15 AI Vendor Security Questions to Ask Before Connecting Company Data

Before connecting company files to an AI tool, ask which files it can read, who can see the answer, what gets stored, and whether it can act in another system. A connector is the link that lets one product use data or functions from another. A security certificate can help establish that a vendor has a control program. It cannot answer how your connector will behave. Keep the answers with the proposed use.

Start with the exact service and the exact job

Send the vendor a one-paragraph description: “Our account managers will summarize approved customer notes, draft renewal briefs, and will not send email or change customer records.” Ask the vendor to answer for the specific product, plan, region, and connected apps. Consumer, business, and application-programming-interface products can have different controls. For example, OpenAI’s enterprise-privacy page distinguishes training defaults, retention choices, and connected sources across business offerings. That is a provider description, not a substitute for checking the contract and configuration you buy.

The 15 questions worth getting in writing

• 1. Which exact service, plan, model or models, and region will process the input and output? If another provider handles a step, name it.
• 2. Which categories of our data may enter the service, and can we prohibit particular sources or fields?
• 3. Is our input or output used to train or improve models? What are the defaults and any opt-in controls for this plan?
• 4. How long are prompts, retrieved passages, outputs, files, logs, and backups kept? Which settings can we change?
• 5. How do we delete and export each kind of data at pilot end or contract exit, and what remains afterward?
• 6. Which employees, vendor staff, and subcontractors can access our content, under what conditions, and with what record?
• 7. What permissions does each connector request? Can it be limited to selected users, folders, accounts, or read-only actions?
• 8. Does the tool use the employee’s own access rights, or a broad shared service identity? How do we revoke it?
• 9. Can administrators control sharing, external recipients, plugins, tool actions, and model choices by team?
• 10. What does the audit log show about sources read, drafts made, actions taken, approvers, and unusual access?
• 11. Can the tool send, spend, delete, change permissions, or update the official customer or finance record? Which actions require a person to approve the exact result?
• 12. How does the product treat instructions found inside emails, documents, web pages, or search results?
• 13. What happens if the service, connector, model, or source feed fails? Can we pause actions without losing records?
• 14. What is the incident-notification route and timing under our agreement, and who helps us identify affected records?
• 15. Which independent audit or certification covers this exact service and period, and what customer configuration remains our responsibility?

Do not mistake an answer for a tested control

Ask for the relevant written policy, contract term, administrator screen, or sample log. Confirm that consequential sales answers are reflected in the agreement you sign. Then connect a small test workspace with synthetic customer records. Try one permitted account and one account the user should not see. Try a name collision and a deliberately stale source. A passing pilot retrieves zero forbidden records, records every source read, and performs no unapproved external action. The 2025 OWASP guidance on excessive agency explains why a tool with more functions or permissions than the task needs can turn a manipulated answer into a damaging action.

A “no training on your data” promise is useful but incomplete. It does not by itself settle retention, connector scope, staff access, output sharing, or deletion. Conversely, do not require a large-enterprise questionnaire for an isolated pilot using only public material. Scale the review to the information and action at stake.

Make the decision conditional

The business owner—the person accountable for the workflow’s outcome—should sign a one-page decision: approved workflow, data allowed, permissions granted, person reviewing the output, vendor evidence, unresolved questions, and conditions for a wider rollout. Check the action log weekly during the pilot; any forbidden-record retrieval or unapproved action is a stop. Reopen the decision on renewal and whenever the vendor changes terms, third parties that process your data, models, or connector permissions. If several vendors handle a chain, repeat the review at each handoff. NIST’s Cybersecurity Framework 2.0 places supply-chain risk and governance inside the organization’s security program; it does not certify a particular product. Involve privacy or legal specialists when regulated, client-restricted, or contract-sensitive data is involved. Keep the pilot on synthetic or public data if the vendor cannot answer how sensitive records are retained or who may access them. Our free AI security course works through the operating controls that follow a buyer’s checklist.