IT and finance due diligence request list items that reveal licensable records

Why read a diligence request list for data value?

A standard IT and finance diligence request list already asks for the documents that show whether a company's records could be licensed: the application inventory, retention and deletion settings, the list of retired platforms, privacy notices and data processing terms. The annotations below show how to read each answer twice, once for risk and once for value, without adding a single request for actual records.

For transaction advisors this is a cheap second use of work already in the plan. A company being sold, recapitalized or refinanced can hold years of operational history nobody has priced. On the sell side, spotting it early gives the owner an additional source of proceeds to pursue on its own timetable. On the buy side, the same answers tell the acquirer whether a value creation lever exists after closing.

The annotated request list

Each item is an ordinary diligence request. The note after it says what the answer reveals about licensing fit.

Systems and architecture

• Application inventory with owners, start dates and user counts. Companies with strong records often run 10-15+ systems, and start dates show how far back the history goes.
• Retired, replaced or archived systems, and where their data now sits. Archived platforms can add years of history, provided an export survived.
• Integration and data flow map. Connected systems, such as CRM feeding ERP feeding the support desk, let records be linked into complete workflows.
• Email and collaboration tenancy details with retention settings. These show whether years of email and chat still exist or are purged on a schedule.
• Admin roles for each major system. Someone inside the company must be able to run exports; if nobody can, licensing stops there.

Records management and retention

• Records retention schedule and deletion policy. Short auto-delete windows cap the history available.
• Legal holds currently in force. Held records are preserved but may be off-limits for other uses until the hold lifts.
• Backup and archive policy, including the oldest restorable backup. Shows whether gaps in live systems could be filled.

Contracts, privacy and rights

• Customer contract templates and material contracts, especially data and confidentiality clauses. If clients own the deliverables or the records, the company may not be able to license them.
• Vendor and SaaS terms, including data export rights on termination. Confirms the company can get its own history out.
• Current and prior privacy policies and terms of service, with change dates. What the company promised about data use governs what it can license.
• Employee and contractor IP assignment agreements. Shows who owns material created by people who were not employees.
• Call recording notices and consent practices. Recordings are usable only where proper notice was given.
• Existing data licensing or data sharing agreements, especially for AI training. A prior AI-training license on the same records is a conflict.

Finance and operations

• ERP migration history: what moved to the new system and what stayed behind. Left-behind detail is often the deepest record of how the business ran.
• Audit PBC lists and response histories for recent years. The note on audit PBC request lists and response histories explains why these finance workflows have value in their own right.
• Headcount by year, with full-time staff and contractors shown separately. The licensing baseline counts full-time employees at peak, not contractors.
• Ticketing, project and CRM volumes by year. Volume plus outcome fields (resolved, escalated, won, lost) indicate depth.

The privacy item deserves a closer read. FTC staff have said that companies' promises not to use customer data for undisclosed purposes, such as training models, are enforceable wherever they were made (FTC staff, January 2024), and that adopting more permissive data practices through a quiet, retroactive change to terms or privacy policies may be unfair or deceptive (FTC staff, February 2024). Both are staff guidance, not rules, but they explain why the history of a company's privacy promises matters as much as the current version.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

What should you never request for licensing purposes?

Diligence exists for the transaction. Keep licensing out of the data room.

• Do not ask for sample records, exports or extracts to judge licensing value. Any licensing review happens later, between the company and SourceX, under its own agreement.
• Do not repurpose data-room material. Information shared under a deal NDA is usually limited to evaluating the transaction; raise licensing only with your client's permission and through the company's leadership.
• Do not describe the target's records to anyone outside the deal team.
• Do not let licensing questions slow the deal. One note in the cover memo is enough.

A referral partner's job ends at the introduction and a few basic fit facts. De-identification and redaction rules are agreed with the company before any work starts, and nothing is delivered without an executed agreement and the company's authorization. The CFO-side companion, due diligence questions to ask a data licensing platform, covers what the company should ask SourceX.

How do you use the results?

The who qualifies page sets out the full baseline. When a CFO objects mid-deal that the team has no capacity, the page on finance team bandwidth for a licensing project is the one to share.

Red flags to record

• A court, trustee or assignee controls the assets and has not been involved.
• Records were generated with AI in order to sell them.
• Nobody inside the company can export the data.
• The owner will not consider an exclusive license for an agreed term; the page on exclusive license opportunity cost explains why that matters.
• The data is mainly protected health information, such as medical records or claims, with no authorization or de-identification in place.

When should licensing come up in the deal timeline?

If you hold a securities registration or a professional license, check its rules on referral compensation and disclosure with your compliance team before taking part.

Next step

Add these annotations to your next request list template. When a target or client shows strong signals and the owner is interested, register as a partner and introduce the company's owner, who can also apply at sourcex.si/apply through your referral link. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, paid only after the buyer pays and SourceX receives its fee.