Rights and contracts
Third-party enrichment data in your CRM: can it be licensed?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Third-party enrichment data in your CRM usually cannot be licensed onward. Vendors that fill fields such as job titles, direct dials, company size, industry codes and technographics license that data for your internal use, and their terms commonly prohibit resale or redistribution. Identify every field a vendor wrote, strip it, and license the activity and deal history your team created.
Key takeaways
- Enriched CRM fields are held under the vendor's license, not owned by you, and the restrictions follow the data into your CRM.
- Contact details, firmographics, technographics and intent signals are the field groups most often written by vendors.
- Activity history, deal stages, quotes and close reasons your team created are usually yours to license after privacy preparation.
- Removed integrations can leave values behind, and old contracts may have required deleting them.
- Where a field's source cannot be established, treat it as enriched.
Can you license enrichment data that sits in your CRM?#
Enrichment data in your CRM generally cannot be licensed onward, because you hold it under the vendor's license rather than owning it. Contact and company data providers typically grant use for internal business purposes and prohibit resale, sublicensing, redistribution and use to build a database that competes with theirs.
Those restrictions follow the data after it lands in Salesforce or HubSpot. A direct dial written into a contact record by an integration is still the vendor's licensed data, even though it now sits beside notes your reps typed.
Enriched contact fields are also personal data about people who may never have dealt with you directly, which adds a privacy question on top of the contract one. Both point the same way: those fields come out of scope.
Which CRM fields are usually enriched?#
The CRM fields most often written by vendors are the ones describing who a contact is and what their company looks like. The fields describing what your team did with that contact are almost always your own.
| Field group | Examples | Usual source | Treatment |
|---|---|---|---|
| Contact details | Direct dial, mobile, email, social profile URL | Contact data provider | Strip |
| Role data | Title, seniority, department | Provider or rep-entered | Strip unless rep-entered and verified |
| Firmographics | Employee range, revenue range, industry codes, headquarters location | Enrichment vendor | Strip or replace with your own segment |
| Technographics | Installed software and tools | Enrichment vendor | Strip |
| Intent signals | Topic surges and intent scores | Intent data vendor | Strip |
| Lead and account scores | Fit and engagement scores | Mixed | Review the inputs |
| Activity history | Calls, emails, meetings, notes | Your team | Keep after privacy preparation |
| Deal records | Stages, close reasons, quotes, loss notes | Your team | Keep after privacy preparation |
How to find which fields a vendor wrote#
Finding enriched fields is an audit of integrations, not a guess from field names. RevOps or the CRM administrator can usually trace most of it from the admin settings, integration users and import logs.
Removed integrations matter as much as active ones. A provider you stopped using years ago may have left values behind in fields nobody has touched since, and its contract may have required you to delete them when the subscription ended.
- List every installed package, connected app and integration user in the CRM, current and removed.
- Map each vendor to the fields it writes, using its setup documentation and field mapping screens.
- Check field history or property history, where enabled, to see which integration user last changed each value.
- Look for vendor-prefixed custom fields and import batches loaded from purchased lists.
- Flag fields whose source cannot be established and treat them as enriched.
- Pull the vendor contracts, including terminated ones, and note any deletion duty after termination.
Enrichment vendor terms to read#
Enrichment vendor terms decide what you may keep, what you must delete and whether anything derived from vendor data is restricted too, and they differ by vendor and by version. Read the signed agreement, the order form and any terms incorporated by link, not the vendor's marketing page, and check whether newer versions add language on machine learning or AI use.
| Clause | What to look for |
|---|---|
| Permitted use | Whether use is limited to internal sales and marketing |
| Prohibited use | Resale, sublicensing, redistribution, competing databases or model training |
| Derived data | Whether scores or insights built from vendor data are restricted as well |
| Termination | Whether data must be deleted or may be kept after the subscription ends |
| Audit | Whether the vendor can inspect how its data is used |
| Privacy cooperation | Duties to honor opt-outs and deletion requests passed on by the vendor |
Privacy duties that come with enriched contacts#
Privacy duties attached to enriched contacts give a second reason to remove them. People whose details a vendor supplied often never gave those details to you directly, and some state privacy laws may give them rights to know about, opt out of or delete that information. In California, business contacts at your prospects have been fully within the CCPA since its temporary B2B exemption lapsed on January 1, 2023. Licensing enriched contact data onward would stretch that chain one step further.
