How to vet an outside vendor or program before introducing portfolio companies

Before offering an outside vendor or program to portfolio companies, vet five things: who pays whom, what data is shared and when, which contract terms bind the company, what conflicts the sponsor's people have, and reputational risk. Applied to SourceX: partners never share records, nothing binds until the company signs, and rewards come from SourceX's fee.

Why vet a program before it reaches the portfolio

Vet five areas before any introduction: who pays whom, what data moves and when, what binds the company, what conflicts the sponsor's people have, and reputational fit. A program the sponsor endorses arrives carrying the sponsor's credibility. If it mishandles data or surprises a CEO with terms, the damage lands on a dozen relationships at once rather than one. A short written vetting record also answers what LPs, deal teams and portfolio CEOs ask later: who checked this, and what did they find?

This checklist is built for heads of portfolio operations and operating partners running preferred-vendor lists or portfolio-wide programs. Further down it is applied openly to SourceX, so you can see what a completed review looks like.

The vetting checklist

Money: who pays whom

Who pays the vendor, and is the price the same for every portfolio company?
Does anyone at the sponsor, or the sponsor itself, receive a referral fee, rebate or commission?
If so, does the vendor pay it out of its own revenue, or is it added to the company's cost?
What triggers any payment: the introduction, a signature or the company's own payment?
Are there minimum commitments, setup fees or charges the company pays before value arrives?

Data: what is shared, when and by whom

What does the vendor need from the company, and at which stage?
Does anything flow from the sponsor to the vendor, or only from the company?
Who decides what is shared, and can the company narrow the scope?
Do the company's existing privacy policies and customer contracts allow the proposed use?
How is data redacted, de-identified, stored and deleted?

Contract: what binds the company

Is anything binding before the company signs a definitive agreement?
Does the company keep ownership of its assets?
Are there exclusivity provisions, and what are their term and scope?
How does the company exit, and what survives termination?

Conflicts and disclosure

Have the sponsor's people disclosed any personal compensation to the company in writing?
Do fund documents or firm policy restrict compensation connected to portfolio companies?
Is any board member who would benefit stepping back from the company's decision?

Reputation and fit

Can the vendor explain its model plainly, without inflated claims?
Is participation genuinely optional for each company?
Would the deal team be comfortable seeing it in diligence at exit?

How SourceX answers the checklist

Question	SourceX answer	Where to confirm
Who pays whom?	AI labs and data buyers pay for the license; the company receives one all-in price with SourceX's fee included and no separate charges	The company's own agreement
Who pays a referral reward?	SourceX, as a share of the fee it collects; nothing is deducted from what the company receives	Program terms
What triggers a reward?	Only the buyer's payment and SourceX's receipt of its fee; an introduction or a signature alone triggers nothing	Program terms
What does the sponsor share?	Nothing beyond the introduction and basic fit information; partners never export, upload or describe records	Program terms
What does the company share, and when?	A data inventory first; data moves only after an executed agreement and the company's authorization, under redaction rules agreed beforehand	The company's own agreement
Is anything binding early?	No; nothing binds until the company agrees price and terms and signs	The company's own agreement
Who owns the data?	The company keeps ownership; the data is licensed, not sold	The company's own agreement
Exclusivity?	Deals are typically exclusive for AI training for an agreed term	The company's own agreement
Is participation optional?	Yes; each company decides for itself	How it works

Two legal points sit behind those answers. US copyright law lets an owner transfer or license specific rights while keeping others (17 U.S.C. 201), the same idea behind licensing records rather than selling them, though which rights cover a given set of records is a question for the company's counsel. And FTC staff have stated that companies' promises not to use customer data for undisclosed purposes, such as training models, are enforceable wherever the promise was made, so any portfolio company considering a license should check what its own privacy policy and terms promised.

This is general information, not legal, tax or financial advice. Each company should confirm with its own counsel before signing.

How to use the results

Result	What it means	Next action
Every answer clear and documented	Low risk to offer as an option	Add it to the optional program list and introduce company by company
Money flows or payment triggers unclear	Possible hidden cost or misaligned incentives	Get written answers before any introduction
Data flows from the sponsor	The program depends on the sponsor sharing company information	Decline, or restructure so only companies share
Binding terms before signature	An early step could commit the company	Decline until fixed
Personal compensation undisclosed	Conflict risk for the individual and the firm	Disclose in writing, or decline the compensation

Red flags in any portfolio-wide program

The vendor asks the sponsor for portfolio company data, contacts or financials.
Payment to anyone at the sponsor is triggered by introductions or meetings rather than by results.
The company's price rises to fund a referral fee.
Participation is presented as expected rather than optional.
Promised outcomes, client names nobody can verify, or pressure to decide quickly.
Terms that transfer ownership when a license would do.

Rolling it out without a mandate

Start with one company where the fit is obvious, then share the vetting record with other CEOs as an option, not an instruction. For data licensing, the baseline shortens the list quickly: US companies that reached 50+ full-time employees at peak (contractors excluded), with years of documented operations across many systems, rights to license their records and an authorized sponsor. The who qualifies page and the network opportunity finder help you shortlist, and sponsor etiquette for portfolio CEO introductions covers the handoff itself. For the wider AI agenda, see the 2026 AI value creation playbook.

Next step

File the completed checklist with your portfolio operations records. If SourceX passes your review, register as a partner and introduce the first company that fits; referral opportunities for private equity operating partners explains the program from the sponsor's side.

Step 1Share your linkSend your personal link to a company you know.
Step 2Company appliesThe company applies itself at /apply.
Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
Step 4You get your rewardYour share of SourceX fees becomes payable.

Common questions

Should portfolio CEOs see the vetting record?

Yes, in summary. A one-page note covering who pays whom, what data moves and when, what binds the company and any compensation the sponsor's people might receive lets each CEO decide with the same facts you had. It also shows that the program was reviewed before it was offered, which matters if anyone questions it later.

What should the vetting file contain?

Keep the completed checklist, the vendor's written answers to each question, the version and date of any program terms you reviewed, copies of every disclosure sent to portfolio CEOs, and a log of which companies were introduced, when and what each decided. If anyone at the firm would personally benefit, record who else signed off the review. That file answers most later questions from deal teams or LPs.

How is vetting a data licensing program different from vetting a software vendor?

A software vendor review centers on security, pricing, implementation and support. A data licensing review centers on what leaves the company: ownership, rights, privacy promises, redaction and de-identification, exclusivity and the timing of any data transfer. The company's own counsel should review the license itself, because the records, contracts and privacy commitments belong to the company, not the sponsor.

Who at the portfolio company should approve participation?

An authorized sponsor at the company, such as the owner, CEO, CFO or another authorized representative, with the company's own counsel reviewing any agreement. The sponsor firm can share its vetting record, but the decision, the contract and the data all belong to the company. Board approval may also be needed, depending on the company's governance documents.

How often should an approved program be reviewed again?

At least once a year, and sooner when the vendor changes its terms, ownership or fee structure, when a portfolio CEO raises a concern, or when a company enters a sale process. Keep the original checklist on file and note what changed, so the next reviewer can see the history without starting over.

Free resources

Referral earnings calculator — Hypothetical partner earnings with the per-company cap.
Cash conversion cycle calculator — DIO, DSO, DPO and the cash conversion cycle.
Operational data inventory builder — List systems, record types, years held and owners.
All free tools · MCP resource center

By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09

Know a US company with valuable proprietary data?

Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.

Refer a company →

I own a business

Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.

Start an assessment