Portfolio membership gives an operating partner access, not authority. A board seat or a weekly call with the CFO is a path into the company; it is not consent from the company, and if the decision maker does not know an introduction is coming, SourceX's screening guidance says it is usually not a fit.
Four roles around one decision
| Role | Who usually holds it | What they control | What they cannot do | Your question for them |
|---|---|---|---|---|
| Authorizer | The CEO; in an owner-run company, usually the owner | Whether the company discusses licensing, and signing for it | Answer every record question alone | Would you take a 20-minute conversation about licensing records you already keep? |
| Data owner | CFO for ERP and billing, COO for operations and dispatch, head of support for tickets, sales leader for CRM | Which records exist, how far back and in which system | Authorize a license by title | Which record sets do you own, over how many years, in which system? |
| Sponsor | Board member, operating partner, CFO or a trusted founder | Getting the topic onto the CEO's agenda | Consent on the CEO's behalf | Will you raise it with the CEO, and how would they want to hear it? |
| Gatekeeper | General counsel, a data protection officer, the IT security lead, and customers through their contracts | Whether rights, privacy and contract terms allow it | Make the commercial decision | What would you need to see before you are comfortable? |
Two NIST definitions make a useful distinction inside the data-owner column. NIST's glossary defines an information owner as the official with statutory or operational authority for specified information and responsibility for its controls from generation to disposal, and a system owner as the official responsible for procuring, operating and maintaining the system. The head of support may own the tickets while IT owns the help-desk tool. Neither, by title, decides whether the company licenses them; the data owner versus custodian comparison covers that line in more depth.
In EU companies a data protection officer is often the gatekeeper who matters most. The GDPR requires one where, among other cases, core activities involve regular and systematic monitoring of people on a large scale. Article 38 says the officer reports to the highest management level, receives no instructions on those tasks and cannot be penalized for performing them; Article 39 makes the officer's job advising and monitoring compliance. Treat the officer's questions as design inputs from the start; the regulation protects the officer's independence, so a route around them is no shortcut.
Build the owner-sponsor-gatekeeper graph
Draw one graph per company. People appear by role, never by personal detail, and record sets appear by type, never by content.
- Put the CEO in the center. Every path ends there.
- List the record sets at metadata level: type, rough volume, years covered, system and administrator. Draw an "accountable for" edge from each record set to its data owner.
- Draw "can ask" edges from each sponsor to the CEO, marked by strength: weekly contact, quarterly contact or none.
- Add the gatekeepers with a "must clear" edge to the decision, and write each one's first question beside it: counsel on customer contracts, the data protection officer on personal data, IT security on system access.
- Draw a "holds rights" edge from any outside party, usually customers, whose contracts or ownership cover a record set.
- Add yourself, with your edge to whichever sponsor you know best.
Reading the graph. The shortest credible path from you to the CEO is your route. A record set with no data owner is an orphan that nobody can describe; a record set with a "holds rights" edge from customers is a rights question before it is an opportunity. Every gatekeeper question still open is a delay you can see coming.
Method note. The graph records roles, record-set metadata and relationship strength as the operating partner and the sponsors describe them, on a stated date. It does not measure demand for any record set, record quality or payout, which only SourceX's review assesses, and it never requires anyone to open a record.
Three companies, three graphs (Illustrative)
Illustrative: three generic companies, every fact invented, no outcome implied.
A. An owner-led company. A 120-person industrial equipment repair company. The founder is the CEO, the owner and the data owner of eleven years of job tickets in one service system. The only gatekeeper is the outside IT provider, which holds administrator access but no say in the decision. The operating partner chairs the board, so the graph has one edge: operating partner to CEO. The ask is a direct conversation.
B. A network intermediary. A PE-backed 650-person distribution company. The CFO owns the ERP and nine years of order and returns history; the head of customer service owns the ticketing records. The operating partner's strongest edge is to the CFO, not the CEO, so the CFO becomes the sponsor. General counsel's first question is whether customer agreements restrict reuse of order data, and IT security wants no system access before any agreement. The route is operating partner to CFO to CEO, with counsel's question answered at metadata level before the first call; introducing through a sponsor or directly to the CEO weighs that choice.
C. A no-fit counterexample. A 300-person payroll processor. Its main records are clients' employee data processed on their behalf. The graph shows a "holds rights" edge from the clients to almost every record set, and the company's own operational records are thin. SourceX's guidance treats data a company does not control and material that belongs to its clients as usually not a fit. The row is dropped however warm the CEO relationship is.
Reachable executives are not the same as mandate-fit companies
An operating partner can reach dozens of executives across a portfolio. A company is worth an ask only when two gates pass.
The fit facts. At least 50 full-time employees at peak (contractors do not count), a documented operating history, the rights to license the records, and a qualifying location. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Where the portfolio company sits in a group, the parent and every subsidiary share one reward cap.
The authorized path. A sponsor who will ask the CEO, and a CEO who knows about and wants the conversation. Where two owners hold equal stakes, the CEO alone may not be enough. Whoever submits signs the SourceX Channel Partner Agreement first. Operating partners should also clear any outside payment with their firm before accepting one, a point covered in referral fees and conflicts of interest.
Rank the next conversations by the graph, not by guessed proceeds
SourceX has not published conversion rates or typical payouts, so estimated proceeds cannot rank anything. Sort companies by four things the graph shows, in this order: hops from you to the CEO, whether the main record set has a named data owner, how many gatekeeper questions are still open, and whether any record set carries a "holds rights" edge from customers. A company whose main records belong to its customers, or that fails a fit fact, drops out however short its path.
| Order | Company (Illustrative) | Hops to CEO | Data owner named | Open gatekeeper questions | Customer rights edge |
|---|---|---|---|---|---|
| 1 | Case A, equipment repair | 1 | Yes | 0 | No |
| 2 | 280-person regional lab network | 1 | Yes | 1 | No |
| 3 | Case B, distribution company | 2 | Yes | 2 | Partial |
| 4 | 900-person logistics group, sponsor not yet asked | 3 | No | Unknown | Unknown |
| 5 | Case C, payroll processor | 1 | Clients | Not assessed | Yes, dropped |
Where the map misleads
- Org charts are not authority. Titles suggest owners; confirm with the person, not the chart.
- Gatekeepers are not obstacles. A data protection officer's independence is written into the GDPR, and counsel's contract questions protect the company. A route that avoids them fails later.
- Board capital. Raising a non-core topic with a CEO spends credibility, so spend it where the graph is shortest and the gatekeeper questions are already answered.
- Rights. Customer contracts and SourceX's rights review decide what may be licensed, not the graph.
- Demand. SourceX judges each company against the specific program's criteria, and one that misses today's program may fit a later one. If synthetic data comes to cover more training needs, demand for real records could narrow across every graph at once.
What an operating partner does across the hold is in the operating partner explainer; the page for private equity operating partners and the guide to general counsel in a portfolio company fill in the program and the counsel's view. For companies outside the portfolio, the age-and-ownership worksheet finds who controls them. More in the guides hub.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
When a graph shows one or two hops to a CEO who wants the conversation and a named data owner, register for a partner link, put the graph's facts beside who qualifies and read through the program terms before the sponsor makes the ask.
Whether SourceX is a sound investment is a question apart from this map, and investors can request materials through the SourceX investor overview.
This article is for information only and is not an offer to sell or a solicitation of an offer to buy securities. Any offering by SourceX is made only to verified accredited investors through its offering documents.