The short answer: three layers, and the strictest wins
What a referral partner may share depends on three sets of obligations at once: the confidentiality clause in the referral agreement, your own duties to the client (engagement letter, NDA, professional rules), and the company's commitments to its own customers and staff. Whichever is strictest sets the limit.
For SourceX introductions the line is deliberately narrow. With the company's permission, a partner passes on the company name, the sponsor's name and contact details, a rough headcount band, how long the company has operated and its industry. Everything else, from revenue to records, stays with the company until it decides to share it with SourceX directly.
What a typical confidentiality clause covers
Most referral agreements borrow their confidentiality language from a standard mutual NDA. The elements below appear in some form in most of them.
| Clause element | What it usually says | What to check |
|---|---|---|
| Definition | Non-public information one party discloses to the other, often whether or not it is marked | Whether it covers information about referred companies as well as the program's own terms |
| Exclusions | Information already public, already known, independently developed or lawfully received from someone else | That the exclusions are mutual and cover what you knew before signing |
| Use restriction | Information may be used only to perform the agreement | Whether you can still use general program knowledge in client advice |
| Permitted recipients | Employees and advisers with a need to know, bound by similar duties | Colleagues at your firm and your own counsel |
| Duration | Obligations last for a set period after termination | How long, and whether trade secrets are carved out to last longer |
| Compelled disclosure | Notice before disclosing under subpoena or court order | The notice process and who to contact |
| Return or destruction | Materials returned or deleted on request or termination | How this applies to email threads and CRM notes |
| Personal data | Contact details used only for the introduction | That sponsor contact details are handled as personal information |
Read the clause in the program terms together with the payment, attribution and termination sections; the referral partner agreement checklist walks through those.
What do professional rules say about sharing a client's name?
For many licensed professionals, the client's identity itself is confidential, so even a name needs consent. The rule comes from your profession and state, not from the referral agreement.
Lawyers are the clearest example. In Advisory Opinion 12-03, the Illinois State Bar Association concluded that a client's identity is confidential information, so a lawyer needs the client's consent before sharing the client's name with a networking group, and that a reciprocal referral arrangement with nonlawyer professionals must be non-exclusive with the client informed. Other states have their own opinions and versions of the rules.
Accountants, bankers, registered representatives, receivers and consultants each work under their own codes, engagement letters and firm policies. Check them before you name anyone.
The company's own promises matter too. FTC staff wrote in January 2024 that companies' commitments not to use customer data for undisclosed purposes, such as training or updating AI models, are enforceable whether they appear in privacy policies, terms of service or marketing. A partner cannot know what a company promised its customers, which is one more reason partners never describe a company's data. Those commitments are reviewed between SourceX and the company during the rights review.
The SourceX line: what a partner may share
| Information | Share with SourceX? | Condition |
|---|---|---|
| Company name and website | Yes | After the company agrees to be introduced |
| Sponsor's name, title and work email | Yes | With the sponsor's agreement |
| Headcount band at peak, such as 50-100 or 200-500 full-time | Yes | A rough band only |
| Years operating and status (operating, acquired or wound down) | Yes | Public or approved by the company |
| Industry | Yes | General description |
| Which systems hold which records | No | The company describes this in its own data inventory |
| Revenue, margins, customers, sale plans | No | The company may share directly under its own terms |
| Records, exports, screenshots or sample files | Never | Not under any circumstances |
| Anything told to you in confidence | No | Unless the company itself chooses to raise it |
How the rules apply in common partner situations
| Situation | What to check | Typical outcome to confirm |
|---|---|---|
| Sell-side M&A advisor with a signed engagement | Engagement letter and any process NDAs | Written client consent before naming the company; no mention of the sale process |
| CPA firm or fractional CFO | Engagement letter, your confidentiality rule and state board rules | Client consent before naming them; referral fee rules checked separately |
| Lawyer | Your state's confidentiality and referral rules | Client consent before sharing even the name |
| Commercial banker | Your bank's customer information policy and code of conduct | Whether the bank permits outside introductions at all |
| PE operating partner | Portfolio company confidentiality and fund obligations | The portfolio CEO agrees before any introduction |
| Receiver, trustee or assignee | The court order and estate counsel | Whether the court must be told about the introduction |
| ERP, CRM or IT consultant | Statement of work and data processing terms | Introduce the executive only; never use your system access |
| Someone you met at an event | No formal duty, but trust is at stake | Ask before passing on their name |
Disclosure and consent good practice
- Get the company's yes before you submit it. Alternatively, send the sponsor your referral link so the company applies itself at sourcex.si/apply and controls what it shares, while your credit is preserved.
- Tell the company in writing that you may receive a reward; the referral fee disclosure letter template gives you the wording.
- Keep a short consent record: the date, who agreed and exactly what you passed on.
- If the company offers you files, decline and point it to SourceX. De-identification and redaction rules are agreed with the company before any work begins, and data moves only after an executed agreement and the company's authorization.
- Draft the introduction itself with the introduction email builder and keep it to fit facts.
Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and the reward is paid only after the buyer pays and SourceX receives its fee. Confidentiality is one question; whether you may be paid at all is another, covered in is a finder's fee legal.
Questions to ask your counsel or professional body
- Does my engagement letter or NDA with this client restrict naming them to a third party?
- Does my profession's confidentiality rule treat the client's identity as confidential?
- Does my firm require written client consent before any outside introduction?
- Must I disclose referral compensation, and in what form?
- Does the referral agreement's confidentiality clause conflict with any of my existing duties?
- How long should I keep records of consent and disclosure?
If your firm runs a formal review, the compliance review checklist lists what compliance teams ask.
This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.
Next step
Check your engagement letters for confidentiality and consent terms, then register as a partner and introduce only companies that have agreed to it. A company you have in mind can be screened against the who qualifies baseline, which looks for 50+ full-time employees at peak (contractors excluded), a multi-year operating history, clear rights over the company's own records and an owner or executive able to sponsor the deal.