Leadership and readiness
Records that mention partners, vendors or competitors: what to check
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Third-party names in licensed data are rarely the problem on their own; the risk sits in what surrounds them. Sort each mention into one of four types: name only, confidential terms, pricing or technical detail. Name-only mentions can often stay or be pseudonymized, while partner pricing, NDA material and non-public technical detail usually need removal.
Key takeaways
- A bare vendor, partner or competitor name rarely creates an obligation; confidential content attached to it often does.
- Read the definition of confidential information and the survival clause in each NDA, supplier and partner agreement behind a mention.
- Partner pricing, rebates and discount terms are among the details most often protected by contract.
- Consistent pseudonyms such as Supplier A keep patterns across records while removing identity.
- Automated scanners find many names but not all, so pair them with human review of high-risk record families.
Is a third-party name in licensed data a problem?#
A third-party name in licensed data is usually a low-risk detail; the risk depends on what the record says about that party and under what agreement you learned it. A support ticket noting that a customer's issue came from a payment integration is different from a sales note quoting a supplier's confidential rebate schedule.
Sorting mentions by type turns an open-ended worry into a checklist. Operational records name other companies constantly, so the goal is to find the few categories that carry obligations, not to scrub every name.
| Mention type | Example in records | Where obligations come from | Usual treatment |
|---|---|---|---|
| Name only | Ticket says an issue involved a payment processor | Rarely any, unless a contract bars naming the party | Keep or pseudonymize |
| Contact person | Email thread with a named account manager at a supplier | Privacy laws and your vendor agreements | Remove personal details |
| Confidential terms | Notes on a partner's exclusivity or service levels | NDAs, partner and reseller agreements | Redact or exclude |
| Pricing | Opportunity notes quoting a supplier's discount or rebate | Supply agreements and pricing confidentiality clauses | Redact figures or exclude |
| Technical detail | Jira issue describing a vendor's non-public API behavior | NDAs, beta agreements, developer terms | Redact detail or exclude |
| Competitor commentary | Win-loss notes about a rival's product | Mostly brand and accuracy risk, not contract | Generalize names, remove opinions |
Where third-party mentions hide in operational records#
Third-party mentions concentrate in a predictable set of record families, and knowing them lets you aim review effort. Start with the systems where staff talk about other companies, not only to customers.
- CRM opportunity and win-loss notes in Salesforce or HubSpot, which often name competitors and their pricing.
- Help desk tickets in Zendesk or Intercom citing integration partners, carriers or payment providers.
- Engineering issues in Jira, GitHub or Linear that describe vendor APIs, bugs and workarounds.
- Slack or Teams channels shared with outside organizations, where partner staff write directly.
- Purchasing records in NetSuite, Epicor or Acumatica that carry supplier terms and rebates.
- Project records in Procore or Bluebeam with subcontractor RFIs, submittals and change orders.
- Supplier corrective action requests in a QMS that describe another company's defects.
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Checklist for confidential terms and pricing#
Confidential terms and pricing are the mention types most likely to be covered by an agreement you signed. The review question is not whether a record names a supplier, but whether it repeats information you received under a duty of confidence.
- Find the agreement: NDA, supply agreement, reseller or alliance agreement, or partner program terms.
- Read the definition of confidential information; many cover pricing, product plans and business terms by default.
- Check permitted use, which in most NDAs is limited to the purpose of the relationship.
- Check the survival clause, since confidentiality duties often outlast the agreement.
- Check return or destroy obligations that may already have required deleting the material.
- Note any clause that bars disclosing the relationship itself.
Why trade secret law raises the stakes#
Trade secret law raises the stakes because partner information shared under an NDA may be another company's trade secret, not just a contract term. Under 18 U.S.C. 1839(3), information qualifies as a trade secret only if its owner took reasonable measures to keep it secret and it derives value from not being generally known.
DOJ guidance lists confidentiality agreements and need-to-know access among the measures that count. A supplier that disclosed its pricing to you under an NDA was taking exactly those measures, so passing the figures to a third party may raise misappropriation questions in addition to breach of contract. Your own confidential records benefit from the same logic: licensing them under confidentiality and use limits, rather than sharing them widely without terms, can help preserve their protected status.
