Confidentiality in Defect Data: Designs, Customers and Suppliers

Why defect data is more sensitive than it looks

A picture of a scratch on a housing looks harmless. It also shows the housing: its geometry, material finish, features, part markings and the fixture it sits in. A rejected-lot record shows who supplied the resin, which customer's order was affected, how often, and what tolerance the customer demands. Put together, a defect archive describes a product line and the commercial relationships around it.

Manufacturers rarely own all of that. A contract manufacturer often makes parts to a customer's drawing, under a supply agreement that treats designs and quality data as the customer's confidential information. A component maker may be bound by non-disclosure terms with its suppliers. The company holding the images is therefore frequently not the only party whose permission matters.

This page covers the licensing and delivery diligence for that situation. Image and report content are discussed in nonconformance reports and inspection report text paired with images. General license clauses for training data are in licensing terms for robotics training data. This is not legal advice; contract and intellectual property questions belong with counsel.

What information is at risk

Reference imagery needs particular care; see golden samples and reference images, since these are often the most revealing frames of a design.

Who can grant what

Ask for a plain statement of the supplier's rights position, per source:

• Owned outright. The supplier designed the part and captured the images with its own equipment and staff.
• Customer-owned designs. The supplier took the images, but the part is a customer's design and the supply agreement restricts disclosure. Customer consent, or a carve-out, is usually needed.
• Third-party content. Images or text from standards bodies, vendors' manuals or inspection firms.
• Employee-captured. Photos and video made by staff; employment terms and individual consent come into play where people are identifiable.

The U.S. Copyright Office's pre-publication report on generative AI training, released 9 May 2025, covers where copying in AI development may implicate rights and examines licensing options (U.S. Copyright Office, 2025). It is a policy analysis, not a ruling, and it is not specific to manufacturing records; it does not decide who can license a customer's part images. A buyer's counsel should look at contracts, not only copyright, because confidentiality duties often arise from agreements rather than from copyright law.

Clause topics to expect

Terms are for counsel to draft. Topics that commonly matter for defect data:

• Scope of use. Training, evaluation, internal research; whether resale, sublicensing or release of model outputs is allowed. The site's licensing terms page and the guide on how to license proprietary data for AI training give general background.
• Exclusions. Parts, customers or product lines the supplier withholds.
• Third-party consent warranties. Whether the supplier states that it has obtained permissions, and what happens if it has not.
• Confidentiality of the data itself. Storage, access limits, personnel, audit rights and breach notice.
• Derivative models. Whether models trained on the data may leak design features, and whether the supplier requires evaluation for memorization.
• Return or deletion. What happens to data at term end, and whether trained models survive.
• Indemnities and limitation of liability. Allocation of risk if a customer objects.
• Attribution and publication. Whether the buyer may name the data source or publish results.

Nothing is contracted until a supplier agrees, and a license can only grant what the supplier is permitted to grant.

Reducing exposure before delivery

Preparation can narrow what is disclosed. It cannot make an unpermitted disclosure permitted.

1. Field removal. Strip customer, supplier and part-number fields; replace with codes.
2. Image treatment. Mask nameplates, labels and background fixtures; crop to the defect area where context is not needed. Cropping and masking reduce training value when a model needs to see part geometry or markings, so decide per use case.
3. Product-family exclusions. Remove parts under the strictest customer agreements.
4. Sampling. Release a reviewed subset first.
5. Controlled access. Where the supplier requires it, deliver to a restricted environment with logged access instead of transferring files. Buyers should ask whether this is acceptable for their training pipeline.

Faces, hands, badges and voices bring a separate set of questions; see worker consent and identifiable people in workplace recordings.

Illustrative confidentiality screening record

# Illustrative: synthetic screening of a defect-image batch
batch: lineB_2025Q1
images: 4000
screen:
  customer_designed_parts: "to be confirmed per part family"
  restricted_by_contract: [family_X, family_Y]    # synthetic
  nameplates_visible: "sampled; 7% of images"
  people_visible: "sampled; hands only, no faces"
decision:
  license_scope: [family_Z]
  fields_removed: [customer_name, supplier_lot, drawing_number]
  third_party_consent_needed: [family_X]
  delivery: "files | restricted_environment"

Limitations

The cleaner the data is made, the less it may resemble production. Masked geometry weakens detection on that geometry. Withholding the strictest customers' parts may remove the very defects you need. And no preparation step lets a supplier grant more than it holds.

Consent from a customer can take time, may be refused, and may come with its own restrictions or review rights. Some archives will simply not be licensable. That is a valid outcome of diligence rather than a failure of it.

Delivery mechanics and records

Confidentiality is managed through the whole delivery chain, not only in the contract. Agree how data moves: encrypted transfer, delivery of a reviewed subset, or access in a restricted environment. Agree who within the buyer can access it, how copies are tracked and how deletion is evidenced at the end of the term. Keep a record of what was delivered, in what form, with which fields removed, so that if a customer objects you can show exactly what left the supplier.

Plan the review step. A common sequence is: the supplier selects candidate part families, its quality and legal staff screen them for customer restrictions, the buyer receives a small sample to test usefulness, and only then is the full batch prepared. Screening a sample first finds problems cheaply, such as nameplates that appear in half the images.

If inspection firms produced the material, confirm who holds rights in photos and reports; see third-party inspection firms as suppliers. Their client agreements often reserve rights to the client, which means the firm may not be the right party to license.

Questions to ask suppliers

• Who designed the parts shown, and under what agreements were they made?
• Do your customer or supplier agreements restrict disclosure of designs, images or quality data?
• Have you asked for, or do you hold, customer permission, and in what form?
• Which fields and image regions can be removed, and has that been tested on a sample?
• Are any images from inspection firms, vendors or standards documents?
• Who at the company can sign for the license, and have legal and quality teams reviewed it?
• What delivery controls do you require, such as restricted access or limited retention?
• What happens if a customer objects after delivery?

Discuss your requirements

If you plan to license defect data and need confidentiality questions asked early, explore sourcing and licensing options with SourceX. SourceX looks for US businesses that hold suitable material, checks the data and the supplier's licensing permissions, agrees pricing and allowed uses in a license, and coordinates delivery and payment. Nothing is contracted until a supplier agrees, and a request does not guarantee a match. Start from the humanoid training data guide or the inspection, defect and failure data hub.

Explore sourcing and licensing options with SourceX

Sources

• Copyright and Artificial Intelligence, Part 3: Generative AI Training (pre-publication version) — U.S. Copyright Office report on AI training, rights and licensing options.