The request is usually well meant. The customer trusts you, your product holds years of its records, and asking you to "just send it over" looks like the shortest path. Saying yes would put your company on both sides of a deal it stands to earn a reward from, holding data it promised to use only to run its service.
Why the vendor should stay out of the data path
Five separate reasons point the same way, and any one of them would be enough.
| Reason | What it means in practice | Basis |
|---|---|---|
| Your role is introduction only | The program never needs a partner to export, upload or describe confidential records | SourceX's how-it-works page |
| The customer delivers | The company applies itself, signs, delivers its data and is paid by SourceX under its agreement | SourceX's who-qualifies page |
| A processor acts on the controller's instructions | For personal data under the GDPR, a processor processes only on documented instructions from the controller, including for transfers | GDPR Article 28(3)(a) |
| Your data promises are enforceable | FTC staff, writing about model-as-a-service companies, said promises about customer data in terms of service or marketing materials can be enforced | FTC Office of Technology, January 2024 |
| You would be on both sides | Your reward is the greater of $50,000 plus 5% and 15% of what SourceX pays the customer, so moving the records yourself mixes the referral with the delivery it pays on | SourceX program terms |
None of this stops you helping the customer. The customer's benefit does not depend on the route: if it licenses, SourceX pays it directly under its agreement, and its CEO, the authorized sponsor, is the only person who can start that. What changes is the kind of help you give and who asks for it.
Locate the request: six asks and where each one goes
Customers rarely say "please act as our data transfer agent". They ask one of six things, and each has its own route.
| What the customer says | What it really asks for | Route | Owner |
|---|---|---|---|
| "Can you send our data to SourceX?" | You as the transfer channel | Decline; the customer applies itself and delivers under its own agreement | Account manager, then partnerships |
| "Can you tell SourceX what we have?" | You as the describer of its records | Decline; the customer describes its own records at metadata level when it applies | Partnerships |
| "Can you export everything for us?" | A normal export | Standard export request under the contract, delivered to the customer's admin | Support |
| "Can SourceX have API access to our workspace?" | Credentials for a third party | Decline; no partner shares logins or keys, and SourceX works with the customer directly | Partnerships, then security |
| "Would licensing break our contract with you?" | Legal advice from the vendor | Point to the contract and the customer's own counsel; do not advise | Legal |
| A manager asks without the CEO knowing | An introduction without authority | Thank them; nothing moves until the CEO wants the conversation | Account manager |
The fourth row deserves a fixed answer in every team's notes. Handing a third party access to a customer's workspace is a security decision for the customer, and no referral program needs it.
The authorized-route escalation script
Three levels, each with words to use, a time limit and a hand-off. The account manager handles most requests at level 1; levels 2 and 3 exist for customers who push back or need help.
Level 1, account manager or customer success manager, same day.
"Thanks for asking us first. We introduce companies to SourceX, but we don't move or describe customer records for that program, including yours. If your company wants to explore it, your CEO decides, your team applies to SourceX directly, and anything licensed goes from you to SourceX under your own agreement. If what you need is a full export from our product, I can open a standard export request for your admin."
Then log the request in one line: date, customer, who asked, which of the six asks it was. Do not forward anything about the customer's data.
Level 2, partnerships lead, within two business days.
"Following up on your question to our account team. Three things to know. First, the decision to explore licensing sits with your CEO; if they'd like a conversation, we can introduce them, and we only do that once they've said yes. Second, your company applies and works with SourceX directly, so scope, terms and delivery are agreed between you and them. Third, we may receive a referral reward from SourceX if your company licenses data; it's paid by SourceX and never comes out of what your company is paid."
If the CEO says yes, make a double opt-in introduction with fit notes the customer has read. If the customer only wanted an export, close the loop and step back.
Level 3, legal or privacy, only if the customer insists the vendor perform the transfer or asks about its contract.
"We can't act as the delivery route for a licensing deal we referred. If you need your data exported, we'll handle it as a standard export under our agreement with you, on written instructions from your authorized administrator, delivered to you. Questions about what your contract allows are for your own counsel; here is the section that covers export and retention."
Under the GDPR, a processor that receives an instruction it believes infringes the Regulation must inform the controller, so legal should also check that any export instruction is complete and comes from someone the customer has authorized.
| Never say | Say instead |
|---|---|
| "We'll take care of it for you" | "Your team works with SourceX directly; we can help you export from our product" |
| "Your data looks like a great fit" | "SourceX decides in its own review; we haven't looked at your records and won't" |
| "We already told SourceX about you" | "Nothing about you has gone to SourceX, and nothing will without your CEO's yes" |
| "Licensing is fine under your contract" | "Your counsel should read the contract; here's the section on data and export" |
| "We'll send a sample so they can see" | "No samples. Any description of your records comes from you, at a high level" |
Reaching the records to run a service is no right to move them
Your product can reach the customer's records because the customer bought a service. That access gives your company no right to license, describe or move them, and it tells you nothing about whether the customer may license them; that depends on the customer's own contracts and SourceX's rights review. SourceX treats material that belongs to a company's clients rather than the company as usually not a fit, which is also why a SaaS company licensing its customers' data is the wrong frame. The customer is the company here, and it licenses its own records.
Customers asking these questions may also be checking your side of the paperwork. Is your SaaS vendor training AI on your data? shows what they will read, SaaS data export rights covers what your contract lets them take out, and what to say when a customer asks about AI and their data has replies for your own data practices. Outsourcers face the same line from the other direction in can an outsourcing vendor share client data?.
A request worked through (Illustrative)
Illustrative. A generic company and invented facts.
A 240-person property management company has run its maintenance requests and vendor work orders in your platform for nine years. Its head of operations hears about SourceX in your customer newsletter and emails her account manager: "Can you push our maintenance history to SourceX for us?" The account manager uses the level 1 script and logs the request as ask 1, transfer channel.
She replies that her CEO hasn't heard about it yet. Nothing goes to SourceX. Two weeks later she writes that the CEO would like a conversation, and the partnerships lead sends the level 2 note to both of them and makes the introduction. The customer applies itself. A month on, the customer's IT administrator files a standard request for a full export of the work-order history, which support runs and delivers to the administrator, as it would for any customer. The partnerships team never sees the export, and the ticket mentions nothing about SourceX.
A variant ends differently. The same head of operations asks you to create API keys so SourceX can "pull what it needs". That is ask 4. The answer is no, recorded with the date, and it stays no whatever happens with the referral.
Keep product trust while you pilot introductions
Count what these requests do to trust, not just to introductions. Track how many transfer requests arrive, how many are routed within the level 1 and level 2 time limits, and how customers rate the answer in a one-question follow-up. No benchmark for any of these has been published, so your first quarter is your baseline. If transfer requests are common, your outreach is probably implying that you handle more than you do; fix the invitation, as described in the SaaS partner pilot with an opt-in customer cohort. More playbooks sit in the guides hub.
Next step
Refer a company. No cap on rewards. Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
When a customer's CEO wants the conversation and your team has used the script rather than the export button, register for a partner link, check the customer against who qualifies and read the program terms before you introduce.