Other Information Businesses Industry Terminology

Access Control

Policies and mechanisms that determine who can access data, systems, and operations, often via RBAC/ABAC, least privilege, and MFA.

We implemented RBAC so only research analysts can view raw clickstream tables.; ABAC rules deny exports when user.region != dataset.region (data residency).; Quarterly access reviews enforce least-privilege across our data lake.

API Monetization

Packaging, pricing, and licensing strategies for selling access to APIs (e.g., freemium, tiered, usage-based, per-seat, revenue share).

We moved our API to usage-based pricing at $2 per 1,000 calls.; Partners resell our data under a revenue-share license.; The enterprise tier includes SLAs and premium endpoints.

API Rate Limiting

Controls that cap the number of API requests over time to protect performance and fairness (e.g., token bucket, leaky bucket, quotas, bursts; 429 errors on excess).

Clients get 100 req/sec with a 1,000-request burst; we return 429 on overflow.; We raised partner quotas for nightly backfills.; Rate limits differ per API key and plan tier.

ARR (Annual Recurring Revenue)

Annualized value of contracted, recurring subscription revenue; key for forecasting and valuation.

ARR grew from $8.2M to $11.4M YoY.; We multiply MRR by 12 to estimate ARR, net of discounts.; Expansion ARR offset logo churn this quarter.

Audit Log

Tamper-evident records of who did what, when, and from where (access, changes, exports); vital for compliance and forensics.

Audit logs show who exported the article archive on Friday.; Immutable logs are retained 2 years for SOC 2 evidence.; We alert on anomalous export patterns in audit trails.

CAC (Customer Acquisition Cost)

Total sales and marketing cost to acquire one new customer; used with LTV to assess unit economics.

Our CAC payback is 11 months on the SMB plan.; We target an LTV:CAC ratio of at least 3:1.; Raising content marketing cut CAC by 18%.

CCPA/CPRA (California Privacy Laws)

California laws granting rights to access, delete, correct, and opt out of selling/sharing personal data; adds sensitive data rules and GPC signals.

Our CMP honors Global Privacy Control (GPC) for opt-outs.; CPRA requires separate handling for sensitive geolocation data.; We updated our ‘Do Not Sell or Share’ link to meet CPRA.

CDP (Customer Data Platform)

A system that unifies first-party customer data into profiles for analytics and activation to downstream channels.

We consolidate web, app, and email events in the CDP.; Identity stitching links hashed emails to device IDs.; Segments sync to ad platforms hourly.

Churn Rate

The percentage of customers or revenue lost over a period (logo or net revenue churn).

Logo churn fell to 2.1% monthly.; We track gross and net revenue churn separately.; Onboarding improvements reduced 90-day churn.

CMP (Consent Management Platform)

Tooling to collect, store, and transmit user consent signals (e.g., IAB TCF), manage preferences, and enforce them across systems.

The CMP records consent and passes the TCF string to our ads stack.; We re-prompt EU visitors when purposes change.; Consent logs are tied to user IDs for audits.

Content Syndication

Distributing content to third parties via feeds, APIs, or widgets under licensing terms to extend reach and monetize.

We license our newswire via API and RSS feeds.; Syndication partners must attribute and link back.; Regional rights differ per territory in the license.

Copyright and Licensing

Legal rights to reproduce, distribute, adapt works; licenses (exclusive, non-exclusive, creative commons) define permitted uses and fees.

The client purchased a non-exclusive archival license.; Our derivative dataset includes required attribution.; Fair use covers brief quotes, not full-text reposting.

Customer Lifetime Value (LTV)

Projected net revenue (or margin) from a customer over their relationship; used to plan spend and pricing.

We model LTV by cohort with 36-month retention curves.; Target LTV:CAC is 4:1 on enterprise.; Upsell increases LTV via add-on datasets.

Data Broker

An entity that collects, aggregates, enriches, and sells or licenses data about individuals or entities; often subject to registration and opt-outs.

We registered as a data broker in Vermont and California.; Our broker feeds power identity resolution workflows.; We provide a self-service opt-out portal.

Data Catalog

An indexed inventory of datasets with business/technical metadata, ownership, lineage, and quality scores.

Analysts discover partner feeds in the data catalog.; Stewards maintain glossary entries and PII tags.; Quality checks surface freshness SLIs in the catalog.

Data Enrichment

Adding third-party attributes to first-party records to improve completeness or insight (firmographics, geos, interests).

