# Who can license subcontractor evidence records? | SourceX

Canonical: https://refer.sourcex.si/questions/who-can-license-subcontractor-evidence-reconciliation-records
Last updated: 2026-10-19

Start with the supplier compliance director, who knows where evidence packages, reviewer notes and decisions live and how complete they are. The person who can authorize a licensing discussion is the CEO. General counsel must weigh in on anything the subcontractor authored or anything touching government customer information. Portal administrator rights are access, not authority, and what can actually be licensed stays open until SourceX's rights review.

This answer belongs to the [subcontractor evidence reconciliation guide](/guides/workflow-subcontractor-evidence-reconciliation). It is laid out as a decision tree because the answer changes with one question the other pages do not ask: who wrote the record?

## Five questions that lead to a yes

Work down the list in a normal conversation with the client. None of the questions requires seeing a document.

1. **Who runs evidence review day to day?** Usually the supplier compliance director, sometimes a subcontract compliance manager inside procurement. This is your sponsor.
   - No single owner? Ask who signs deficiency letters. That person knows where the history sits.
2. **Who wrote each record class?** The prime writes flowdown lists, reviewer notes, deficiency letters and approvals. The subcontractor writes evidence packages and attestations. The government customer's information may appear inside both.
   - Prime-authored only: continue to question 4.
   - Subcontractor-authored or customer information involved: go to question 3 first.
3. **What do the agreements say?** The subcontracts manager can point to confidentiality and ownership terms for submitted documents; counsel decides what they mean. Where the subcontractor handled Federal contract information, which is when FAR 52.204-21's safeguarding clause flows down, the material it submitted about those systems deserves particular care.
4. **Who can authorize a discussion about licensing company data?** The CEO. Some companies need board or owner consent for a new revenue line; see [whether licensing data requires board approval](/questions/does-licensing-data-require-board-approval).
5. **Has the CEO agreed to a first call?** If yes, the tree ends at an authorized introduction. Everything after that is SourceX's rights review with the company.

## Records by author: prime, subcontractor, government

The second question matters more here than in most workflows, because a reconciliation file mixes three authors.

| Record class | Written by | Who usually controls it | Who must review before any proposal |
|---|---|---|---|
| Flowdown lists and modifications | Prime (subcontracts team) | Prime's CEO | Counsel checks prime contract terms |
| Reviewer comments and deficiency letters | Prime (compliance team) | Prime's CEO | Counsel, light review |
| Approvals and closeouts | Prime (compliance and quality) | Prime's CEO | Counsel, light review |
| Evidence packages and attestations | Subcontractor | Shared; depends on subcontract confidentiality and ownership terms | Counsel; possibly subcontractor consent |
| Material containing government customer information | Government or prepared for it | Governed by the prime contract and any CUI rules | Counsel; may be excluded |

The last row is the hardest. NARA describes controlled unclassified information as information the government creates or possesses, or that others create or possess for it, where a law, regulation or government-wide policy requires or permits safeguarding or dissemination controls. Whether any of that sits in a reconciliation file is a legal question, and the [government contractor CUI guide](/industries/government-contractor-data-licensing-cui-restrictions) explains why such material is often left out entirely.

## Role card: sponsor, advisers and signer

| Role | Part they play | Can authorize? | One question to ask them |
|---|---|---|---|
| Supplier compliance director | Sponsor; knows coverage and gaps | Rarely alone | "How many years of reviews can you still follow?" |
| Subcontracts manager | Adviser on subcontract terms | No | "Do subcontracts address who owns submitted documents?" |
| General counsel or contracts counsel | Adviser with a veto in practice | Advises; often must clear | "Would customer or subcontract terms limit reuse?" |
| CEO | Signer | Yes | "Would you take a first call about licensing?" |
| Portal or IT administrator | Source of technical facts | No | "How long is closed-supplier history kept?" |

Keep the sponsor and the signer apart in your notes. Introductions fail most often when an enthusiastic sponsor is mistaken for a decision-maker. The general [guide to finding the right decision-maker](/guides/how-to-find-the-right-decision-maker-for-a-data-partnership) covers the same distinction for other companies.

## Branches that stay open until rights review

Some parts of the tree cannot be closed by the partner or by the company in a first meeting. Saying so plainly makes the introduction more credible.

- **Subcontractor consent.** Whether the subcontractor must agree before its packages can be included is a reading of the subcontract, not a guess.
- **Controlled information.** Which records contain CUI or Federal contract information is assessed record class by record class.
- **Retention versus reuse.** FAR 4.703 generally requires contractors to keep records available for 3 years after final payment. That is an audit obligation and grants no permission to reuse anything.
- **Buyer interest and offer.** Whether there is demand for reconciliation histories, and on what terms, is unknown until SourceX reviews the opportunity.

[Why data rights matter](/proof/why-data-rights-matter) explains what SourceX checks and why it checks before anything is proposed.

## Ready to introduce?

Three checks before you submit:

- **Sponsor confirmed.** The supplier compliance director agrees the records exist and will raise the idea internally.
- **Signer named.** The CEO has agreed to a first call, or the sponsor has committed to ask.
- **Company fit.** The introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English.

Partners sign the Channel Partner Agreement before submitting, and the first valid introduction within the 90-day window is credited when the company submits a verified application. If you work as a consultant through another firm, read the [subcontractor agreement guide](/guides/fractional-cfo-subcontractor-agreement) before raising the subject. Describe the records using the [system map](/guides/subcontractor-evidence-reconciliation-records-across-systems) and send the note with the [referral brief template](/resources/subcontractor-evidence-reconciliation-referral-brief-template).

## Next step

> **Refer a company. Earn up to $100,000.** Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

Once the tree ends at a CEO willing to take a call, [register as a partner](/register), confirm the contractor against [who qualifies](/who-qualifies), and read the [program terms](/terms) before you make the introduction.

## Sources

- https://www.archives.gov/cui/about
- https://www.acquisition.gov/far/52.204-21
- https://www.acquisition.gov/far/4.703
- https://refer.sourcex.si/terms