Editor’s note: Kristy McCann is a CEO, Founder, and CHRO who has spent 25+ years at the intersection of people, culture, and technology, building companies, transforming enterprises, and coaching leaders at every stage. We decided to go back and forth on a handful of deals that we think are about the same core issues.
Lance Haun — Three deals in seven days and they all three put a price on the same thing.
Lattice paid an undisclosed sum for Pando and gave the workforce record away for free. Silver Lake is reportedly in talks to take Workday private, no price officially reported. Google bid ten million dollars for a dead airline’s email.
Think these are all different? They’re not.
Kristy emailed me the morning the Pando news broke. Her read was that the M&A market is an employee TAM play and a data play, and that the transaction is the story. I wrote back that she had it backwards.
Kristy, great minds think alike, as long as they agree with me.
My position is that who owns these companies is the least interesting thing about them. Follow the money that far down the rabbit hole and you’ll miss the decision that was printed on the pricing page a year earlier.
She goes first. The deal she cares about is the one that almost nobody covered.
The Lattice MCP permissions
Kristy McCann — Start with Pando for a second and then leave it, because the deal is the least interesting thing here although interesting.
Fifteen people. No fundraise since 2022. Barbra Gago walks in as chief marketing and strategy officer. Marketing. Nobody buys fifteen people and a four-year-old cap table for the revenue, and Lance can run whatever multiple he likes on it. It won’t come out to a number that works as a purchase. M&A rollup time shall we say!
It works as the third move in a sequence. March, Mandala, and the coaching data. June, Lattice MCP. Tuesday, Pando.
The middle one is the whole thing and almost nobody covered it.
I read the setup documentation, because that is where companies stop marketing. When a user connects Lattice to Claude, here is what they approve. View employee information. View feedback. View goals. View competencies and career tracks. Then view and write meetings. View and write performance reviews. View and write updates.
Three of the seven are write.
So a manager opens Claude or ChatGPT, pulls a direct report’s review history, peer feedback, goals and competency track into the chat window, drafts the review there, and submits it. Never opens Lattice. Lattice markets the part where you blend it with Salesforce and Notion and Jira on the way through.
They will tell you, correctly, that permissions carry over. That manager could always see that review. True, and beside the point. The permission boundary held. The building boundary did not. That review used to sit inside one vendor’s walls with one set of terms on it. Now it is context inside a general purpose model, and the audit trail for how it got there is an OAuth consent screen somebody clicked in June. CHRO’s - something to really think about here.
Two things belong on the record, because the overstated version of this is how the true version gets thrown in the bin. An owner can turn the writes off. Lattice’s own instructions say you can set the connector to read only and prevent any writes across the organization. Default on, switchable off.
And Lattice disclosed all of it. The scopes are published. OpenAI is named on the subprocessor list, updated August 13, under a heading that says optional and opt-in. Lattice states OpenAI does not train on customer data and that it runs zero data retention. Nothing is hidden.
Which is exactly my point. It was never hidden and nobody read it. Fine print exists so that you don’t read it
So here is my question for Lance, since he thinks I have this backwards. Lattice is not selling performance software anymore. It is running a distribution strategy for a data asset and it published the pipe. The employee TAM was never the seat count. It is every record those seats ever produced, and Lattice just made that record portable into a general purpose model on the strength of a consent screen.
Tell me that isn’t a TAM play - as TAM Is the data or every employee
Why per-seat pricing opened the door
LH — It isn’t. She’s got the mechanism right and the motive backwards. The record didn’t get more valuable. The seat got less valuable.
Lattice sells seats. So does Workday, and the market spent eighteen months deciding seats are the problem. Workday was down about 15% on the year and more than 40% off its 2024 peak before the Silver Lake story broke. If agents do the work, you buy fewer seats. Per-employee pricing is a tax on a headcount number that stopped going up.
A vendor who thinks the record will hold his customers keeps the record in the building. You open it up when you aren’t sure the seat is going to be there in three years.
