The call usually comes from someone who handed the keys over: the in-house administrator who retired when your firm took over the client's infrastructure, or the contractor who ran the old file server before the cloud move. They ring you because you are the technical contact they still know. That makes you the natural person to hear the tip and the wrong person to act on it alone.
What the retired administrator knows that nobody else does
Often the one thing nobody wrote down: which copies exist outside today's backup regime, and how to read them. SourceX's own guidance on archiving retired systems makes the point bluntly: "A data dictionary written by the people who ran the system is worth more than any storage choice." It adds that restoring a native backup "usually needs the original software, often in a specific version." A retired administrator may be the last working copy of that dictionary.
That matters to the client first, whatever happens about licensing. An archive nobody can find or read is a retention, recovery and disposal question for the company before it is anything else. Five things you might hear, in invented but typical words, and the event behind each:
| What you hear | The system event behind it | Who at the client should hear it |
|---|---|---|
| "The 2004 to 2014 project files are on tapes in the server room cabinet" | Backups kept outside the current backup service | The CEO and the IT owner |
| "Nobody migrated the old job-costing database; its image is on the old NAS" | A retired application kept only as a machine image | The IT owner |
| "You need the 2011 release of the backup software to open those" | Readability tied to one software version | The IT owner |
| "That NAS goes back to the leasing company next spring" | A dated disposal that would end the copy | The CEO, who decides on timing |
| "I think I still have a drive with some of it at home" | A copy outside the company's control | The CEO, who decides with counsel |
The potential sponsor is the CEO, who under the program authorizes a licensing discussion and signs for the company. Where IT is outsourced to you, the IT owner on the client side is usually a COO, controller or operations director, not your own engineer.
The knowledge-to-current-owner handoff
Three parts: sort what you hear, route it to the client, then close the loop.
Part 1: sort. Take notes once, from memory, in five rows and nothing else.
| Kind of knowledge | Example | Goes to | In the written note? | What the MSP may do with it |
|---|---|---|---|---|
| Location | Tapes in the cabinet; a machine image on the old NAS | CEO and IT owner | Yes, in plain words | Nothing until the client instructs |
| Coverage | Job costing from 2006 to 2015; project folders by client | CEO and IT owner | Yes, as year ranges and record types | Nothing until the client instructs |
| Readability | Software release needed; what status codes 40 to 49 meant | IT owner | Yes, written like a dictionary entry | Add it to the client's own documentation if asked under the service agreement |
| Secrets | Passwords, encryption keys, a safe combination, who holds a key | The IT owner directly, by a process the client chooses | Never | Never receive them for the referral |
| Copies outside the company | A drive at home; a personal cloud folder | The CEO | Only the fact that one exists | Never take possession for the referral |
Part 2: route. Five steps, each dated.
- The retired administrator talks once; you write the note in the rows above.
- You send it to the CEO and the IT owner together, unchanged except that anything in the secrets row is left out. It becomes the client's record, not your firm's.
- The client decides what it wants done: confirm the copy exists, preserve it, recover it, document it or let it go. If it instructs you, that is service work under your agreement, ticketed like any other request, done for the client.
- Separately, the CEO decides whether a licensing conversation interests the company. Nobody introduces anyone before that answer.
- You tell the retired administrator the note reached the client. What the client then does is the client's business.
Part 3: close. Mark every fact in the note as remembered or confirmed, and by whom. Memory from ten years ago is a lead for the client's own check, not a description anyone repeats as fact.
NIST's control catalog treats this sort of handover as ordinary housekeeping. Control PS-4, on personnel termination, lists exit interviews among the steps and has the organization keep access to the information and systems the departing person controlled (our paraphrase of the search excerpt). When an administrator retired without that step, the handoff above is the late version of it, and the client owns it.
Method note. The rows come from SourceX's archiving guidance, its program pages and terms, and NIST SP 800-53 Rev. 5, all read on 2026-10-27. The handoff governs what moves between people. It does not judge whether an archive is complete, readable, wanted or licensable; the client's own check answers the first two and SourceX's review the rest.
