Does a company need a SOC 2 report before it can license its data?

Is SOC 2 required to license company data?

No. SOC 2 is not part of SourceX's qualification baseline, and neither is ISO 27001. A company qualifies on four things: it is a US business that reached 50+ full-time employees at peak (contractors excluded), it has several years of documented operations, it holds the rights to license its records, and an owner, CEO, CFO or other authorized representative will sponsor the process.

Security comes in later, at a specific point. Before any work on the records begins, the company agrees de-identification and redaction requirements with SourceX, and nothing is delivered until an agreement is executed and the company authorizes it. That is where a company's controls get described, whether or not an auditor has ever reported on them.

Why MSPs hear this objection first

When a client's CEO hears that operational records can be licensed to AI developers, the next call often goes to the IT provider. You run the quarterly business review, you filled in the last cyber-insurance questionnaire, and you may have scoped a SOC 2 readiness project that stalled on budget. So the question lands with you: do we need SOC 2 for this?

A confident, accurate answer keeps the conversation going. A vague one tends to end it, because the client assumes a months-long audit project stands in the way.

What SOC 2 answers and what a data license asks

A SOC 2 report is built for customers asking whether a vendor's controls can be trusted with their data. A data license asks a different set of questions, and most of them are about rights rather than controls.

The pattern is the same one behind audited financials: a formal report helps describe the company, but it is not the gate.

How existing SOC 2 work still helps

If a client has been through a SOC 2 examination or a readiness assessment, its compliance folder already holds several things the data inventory needs. Point the client's own team to these before the first call with SourceX; the company shares what it chooses, and you never pass along the records themselves.

• System inventory: the list of in-scope systems is a head start on listing where records live and how many years each one holds.
• Data classification policy: shows where customer, employee and confidential data sit, which tells everyone what will need exclusion or redaction.
• Retention and disposal schedule: reveals how far back records go and whether anything is due to be purged soon.
• Vendor list: names the SaaS tools that hold records and who administers them.
• Customer commitments: the promises the company makes about customer data, which must be read before anything customer-related goes into scope.

The last item matters most. FTC staff wrote in January 2024 that companies' promises not to use customer data for undisclosed purposes, such as training models, are enforceable whether they appear in a privacy policy, terms of service or promotional materials. A company with a polished report but restrictive customer promises may have less to license than one with no report and clean contracts. This is general information, not legal, tax or financial advice.

How to answer the client in one breath

Keep it short and factual, and do not promise an outcome.

If the client wants a quick read before a call, the company fit checker runs a preliminary, non-binding screen with no contact details required.

When the security concern is valid

Sometimes the hesitation points to a real problem. Treat these as reasons to pause or narrow the scope, not as objections to talk past.

Your role does not change in any of these cases. As the referring partner you make the introduction and share basic fit information; you never export, upload or describe confidential records, even if you hold admin credentials for the client's systems.

What the partner reward looks like for an MSP

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and the reward becomes payable only after the buyer pays and SourceX receives its fee. Rewards are not guaranteed, and the reward comes out of SourceX's fee, never out of what your client receives. The MSP partner page covers which clients in a typical book fit and how to raise the topic at a QBR.

Next step

Pick one client who asked about security and walk them through the who qualifies baseline. If they fit, register as a partner and make the introduction, or send the CEO to apply directly at sourcex.si/apply with your referral link.