Rights and contracts
How to find data-use restrictions across hundreds of customer contracts
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
To find data-use restrictions across hundreds of customer contracts, sort them by template family, review each template version once, and then search customer-paper agreements, amendments and addenda for a fixed list of data terms. Record every finding in a clause inventory keyed to customer account IDs, so restricted accounts can be excluded from any licensed dataset.
Key takeaways
- Contracts on your own paper share template versions, so review each version once and map accounts to it.
- Customer paper, amendments and data addenda need full review because they can override your standard terms.
- A fixed search-term list across ownership, use limits, carve-outs, AI terms and confidentiality surfaces the clauses that matter.
- A green, amber and red triage lets counsel spend time on the ambiguous contracts.
- Key the clause inventory to the account IDs used in your CRM and helpdesk so exclusions can be automated.
Where do the contracts actually live?#
Customer contracts in a company with years of history rarely live in one place. Assemble a complete set before anyone reads a clause, because a missed amendment or side letter can reverse what the master agreement says.
Then reconcile the contract set against your customer list. Pull every account from the CRM or billing system, including churned accounts, and flag any customer with records in your helpdesk or ERP but no contract on file. Those accounts default to Amber until a signed agreement or an accepted terms version is found.
- The contract management system, if one exists, including expired agreements.
- E-signature accounts such as DocuSign, which often hold executed copies no one filed.
- CRM attachments on account and opportunity records in Salesforce or HubSpot.
- Shared drives and email, where side letters and redlines tend to sit.
- Clickwrap acceptance logs showing which version of online terms each customer accepted.
- Archives from acquired companies, which may carry their own templates.
Sort contracts by paper before reading clauses#
Sorting contracts by paper, meaning whose template each one started from, shrinks the review before anyone reads a clause. Contracts on your own standard terms share wording, so each template version needs one careful review, after which you only need to know which accounts signed which version.
The remaining work concentrates where wording varies: customer paper, negotiated redlines and the addenda and order forms that sit on top of a master agreement.
| Contract family | Review approach | Typical restriction risk |
|---|---|---|
| Your standard terms, by version | Review each version once; map accounts to versions | Low to moderate; depends on each version's data clause |
| Online terms accepted by clickwrap | Review each version; use acceptance logs for mapping | Usually low if the terms include a usage data clause |
| Negotiated redlines of your terms | Search only the changed sections | Moderate; customers often strike data clauses |
| Customer paper | Full search and read | Highest; customer drafts tend to restrict use |
| Data processing and security addenda | Read purpose and use sections closely | High; may limit processing to providing the services |
| Order forms, statements of work, side letters | Search for override language | Variable; can quietly change the master terms |
Search terms that surface data-use clauses#
A fixed search-term list, run across every contract, catches clauses that template mapping misses. Group the terms so reviewers know why each hit matters, and add the defined terms each template actually uses.
Scanned PDFs need text recognition before any search will work, and older contracts may use different vocabulary, such as information or materials where newer ones say data. Where your tool supports it, proximity searches, such as data within a few words of solely, cut down false hits.
- Ownership: customer data, owns, exclusive property, all right, title and interest.
- Use limits: solely, only for the purpose of, to provide the services, no other purpose.
- Carve-outs: aggregate, aggregated, anonymized, de-identified, usage data, statistical.
- Improvement rights: improve the services, product improvement, feedback, analytics.
- AI terms: machine learning, artificial intelligence, train, training, model, generative.
- Confidentiality: confidential information, return or destroy, survive, residuals.
- Disclosure: third party, disclose, affiliates, subcontractor, subprocessor.
- Privacy roles: processor, service provider, business purpose, sell, share.
How to triage the hits#
Triage sorts each contract into a tier that decides what happens to that customer's records. The aim is to spend counsel's time on ambiguous contracts rather than on clear ones.
Record the reason for every Amber and Red decision. Buyers and future reviewers will ask why an account was excluded, and the answer should not depend on anyone's memory.