Custodian, owner and reviewer: three jobs that stay apart
Your admin access is the reason the tip reached you and the reason you should not act on it alone. The data owner versus data custodian comparison sets out the general split; in this referral it looks like this.
| Party | What it holds | What it decides | What it never does here |
|---|---|---|---|
| The MSP, as technical custodian | Admin access under a service agreement; knowledge of today's systems | How to carry out work the client orders | Opens, restores, exports, samples or describes contents for the referral; uses its access to check the tip unprompted |
| The client, as owner | The records, the systems and the CEO's authority | Whether to confirm, preserve, recover or license, and who introduces | Hands the licensing decision to its IT provider |
| SourceX, as reviewer | Nothing until the company applies | Whether the company fits a current program, and the terms the CEO signs | Needs the partner to export, upload or describe confidential records |
SourceX's program page puts the partner's part plainly: you make the introduction, and you do not need to export, upload or describe confidential records. The company controls whether it proceeds and what scope it offers. Nothing in that sentence changes because you happen to hold the keys.
What the introduction may say about an archive nobody has opened
If the CEO wants the conversation, the introduction carries only what the CEO has approved, at metadata level: the company, its size, the kind of records, the years, where they sit and whether the client has confirmed they exist. It carries no sample, no screenshot, no file listing and no claim nobody has checked.
| You may write | You may not write |
|---|---|
| "Project archive, 2004 to 2014, on tapes; existence confirmed by label count" | "Everything is there and readable" |
| "The firm's own job-costing records, per the CEO" | "It qualifies" or "it is worth" any figure |
| "The CEO wants a conversation and is copied" | Anything the retired administrator said about contents |
Fit still decides. A company needs a full-time headcount that reached 50 at its peak, contractors excluded, years of records it created itself, rights to license them and a CEO who wants to talk. Old project files can include deliverables that belong to the firm's clients, and SourceX's screening page lists client-owned material as usually not a fit, so rights stay an open question until SourceX's review.
Only one partner is credited per company, under section 2 of the terms. The retired administrator may have a line to the CEO of their own, as the answer on former employees introducing a former employer explains, so agree in writing who registers and submits before anyone mentions licensing. That person signs the SourceX Channel Partner Agreement first. The broader version of this situation, seen from a fund, is in when a former employee knows where the archive is.
One call, one cabinet, eleven days (Illustrative)
Illustrative. The firm, people, counts and dates are invented, and no outcome is implied.
A 260-person civil engineering firm moved its IT to an MSP in 2024, when its administrator retired. In October he calls the MSP's account manager: the 2004 to 2014 project archive and the old timesheet database sit on tapes in a cabinet behind the plotter; reading them needs the old tape drive and the 2011 release of the backup software; the cabinet key is with someone in the office.
- Day 1. The account manager writes the note in five rows. The key's whereabouts go in no row the MSP keeps; the administrator is asked to tell the firm's operations director directly.
- Day 2. The note goes to the CEO and the operations director, who owns IT decisions at the firm.
- Day 6. The operations director opens a ticket asking the MSP to count the tapes and read their labels, nothing more. The MSP reports 38 tapes labeled 2004 to 2014 and no compatible drive on site.
- Day 9. The CEO decides to keep the cabinet locked and the tapes as they are while the firm considers recovery, and separately says she would like to hear about licensing.
- Day 11. The retired administrator declines to be involved further. The MSP signs the partner agreement and submits one introduction: the firm, its peak headcount from the CEO, a tape archive covering 2004 to 2014 whose existence is confirmed by label count, contents not restored, and a note that some project files may be client deliverables.
The recovery decision and the licensing decision ran on separate tracks, and both stayed with the firm.
Next step
Refer a company. No cap on rewards. Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
Once the client holds the note and its CEO has asked to hear about licensing, set up your partner account through registration, compare the firm's headcount, history and rights with the published fit criteria, and keep sections 1 to 3 of the program terms open while you write the one introduction. The MSP partner overview, the guide to client data security questions for MSPs and the guides library cover the rest of the MSP's side.