How to read a CIM as a buyer, including systems, records and NDA limits

How do you read a CIM as a buyer?

Read a CIM in two passes: first for the business (revenue quality, customers, margins, people), then for how the work is recorded, meaning which systems run it, how far back they go and who owns the information inside them. The second pass is the one most buyers skip, and it shapes diligence requests, integration plans and what you can later do with the records.

One hard rule comes before everything else. Information you receive under a nondisclosure agreement is for evaluating that deal only. You cannot use a CIM to identify a company and then refer it to SourceX, or anyone else, without the owner's agreement. Referrals come from relationships where the owner has said yes, never from material marked confidential.

What does a CIM actually contain?

A confidential information memorandum is the seller's marketing document, usually prepared by the sell-side banker or broker. It tells the seller's story, so treat every claim as a lead for diligence, not a finding.

The 3S read: Systems, Span, Stewardship

Use this screen on the operations and technology pages before you spend diligence hours.

• Systems: does the CIM name the tools for email, chat, CRM, finance, support, engineering and operations, or does it only say "modern cloud stack"? Strong operating businesses often run 10-15+ systems.
• Span: does it state when each system went live, and are there archived platforms from earlier years? Five to ten years or more of history is a positive signal.
• Stewardship: is there a named person who administers each system and can run exports, or is everything held by a vendor or a departed founder?

Record the answers in your own deal notes. They help you price integration risk whether or not any data is ever licensed.

What should you do with the signals you find?

If several rows apply, you have learned something useful about integration, valuation and risk. None of it permits outreach to anyone about licensing.

What does the NDA actually limit?

Most NDAs restrict use of the seller's confidential information to evaluating, negotiating and closing the transaction. Contact restrictions, such as limits on approaching employees, customers or suppliers, often sit alongside them. Read your own agreement; terms differ.

In practice:

1. Do not forward the CIM, its numbers or the company's name to SourceX, a data buyer or any third party.
2. Do not use CIM details to tailor an unsolicited pitch to the company's owner.
3. If you pass on the deal, your obligations usually continue, so check return and destroy clauses and the confidentiality term.
4. If you later own the company, the records are yours to manage as owner, subject to client contracts and law, and the question becomes an ordinary post-close conversation.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting on any NDA.

When can records come up without breaching confidence?

Three situations are clean. Each depends on consent or on you being the owner.

What to say when the owner is open to it

Once an owner has raised the subject, or you own the company, keep it short and non-binding.

The network opportunity finder helps you think through which of your relationships, outside any confidential material, might be worth a conversation.

How does a buyer's records read connect to AI demand?

AI developers are moving toward agents that perform tasks, and training them needs records of real work: multi-step workflows, decisions and outcomes. Our explainer on services-as-software covers why those records are scarce, and the guide to what AI roll-ups look for in acquisitions shows how acquirers think about the same systems. When you reach the offer stage, the LOI records checklist lists what to write into your letter of intent.

For context on counterparties, see who buys lower middle market companies and what micro private equity is.

How would a partner reward work if a referral happens later?

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 cumulative per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. It is a share of SourceX's fee and is never deducted from what the company receives. See the program terms for details.

When is reading a CIM for records not worth the effort?

• The deal is too small for the company to reach 50+ full-time employees at peak (contractors excluded).
• The business is mostly consumer personal data or protected health information with no licensing basis.
• The records mainly belong to the target's clients and those clients have not consented.
• Archives were deleted, or nobody can export the data.
• The only route to the owner is through confidential material.

Next step

Add the 3S read to your CIM template and use it only for your own diligence. If you have a relationship where an owner is open to the conversation, register as a partner and make the introduction there, or check the baseline on the who qualifies page first.