Build a referral opportunity map from metadata, without reading client content

What metadata can a partner collect without reading private company records?

Anything that describes the records rather than reproduces them. NIST's glossary defines metadata as information describing the characteristics of data, separating structural metadata (format, syntax, semantics) from descriptive metadata. For a referral, that means the shape and history of a record set, never its content.

The line is easy to hold in practice. "The service desk has about 300,000 tickets since 2014" is metadata. "Here are ten sample tickets" is content, and partners never ask for it. The network opportunity finder helps choose which conversations to start; this page covers what to write down once a conversation starts.

The eight-column inventory

Each column has a rule that keeps it reproducible: another person asking the same owner the same question should get the same row.

UK and EU companies often already hold part of this. The UK Information Commissioner's Office says Article 30 records should include, where possible, retention schedules for each category of personal data, and its data-mapping guidance suggests recording where and how information is stored and for how long. Checked 2026-10-18. A partner does not need that document; the owner may simply find the questions familiar. Companies that want their own fuller register can start from the data asset register template.

A worked inventory (Illustrative)

A fictional 310-person regional logistics company, interviewed by its outsourced IT partner in one 20-minute call with the COO. Every figure is invented.

Four rows, no record opened, and the useful signals are already visible: more than a decade of shipments with a system-reported count, a ticket archive that a retention rule could shrink, and one CEO who would need to approve, with the operations director, the customer service manager and the fleet manager as the people who know the records. ERP and knowledge-base specialists can map the same columns onto their own projects, as in the guides for NetSuite consultants and Confluence consultants.

What never goes in the map

• Record contents, samples, screenshots or exports.
• Customer, patient, employee or vendor names.
• Credentials, system access or admin views a partner happens to have from other work. Having access is not permission to look for this purpose.
• Guesses presented as facts. "Unknown" is a valid cell.

Company qualification questions

The inventory feeds four questions SourceX asks first:

• Size and history: at least 50 full-time employees at peak, contractors excluded, with documented operating history.
• Ownership: are these the company's own operational records, or material it holds for clients?
• Authority: is the person in the "who can authorize" column reachable, and do they know about the introduction?
• Geography: Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English.

Still unknown until SourceX reviews: whether there is demand for any row's records, what rights limit reuse, and what the records would be worth. For mapping a whole network of companies at once, use the 20-company network mapping exercise.

Limits and unanswered questions

• Owner-stated figures can be wrong. The source column exists so the number can be rechecked.
• Metadata can still be sensitive. Partners sign the Channel Partner Agreement before submitting introductions; treat the inventory as confidential.
• Two payments, kept apart. Any compensation for licensed data is agreed between SourceX and the company. A partner's referral reward is paid separately by SourceX and never deducted from the company's payout.

Next step

Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

When an owner has answered the eight columns and the authorizing executive knows about it, make the introduction: register, check who qualifies, and read the terms. More playbooks are in guides.

What should a portfolio operations analyst know about a multiple data category referral?

When one company holds several kinds of records, send SourceX a single page with a block for each category, not a long list of system rows and never a sample. Each block says what one record is, where the category lives, roughly how many records exist and since when, who created them, what could limit their use and what nobody knows yet. The CEO approves the page before it leaves the company, and every number on it says whether it is a report or an estimate.

The eight-column map above works one system at a time. Companies with several record categories strain it in two ways: one category spreads across several systems (customer issues split between a helpdesk and a shared inbox), and one system holds several categories (an ERP carrying purchasing, inventory and finance). Rights, sensitivity and fit attach to a kind of record, not to the software that stores it, so a packet built by category answers the questions that come next.

Model developers are already being asked to describe training data by source. Under the EU AI Act, providers of general-purpose AI models must publish a summary of their training content on a European Commission template, an obligation that applies from 2 August 2025, with models already on the market before then given until 2 August 2027. The template's sources run from publicly available and private datasets to scraped data, user data and synthetic data, and it asks for different levels of detail depending on the source. A category packet gives a company a way to describe its records in similar terms while every record stays where it is.

Start with the company context, once

Write the context at the top, so each category block can stay short. Every line comes from the CEO or the person the CEO names, with a date.

