The request is usually generous rather than careless. A client who trusts you with its servers sees you as the quickest way to get something done, and "just upload everything" is meant as a favor to both of you. Treat it as a sign of interest. Then turn that interest toward the one person who can act on it.
Where the upload request comes from, and who is really asking
It tends to arrive when you already hold the keys for another reason: a storage consolidation, a helpdesk or CRM cutover, a backup review, a tenant merger after an acquisition. The person asking is rarely the person who decides.
- The operations or IT lead who owns the system day to day wants to spare their team the work. They are often the right internal sponsor: they know the records and can raise the idea with the CEO. They cannot authorize a licensing discussion; under the program the CEO does.
- The CFO who heard there might be money in it wants a figure. Nobody can give one before review, and SourceX does not publish how it prices offers.
- The CEO wants it handled. The answer is still no, because the program never routes a company's records through a partner. A CEO who wants to go ahead talks to SourceX directly.
Whoever asks, your reply should do two things: refuse the transfer and name the next step that belongs to the company.
The client redirect and secure-handoff script
Six requests clients make, a reply you can say out loud, and the reason it holds. The wording is Illustrative; keep the substance and use your own voice.
| The client says | You reply (Illustrative) | Why the reply holds |
|---|---|---|
| "You have admin on everything. Just upload it all to SourceX." | "I can't, and you wouldn't want me to. My access is for running your systems. SourceX's application asks you to describe them, so nothing has to leave yet." | SourceX's application says no files are needed and nothing is licensed or transferred by applying |
| "Then send them a sample so they can see what we have." | "A sample is still your records leaving through me. If SourceX ever needs to see data, you agree that with them after you sign." | SourceX's process page has the company approve scope and terms and sign before any data is delivered |
| "Give SourceX a login to the helpdesk so they can look around." | "Nobody needs a login to assess fit. The first step runs on a list of your systems, how many years they cover and what could be exported." | The application asks for no passwords or API tokens; SourceX says its initial assessment runs on metadata |
| "Our managed services contract covers data work. Bill us for it." | "My contract covers the services in it. Licensing your records is your CEO's call with SourceX, and my referral role carries no authority over your data." | Section 4.2 of the partner agreement sample gives a partner no authority to share a supplier's records or to access extraction systems |
| "Can you fill in the application? You know our systems better than we do." | "I can remind you which systems to list. The application is yours: it asks who signs for the company and where legal notices go." | The application collects the company's legal name, entity type and notice address |
| "I'm the CEO, and I'm authorizing you." | "Thank you. The answer stays the same: SourceX works with you directly. I make the introduction and then step out." | SourceX may deal with a referred company directly without affecting the partner's attribution (terms, section 2) |
The handoff, in five moves. The handoff is secure because nothing of the client's travels with it: no export, no credential, no inventory. Only a relationship changes hands.
- The CEO says yes in writing. If the request came from the operations lead, that lead takes it to the CEO first. An introduction the decision maker never heard about is usually not a fit.
- You say what you stand to gain. Tell the CEO plainly that SourceX may pay you a reward if a license closes, and that it is SourceX's own payment, never taken from the compensation in the company's agreement.
- You sign, then introduce. The SourceX Channel Partner Agreement comes before any submission. Then send your partner link or a written introduction; an introduction made only in conversation needs confirming in writing.
- The company applies itself. It lists its own systems, years and export options. From here SourceX deals with the company.
- You log the date and step out. Any question about the records goes between SourceX and the CEO, not through you.
Keys, duties and authority are three different things
NIST's security glossary describes least privilege as keeping each user's access to the minimum their assigned tasks need (a paraphrase of the entry). Your access was sized for the tasks in your service agreement. A licensing upload was never one of them, and the referral program adds no authority of its own.
