# No-upload referral queue: a metadata-only template | SourceX

Canonical: https://refer.sourcex.si/guides/how-to-build-a-referral-queue-without-uploading-client-data
Last updated: 2026-11-05

Build the queue from facts, not files. Each company gets one card with ten slots: a code, the entity and its public web domain, its group, the CEO who decides, the colleague who owns the relationship, four fit answers in the CEO's own words, any earlier contact with SourceX, who holds the next move, one dated action and a pointer to the message behind it. Tag every fact with where it came from, give the queue nowhere to attach a file, and empty each card when its referral ends.

The reader is the operations lead at a managed service provider, accounting practice, consultancy or agency whose staff work inside client systems every week and notice companies that might fit. A queue lets any of them raise a company without carrying the client's records into referral work, and SourceX asks partners for none of that material: its process page says the partner makes the introduction and does not need to export, upload or describe confidential records.

## What a colleague may bring to the queue, and what stays with the engagement

A partner firm learns about a client company through several channels, and only some of them may feed the queue.

| Where the fact came from | Example | Goes in the queue? |
|---|---|---|
| A public source | The company's website lists four depots and a founding year | Yes, tagged public, with the date read |
| The CEO, for this purpose | "Full-time staff peaked at about 140 in 2022" | Yes, as a fit answer tagged CEO |
| Your own relationship | "I have advised the CEO for eight years" | Yes, as the path |
| Paid work on the client's systems | 38,000 tickets in the service desk, a 2 TB file share | No; it becomes a question for the CEO |
| Another client, or gossip | "I heard they are selling" | No |
| SourceX's dashboard, after an introduction | The stage and reward status SourceX shows you | Yes, as displayed, with the date read |

The fourth row is where partner-lane firms slip. An engineer who administers a client's service desk can count its tickets in seconds, and that count is often why the company came to mind. The hunch is fine; the number is not the firm's to reuse. The unsigned sample of the Channel Partner Agreement calls the company that licenses its data the supplier, and it withholds from the partner any right to hand over what a supplier holds, from its inventory and raw records to the personal details in them, or to touch the systems data is extracted from. It also bars partners from collecting or keeping copies of a supplier's dataset through the program without separate written authorization. So the card reads "history: unknown, ask the CEO" until the CEO says how far back the company's own records go.

## The metadata-only queue template

Ten slots per card. Each slot names the only sources allowed to fill it, and the last column says what it must never hold.

| Slot | What it holds | Allowed source | Never |
|---|---|---|---|
| 1. Code | A short reference such as Q-034, used in every report and meeting instead of the name | The operations lead | Your billing or ticketing account number for the client |
| 2. Entity and domain | The legal entity whose CEO decides, and its public web domain | Public | Internal hostnames, tenant or workspace IDs |
| 3. Group | The parent, if any; a parent and its subsidiaries count as one referred company for the once-per-company USD 50,000 floor | Public, or the CEO | A guess from a shared office address |
| 4. Decider | The CEO's name and the date it was confirmed; once an acquisition closes, the acquirer's CEO | Public, or the CEO | A personal mobile number or home address |
| 5. Path | The one colleague allowed to raise the topic with this company | Your firm | "The account team" |
| 6. Fit answers | Four tests, each marked pass, unknown or fail: full-time headcount of 50 or more at peak, years of the company's own records, records it owns rather than holds for clients, and location and language | The CEO's own words | Any count read from a system your firm runs |
| 7. Earlier SourceX contact | None known, yes, or not yet asked | The CEO | Another advisor's claim |
| 8. Move holder | Us, the path, the CEO, or the company and SourceX | The queue | Blank |
| 9. Next action and due date | One action from the lane table below, and a calendar date | The queue | "Follow up" with no date |
| 10. Evidence | A pointer to the written message in the referral mailbox; after the introduction, the dashboard's stage and reward status with the date read | Your mailbox; SourceX's dashboard | The message pasted in, or any amount before the status reads Paid |

There is no column for attachments, samples, screenshots, exports, logins, customer or employee names, reward estimates or the CEO's reasons for anything. A slot that does not exist cannot be misused.