We enrich domains with company size and industry.; Phone append increased match rates by 12%.; We throttle enrichment to respect partner quotas.

Data Governance

Policies, roles, and controls ensuring data is accurate, secure, compliant, and appropriately used.

Data stewards approve new data uses via a governance board.; We classify PII and restrict exports by policy.; Quarterly reviews check compliance with retention rules.

Data Lineage

End-to-end tracing of data origins, transformations, and destinations to support trust, debugging, and audits.

Lineage shows revenue metrics derive from table v3.; A failed transform explains the drop in counts.; We expose lineage graphs in the catalog.

Data Minimization

Privacy-by-design principle to collect, process, and retain only what is necessary for specified purposes.

We dropped precise GPS and kept city-level data.; Hashing emails supports minimization for analytics.; Purpose limitation is enforced in our DPA.

Data Processing Agreement (DPA)

Contract between controller and processor defining processing purposes, security, sub-processors, and transfer mechanisms (e.g., SCCs).

Clients require a signed DPA with SCCs for EU data.; Our DPA lists all sub-processors and audit rights.; We notify clients before adding a new sub-processor.

Data Provenance

Documentation of source, method, and chain of custody for data to establish authenticity and reliability.

Provenance fields track original publisher and scrape time.; We reject records without verifiable provenance.; Watermarks encode provenance in distributed files.

Data Residency

Where data is stored/processed geographically to meet legal or contractual requirements.

EU datasets stay in Frankfurt; US in Ohio.; We geo-fence processing by region tags.; Residency obligations are noted in customer MSAs.

Data Retention Policy

Rules defining how long data is kept and when it is deleted or archived, considering legal holds and business needs.

Raw logs are kept 90 days, aggregates 2 years.; We pause deletion under legal hold notices.; Retention timers trigger automatic purge jobs.

Data Scraping (Web Scraping)

Automated extraction of information from websites/APIs; must respect legal terms, robots.txt, rate limits, and ethics.

Our crawler honors robots.txt and crawl-delay.; We avoid paywalled content to respect ToS.; 429s trigger backoff and retry with jitter.

Data Subject Access Request (DSAR)

Individual requests to access, delete, correct, or port their personal data under laws like GDPR/CCPA.

We verify identity before fulfilling DSARs.; Deletion requests propagate to sub-processors.; We provide machine-readable exports for portability.

Differential Privacy

Technique adding calibrated noise to outputs so statistics remain useful while protecting individuals’ data.

We release differentially private counts with epsilon=1.; DP prevents re-identification in small segments.; The DP budget resets monthly for reports.

Digital Rights Management (DRM)

Technologies that control access, copying, and redistribution of digital content (encryption, licensing, watermarking).

Encrypted PDFs expire after 30 days via DRM.; We embed forensic watermarks in syndicated videos.; License servers enforce device limits.

Disaster Recovery (RTO/RPO)

Plans and capabilities to restore services after incidents; RTO = time to recover, RPO = allowable data loss.

Our RTO is 4 hours, RPO 15 minutes for the API.; We test failover quarterly to a secondary region.; Backups are encrypted and periodically restored.

DMP (Data Management Platform)

Adtech system that ingests and segments audience data for targeting; impacted by cookie deprecation and privacy rules.

Third-party cookie loss reduced DMP match rates.; We push DMP segments to DSPs nightly.; Shifted budgets from DMP to CDP with first-party IDs.

Encryption at Rest/In Transit

Protecting data via cryptography when stored (AES-256, KMS) and when transmitted (TLS 1.2+ with PFS).

All S3 buckets use SSE-KMS with key rotation.; APIs require TLS 1.2+; HSTS is enabled.; Client-side field encryption for sensitive PII.

ETL/ELT (Extract, Transform, Load)

Patterns for moving and shaping data; ETL transforms before loading; ELT transforms inside the warehouse/lakehouse.

We ELT raw JSON into the lakehouse, then model.; dbt jobs handle transforms post-load.; Partner data arrives via SFTP, then ETL to Parquet.

Event Streaming

Real-time data ingestion and processing via append-only logs (Kafka, Kinesis, Pulsar).

Clickstream events flow to Kafka for enrichment.; We stream content updates to partners via topics.; Stream processors calculate rolling metrics.

Fair Use

US doctrine allowing limited use of copyrighted material without permission, depending on purpose, nature, amount, and market effect.

Quoting two lines for commentary is likely fair use.; Full-text republication fails the fair use test.; We provide excerpts, not full articles, to be safe.