So I’ll leave the TAM correction where she put it. If this is a play for the total employee base, the employee base is the part in doubt. It’s why the stock got cheap enough for anyone to call and ask about it.
One more thing on her scope list. She was careful here and I’m going to be less careful.
If a manager can pull an employee’s file into a chat window, the file is in the chat window. Reviews, comp band, whatever else is on the profile. Tell me I’m right.
RIP Lattice’s payroll business — June 2024 to March 2026
KM — No. Stop there, because that’s the error everybody makes with this and it will get the whole argument thrown out.
The MCP server runs at manager and individual contributor level only. Administrative capability is not exposed, and Lattice says that applies to everyone, including a super admin who can see the entire directory through the admin interface. Data that lives only in that interface does not travel through this pipe. Performance context goes. The payroll file does not.
I’m being pedantic on purpose, because the payroll file is its own story and it is worse than the one Lance just tried to hand me.
Lattice announced payroll in June 2024, built with Gusto. HRIS went generally available that October. The help center page listing required payroll fields called for Social Security number, birthdate and permanent home address, along with base pay, classification, start date and work location. Ethnicity sits on the employee profile as its own field. That is the file that opens a bank account in somebody’s name.
That page now sits behind a Lattice sign-in wall. I read it when it was public. You can’t.
In October 2025, Lattice was still marketing itself as the all-in-one people platform with a modern HRIS, payroll and career development tools. About a month later, customers were told the HRIS and payroll were going away. Payroll ended March 31, 2026. HRIS ends July 31. I could not find a single public announcement of any of it. Not a press release, not a blog post. ADP built a migration page for stranded Lattice customers and even ADP hedged, writing that observers had speculated Lattice may be shifting focus and that ADP had not independently verified Lattice’s product plans.
Twenty months from launch to shutdown on the most sensitive file a company keeps.
Then read the retention page:
Your Lattice account and all data stored in your account will be deleted automatically 180 days after contract expiration or termination. Note: For Lattice HRIS Customers, this rentention [sic] period does not apply. All data will be deleted on the 6th of August.
The customers whose Social Security numbers were in the system got carved out of the standard policy and handed a fixed date instead. The page does not say which year. It also misspells retention, which tells you how much attention the sentence got before it went live. And what about compensation - hmmm
I’m not building a headline out of a typo. This is the retention notice for payroll-grade PII and it doesn’t carry a year. If you were an HRIS customer, go read it, then ask them in writing what was deleted, when, from which systems, and whether that includes backups.
And the paperwork never caught up to the product. Lattice’s Data Processing Addendum is dated April 3, 2024, before payroll and before the HRIS shipped. It enumerates the categories of personal data Lattice processes. Compensation and benefits are in there. Race and ethnicity are in there, in the special category paragraph. Social Security numbers are not. Dates of birth are not. Home addresses are not. The catch-all covers it, because “may include, but are not limited to” does exactly the work a lawyer put it there to do.
Now take Lance’s own argument and follow it one step further than he wants to.
He says the pricing model killed that product. Fine. Who sets the pricing model? Who decided a payroll business with SSNs in it wasn’t worth carrying another year? That is not a spreadsheet making a decision. That is an owner, and the reason I keep asking who owns these companies is that the answer is upstream of every roadmap either of us gets briefed on.
Oracle, the SaaS discount and the rate curve
LH — Here’s where we split, and I’ve got the really unpopular take.
Oracle is borrowing about forty billion dollars to build AI infrastructure and laying off thousands of people to cover it. No sponsor or take-private. No sovereign wealth fund on the cap table, either. A public board and a quarterly call drives everything.
Leading a public software company is now demonstrably worse than a PE or venture backed one.
