Holding company IT shared services: who controls subsidiary data and who owns it

What holding company IT shared services means in practice

Holding company IT shared services means the parent, or a management company it owns, runs some or all of the technology its operating subsidiaries use: the email and file tenant, identity and sign-in, device management, security tools, backups and software purchasing. The subsidiaries keep running their own businesses, but the people holding the admin passwords often sit at the parent.

That split is deliberate. Many holdcos that buy and keep small companies run decentralized operations with centralized capital, and IT is one of the few functions they pull to the center, often once several acquisitions make separate tenants, separate managed service providers and separate security tools hard to oversee. The arrangement is efficient, but it blurs a question that matters the moment anyone wants to license, sell or move a subsidiary's records: the team that controls the systems is not necessarily the entity that owns what is in them.

How holdcos set up shared IT: four common models

Most holdcos land on one of four arrangements, sometimes a different one for each subsidiary.

None of these models is wrong. Each one simply puts the admin keys in a different place, and that changes who has to act when records are exported.

Control versus ownership: who can export and who can sign

Admin rights decide who can physically export a subsidiary's records. Ownership and corporate authority decide who can license them. In a holdco those are often three different people.

Think in three layers:

1. Technical control: who holds the global admin or super admin roles, the backup console, the encryption keys and the MSP relationship. Usually central IT.
2. Ownership: which legal entity's business created the records. Customer contracts, employment relationships and the company's own policies usually point to the operating subsidiary.
3. Authority to sign: which officer can bind that entity, and whether the holdco's operating agreement or delegation-of-authority policy requires parent approval for a contract of this kind.

Employment structure adds a wrinkle. Under US copyright law, a work prepared by an employee within the scope of employment is a work made for hire, and the employer is treated as its author and owner (US Copyright Office, Circular 30). If the IT, finance or HR people who write runbooks, policies and reports for a subsidiary are employed by the parent's management company, the documents they produce may belong to that employer unless the intercompany services agreement says otherwise. Ownership can also be transferred, or individual rights licensed, through a signed agreement (17 U.S.C. 201), so the services agreement is the first document to read.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Mapping one subsidiary's systems before any data conversation

A one-page map per subsidiary settles most questions early. Fill it in with central IT and the subsidiary's finance lead.

If records from several subsidiaries live in one tenant, they need to be separable by entity before any license. A license signed by one subsidiary cannot cover a sister company's mailboxes.

The keys, title and pen test

Before raising data licensing with a holdco, run these questions for each subsidiary. A clear no on any of them means fix that first.

• Keys: does someone hold working admin access to every system and backup, and will they export on the owning entity's written instruction? If not, the guide to recovering admin access after an acquisition covers the fixes.
• Title: which legal entity owns the records, and do customer contracts, employee notices or earlier purchase agreements limit their use?
• Pen: who can sign for that entity, and does the parent need to approve?
• Separation: can the subsidiary's records be isolated from its sister companies' in shared tenants and drives?
• Inheritance: when the subsidiary was acquired, did its older archives come across, or were legacy systems switched off?

Why it matters for a holdco looking at data licensing

A holdco with several operating companies may have more than one candidate, but each subsidiary stands on its own. SourceX looks at a specific US company: 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license the records, and an authorized sponsor such as the owner, CEO, CFO or another authorized representative. A subsidiary that passes can be introduced even if its sisters do not.

Central IT can help. A parent that has kept consistent retention settings and preserved archives from acquired companies often holds the deepest history in the group, and it can describe systems and date ranges quickly when the subsidiary builds its data inventory. The guide to AI roll-ups explains why acquirers and data buyers both look for long, connected operating records, and how to monetize company data compares licensing with other options.

What it means for a referral partner who knows the holdco

People who know a holdco well, such as private equity operating partners, fractional CIOs, MSP owners and board members, are well placed to make introductions, provided the introduction names the right entity.

1. Register and introduce the specific subsidiary by legal name, using your referral link or the referral form. Mention that IT is run centrally so the right people join early.
2. SourceX qualifies that subsidiary on size, history, breadth of records and rights.
3. The subsidiary completes a data inventory; central IT supplies the system list, admin owners and date ranges.
4. The subsidiary's authorized signer agrees price and terms, with parent approval if its governance requires it.
5. AI labs and data buyers review the opportunity.
6. The deal closes, central IT delivers under the agreed redaction rules, and the subsidiary is paid.
7. Your reward is paid after SourceX receives its fee.

You never export, upload or describe records yourself, and central IT should not prepare any extract before an executed agreement and the subsidiary's authorization.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and rewards become payable only after the buyer pays and SourceX receives its fee. No reward is guaranteed, and the reward is never deducted from what the subsidiary receives.

Limits and open questions

• Entity structures vary. Series LLCs, management companies and intercompany agreements can shift ownership in ways only counsel can confirm.
• The holdco's own management company rarely fits the baseline by itself; its operating subsidiaries are the usual candidates.
• If a subsidiary has been sold, its records generally followed the sale agreement, and copies the parent kept may not be its to license.
• If shared mailboxes and channels cannot be split by entity, wait until they can.

Next step

Use the network opportunity finder to list which subsidiaries you know well enough to introduce, check each against who qualifies, then register as a partner and introduce the strongest one by name.