Checklist for technical detail and competitor content#
Technical detail about another company's product needs the same scrutiny as pricing when it came through a beta program, a developer agreement or a private integration channel. Public documentation and behavior any customer could observe carry far less risk.
| Check | Question to answer | Where to look |
|---|---|---|
| Source of the detail | Public docs, our own testing or a private channel? | Ticket history, linked emails, partner portal access |
| Agreement in force | Was an NDA, beta or developer agreement in place at the time? | Contract repository, partner program records |
| Code and configuration | Do records include a vendor's code, keys or config files? | Repositories, attachments, pasted logs |
| Competitor documents | Did anyone bring in a rival's internal material, for example from a past employer? | Sales notes, shared drives, new-hire onboarding |
| Opinions | Do notes make unverified claims about a named rival? | Win-loss notes, internal chat |
How to treat flagged mentions#
Flagged mentions get one of four treatments, chosen as the smallest change that removes the risk. Removing every name destroys useful context, while keeping everything carries other companies' obligations into the license.
- Keep: public names in harmless context, such as a ticket naming a widely used integration.
- Pseudonymize: replace names with consistent labels, such as Supplier A, so patterns survive.
- Redact: remove figures, terms, contact details or technical specifics and keep the rest of the record.
- Exclude: drop whole threads, channels or record families where confidential material runs throughout.
Can automated tools find third-party mentions?#
Automated tools find many third-party mentions quickly, but they do not finish the job. The open-source Presidio project's documentation warns that because it relies on automated detection, there is no guarantee it will find all sensitive information, and that additional protections should be used.
A practical approach is to run a named-entity scan, then match results against a list built from your vendor master, partner agreements and CRM competitor fields. Sample the output by hand in the riskiest record families, such as opportunity notes and shared channels, before signing off.
Illustrative: a distributor reviews supplier mentions#
Illustrative: a fictional industrial distributor runs Epicor for orders and purchasing, Salesforce for sales and Zendesk for customer service. It considered licensing its order exception and resolution records, which regularly named manufacturers, freight carriers and competing distributors.
The general counsel pulled the supply agreements for the manufacturers named most often and found that rebate and pricing terms were defined as confidential. The team pseudonymized manufacturer and carrier names, redacted every price, rebate and discount reference, and excluded a shared channel with one manufacturer's field engineers. Competitor names in win-loss notes became generic labels and opinions were removed.
The resulting record set kept the sequence of exception, investigation and resolution that made it useful, without carrying any supplier's confidential terms.
How SourceX handles third-party content#
SourceX handles third-party content as a rights question first and a preparation task second. In the SourceX five-step transaction, mentions of partners, vendors and competitors are assessed in the Rights step against the agreements behind them, removed or pseudonymized in Preparation, and released only after the supplier approves the prepared set.
Each treatment, from a pseudonymized supplier name to an excluded shared channel, is noted in the SourceX Evidence Packet alongside provenance, licensing rights, permitted use, the privacy record and release authorization. The reading of any specific NDA or supply agreement stays with the supplier's own counsel.
Frequently asked questions
Do we need a vendor's permission to license tickets that mention its product?
Usually not for a name alone, unless an agreement restricts disclosing the relationship. Questions arise when tickets contain information the vendor gave you in confidence, such as roadmap details, non-public API behavior or pricing. Check the agreements behind those mentions and remove or exclude the details rather than seeking permission for each one.
Are competitor mentions in sales notes a legal risk?
Mostly they are a brand and accuracy concern. A note that a deal was lost to a named rival is an ordinary business record. Risk rises when notes repeat unverified claims about a competitor or include its internal documents. Generalize names in commentary, remove opinions and exclude any competitor material with an unclear source.
What about channels shared with partners in Slack or Teams?
Treat them as higher risk. Partner employees wrote part of that content, and the partner agreement may treat it as the partner's confidential information. Many companies exclude shared channels by default and review them only when they hold uniquely useful records and the governing agreement allows it.
What if the partner agreement has expired?
Expiry often does not end confidentiality. Survival clauses can keep duties alive for a set period, or indefinitely for trade secrets, and return or destroy clauses may already have required deletion. Read the survival and termination sections before treating old partner material as free to use.
Does pseudonymizing a supplier's name remove the obligation?
It removes identity, not content. If a record still holds the supplier's confidential pricing or technical detail, a pseudonym does not change what was disclosed, and context can reveal who the supplier is. Pseudonyms suit name-only mentions; confidential content needs redaction or exclusion.
Sources
- Under 18 U.S.C. 1839(3), information qualifies as a trade secret only if the owner has taken reasonable measures to keep it secret and it derives independent economic value from not being generally known. Source
- DOJ guidance states that trade secret protective measures must be reasonable under the circumstances, citing examples such as limiting access on a need-to-know basis and requiring confidentiality agreements. Source
- Presidio's documentation warns that because it uses automated detection mechanisms, there is no guarantee it will find all sensitive information, and additional systems and protections should be employed. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.