Service provider or third party: when a SaaS company cannot license customer data

What separates a service provider from a third party?#

A service provider processes personal information on a business's behalf, for that business's purposes, under a written contract that limits what the provider may do with it; a third party is anyone else who receives the information. Under the CCPA, the label in your marketing does not decide the role. What you actually do with the data does.

Most other state privacy laws use the controller and processor pair instead. A processor acts on the controller's instructions, and a processor that starts deciding its own purposes for the data can be treated as a controller for that processing. The practical effect is the same: data you hold to run your customers' accounts is governed by their decisions, not yours.

The role is set dataset by dataset. A project management SaaS company is usually a service provider for the tasks, files and comments its customers store in the product, and a business in its own right for its sales pipeline, its engineering history and the internal notes its staff write.

Why does the role decide whether you can license customer data?#

The service provider role decides the question because the contract that creates the role generally forbids the use that licensing requires. Service provider and processor terms typically bar retaining, using or disclosing personal information for any purpose other than the services, prohibit selling or sharing it, and limit combining it with data from other sources.

Licensing customer content to an AI developer is a purpose of your own, for your own benefit. That moves you outside the role for that data. Counsel may then see two problems at once: a breach of the customer contract, and a disclosure the customer never described to its own users, which could be characterized as a sale by the customer, by you, or by both.

Enterprise customers usually add their own layer through negotiated data processing agreements. Those often include audit rights, notice duties for new subprocessors, deletion at termination and indemnities, so a single unauthorized use can surface across many accounts at once.

A decision table for common SaaS record families#

SaaS record families fall on different sides of the line, so sort them before anyone discusses scope. The table shows the usual starting position; contracts and notices can move any row.

Support tickets deserve the closest look. The ticket thread belongs to your support operation, but customers routinely paste their own data into it: exports, screenshots, record IDs and sometimes end-user details. Those embedded pieces remain customer data even inside your helpdesk.

Does a service-improvement clause change the answer?#

A service-improvement clause usually does not change the answer, because it lets a provider improve its own service, not hand data to an outside developer. Many DPAs, and the CCPA rules for service providers, allow some internal use to build or improve the service under conditions. Licensing to a third party for its model training generally sits outside that permission.

Watch for aggregated or anonymized data clauses in master subscription agreements. Some give the vendor rights to statistics derived from customer data. Read whether the clause allows disclosure to third parties, whether it covers content or only usage metrics, and whether the promised anonymization meets the deidentification standard in the state laws that may apply.

Where the clause is broad, counsel should still weigh how customers understood it. A clause written for benchmarking dashboards is a weak foundation for licensing ticket text or documents to an AI developer. Read these defined terms in the master agreement and DPA side by side.

• 1Aggregated data or statistics: does it cover content or only metrics, and may results be disclosed outside your company?
• 2Usage data or service data: does the definition reach event payloads, file names or free-text fields?
• 3Service improvement: is the permission limited to your own service and to internal use?
• 4Deidentified data: does the clause describe the safeguards, public commitment and recipient contracts that state laws may expect?
• 5Feedback: this usually covers suggestions customers send you, not the content they store in the product.

Can you change your terms to allow licensing?#

Changing your terms can support licensing of data collected after the change, under conditions, but it rarely reaches data already collected. A retroactive change to permit a materially different use is the riskiest route, and consumer protection law may treat a quiet change as unfair or deceptive.

Negotiated agreements add another limit. Enterprise customers with signed DPAs usually have order-of-precedence clauses that put their DPA above your online terms, so a click-through update does not amend them. Each would need its own signed amendment.

Some vendors build an opt-in program instead: a separate agreement under which a customer chooses to contribute specific data, with defined preparation steps and the right to stop contributing future data. That is a negotiation with each customer, not a terms update.

Illustrative: a workforce scheduling vendor sorts its records#

Illustrative: a fictional workforce scheduling SaaS company sells to restaurant groups and retail chains. Its product stores shift schedules, time-off requests and pay rates for its customers' workers. It runs support in Zendesk, engineering in Jira and GitHub, and sales in Salesforce.

Counsel classifies the product database as service provider data and excludes it entirely, including backups and analytics copies. Support tickets stay in scope only after preparation removes the worker schedules and names that customer admins pasted into them. Jira issues, code reviews and release notes are company records and form the core of the package.

The resulting scope is narrower than the founders first imagined, but every record in it has a clear owner. No customer contract needed amending, and the answers the company gives in customer security questionnaires stayed accurate.

Questions counsel will ask before scoping#

Counsel's first questions map every record family to a role and a contract, so prepare the answers before the first meeting. Most can be answered from the contract repository, the trust center and a short call with the CTO.

• 1Which customer contracts and DPAs name you a service provider, processor or subprocessor?
• 2Which customers signed negotiated DPAs, and what do their precedence clauses say?
• 3Does your master agreement include an aggregated data or usage data clause, and what exactly does it permit?
• 4What do your privacy notice, trust center and past questionnaire answers say about AI and model training?
• 5Which systems hold customer content, including backups, logs and analytics copies?
• 6What deletion or return obligations apply to data from customers who have left?
• 7Which state privacy laws may apply to the people named in your own records?

How SourceX handles the service provider question#

SourceX addresses the service provider question in the Rights step of the SourceX five-step transaction, working with the supplier's counsel before any preparation starts. Record families a company holds on its customers' behalf are separated from the company's own operational records, and only the latter move forward unless customers have authorized otherwise in writing.

The decision is recorded in the SourceX Evidence Packet under licensing rights and permitted use, so the supplier, its counsel and the buyer see the same basis for every record family in the package.