Suppression and opt-out lists make a useful cross-check. A contact who asked to stop hearing from you is a reminder that enriched personal data is the least defensible part of a CRM to move anywhere, and the part a buyer studying sales work needs least.
What about notes that repeat enriched facts?#
Notes your reps wrote are generally your company's work, even when they mention something an enrichment tool surfaced. A call note saying the prospect's operations lead is evaluating a warehouse system change records your team's conversation, and it stays in scope after privacy preparation.
The line is bulk copying. If a workflow pasted enriched values into a notes or description field automatically, that text is still vendor data and should be treated like the field it came from. Automation logs and identical formatting across many records usually reveal it.
Illustrative: a 3PL cleans its Salesforce org#
Illustrative: a fictional third-party logistics provider has run Salesforce for its sales team for years, with two enrichment tools over that time: one still active, one cancelled after a pricing dispute. Reps log calls, site visits, quotes and lost-deal reasons, and onboarding notes sit in linked cases.
Counsel reviewed both vendor contracts. The active tool limited use to internal sales and marketing, and the cancelled one required deletion of its data after termination. The RevOps lead used field history to tag every value either integration wrote, purged the cancelled vendor's leftovers as the old contract required, and removed all enriched contact and firmographic fields from the export. Industry codes were replaced with the provider's own customer segments from its billing system.
The licensed scope became the sales process itself: activity timelines, quote revisions, onboarding cases and close reasons, with people and companies de-identified.
How SourceX handles CRM enrichment#
SourceX reviews CRM enrichment during the Rights step of the SourceX five-step transaction (Supply, Rights, Preparation, Approval, Delivery). Vendor agreements are read alongside customer contracts, and enriched fields are listed as exclusions before preparation begins.
In the SourceX Evidence Packet, provenance and licensing rights record which integrations were found and which fields were removed and why, alongside permitted use, the privacy record and the release authorization. The supplier can then show that the licensed CRM history is its own team's work rather than another vendor's licensed data.
Frequently asked questions
What if we bought a contact list outright rather than subscribing?
List purchases usually come with a license too, often limited to your own marketing and sometimes for a fixed period. Read the purchase terms; few lists come with a right to resell or sublicense. Treat imported list data as third-party data unless the terms clearly say otherwise.
Are our own lead scores restricted if they use enriched inputs?
Possibly. Some vendor terms treat anything derived from their data as restricted, while others let you keep derived insights. If a score was calculated mostly from vendor fields, the safer course is to exclude it or recompute it from your own activity data.
Can we keep account names for companies that were our customers?
The customer relationship and your history with that account are yours, but company and personal names are usually removed during privacy preparation anyway. What stays is the de-identified sequence of activities, quotes and outcomes. If segment context matters, replace the name with a category you assigned yourself, such as regional grocery distributor, rather than a vendor's industry code.
Do marketing automation fields count as enrichment?
Email engagement, form fills and site visits captured by your own marketing automation are generally your records, subject to privacy review. Fields synced in from third-party intent or advertising platforms are not, and need the same vendor terms check as enrichment.
Does stripping enriched fields reduce the value of CRM data?
Usually less than people expect. Buyers studying sales and service work want the sequence of conversations, decisions and outcomes. Contact details and firmographic labels add little to that, and they carry most of the rights and privacy risk.
Is a CRM migration a good time to separate enriched fields?
Yes. A migration already forces a field-by-field mapping, so tagging each field's source at that point costs little extra. Many teams also decide which enriched fields to leave behind in the old system, which simplifies any later licensing scope and the vendor deletion duties.
Sources
- The California legislature did not extend the CCPA employee and business-to-business personal information exemptions, so they expired on January 1, 2023. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.