Marketing automation vendors: subscriber data vs your own platform records

Which records belong to your customers?#

The records that belong to your customers are everything they and their subscribers put into the platform: subscriber lists, contact properties, segments, campaign and automation content, form submissions and engagement events such as opens and clicks. You hold them as a processor, and your DPA limits what you may do with them.

The largest platforms now say so in writing. HubSpot's updated developer terms state that customer data belongs to the customer, not to HubSpot or developers, and restrict using data accessed through its APIs to train AI models, with a carve-out for legitimate single-customer use. HubSpot also gives customers a switch that controls whether it uses their account data to train its own AI models.

Expect your customers and their legal teams to hold you to the same standard. A martech vendor that treats subscriber data as raw material for its own projects invites contract disputes and churn, whatever its terms technically allow.

Subscriber data vs platform records: the dividing line#

The dividing line runs between data about your customers' audiences and records about how your company runs the platform. The first is customer data; the second is your operating history, even though customer details are woven through it.

Use the table below as a first sort, then confirm each row against your subscription agreement and DPA.

Two rows deserve a second look. Engagement events feel like platform telemetry because your systems generate them, but they describe how specific people responded to a customer's message. Support transcripts feel like customer content, yet they record your team's diagnosis and become usable company records once customer details are removed.

Why deliverability and compliance records stand out#

Deliverability and compliance records stand out because they capture expert decisions that are hard to find anywhere else. A deliverability engineer diagnosing why a sender's mail moved to spam folders, planning an IP warm-up or working through a blocklist removal leaves a trail of reasoning, actions and outcomes.

Abuse desk cases follow the same shape. An analyst reviews a spike in complaints, inspects how a list was collected, decides whether to suspend sending, and documents the customer's remediation. Support escalations about authentication records, bounce classification and API limits show the same cause, action and result pattern.

In SourceX Enterprise Data Value Framework terms, these records score on domain expertise and human-generated signal, and they are hard to reproduce from public sources. Preparation cost is the offsetting driver, because nearly every case mentions a customer domain or a recipient address.

Where recipient data hides inside your own records#

Recipient data hides inside your own records wherever a customer or engineer pasted evidence into a case. Removing it is the main preparation task for a martech vendor, and it should be planned before any scoping conversation starts.

A typical approach replaces addresses and domains with consistent placeholders, strips message bodies and attachments, and keeps the analyst's reasoning and the outcome. Consistent placeholders preserve the thread of a case without exposing who was involved.

• 1Email headers pasted into tickets, which carry recipient and sender addresses.
• 2Bounce and complaint logs attached to deliverability cases.
• 3Complaint forwards from mailbox providers that quote the original message.
• 4List exports customers attached when asking for import help.
• 5Screenshots of contact records, segments and campaign reports.
• 6Customer sending domains and account names that identify the customer.

Contract terms that decide the gray zone#

The contract terms that decide the gray zone are the usage data clause, the AI features clause and the DPA's purpose limits. Together they say whether you may keep aggregated statistics, whether customer data may improve your models, and whether anything derived from customer data can leave the company.

Aggregated engagement benchmarks are the hardest case. If you rely on de-identification, check the standard that applies: under California law as amended by the CPRA, deidentified information must not reasonably be linkable to a consumer, and the business must take reasonable measures against association, publicly commit not to reidentify it, and contractually bind recipients to the same terms.

If your terms are silent, adding new rights through a quiet terms update is risky, especially with enterprise customers on negotiated agreements. A signed amendment or an opt-in addendum is slower but holds up when a customer's counsel reads it.

Illustrative example: an email platform for independent retailers#

Illustrative: a fictional email and SMS platform serving independent retailers runs Zendesk for support, Jira and GitHub for engineering, an internal deliverability console, and a Slack channel where the abuse desk discusses suspensions. Its CEO wants to know what could be licensed to an AI developer building email operations agents.

The review excludes subscriber lists, message content and engagement events entirely, and sets aside engagement benchmarks because the usage data clause covers only service improvement. The candidate package is deliverability cases, abuse desk decisions, support escalations and engineering postmortems, with every address, domain and account name replaced by placeholders and message bodies removed.

The CEO approves that scope, and the company adds a plain statement to its trust page that subscriber data is never licensed. The statement answers the question customers ask most and matches what the contracts already say.

How SourceX scopes a martech vendor#

SourceX scopes a martech vendor by excluding subscriber data and message content in the Rights step of the SourceX five-step transaction, then assessing the vendor's own operating records for fit. The fit check asks only for metadata, such as which systems hold deliverability and support history and how many years remain accessible.

If a package proceeds, Preparation replaces customer and recipient identifiers, the vendor approves the result, and the SourceX Evidence Packet documents provenance, licensing rights, permitted use, the privacy record and release authorization.