Client-owned data vs company-owned data: a rights map for service providers

Service providers usually own their internal operating records but not the data they hold for clients. Managed service providers, 3PLs, TPAs, PEOs, agencies and call centers each have a company-owned layer and a client-owned layer, and contracts decide where the line falls.

When do you need a rights map for client data?

Use this rights map whenever you are about to introduce a company that works on its customers' data: managed service providers, 3PLs, third-party administrators, PEOs, agencies, collections shops and contact centers. The short rule: a service provider usually owns its own operating records and does not automatically own what it holds for clients. The table below shows where each type typically lands. The contract decides, so treat every row as a prompt for a question, not a conclusion.

Rights map by service-provider type

Provider type	Typically company-owned	Typically client-owned or needs consent	First question to ask
Managed service provider	Internal runbooks, ticket workflow design, finance, HR, sales	Client environment data, credentials, logs from client systems	Does the master services agreement address use of ticket content?
3PL and freight brokerage	SOPs, pricing policies, internal exception notes	Shipment contents, shipper rates, consignee details	Which fields in the TMS come from the shipper?
Third-party administrator	Corporate finance, HR, operations manuals	Member and claims records, plan sponsor data	Is any record non-PHI and non-member?
PEO and payroll bureau	Own finance, sales, internal support processes	Worksite employee records, payroll data	Do client agreements restrict secondary use?
Agency (marketing, creative, software)	Proposals, internal project management, pitch outcomes	Client assets, campaign data, customer lists	Who owns the working files at delivery?
Collections agency	Internal compliance procedures, finance	Debtor account data and creditor files	Is any record free of consumer data?
Contact center and BPO	Training content, QA scorecards, internal analytics design	Call recordings, transcripts, customer interactions	Do client contracts allow reuse of recordings?
Property manager	Own accounting, leasing process, maintenance workflow design	Owner financials, tenant records	Are tenant and owner records separate?
Architecture firm	Internal proposals, QA records, finance	Drawings, specifications, site information	Do contracts transfer ownership at delivery?

How to use the map with the template below

A map is only useful if you capture the answers consistently. Copy the notes template into your own file, fill it in from conversation, and keep it free of record contents. You note categories and the owner's answers, never the records themselves.

Add one line per category and avoid free-text descriptions of confidential material.

A sample client email asking about consent

Use this only after the owner has said the idea is worth exploring and prefers to check client terms first.

Personalize it with the company name and the specific system under discussion. Follow up in a week if you hear nothing, and stop after two follow-ups.

What the answers mean

Result	What it means	Next action
Large internal layer, clearly company-authored	Strong rights position	Run the company fit checker and introduce
Mixed, contracts silent	Rights uncertain	Ask counsel to review; introduce only if the company-owned layer stands alone
Mostly client-owned	Rights weak	Do not introduce; see poor-fit industries
Clients' consent obtained in writing	Rights improved	Tell SourceX about the consent during qualification

The guide on how to distinguish company data from data owned by its customers explains the tests in more depth, and the buy-and-build sectors guide shows where service providers appear in acquirer strategies.

Where the map breaks down

Real companies rarely fit one row. A managed service provider may run its own software products, a 3PL may sell analytics, and an agency may keep a proprietary playbook built from years of client work. In each case ask what the company created independently of any single client, and whether any contract assigns that work to the customer. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Two further checks help. First, look at how records are labeled inside the systems: a ticketing tool with a client field on every record is easier to scope than one where client details are scattered through free text. Second, ask whether the company ever signed a data-processing or confidentiality schedule that limits secondary use. Those clauses decide more outcomes than industry labels do, and the company, not the partner, should confirm them with counsel.

What never to include in any message

Confidential records, screenshots or excerpts from a client system.
Promises of payment, reward amounts or any suggestion that a deal is certain.
Claims that a company qualifies or that rights are cleared. SourceX reviews rights, and the company signs.
Statements about specific buyers. Refer to AI labs and data buyers generally.

Partners earn 25% of the eligible platform fees SourceX actually collects, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee. No reward is guaranteed.

Next step

Fill in the rights note for the next service-provider company you consider. If a clear company-owned layer exists, register as a partner and introduce it, or have the owner apply at sourcex.si/apply. The baseline is on the who qualifies page.

Step 1Share your linkSend your personal link to a company you know.
Step 2Company appliesThe company applies itself at /apply.
Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
Step 4You get your rewardYour share of SourceX fees becomes payable.

Common questions

Who owns data a service provider creates for a client?

It depends on the contract. Often the client owns data it supplies and results delivered to it, while the provider owns its own tools, methods and internal records. Agreements vary, so a rights map is a starting question list, not a legal conclusion.

Can a managed service provider license ticket history?

Possibly, if its contracts permit and client information can be removed or consented. Ticket content often contains client details, so the provider and counsel decide the scope. SourceX reviews rights and agrees redaction rules with the company before any work.

What if clients have given consent in writing?

Written consent improves the rights position, and SourceX can look at it during qualification. The consent needs to cover the intended use, which is an exclusive AI-training license for an agreed term. Counsel should confirm the wording.

Do I need to review the contracts myself?

No, and you should not. Partners give basic fit information only. The company and its counsel review its contracts, and SourceX reviews rights during qualification. Your role is to ask which categories look clear and note the answers.

Why does a service provider with many clients look attractive but fail?

Because volume is not ownership. A provider can hold years of rich records that mostly belong to its customers. Buyers need clean rights, so the screen focuses on the company-authored layer, which is often smaller than the owner expects.

Free resources

Working capital calculator — Net working capital, current ratio and quick ratio.
Due diligence checklist generator — A tailored document request list by deal type.
Cash flow calculator — A 12-month cash forecast with shortfalls highlighted.
All free tools · MCP resource center

By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09

Know a US company with valuable proprietary data?

Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.

Refer a company →

I own a business

Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.

Start an assessment