Synthesis: data is a *defensible asset* only when proprietary + hard to replicate + tightly coupled to a feedback loop + continuously refreshed — otherwise it is an operational byproduct any competitor can buy or collect

Synthesis (combining a16z + the data-maturity literature):

Data is a defensible asset only when it is:

1. Proprietary — not on a marketplace and not derivable from public sources.
2. Hard to replicate — generated as a byproduct of operations the competitor cannot trivially reproduce.
3. Tightly coupled to a feedback loop — the data informs decisions that produce more data of the same kind (the engine self-feeds).
4. Continuously refreshed — the asset stays useful because the business keeps running.

Otherwise it is an operational byproduct that any competitor can also buy or collect. The same dataset is not differentially defensible across firms.

Source: Synthesis of Andreessen Horowitz, "The Empty Promise of Data Moats" (Casado & Lauten, 2019) — most "data network effects" are really scale effects that diminish + general data-maturity model literature (indeed.com; pragmaticinstitute.com; safegraph.com).

Confidence: Industry-consensus among independent voices.

Why this matters for Candid: The four-point test is the practical version of "would your competitor's version of this look exactly like yours?" — see R7 — Test defensibility with one question: would your competitor's version of this look exactly like yours? If yes, it's a commodity and R2 — Build only on data you already own — transaction history, CRM, scheduling, no-show patterns; that is the only category with native defensibility.