| Role | What it holds | What it decides | What it signs | When records move |
|---|---|---|---|---|
| Technical custodian: you, the consultant or MSP | Admin rights, backups, runbooks, monitoring data | Nothing about licensing; it passes the question to the CEO | Its service agreement, and the Channel Partner Agreement for the referral | Never for the referral |
| Customer owner: the company | The records and the contracts that govern them | The CEO decides whether to talk to SourceX and what scope to offer | The Master Supplier Licensing Agreement, then a Dataset Deal Confirmation for each deal | Only after signing, through the route agreed in the deal |
| SourceX | No records before the company signs; it works from the system inventory it completes with the company, whose records stay at home | Fit, rights review and the processing route, with the company | Its agreements with the company | After its go-ahead, extraction, transfer and de-identification run through approved processing routes |
SourceX's own guidance on custody adds that it does not host multi-terabyte datasets: large deliveries stay in the seller's storage or ship on encrypted drives. That describes what happens after a deal is signed. Before then, there is nothing to move and no reason for you to touch it. The wider split between billed IT work and the referral, invoices and ticket queues included, is mapped in how to separate paid IT work from a referral arrangement.
What the introduction carries, and what it leaves for the company
Keep the note short enough that nothing in it could have come from your consoles.
- It carries the company's name, the CEO's name, the fact that the CEO asked to be introduced and, if the CEO agreed, a plain description such as "a 230-person claims administrator with a long-running helpdesk".
- It leaves out anything you measured as the custodian: ticket counts, storage sizes, user totals, screenshots, field lists. Even accurate numbers from your monitoring are the client's information. Let the company state its own figures when it applies.
- It makes no claims about eligibility, rights or value. Whether the records belong to the company or to its clients, and whether they match a current program, is settled in SourceX's review.
One check before sending: ask whether anyone at the company has already been in touch with SourceX, such as a colleague who tried the fit check. Under section 3 of the terms that makes the company a duplicate, so you send no introduction and the company simply carries on directly. For the general rule on documents and partners, see should I upload company documents when making an introduction.
Fit facts the CEO can confirm on one call
Ask, do not inspect. The company should have reached 50 or more full-time employees at its peak, contractors excluded; hold years of operating records it created itself; have the rights to license them, which rules out material that belongs to its clients; and have a CEO who wants the conversation. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 70% of the data is in English. Records that were ever licensed for AI training are out; the company has to confirm they never were. If the CEO's real worry is legal, the response when a client wants a lawyer first covers that conversation.
A storage consolidation and a Friday deadline (Illustrative)
Illustrative. The company and people are fictional and no outcome is implied.
An MSP is consolidating file storage for a 230-person insurance claims administrator. The operations director, who owns the helpdesk, asks the MSP to "push the whole ticket archive to SourceX before we shut the old share on Friday". The MSP uses the first and fourth replies, says the Friday date is about storage and has nothing to do with licensing, and suggests the director raise the idea with the CEO.
The CEO emails the next week asking to be introduced. The MSP mentions the possible reward, signs the partner agreement, sends a three-line introduction and logs the date. The company applies, listing its helpdesk, claims platform and document store with their years. Nothing from the archive moves. If a license later closed and SourceX paid the company $250,000 under its agreement, the MSP's reward would be $62,500, paid by SourceX on its own account, with nothing for the MSP coming off the compensation in the company's signed agreement.
Where the script will not carry you
- A client who insists. Some will press, or hint at the contract. The answer does not change, and the company can apply on its own at any time. A founder who wants to send files straight to SourceX is a different conversation, covered in handling a founder who wants to send data immediately.
- Records that belong to someone else. An MSP's own ticket history often describes its clients' environments; whether any of it is the MSP's to license is a rights question, covered in whether an MSP can share client ticket data.
- Your own contract. Confidentiality terms in your service agreement may say more than this page can. Read them with your own counsel; nothing here is legal advice.
- No data yet. Nobody has published how often clients ask consultants to upload records, or how they react to a refusal. To learn it, log each request: who asked, which reply you used, and whether the CEO later asked for an introduction.
The two-email version of the same discipline, with the link withheld until a written yes, is in the permission-first email pair for MSPs, and the partner overview sits on the managed service providers page.
Next step
Refer a company. No cap on rewards. Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
Once the client's CEO has asked in writing to talk to SourceX, create your partner account, recheck the company against who qualifies and read sections 2 and 3 of the program terms, then send an introduction that carries no file at all. More playbooks for technology partners are in the guides library.