• The entity that holds the records. The legal name, not a brand. If categories sit in different entities of one group, list each one; a parent company and its subsidiaries count as one company, so the whole group shares a single $100,000 reward cap. Whether an introduction of a second entity is credited, for example when the parent dealt with SourceX before or another partner introduced a sister company, is something SourceX works out when it checks the introduction against its own records. The terms set no rule for it, and the multiple subsidiaries guide shows how to list entities.
• Peak full-time headcount and its year. Introduced companies need 50 or more full-time employees at peak; contractors are excluded.
• Years operating, location and record language. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English.
• Who authorizes. The CEO, who makes the call on a licensing discussion and signs for the company, plus the contact the CEO names to prepare the case.
• Prior contact. Whether the company has had any application, relationship, lead, account or email correspondence with SourceX. If it has, it is a duplicate, and no partner is credited.

The category-level summary template

One block per kind of record. Each field has a rule so that a second person asking the same owner would write the same block.

The "people in it" flag matters most for categories that touch health or identity. The UK Information Commissioner's Office lists the special categories under Article 9 of the UK GDPR: racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for identification, health, sex life and sexual orientation. The line is not always obvious. In the ICO's guidance, appointment details and invoices count as health data only when they reveal something about a person's health, so a scheduling category is not automatically sensitive, while workplace injury reports usually are. The partner raises the flag; deciding what follows is the company's and SourceX's work, and de-identification is a separate question from permission to license.

A filled category packet (Illustrative)

A fictional 420-person commercial facilities maintenance company, peak headcount 450 in 2023, answered by its COO in one call and approved by its CEO on 2026-10-22. Every figure is invented.

Read across the rows and the packet does its job without ranking anything. Two categories are the company's own records with long spans, one of them with a system-reported count. The ticket category has a deletion schedule that could shrink it. The injury reports carry a sensitivity flag instead of being quietly dropped, and the drawings are listed with a plain note that client-owned material is usually not a fit. SourceX has not published demand or prices by category, so the blocks are ordered by how much the company created and knows, not by anyone's guess at value.

Label estimates, limits and open questions

Three labels cover every number: reported (from a system report), estimate (someone's judgment, with the role named) and unknown. Use bands rather than precise-looking figures, because an estimate of "about 412,000" invites more confidence than it deserves. For limits, "none known" means the owner was asked and knows of none; "not asked" means nobody checked. Open questions stay on the page: a packet with three honest unknowns is more useful in review than one where a partner has guessed the answers. The missing permissions guide shows how to phrase the questions so the company, not the partner, answers them.

CEO sign-off first, then an order of business for the first call

Before anything leaves the company: the CEO has read and approved the page, the partner has signed the SourceX Channel Partner Agreement, the packet goes only to SourceX and is treated as the company's confidential information, and nothing is attached. Then propose an agenda the company can prepare for. SourceX runs its own review; this is a starting order, not its process.

1. Confirm the entity, peak headcount, location and the CEO's authorization.
2. Walk the categories in the packet's order, with the people who own them correcting any estimate.
3. Client-held material and contract limits, category by category.
4. Flagged categories and any deletion dates.
5. What SourceX would need next, and who at the company owns each item.

The joint call guide covers whether the partner should attend.

If any categories are licensed, the reward follows the company, not the category. Illustrative: if SourceX actually paid the company $160,000 for one category and later $240,000 for a second, the cumulative Actual Supplier Payout of $400,000 gives a reward of $100,000, and a third category licensed after that adds nothing, because the cap does not reset. SourceX pays the reward separately; it never comes out of what the company receives.

Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

When the CEO has approved a packet like this, open a partner account at registration, screen the company with who qualifies and keep the program terms at hand.

Where a category packet can mislead

• Bands can still be wrong. Owner estimates are often off by a band. The source line exists so the figure can be checked rather than defended.
• Categories can hide sub-categories. "Customer service tickets" may include warranty claims with different contract terms. If two owners give different answers about a category, split it.
• A flag is not a finding. Marking a category as possibly sensitive does not settle anything about rights or lawfulness; only the company's counsel and SourceX's review can.
• The packet says nothing about demand. It does not show whether any category matches what SourceX is currently seeking, or what it would be worth.

Methods note. The template was built on 2026-10-27 from the program terms (Version 2026-10-22.2), the who qualifies page, the Commission's training-content template and the ICO's special category guidance. Its fields and scale bands are editorial choices, not measured weights, and it has not been tested against review outcomes; SourceX has not published acceptance rates by category, so none are implied. For the system-level groundwork, the metadata-only inventory guide and the data asset register template come first, and the guides library has the rest.

Evaluating SourceX as a company is a separate decision from preparing a referral packet, and readers weighing it can request materials through the SourceX investor overview.

This article is for information only and is not an offer to sell or a solicitation of an offer to buy securities. Any offering by SourceX is made only to verified accredited investors through its offering documents.