Treat improvement rights with care. A clause letting you use customer data to improve your own services is common in software contracts, but it rarely reads as permission to license records to a third party, so counsel should decide those contracts rather than marking them Green.
| Tier | Typical language | Action |
|---|---|---|
| Green | Your paper with a right to use aggregated or de-identified data and no AI prohibition | Include after preparation |
| Amber | Silent on data use, a confidentiality clause that may cover the records, or a right to use data only to improve your own services | Counsel review; include, exclude or seek consent |
| Red | Customer owns all data, use solely to provide the services, or an express ban on AI training | Exclude by account ID |
Build a clause inventory keyed to accounts#
A clause inventory is a spreadsheet or database with one row per contract and the fields needed to act on it. Its most important column is the customer account ID, because that is what turns a legal conclusion into an exclusion rule in an export.
Feed Red and pending Amber account IDs into the export filters so excluded records never leave the source systems. Re-run the mapping before each new package, since new contracts and amendments keep arriving.
- Customer legal name and account IDs in the CRM and helpdesk.
- Contract ID, family, template version, and effective and end dates.
- Relevant clause excerpts and the search terms that found them.
- Tier, reviewer, review date and reason.
- Record systems affected, such as Zendesk organizations or NetSuite customer records.
Can AI contract review tools do the first pass?#
AI contract review tools can do much of the first pass: extracting clauses, clustering contracts by template and flagging likely data terms. They are most reliable on contracts that share wording and least reliable on unusual customer paper.
Two cautions apply. Tools can miss clauses in poor scans or summarize them wrongly, so a person should confirm every Red and Amber finding. And customer contracts are themselves confidential, so run any tool under an agreement that bars the vendor from training on your documents.
A workable division of labor is to let the tool propose a tier and a clause excerpt for each contract, have a paralegal confirm Green findings by sampling, and have counsel confirm every Amber and Red finding in full.
Illustrative: a scheduling software company reviews its base#
Illustrative: a fictional workforce scheduling software company serving restaurant groups wants to license support tickets and in-app feedback linked to product changes. It has several generations of its master agreement, online terms for small customers and a group of enterprise customers on their own paper.
The general counsel maps accounts to template versions using Salesforce and the clickwrap logs. The newest master agreement includes an aggregated and de-identified data clause, so those accounts are Green. An older version is silent, so its accounts go to Amber. A handful of enterprise contracts limit use to providing the services, and one bans AI training outright, so those accounts are Red.
The Zendesk export filters on organization IDs from the inventory. Counsel works through the Amber group in parallel, and the first package draws only on Green accounts.
How SourceX fits into contract review#
In the SourceX five-step transaction, contract review belongs to Rights, the stage that follows Supply. SourceX works from the supplier's clause inventory and its counsel's conclusions rather than overriding them.
Excluded accounts and the reason for each are recorded under licensing rights in the SourceX Evidence Packet, so a buyer can see that restrictions were found and honored without seeing the customer contracts themselves.
Frequently asked questions
Do expired customer contracts still matter?
Often, yes. Confidentiality obligations and return-or-destroy clauses commonly survive termination, sometimes without an end date for trade secrets. Records from former customers need the same review as current ones, mapped to the contract that was in force when the records were created.
What about customers who signed before we added a data clause?
Their records are governed by the terms they accepted. Some online terms allow updates on notice, which may extend a new clause to existing customers, but counsel should assess whether the update process was valid. Otherwise those accounts stay Amber until reviewed.
Should we ask restricted customers for consent?
For a few strategic accounts with especially useful records it can be worth asking, with a clear explanation of de-identification and permitted use. For most restricted accounts, exclusion is faster and avoids a difficult conversation about data the customer may not have considered.
Do vendor contracts need the same review?
Yes, but separately. Help desk, CRM and ERP vendor terms may restrict exports or reuse of data held on their platforms. Review those terms once per vendor rather than per customer, and record the outcome alongside the clause inventory.
How often should the clause inventory be updated?
Update it before each new package and whenever a new template version goes live. Contracts signed or amended since the last review can change a customer's tier, so export filters should always read from the current inventory.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.