Trust center
Trust, security, and data diligence.
SourceX sources, contracts and manages enterprise data licensing transactions. This page lists the controls in place today, and how buyers can request documentation.
Compliance status
SOC 2 Type II
In progressReport not yet issued.
ISO/IEC 27001
In progressCertification not yet issued.
Controls in place today
These controls are built into how every SourceX transaction runs today.
Organization-level access
Companies only see their own records.
Private storage, short-lived links
Supplier files sit in private storage and are shared only through links that expire within minutes.
Agreement before delivery
Nothing is delivered until an agreement is executed and the supplier approves the terms.
Explicit buyer access
Buyer access to delivered files is authorized explicitly for each delivery.
Full audit trail
Every status change is recorded with who made it and when.
Terms locked per offer
Commercial terms are locked into each offer when it is made.
Planned
- Dedicated secure data rooms for buyer review
- Assisted data-preparation tooling
- Independent security assessments
- Direct connectors to common source systems
How we handle sensitive data
- 1
Scope
The supplier decides which systems, records and date ranges are in scope. Everything else stays out.
- 2
Rights review
We confirm the supplier owns the original records and can license it, including any customer or vendor contract limits.
- 3
Preparation
The supplier prepares the data and removes excluded content, or SourceX arranges preparation through a vetted partner as a paid service once a deal is agreed. SourceX reviews the result against the agreed scope.
- 4
Diligence packet
Source, rights, preparation and allowed use are documented for the buyer's review.
- 5
Approval and agreement
The supplier approves the offer and signs the agreement before anything moves.
- 6
Supplier authorizes release
Data is released only after the supplier's explicit authorization, through expiring links or the supplier's own storage.
Incident response and business continuity
Incident response
Suspected security issues are triaged by the SourceX team, affected access links can be revoked immediately, and affected suppliers and buyers are notified. Our full incident escalation process is shared on request.
Business continuity
Transaction records, agreements and audit history are held in managed cloud infrastructure with automated backups. Our business continuity overview is shared on request.
Privacy policy
How we collect and use personal information on this site and in our services.
Subprocessors
List available on request. Use the form below.
Security contact
Email hello@sourcex.si or use the “Contact our security team” form below. Requests are answered within 2 business days.
Our security roadmap
SOC 2 Type II
Report not yet issued
ISO/IEC 27001 certification
Certification not yet issued
These initiatives are in progress. SourceX has not yet received a SOC 2 Type II report or ISO/IEC 27001 certification.
Procurement resources
Security questionnaire responses, business continuity overview, incident escalation process, contract templates and a DPA where applicable are shared privately after review. Only approved materials are released.
Dataset diligence packets are prepared per dataset. Rights, privacy processing and quality differ between datasets.
Data commonly sourced from
- Zendesk
- Intercom
- Salesforce Service Cloud
- Salesforce Sales Cloud
- HubSpot
- Microsoft Dynamics 365
- GitHub Enterprise
- GitLab
- Bitbucket
- Microsoft SharePoint
- Google Drive / Workspace
- OneDrive
- NetSuite
- QuickBooks Online
- Xero
Compatible with exports and records from these platforms. Names are shown for reference only and do not imply a partnership or endorsement.
Request security documentation
Sensitive reports and internal policies are released only to signed-in accounts, after a SourceX administrator approves the request. Access links expire.