Your practice space
Read first, or open the worksheet whenever you are ready.
A polished security page can answer the wrong question perfectly. It may describe the vendor’s overall program while your risk sits in a calendar connection that can read every employee’s appointments or a customer-system connection that can update any account. Good procurement looks at the exact service, plan, settings, and permissions the team will use.
The review should be proportionate. A public-data drafting tool needs a different depth of review from an assistant that can send messages, read customer records, and change orders. Begin by writing the intended use, then ask for evidence that changes the yes, no, or pilot decision.
Constructed teaching example
See the risk in ordinary work
Example: a team buys a meeting assistant and connects email, calendar, and customer relationship management records.
Where it fails
The product’s security certificate looked reassuring, but the connector can read every mailbox and auto-create records in the wrong customer account.
A better route
The buyer tests the exact permissions with a small group, asks for retention and incident terms, and limits the connector to the records needed.
The working diagram
Follow the boundary
- 01
Evidence
Ask for current documents for the exact service.
- 02
Access
Inspect scopes, users, administrators, and subcontractors.
- 03
Test
Try realistic data and a wrong-account case.
- 04
Exit
Confirm revoke, export, and deletion.
A certificate is not a deployment design
Independent audit reports and certifications can be useful evidence of a vendor’s control program. They do not tell you which connection permissions your administrator granted, whether an output is accurate, or how your staff will review it. Ask the vendor what the report covers and its dates, then check your own setup.
A short questionnaire should cover the exact product and plan, data used for model training, how long information is kept and how it is deleted, administrator access, other companies that process the data, incident notice, logs, connection permissions, and export. A vendor may offer different answers across consumer, business, and developer products. Put the answers beside the proposed use, not in a generic spreadsheet forgotten after purchase.
Test the boundary on a real-shaped task
Connect a small test workspace with fictional records. Ask the tool to find a permitted account, then a forbidden one. Try an outdated customer record and two accounts with similar names. Check whether the activity log shows what it read and changed. If the provider cannot support a limited pilot, that is part of the buying decision.
Invite operations, the data owner, and a security reviewer to evaluate different questions. Operations knows whether the workflow helps; the data owner knows what may be exposed; security checks access and recovery. One person with a long questionnaire cannot substitute for all three.
Check it in your organization
- Get terms for the exact product plan, region, and connection.
- Inspect the actual access grant, not only vendor marketing.
- Verify how to turn off access, export work, delete data, and reach the incident contact.
Buy the whole operating arrangement
Include review time, training, support, monitoring, and offboarding in the cost. A cheap seat can become expensive if it requires broad data cleanup or a new administrator. Conversely, do not demand an enterprise architecture for a public-data writing pilot.
The result should be a conditional yes, no, or pilot—not a vague “vendor approved” label that follows the product into unrelated uses. A companion questionnaire linked below gives the buyer a reusable question set.
Follow one business through the course
Northline: the meeting assistant with too much reach
Northline Supply is a fictional teaching example, not a reported company incident.
Northline considers a meeting assistant for sales calls. The demo produces useful notes. During setup, the administrator notices that the proposed connection asks for broad mailbox, calendar, and customer-record access. The vendor’s audit report may be valid, but it cannot tell Northline whether those grants are appropriate for this workflow.
The buying team pilots with synthetic customers and a small user group. It checks whether the tool can read a colleague’s meeting, whether it can write to the wrong account when names collide, and whether the log records the attempted action. The vendor answers retention and incident-contact questions for the precise plan Northline would buy. Sales judges usefulness; the data owner judges permitted records; IT tests the permissions. If the product cannot operate with acceptable scope, the team can still choose manual notes rather than connecting everything.
Another setting
A low-risk public-information tool
A communications team wants a tool to draft headlines from public press releases. It has no private connector and cannot publish directly.
What to do: A short review of the exact plan, accounts, output review, and exit route may be enough. Do not impose the same questionnaire used for a tool with broad customer access.
Where this goes wrong
Three traps worth catching early
A certificate treated as a guarantee
Ask what the report covers and when it was issued. Your configuration, source quality, and approval design remain your responsibility.
The test only uses a happy-path account
Try a forbidden record, a stale entry, and two similar names. The permission boundary is easiest to see when the assistant is tempted to cross it.
Offboarding left until renewal
Know who revokes the connector, exports useful work, and requests deletion before the first real upload.
What good looks like on paper
A conditional vendor decision, filled in
A useful answer is more precise than “approved vendor.”
- Permitted use
- Draft notes for the pilot sales group; no automatic customer-record updates.
- Evidence kept
- Exact-plan terms, access grant screenshot, synthetic test results, and incident contact.
- Open question
- Can the connector be limited to pilot calendars and assigned accounts?
- Decision
- Continue on synthetic data only until access scope is demonstrated.
Put it into practice
Try this on one real workflow
Send the vendor the exact data flow and request written answers to the ten questions that change your decision.
The fill-in worksheet is in the practice space at the top of this lesson. Open it when you have a workflow in mind; it will keep your notes out of the reading flow.
Go to the worksheetSources behind this lesson
The business examples are constructed. These sources support the method or risk described above; they do not prove a result for the fictional company.
A July 2026 final guide to investigating technology suppliers before an acquisition or expansion.
Use our 15-question AI vendor security checklist when you are ready to send a specific request to a provider.
Buying the right setup is the beginning. The next lesson asks what you test before launch and what you watch afterward.