Enterprise software now trades at a discount to the S&P 500. That never happens. Multi-quarter declines wreck equity as a retention tool, and companies under that pressure do hasty things. Surveyed financial executives said, 78% of them, that they’d sacrifice long-term value to smooth earnings. Fifty-five percent would skip a good long-term project rather than miss a quarter. That’s a public company problem and Oracle has it.
Lattice doesn’t. It isn’t public and it isn’t state sponsor-owned. It’s venture-backed, and it killed a payroll product with Social Security numbers in it inside twenty months anyway. Nobody needed a leveraged buyout to make that call.
On timing, everybody tells me these deals were waiting on the Fed. The Fed moved. The effective federal funds rate was 5.33% in January 2024 and it’s 3.63% this week. That’s 170 basis points.
But the ten-year Treasury went up over the same stretch, 3.95% to 4.71%, near its high for the period.
Nobody underwriting a seven-year hold prices off fed funds. Thoma Bravo’s Dayforce financing was a seven-year facility. So the investor waiting for debt to get cheap has been watching the wrong number, and his number got worse. The money never got as cheap as before. At some point everybody quit waiting on it.
A question back, then. One vendor is owned by a sponsor with a seven-year hold and a plan. The other answers to a market that just told 78% of its finance chiefs to protect the quarter.
Which contract would you rather be holding? Which one would you rather lead?
The PE exit backlog and Dayforce
KM — Neither, and that’s the answer, not a dodge.
I was in the room for the inflate and the deflate. I wrote the integration plan and the reduction plan for the same company inside eighteen months. Lance is describing a sponsor with a plan. I’m telling you what the plan is when the exit doesn’t exist.
Private equity is sitting on 33,575 companies it hasn’t been able to sell. Ten years ago that number was under sixteen thousand. At the end of last year it was 32,451, and it keeps climbing. US private equity returned 6.4% annualized from mid-2022 through this spring against 15.2% for the S&P.
They cannot sell what they already own. So why buy something enormous? Because the lot is full. This is a used car business. Buy the depreciating asset, detail it, flip it, and when nobody is buying, you buy a headline instead. It resets the story with your investors and buys five more years.
Lance says they’re moving now because waiting stopped paying. I say they’re moving because they can’t sell. Both are true and neither has anything to do with a product roadmap.
Where he loses me is the idea that the sponsor’s seven-year hold is the safer contract. Thoma Bravo closed Dayforce in February at $12.3 billion, a 32% premium, with a minority investment from a subsidiary of the Abu Dhabi Investment Authority. Sovereign money inside a US payroll platform, closed this year, and almost nobody wrote about that part. Reuters says Silver Lake has been in talks on Workday for months and may bring in additional investors. It has named none.
So I’ll ask rather than assert. You’ve seen who turned up on the last deal that size. Whose money would you like sitting inside the system that runs your payroll?
Oracle’s board answers to a quarterly call, which is bad. A sponsor answers to a fund with a clock on it and limited partners you will never see named. And the debt never services itself. It comes out of your renewal.
The Spirit Airlines data auction connection
LH — I’ve been saying the whole way through that the transaction doesn’t matter and the pricing model does.
I’ll admit that argument does have an expiration date, though.
Google bid ten million dollars for Spirit Airlines’ internal data. Mercor bid seven and a half, so there was a negotiation. The lot is roughly 100 million emails, about 500 million Teams messages, 7.5 billion passenger transaction records, and around 175,000 employee records that court filings date to 1986.
There’s no pricing model. There’s no vendor. The Greyhound bus of the skies is dead. A bankruptcy trustee has a duty to turn assets into cash, and it turns out employee email is an asset.
Every remedy I believe in requires a counterparty. Read the contract, ask the vendor, hold the renewal. None of that works against an estate. Nobody at Spirit signed anything covering this, because Google wasn’t party to anything when those people were hired. The record outlived the company. When the company died it went into the pile with the gate slots and the planes.
It hasn’t closed though.
A labor union went to court and objected that employee communications could be analyzed in ways that affect workers’ future job prospects, and that de-identification isn’t foolproof. The hearing moved to September 9.
