MSPs: answering client security questions about a data license

Why clients ask their MSP first

A managed service provider sits closer to a client's systems than almost anyone else outside the company. When an owner hears about data licensing, the first call is often to the IT provider: "Is this safe? Can you pull the data? What are the risks?"

That makes the MSP a trusted voice and also a party with its own obligations. The MSP holds credentials, runs backups and may be bound by contracts that limit what it can do with client data without instruction. The answers below keep the MSP useful without taking on a decision that belongs to the client.

The roles are separate. The client decides whether to license. SourceX qualifies the company and works through price, terms and buyer review, while the company completes its own data inventory. A partner introduces and never handles records. The MSP, if engaged, performs technical tasks only on the client's written instruction.

What should the MSP say when asked "is it secure?"

Do not promise outcomes you cannot verify, and do not speak for the buyer's controls. The MSP can describe the client's side: access, staging, logging and deletion. For what never to promise, see what partners should never promise an owner about privacy.

What to agree before running any export

Use this as a pre-export checklist and keep a signed copy.

• Written authorization from the sponsor (owner, CEO, CFO or authorized representative) naming the systems and the purpose.
• Scope: systems, date range and exclusions, such as HR channels and customer content.
• Redaction and de-identification requirements agreed with the company before any work begins.
• Who holds credentials, and how they are issued and revoked.
• Where files stay: the client's own storage, or encrypted drives for large deliveries.
• Who may view the exported files and who may not.
• Logging turned on for the export tools and the staging area.
• A deletion step for working copies after handover is confirmed.
• A check of the MSP's own contracts for limits on using client data.

Who handles what?

Where do the files stay?

For big datasets the MSP will usually be asked to keep files inside the client's own environment or to prepare encrypted drives, because SourceX does not host multi-terabyte data. The handover is recorded so the client can show what was delivered. The comparison of encrypted drives and seller-hosted access goes through the trade-offs, and the delivery manifest template shows how to record what moved.

What are the MSP's own limits?

Before the MSP touches a client's data for this purpose, check these.

How to raise it with a client

Timing matters. The easiest moments are the quarterly business review, a system migration or a contract renewal, when the MSP is already discussing records and retention. The guide on recognizing suitable client businesses helps you decide which clients to raise it with, and the managed service provider overview covers the role in more depth.

A similar question comes up for commercial bankers, where the issue is keeping the topic separate from a credit decision. For the MSP, the equivalent is keeping it separate from the service contract.

What if a client asks about everyone who might see the data?

Tell them the access list is the client's to define. Point to the stakeholder objection map and the guide on who outside the company should know. A sponsor's view of reputational risk is useful if the client is private equity backed.

How rewards work for an MSP

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. Rewards become payable only after the buyer pays and SourceX receives its fee, and no reward is guaranteed. The reward is a share of SourceX's fee and is never deducted from what the company receives.

Be open with clients that you may earn a reward if they proceed. Review your client agreements before you register, and read the program terms.

When not to bother

Skip it if the client never reached 50+ full-time employees at peak (contractors excluded) or has no way for its own staff to approve an export. Also skip it if the data in your tools belongs to the client's customers, not the client.

What to say when you make the introduction

Which moments in the MSP calendar work best?

Next step

Choose one client that fits and ask whether the owner would like a short introduction. Register as a partner to make it. The referral FAQ answers process questions.