# Premature data sharing in a referral: what to say | SourceX

Canonical: https://refer.sourcex.si/guides/how-to-handle-a-founder-who-wants-to-send-data-immediately
Last updated: 2026-11-05

Thank the founder, decline the file and turn the energy into a decision the company can make. A referral never needs records: SourceX's process asks the partner to make the introduction, not to export, upload or describe confidential material, and the company applies itself. Ask the five metadata questions instead, confirm the CEO wants the conversation, and point the company to its own application. If a file has already arrived, do not open or forward it; tell the founder you have deleted it, and do so.

This page is for a VC operating partner or platform lead whose founder has just offered a spreadsheet, a folder or a login. Program facts come from SourceX's how-it-works, who-qualifies and terms pages (Version 2026-10-22.2, since replaced by version 2026-11-04) and its sample Channel Partner Agreement, read on 26 October 2026. The reply templates are this page's own, and the three founders are Illustrative.

## What the founder is asking for, and the step that actually comes next

A founder who offers data on the first call usually wants one of three things: proof that the records are worth something, speed, or someone else to carry the work. A file in your inbox delivers none of them. Nobody can value records from a sample sent to an investor, speed comes from the company's own application, and the work of rights review, preparation and delivery belongs to SourceX and the company under their own agreements.

So the step you ask for is different from the one the founder offered. Not "send it to me", but two things only the company can supply: a dated yes from its CEO, and its own application. Three endings are all acceptable from there. The founder's interest becomes an authorized conversation when the CEO agrees; the founder raises it with a CEO who has not heard of it yet; or, having heard the steps, the founder or the CEO decides not to go ahead, which closes the matter without any cost to the relationship.

## Why no record should reach you

Every published document points the same way. SourceX's how-it-works page tells partners they make the introduction and do not need to export, upload or describe confidential records; the company controls whether to proceed, what scope to offer and the terms it accepts, and nothing is shared without its approval. Its owner assessment needs no uploads. The who-qualifies page says screening questions are answered from a conversation with the relationship holder, never from files, samples or logins.

The partner agreement is stricter still. SourceX's sample Channel Partner Agreement gives a partner no authority to share a supplier's inventory, records, raw data or personal information, or to access extraction systems, and says a partner must not collect or retain supplier dataset copies through the referral program without separate written authorization. It also bars partners from telling a company that a data upload secures a purchase or a reward. And data moves late: under the same agreement, SourceX authorizes preparation only after a per-deal license with an Acquisition Partner is signed.

There is a plainer reason too. The FTC's guide for businesses, Start with Security, opens with data minimization: collect only the personal information you need, and dispose of it securely once that need ends. An operating partner holding a portfolio company's claim notes or support tickets has created a risk for both firms and gained nothing.

## The no-upload redirect replies

Six situations cover most offers. Each reply declines in one line, offers something more useful, and leaves a record.

| # | The founder says | Your reply, in one line | What you offer instead | What you record |
|---|---|---|---|---|
| 1 | "I'll email you a sample tonight." | "Please don't; I never need records, and keeping them out of my inbox protects you." | Five metadata questions on a short call | Date, and that no file was sent |
| 2 | "I've already attached it." | "I haven't opened it and I've deleted it; please don't resend it." | The same questions, then the company's own application | Date received, date deleted, founder told |
| 3 | "I'll give you a login so you can look around." | "No access, please; who sees your systems is decided by you and SourceX's process, not by me." | A description of systems by name, owner and years covered | Offer declined |
| 4 | "Can you send it on to SourceX for me?" | "The company applies itself, and data moves only after agreements the company signs." | The how-it-works page and the application route | Route sent |
| 5 | "Tell me what it's worth before I talk to anyone." | "I can't value it, and nobody can from a sample; SourceX reviews history, rights and relevance first." | The company fit checker, a preliminary and non-binding screen | Question routed |
| 6 | "My CEO doesn't need to know yet." | "Then we stop here; the CEO decides whether the company has this conversation." | Help with how to raise it with the CEO | Paused until the CEO decides |

Three of these deserve full wording, because they are the ones partners most often get wrong.

**Reply 1, before anything is sent.** "Thank you, and please hold on to it. In this process I never see records, and that protects you: what you share and when is your company's decision, made under its own agreement. What helps now is five quick answers: your full-time headcount at its peak, when your own records start, which systems hold them, whether any belong to clients, and whether your CEO wants to talk."

**Reply 2, after a file arrives.** "I've deleted your file without opening it, and I haven't forwarded it to anyone, SourceX included. Please don't resend it. If the conversation goes ahead, the company applies directly and decides later, under its own agreement, what it shares." Then delete the message from your inbox and trash. If your firm keeps backups you cannot purge yourself, tell your own IT or compliance team.

**Reply 6, when the CEO is being kept out.** "I'd rather stop here than go around your CEO. An introduction the CEO doesn't know about usually isn't a fit, and it's the CEO who decides. If it helps, I can suggest how to raise it." This is the reply that protects your relationship with both people.

## Interest belongs to a person; authority belongs to the CEO

Separate the founder's enthusiasm from the company's decision, which the program gives to the CEO, who also signs for the company. A founder-CEO's yes is that authority, but even then the next step is the company's application, not a file. A co-founder, CTO or product lead who offers data is expressing personal interest; the CEO still decides, and an introduction the CEO has not been told about is usually not a fit.