Slot 6 follows SourceX's published screen. Contractors are left out of the headcount, and a staffing firm counts its own full-time staff, not the workers it places with clients. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 70% of the data is in English. Material a company holds for its clients is usually not a fit, and records already licensed for AI training are out, because SourceX's process asks each company to confirm its data has never been licensed for that purpose. Unknown is not a failure; it is the path's next question. Whether the records match a current SourceX program, and whether customer contracts limit their reuse, only SourceX's review and the company can answer, so no slot pretends to.

## Four controls that keep files out

A template states intent; controls make it hold when a colleague is in a hurry. (The short answer to [whether to upload company documents when making an introduction](/questions/should-i-upload-company-documents-when-making-an-introduction) is no.)

1. **No file field.** Build the intake as a form or list with fixed fields and no upload question. If your tool attaches files to records by default, switch that off where the tool allows it; where it does not, the weekly sweep removes anything attached.
2. **One capped line of free text.** A 240-character "why this company" line, written from public facts or the CEO's words. Any number in it carries its source tag in brackets, which makes a figure copied from a client system stand out.
3. **Public links only.** A link to the company's own website is fine. A link to the client's file share, a shared export or a report inside the client's tenant is not, even when it is view-only, because the link is the file by another route.
4. **A referral mailbox.** Pointers in slot 10 refer to messages in a shared mailbox your firm controls. Colleagues forward the CEO's written replies there with any attachments stripped.

The same instinct runs through federal guidance on personal information. NIST's guide to protecting personally identifiable information tells organizations to keep their use, collection and retention of it to what their purpose strictly needs, to review what they already hold on a regular schedule, and even floats an annual purge day (our paraphrase of SP 800-122). The only personal data on a card is a CEO's name and work email and a colleague's name; everything else is company metadata, and the rule of holding the minimum fits both.

## Who holds the next move: four lanes and their dates

Slot 8 sorts the queue. A card sits in exactly one lane, and the lane limits what anyone may do next.

| Lane | Holder | Actions allowed | Due | When it slips |
|---|---|---|---|---|
| A | The operations lead | Look for a card on the same company or group; name one path | 3 working days | The lead clears it at the weekly meeting |
| B | The path | Ask the CEO once whether a conversation is wanted; if yes, take the fit answers and ask about earlier contact with SourceX | 10 working days | Reassign the path or close the card |
| C | The CEO | Nothing, unless the CEO named a date to hear back; then one message on that date | 30 days from the ask, or the CEO's date | Close as no answer, which counts as a no |
| D | The company and SourceX | Read the dashboard monthly and copy the labels | Day 90 after the written introduction | Close as lapsed if no verified application shows |

Moving a card from B to D needs three things on file: the CEO's written yes, an answer about earlier contact with SourceX, and a signed Channel Partner Agreement for whoever submits, because partners sign it before submitting introductions. Credit goes to whichever valid introduction of a company SourceX did not already know arrives first inside the 90-day window, once that company submits a verified application, and SourceX decides it from dated records; a click on a referral link settles nothing by itself. If two colleagues raise the same company, the queue keeps one card and one path. If another firm knows the company too, your queue cannot see it: only one introduction can be credited, and SourceX settles overlapping cases in duplicate review.

The lanes feed [the weekly partner pipeline meeting](/guides/the-weekly-partner-pipeline-meeting-that-stays-useful); ranking cards under limited capacity is covered in [prioritizing introductions when review capacity is limited](/guides/how-to-prioritize-introductions-when-review-capacity-is-limited), and a founder-facing form with no attachments is [a portfolio screening form that avoids sensitive uploads](/guides/a-portfolio-screening-form-that-avoids-sensitive-uploads).

