How we handle the legal side of licensing data.

Consent and ownership

Before any offer, we review whether your company has the right to license the data. That includes data about your own customers and your employees.

We look at your customer contracts, privacy notices and employee policies, and we leave out any data you don't have the right to share. You confirm ownership in writing.

Platform terms

Data often comes from tools such as Zendesk, Gong, Salesforce or GitHub. Each tool has its own terms about how exported data can be used.

We check the relevant terms for each source during review. If a tool's terms restrict a use, that data is excluded or the deal is scoped to fit.

Call recordings and consent

Some US states and other countries require every person on a call to agree to it being recorded. Recordings are only considered when the right consent was in place when they were made.

Where consent is unclear, recordings are left out or limited to text with personal details removed.

HIPAA (healthcare administration)

Health information covered by HIPAA is not licensed in identifiable form. For healthcare administration data, we require HIPAA de-identification, using either the Safe Harbor method or an expert determination, before the data is used or shared. SourceX de-identifies it, directly or through its processing partner, and for protected health information only through a HIPAA-permitted route counsel confirms.

CCPA and GDPR

Where California or European privacy law applies, we review the legal basis for sharing, respect individuals' rights requests, and use de-identified data. Data covered by GDPR is only included when there is a valid legal basis and the right transfer safeguards.

De-identification standard and verification

As the signed agreement specifies, SourceX de-identifies the data, directly or through its processing partner, before it is used or shared: personal details such as names, emails, phone numbers and account numbers are removed or replaced. The method used is recorded for each dataset.

No method is perfect, so de-identification reduces risk but can't remove it entirely. The supplier agreement records this directly: re-identification may still be possible using the deidentified data alone or combined with other sources, and SourceX is not liable for it.

SourceX's customers

SourceX may sublicense or distribute the deidentified dataset to its own customers. What they may do with it is set in SourceX's agreements with them, which suppliers are not party to.

Under the supplier agreement, neither SourceX, its affiliates nor its customers have any obligation to untrain, delete, modify or stop operating an AI model or system built from the deidentified data.

What SourceX is licensed to do

SourceX is not a model developer, but it is not a neutral courier either. Under the signed supplier agreement, once data is selected and deidentified, SourceX holds a perpetual, sublicensable license to use that deidentified dataset — including to train and evaluate AI models and tools operated by SourceX and its customers, to build it into SourceX products, and to distribute or sublicense the dataset itself.

Those rights survive termination of the agreement once the fee has been paid. The supplier keeps ownership of the underlying licensed data throughout. The terms of each deal, including exclusivity and how far model rights extend, are set in that signed agreement rather than on this page.