The investor relationship adds neither piece. A fund's board seat does not let a founder's offer skip the CEO, and it does not make the fund a channel for records. Rights sit apart from both: a founder may not be free to share at all, because the right to license must not breach client confidentiality, employee privacy or third-party contracts, and material that belongs to the company's clients is usually not a fit. SourceX reviews rights; you do not. Whether a company with some client-owned documents can take part is answered in [the client documents question](/questions/can-a-company-participate-if-some-documents-belong-to-its-clients).

The fit facts stay the same however eager the founder is: a workforce that peaked at 50 or more full-time employees, contractors not included; an operating history with documentation behind it; rights to license; and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 70% of the data is in English.

## Three founders, three replies (Illustrative)

Illustrative. Generic companies and invented facts; no outcome is implied.

**A. The attachment.** The founder-CEO of a 140-person claims administrator emails a spreadsheet of claim notes on a Friday evening "to get things moving". The operating partner deletes it unopened, sends reply 2, and on Monday asks the five questions. The founder applies for the company that week, describing record types and years, with nothing attached.

**B. The login, and a decline.** At a board dinner, the co-founder and CTO of a 90-person software company offers repository access; the CEO has not heard of the idea. The operating partner gives reply 3, then reply 6. The CTO raises it with the CEO, who decides the company will not pursue licensing this year. The row closes with the date, and nobody asks again through the CTO.

**C. Eager, but not a fit yet.** The founder of an agency with 35 full-time employees at its peak wants to send campaign files. The size check fails today, so the reply thanks him, declines the files, and records the trigger that would reopen the row: full-time headcount at peak passing 50.

| Case | Founder's role | What was offered | Replies used | Ending |
|---|---|---|---|---|
| A | Founder-CEO | Spreadsheet, already attached | 2, then 1's questions | Company applies, no file |
| B | Co-founder, not CEO | Repository login | 3, then 6 | CEO declines; row closed |
| C | Founder-CEO | Campaign files | 1 | Size fails; trigger recorded |

## Write down the permission and hand off only what was approved

Keep one dated note per company. It records the CEO's name and yes, what you may say (the company's name, the CEO's preferred contact route and a one-line description of record types and years, taken from the metadata answers), anything the CEO asked to keep private, and a line confirming either that no file was received or that one was received and deleted on a stated date. That last line is the one you will be glad of later.

The handoff itself is short. Whoever makes the introduction must first have registered and signed the SourceX Channel Partner Agreement; they share their partner link, and the company applies itself. SourceX may then communicate with the company directly without affecting valid attribution, and it manages the agreement, rights review, data preparation and delivery with the company. The partner's part never involves a dataset. Building a records description without touching records is covered in [the metadata-only inventory guide](/guides/how-to-prepare-a-metadata-only-inventory-of-business-systems), and screening a whole portfolio the same way in [the no-upload screening form](/guides/a-portfolio-screening-form-that-avoids-sensitive-uploads).

## Risks and limits of the redirect

- **Enthusiasm can cool.** Asking an eager founder to wait may lose the moment. No data on how founders respond to a redirect has been published; if the moment passes, [handling a "not now"](/guides/how-to-handle-not-now-objection) is the next page to read.
- **The founder may send it elsewhere.** A redirect does not stop a founder sharing records with another party; that is the company's decision, not yours.
- **Deletion is imperfect.** Mail servers and backups can keep copies after you delete, which is why the note records what you did and when.
- **Personal data raises the stakes.** If a file held personal information, the FTC's minimization guidance is the reason not to keep it, and the company may have its own obligations you cannot judge.
- **Fit and rights are decided in review.** An eager company can still hold records that belong to clients or that match no current program, and a company that falls outside one program today may still suit another one later.
- **The templates are untested.** They follow SourceX's published process; their effect on outcomes has not been measured.

**Methods note.** The replies apply SourceX's how-it-works, who-qualifies and terms pages (Version 2026-10-22.2, since replaced by version 2026-11-04), its sample Channel Partner Agreement (version 2026-10-19) and the FTC's Start with Security guide, all checked on 2026-10-26. Nothing here measures response rates, application outcomes or payouts, and the three founders are invented.

## Next step

> **Refer a company. No cap on rewards.** Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

When the founder's CEO says yes and no file has changed hands, [register for a partner link](/register), check the five answers against [who qualifies](/who-qualifies), read the [program terms](/terms), and send the company to [how it works](/how-it-works) so it can apply itself. More playbooks are in the [guides hub](/guides).

Redirecting a founder's data offer is referral work; looking at SourceX itself as a possible investment is a separate decision, and the [SourceX investor overview](https://sourcex.si/investors) is where investor materials can be requested.

This article is for information only and is not an offer to sell or a solicitation of an offer to buy securities. Any offering by SourceX is made only to verified accredited investors through its offering documents.

## Sources

- https://refer.sourcex.si/how-it-works
- https://refer.sourcex.si/who-qualifies
- https://refer.sourcex.si/terms
- https://sourcex.si/documents/partner/SourceX_Channel_Partner_Agreement_Sample.pdf
- https://www.ftc.gov/business-guidance/resources/start-security-guide-business
- https://sourcex.si/investors