A retired product is code a company still owns but no longer uses. It sits in the repositories, shows up in security scans, and nobody is quite sure whether it can be deleted. If the product no longer makes money and its code can be separated from what is still running, selling it turns a cost into cash. Odys AI Labs, the research and development arm of Odys, buys sunset product code for AI training and R&D.
What your code is likely still worth
Retired company products often score very well. They were built by professional teams over years, with code review, CI pipelines, test suites, design systems, runbooks and a full ticket history. That combination shows how software is actually built, changed and maintained inside an organization, which is exactly what makes code useful for AI training and R&D. Our guide on what companies can do with the code of retired products covers the internal side in more depth.
Suppose a mid-size software company sunset a field-service scheduling product in 2023 after folding its customers into a newer platform. The product had seven years of history, a Java back end, an Angular front end, Android and iOS clients, about two thousand closed tickets and a runbook wiki. None of it is used today, yet all of it still sits in the company’s git host. That is a strong, well-documented codebase, and the main work before a sale is separating it cleanly.
Ownership is often simpler than for startups, because staff wrote most of it. In the EU, the employer holds the commercial rights to code staff write on the job, unless the contract says otherwise, and US and UK law reach a similar result for employees. Contractor code still needs checking.
We do not publish price figures. The company typically receives a concrete cash offer after review, which finance can weigh against the ongoing cost of keeping the repository in scope. How we value a codebase is explained on the call.
What a buyer will check
- Revenue status. The product makes no money today, including maintenance, support or license renewals.
- Boundaries. Which repositories, directories and services belong to the retired product.
- Rights. Staff and contractor contributions, and any code licensed in from partners.
- Third-party code. Black Duck found open source in 98% of the commercial codebases it audited. That is normal and does not stop a sale; what is sold is the code your team wrote, and libraries stay under their own licenses. If your legal team keeps a license inventory for the product, include it.
- Sensitive material. Secrets, customer data and details of live infrastructure.
- Documentation. Architecture notes, decision records, runbooks and SOPs, which companies usually have and startups often do not. They add context and are worth exporting before wikis are cleaned up.
Three risks specific to this situation
1. The product is entangled with live systems. In a large company, a retired product rarely lives alone. It may sit in a monorepo (one repository holding several products) next to current products, depend on shared internal libraries, or share authentication and billing services. Before anything else, draw the boundary: which paths and repositories are the retired product, which are shared, and which are live. A clean carve-out, usually a new repository built from the relevant paths with their history (git-filter-repo can extract chosen paths and keep their commits), protects your current products and makes the sale simple.
2. Contracts that outlived the product. A product can be retired publicly and still be tied to agreements: a few enterprise customers on extended support, a source code escrow arrangement, a reseller deal, a partner integration with exclusivity terms. If anyone still pays for it, it is still making money and we do not buy it. If old contracts restrict transfer or licensing, legal should read them first. This is not legal advice; your counsel should confirm what the contracts allow.
3. Internal repositories hold more secrets. GitGuardian found that private company repos are about six times more likely than public ones to hold hardcoded secrets. A retired product’s repo may still contain service account credentials, database connection strings for shared clusters, and keys that also work for live systems. Rotate first, then scrub history; see how to remove secrets from old code. Treat internal hostnames and network details the same way.
What to do this month
- Name an internal owner for the decision and agree who signs.
- Confirm in writing that the product earns nothing today: no support, maintenance or license fees.
- Map the boundary between the retired product, shared libraries and live systems.
- Ask legal to list contracts that mention the product, including escrow, partner and reseller agreements.
- Ask security to run a secrets scan across full history and rotate anything found.
- Export the product’s tickets, docs and designs before tool licenses or workspaces are cleaned up.
Your options
| Option | For a company’s retired product |
|---|---|
| Sell | Cash, confidential, brand never used; requires a clean carve-out |
| Keep archived | Low effort, but the repo stays in scope for security and audits |
| Open source | Good for developer relations, but public code cannot later be sold exclusively |
| Reuse internally | Useful if parts feed a current product |
| Delete | Ends the cost, and the value; check retention obligations first |
Archiving is the default in most companies, and it is not free: someone has to own access, scans and audit questions indefinitely. Our comparison of selling versus leaving code archived sets out the trade-off. For the legal side, our guide to what is in a source code purchase agreement explains the usual structure: assignment of rights, what is included, warranties on ownership and originality, cleaning obligations and payment on transfer.
The process is built for corporate security teams. We never ask anyone to install or run anything, the review is based on what you tell us, and no code changes hands before a signed written agreement. Payment is cash, one agreed price, on transfer.
What to do next
- Agree an internal owner and confirm the product earns nothing today.
- Draw the carve-out boundary and run a full-history secrets scan.
- Send us a few details for a free code valuation; the form takes about a minute and needs no code.
Frequently asked questions
Who inside a company usually decides to sell a retired product's code?
It varies, but the decision usually involves the engineering lead who knows the code, legal or the general counsel for ownership and contracts, security for the cleaning plan, and finance for approval. Someone with authority to sign for the company signs the written agreement. Agreeing the owner of the decision early keeps the process short.
Can we sell code that shares libraries with our live products?
Often yes, with care. What is sold is the retired product's own code. Shared internal libraries used by live products may be left out, or included only if the company is comfortable with that. We do not buy software that is still making money, so the carve-out has to be clear and agreed in writing.
Will the buyer use our brand or tell anyone they bought from us?
No. We never use the seller's brand or name and never relaunch the product as theirs. Sales are confidential and we do not publish who we buy from. Odys AI Labs uses the code for AI training and R&D after cleaning, and we may also work on it with research partners.
What about customer data and internal infrastructure details in the repo?
They come out before transfer. We never take databases, user records, customer data or chat logs. Secrets, keys and personal data are removed before transfer, and we help with that. Many companies also choose to strip internal hostnames, IP ranges and on-call runbook details that describe live systems, which is reasonable and easy to agree.
Find out what your old code is worth right now.
Tell us about the product in about a minute. No code needed. We review the details and come back with a cash offer or a plain no.
Get my free code valuation →