What a fractional CFO may disclose about a client under a confidentiality agreement
Under a typical consulting NDA, a fractional CFO should treat even the client's name and the existence of the engagement as confidential unless the agreement says otherwise. For a SourceX introduction, get the owner's written permission first, then share only the company name, a size band and the sponsor's contact. Financials, records and system contents stay out.
The short answer: your NDA governs, and the owner's permission comes first
A fractional CFO may disclose only what the confidentiality agreement allows, and most consulting NDAs define confidential information broadly enough to cover the client's financials, systems and plans, and often the engagement itself. The safe rule for an introduction is simple: ask the owner first, share only what they approve, and never pass on records.
A SourceX introduction is designed to fit inside that rule. It needs the company's name, a rough size band and a sponsor contact the owner has agreed to share. It never needs financial statements, exports, screenshots or samples from you.
What typical NDA clauses mean for an introduction
| Clause | What to read | Effect on an introduction |
|---|---|---|
| Definition of confidential information | Whether it covers all non-public information, and whether the existence of the engagement is included | If the engagement itself is confidential, even naming the client needs consent |
| Purpose or permitted use | Whether information may be used only to perform the services | A paid introduction may fall outside the purpose without consent |
| Permitted recipients | Whether disclosure is limited to your staff or representatives bound by similar duties | A referral program is not your representative; treat it as a third party |
| Exclusions | Information that is public, already known or independently developed | A company's name and approximate size may be public; its records never are |
| Consent mechanics | Whether consent must be written and who can give it | Get an email from someone with authority, not a verbal nod from a manager |
| Non-circumvention | Limits on using the client's contacts or opportunities for your own benefit | Read closely; some clauses reach introductions you would consider harmless |
| Survival | How long duties last after the engagement ends | Former clients usually remain covered |
What SourceX needs from you, and what stays out
| Share, with the owner's permission | Never share |
|---|---|
| Company name and website | Financial statements, forecasts, budgets or bank details |
| US location and whether it reached 50+ full-time employees at peak (contractors excluded) | Customer, vendor or employee names and details |
| The sponsor's name, role and contact details | Exports, screenshots or samples from any system |
| How you know the company | Credentials, access or administrator details |
| Categories of systems in use, only if the owner agrees | Debt terms, covenant positions, sale plans or disputes |
The cleanest route avoids disclosure altogether: send the owner your referral link and let them apply at sourcex.si/apply themselves. Your referral code travels with the application, and the company decides what to tell SourceX. Before that, you can test fit privately with the company fit checker, which asks for no contact details.
How it applies in common situations
| Situation | What to check | Safe course |
|---|---|---|
| Current client with a broad NDA | Definition, purpose clause and consent mechanics | Written consent from the owner before you name the company |
| Former client | Survival period and any non-circumvention clause | Consent from someone who can still authorize it |
| You subcontract through a fractional CFO firm | The firm's master agreement with the client and your agreement with the firm | Permission from both the firm and the client |
| Sponsor-backed client | Confidentiality terms with the private equity sponsor as well as the company | The sponsor's policy on third-party introductions |
| Client asks you to send sample data to test fit | Your NDA, and the program rule that partners never handle records | Decline; the company works directly with SourceX on its inventory |
| You hold a CPA license | Professional confidentiality duties on top of the contract | Your state board's rules and your firm's policy |
The second layer: what the client promised its own customers
Your NDA protects your client. Your client's privacy policies, terms of service and contracts protect its customers, and those promises limit what the company itself may license. In a January 2024 FTC staff post, FTC staff warned that when a company promises not to use customer data for undisclosed purposes, such as training AI models, that promise can be enforced, whether it sits in a privacy policy, terms of service or marketing materials. It is staff guidance rather than a rule, but it shows why that review matters. The review belongs to the company, its counsel and SourceX after the introduction; your role is to flag it, not to assess it.
What stricter professions do with client identity
Lawyers work under some of the tightest confidentiality rules, and their ethics opinions are a useful benchmark. The Illinois State Bar Association's Advisory Opinion 12-03 treats a client's identity as confidential and says client consent is needed before a lawyer shares a client's name in a networking referral arrangement. It does not bind CFOs, but it marks where a careful line sits: consent before naming.
A clean consent process
- Raise the idea with the owner in a regular meeting; the annual client advisory meeting agenda has a natural slot for it.
- Follow up by email stating exactly what you would share, with whom and why, and that you may receive a referral reward from SourceX.
- Get a written yes from someone with authority, and file it with the engagement records.
- Send your referral link, or submit only the approved fields through the referral form.
- Keep working papers, including any finance systems inventory you built for the engagement, inside the engagement. They are the client's information, not referral material.
Questions to ask your counsel
- Does my NDA treat the existence of the engagement as confidential?
- Is a paid introduction a permitted use of what I learned?
- Does a non-circumvention clause cover introductions to service providers?
- What form of consent does the agreement require, and from whom?
- Do my professional rules require disclosure of referral compensation?
This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.
Next step
Read your standard NDA once with these clauses in mind, then adjust your consent email. When an owner says yes, register as a partner and send your referral link. The fractional CFO referral playbook covers which clients to consider first, and the CFO checklist for evaluating a data licensing agreement helps once the company decides to proceed.
- Step 1Share your linkSend your personal link to a company you know.
- Step 2Company appliesThe company applies itself at /apply.
- Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
- Step 4You get your rewardYour share of SourceX fees becomes payable.
Common questions
Can I tell SourceX a client's name without asking first?
Treat the answer as no unless your agreement clearly allows it. Many consulting NDAs cover the existence of the engagement, and naming a client to a third party for a paid introduction sits outside the usual purpose clause. Ask the owner and get a written yes, or send them your referral link so they apply themselves.
Do I have to tell the client that I may earn a referral reward?
Disclosing it in writing is good practice for every advisor, and some professional rules require it in certain situations, so check yours. Put it in the consent email: who pays, that the reward is a share of SourceX's fee rather than a deduction from the company's proceeds, and that the client is free to decline.
Can I share a client's list of systems to check whether it qualifies?
Not without consent. Use the company fit checker, which needs no contact details, to form your own preliminary view. If the owner agrees to an introduction, category-level information such as which kinds of systems the company uses can be shared with permission. Exports, screenshots and record samples never come from the partner.
What if my NDA has a non-circumvention clause?
Read it closely. Non-circumvention clauses usually stop you from using the client's contacts or opportunities for your own benefit without consent, and a paid introduction can fall within that wording. Written consent from the owner normally addresses the concern, but counsel should confirm how your specific clause reads before you act.
Who protects the company's records after the introduction?
The company and SourceX, under their own agreements. De-identification and redaction requirements are agreed with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization. The referring CFO is not part of the inventory, review or delivery and never receives copies of the records.
Related pages
Free resources
- SDE vs EBITDA calculator — Seller's discretionary earnings next to market-rate EBITDA.
- IRR calculator — Internal rate of return on annual cash flows.
- Business valuation calculator — Enterprise and equity value from EBITDA, your multiple, cash and debt.
- All free tools · MCP resource center
By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09
Know a US company with valuable proprietary data?
Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.
Refer a company →I own a business
Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.
Start an assessment