First-Party Data

Data collected directly from users by the organization (consented and governed), increasingly valuable post-cookie.

We rely on first-party IDs for personalization.; Consent banners capture first-party preferences.; First-party cohorts outperform third-party segments.

Freemium

Pricing model offering a free tier with limits to drive adoption and upsell to paid plans.

Free tier: 10k API calls/month; overages require Pro.; Usage alerts nudge upgrades at 80% of quota.; Premium features include SSO and audit logs.

GDPR (General Data Protection Regulation)

EU law governing personal data processing: lawful basis, transparency, rights, DPIAs, DPOs, cross-border transfers, and heavy fines.

Our lawful basis is consent for ad personalization.; We completed a DPIA for location analytics.; EU-US transfers use SCCs plus a TIA.

GraphQL

API query language and runtime letting clients request exactly the fields needed, reducing over/under-fetching.

Partners query articles with only title and byline.; We implement caching per GraphQL operation ID.; Introspection is disabled in production for security.

Hashing and Tokenization

Pseudonymization techniques: hashing (one-way, e.g., salted SHA-256) and tokenization (reversible mapping via a vault).

We store hashed emails for identity resolution.; PANs are tokenized before leaving the app tier.; HMAC ensures integrity of webhook payloads.

HIPAA (Health Insurance Portability and Accountability Act)

US law regulating protected health information (PHI); requires safeguards and BAAs for processors.

Our product is not for PHI unless a BAA is signed.; Minimum necessary access applies to support staff.; Audit logs and encryption satisfy HIPAA controls.

Identity Resolution

Linking identifiers across devices and channels to build a unified entity profile (deterministic/probabilistic).

Hashed email + login ID yields high deterministic matches.; Graph-based resolution improves householding.; We report match rates by partner and attribute.

Intellectual Property (IP)

Legal protections for intangible assets: copyrights, trademarks, patents, and trade secrets.

Our taxonomy is copyrighted; the brand is trademarked.; We filed a patent on our deduplication method.; NDAs protect trade secrets in the algorithm.

ISO/IEC 27001

International standard for an Information Security Management System (ISMS); certification demonstrates control maturity.

We’re ISO 27001 certified; scope covers all SaaS ops.; Annex A controls map to our risk register.; Surveillance audits occur annually.

JWT (JSON Web Token)

Compact, signed tokens carrying claims for authN/Z between parties (JWS/JWE); include exp/aud/iss to reduce risk.

APIs accept JWTs with ‘aud=api.company.com’.; Tokens expire in 15 minutes and refresh via OAuth.; We verify signatures with rotating keys (kid).

OAuth 2.0

Authorization framework granting scoped access via tokens; common flows include Authorization Code with PKCE and Client Credentials.

Partners use client credentials for server-to-server calls.; Scopes limit writes to /v2/feeds only.; We rotate client secrets quarterly.

REST API

HTTP-based interface exposing resources via verbs (GET/POST/PUT/PATCH/DELETE), status codes, and representations (JSON).

Use cursor-based pagination on /v1/articles.; PUT is idempotent; retries are safe.; 429 indicates rate limiting; honor Retry-After.

Robots.txt

Robots Exclusion Protocol file guiding crawlers on allowed paths; advisory, not an access control mechanism.

Disallow: /private prevents well-behaved bots.; Sitemap is linked in robots.txt for discovery.; We also set robots meta tags at page-level.

RSS/Atom

XML-based syndication formats for distributing content feeds (news, podcasts via enclosures).

Partners consume our RSS feeds for headlines.; Podcast episodes ship via Atom with enclosures.; We version feeds to avoid breaking consumers.

SLA/SLO/SLI

Service Level Agreement (commitment), Objective (target), and Indicator (metric) for reliability and performance.

SLA: 99.9% monthly uptime; SLO: 99.95%.; SLIs track p95 latency under 300 ms.; Credits apply if SLA is missed.

SOC 2

AICPA audit of controls over Security, Availability, Processing Integrity, Confidentiality, and Privacy (Type I/II).

We provide a SOC 2 Type II report under NDA.; Change management and access reviews are key controls.; Evidence includes audit logs and backup tests.

Standard Contractual Clauses (SCCs)

EU model clauses for international personal data transfers; often paired with a Transfer Impact Assessment (TIA).

Our DPA includes SCCs for EU-to-US transfers.; We completed TIAs for sub-processors outside the EEA.; UK addendum (IDTA) is attached for UK data.