-hosted alternative: an AI business machine you own

I build AI business machines. Ownbox is the first one, and the entire design follows from everything above.

You buy a Base Machine once, for $499. It runs on a server in your name for about $12 a month. Every message lands on your box's disk and stays there. We set it up for you after purchase, and then it's yours — take the image to another host whenever you want.

What's on it: a working dashboard, a mobile app that installs straight from your browser, a job queue, a worker, approval-gated dispatch so nothing sends without a human, a spend ceiling you set, a watchdog, daily backups, and one SQLite file holding everything the box knows.

Two pieces matter most for anyone thinking about ownership. Your AI signs in on your account — Claude, ChatGPT, Gemini or Grok, using the subscription you already pay for, on your machine, not through ours. And every machine has its own MCP server, so any agent that speaks the protocol connects to your box and calls its tools with no integration to write.

One box runs as many machines as you want. That's the part I care about most: humans and AI agents working inside the same system, on the same records, doing real work. Not a chatbot bolted onto a subscription.

There is nothing to encrypt on the way to us, because there is no way to us.

And there's no number for anybody to write down at an acquisition, because there's nothing of yours in the building.

What owning your own machine doesn't solve

I'd rather say this than have you discover it.

You still rent the metal. The VPS is somebody else's hardware, and you're trusting a host the same way you trust any host. The difference is that you can leave with the machine.

You still talk to a model provider. Their terms govern that, not mine.

Owning your data doesn't protect it. Backups, access, keys — that's on you now. Ownership transfers responsibility, not just rights.

That's the honest trade. You take on the administration and you keep the asset.

I sell the alternative, so weigh what I've written accordingly. But the filings are public. Pull Intuit's 10-K, find the business combinations note, and look at the number yourself.

Your customer data is somebody's most valuable asset. The only real question is whose.

Own the machine. → Base Machine, $499

Brian MacDonald

I build AI business machines and run them in my own business before I sell them to anyone else. Ownbox is the first one. Find me at @BmacBuilds or github.com/brianxmacdonald.