## A Monday queue at a 60-person MSP (Illustrative)

Illustrative. A generic firm and generic companies, read on Monday 2 November; invented facts, no outcomes implied.

| Code | Lane | What the card says | Next action |
|---|---|---|---|
| Q-031 | A | Raised by a field engineer: "regional distributor, client since 2015"; no path named; fit answers unknown | The lead names the account partner as path by Thursday |
| Q-032 | B | Path: account partner. Public: four depots on its website. Fit answers unknown | Ask the CEO once by Friday 6 November |
| Q-033 | C | CEO asked on 20 October; she asked to hear back on 2 February | One message on 2 February, nothing before |
| Q-034 | D | Written yes and introduction on 2 October; four fit answers pass; dashboard stage copied as shown on 2 November | Read the dashboard again on 2 December; day 90 falls on 31 December |
| Q-035 | Closed | CEO declined on 21 October | Card emptied to code, ending and dates |

Q-031 is the instructive card. The engineer who raised it knows from the service desk that the distributor has fifteen years of dispatch tickets. The card does not say so. Its history answer stays unknown until the account partner asks the CEO, and if the CEO never wants the conversation, the firm never needed the number.

## When a file lands in the queue anyway

Someone will eventually paste a sample or attach an export. Handle it the same way every time.

1. Remove the item from the card, and from the tool's trash or version history if it keeps one.
2. Note on the card only that an item was removed, when and by whom. Do not describe what it held.
3. Tell the colleague who added it, and check whether the same item went to chat or email.
4. If the company sent the file itself, thank the CEO, explain that SourceX looks at records with the company directly once it applies, and delete your copy under your firm's policy.
5. Where the item held personal data, follow your firm's own incident policy. This page is not legal advice.

For a stray note in a client's support ticket instead, see [keeping referral notes out of client support tickets](/guides/how-to-keep-referral-notes-out-of-client-support-tickets).

## Closing a card and emptying it

A card ends in one of seven ways: no answer, declined, screened out on a named fit test, lapsed at day 90, not credited after duplicate review, no deal, or reward paid. At closing, strip it back to code, entity, group, ending and dates. A declined company keeps a do-not-raise marker, and [recording a decline without keeping private reasons](/guides/how-to-record-a-company-s-decline-without-keeping-its-private-reasons) shows how to keep that marker without the CEO's explanation. A paid card keeps the introduction evidence, the status history, the money received and the date of the company's first qualifying Closing, because the USD 50,000 floor applies once per company and a repeat license, renewal or amendment first agreed within 12 months of that Closing pays 15%.

Your firm's retention policy sets how long anything stays; the partner agreement's return-or-delete clause leaves room for records needed for legal obligations, reward accounting and dispute evidence, and nothing else needs to survive. A fuller design with permissions as their own object is [the three-object referral CRM](/guides/the-referral-crm-should-track-companies-permissions-and-next-steps).

## Where a metadata-only queue falls short

- **Cards look thin.** Without system counts, fit answers stay unknown for weeks. That is accurate: only the CEO can answer them, and SourceX reviews actual records with the company after it applies.
- **Controls leak.** A determined colleague can paste around any rule. The weekly sweep and the removal routine make spills rarer and shorter; they do not end them.
- **Hunches still come from paid work.** What a colleague sees in a client's systems will shape whom they think to raise. Where that becomes inappropriate is a judgment your firm should write down; the queue only keeps the knowledge itself off the card.
- **One firm's view.** The queue cannot show another partner's introduction or an earlier contact between SourceX and the company. Slot 7 asks the CEO, and SourceX decides the rest.
- **Not yet measured.** Nobody has studied whether a metadata-only queue changes how often CEOs say yes. To test it, log the dates each card was raised, asked and answered for two quarters; no figures are published yet.

More operations guides sit in the [guides library](/guides), and SourceX's own walk-through of the stages is on [how it works](/how-it-works).

## Next step

> **Refer a company. No cap on rewards.** Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

When a card reaches lane B with a named path and a CEO who wants to talk, [register your firm as a partner](/register) so the move to lane D has a signed agreement behind it, keep [who qualifies](/who-qualifies) open beside slot 6 and file the version of the [program terms](/terms) the queue was built on.

## Sources

- https://refer.sourcex.si/terms
- https://refer.sourcex.si/how-it-works
- https://sourcex.si/documents/partner/SourceX_Channel_Partner_Agreement_Sample.pdf
- https://refer.sourcex.si/who-qualifies
- https://sourcex.si/how-it-works
- https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-122.pdf