That is the complete list of people who objected.
CFIUS, the DOJ rule and Mobley
KM — He’s conceding more than he thinks. If the buyer’s leverage disappears the moment the seller does, then it was never leverage. It was a courtesy that lasted as long as the vendor needed the renewal.
And the reason a union had to be the one to file is that the rule you’d expect to cover this says the opposite. I went looking, so I’ll save you the trip.
CFIUS doesn’t reach it. The regulation at 31 CFR 800.241 specifically excludes data maintained or collected by a US business concerning the employees of that business from the definition of sensitive personal data. Your workforce file is carved out of the foreign investment review by name. Every question I asked in the last section about whose money is inside your payroll system, the review that exists to answer it was written not to.
What does exist is the Justice Department’s bulk sensitive data rule, effective April 2025 with obligations from October. Six countries of concern. It bites at 100,000 US persons and reaches vendor agreements even when the data never leaves American soil, because granting offshore administrative access can be enough to trigger it. Below a hundred thousand people, outside those six countries, there is no general American requirement that an employer know where its employees’ Social Security numbers are processed or who owns the company processing them.
You can be lawfully ignorant. Most employers are.
The one place anybody is being made to answer is a courtroom. In Mobley v. Workday, Judge Rita Lin held in July 2024 that a vendor can be liable as an agent of the employer, writing that a third-party agent may be liable as an employer where the agent has been delegated functions traditionally exercised by an employer, and that Workday’s role is no less significant because it allegedly happens through artificial intelligence rather than a live human being. This June the court kept most of the discrimination claims alive and ordered Workday to produce a list of customers who had enabled the AI features.
That holding is about liability. Turn it around and it’s about architecture. If one vendor performs a function for thousands of employers, then one model with one threshold makes the same call everywhere it runs. The scale number is Workday’s own: in the certification order the court quotes the company’s filing saying 1.1 billion applications were rejected using Workday during the period at issue, and that any notice would still invite potentially hundreds of millions of potential plaintiffs. Workday volunteered that number while arguing the collective was too large to notify.
No court has held that being screened out by one algorithm screens you out everywhere it runs. I’m not going to claim it did. That’s my inference and I own it as mine. But look at the shape. Same model, same thresholds, 1.1 billion decisions, no notice, and no file anybody can request.
Subprocessor lists and change of control
LH — She didn’t move me on the sponsor question. Between a fund with a seven-year clock and a public board protecting a quarter, the answer depends on the fund and the board.
But I’ll double down that the software buyers who start with the cap table miss the pricing page. They should be reversing that approach, but still not ignoring ownership.
Mobley settles something else, though. It took Derek Mobley three years and a federal judge to establish a fact a buyer could have asked for in an RFP. Nobody reading this is going to file a lawsuit. So it isn’t litigation. And it isn’t a regulator, because Kristy just showed you the regulation with your workforce cut out of it.
That leaves the contract. It’s not much. Here’s what I’d look at.
Pull your subprocessor list. Find out who processes your employee data, by name, and when anybody last looked at it. Find your change of control clause and read what happens to your terms when the company sells. Then ask where your record goes when it does, and get it in writing.
Three questions. A CHRO can ask all three tomorrow.
KM — And the person whose record it is can’t ask a single one.
That’s the part Lance’s lever doesn’t reach. Everything he just described is a right that belongs to the buyer. The employee isn’t a party to the contract. They can’t read the subprocessor list, can’t invoke the change of control clause, can’t demand the retention answer, and won’t be told when the record moves. Spirit proved it. Forty years of email, one union filing, and not one of those 175,000 people had standing to say a word about it.
Ask your three questions. I mean it, ask them, because somebody with standing should. Just don’t confuse having the questions with having the right.
Fail all three and you don’t have a vendor. You have a landlord. Get all three answered and you still don’t own the building. You just know who does.