AI Vendor Security Questionnaire

A checklist to share with, or work through with, your AI vendor to see whether they have strong security, data, and operational practices.

Use this questionnaire to collect written answers, evidence, and red-flag signals from every AI vendor before sharing data, connecting systems, or approving a pilot.

Section 01

Company and compliance baseline

  1. Do you have SOC 2 Type II?
  2. Can you provide the latest report under NDA?
  3. What systems, products, and environments are covered by the report?
  4. Do you have ISO 27001, HIPAA, PCI, GDPR, CCPA, or other relevant certifications?
  5. Do you conduct annual penetration tests?
  6. Can you share recent penetration test findings and remediation status?
  7. Do you maintain a written information security program?
  8. Do you have cyber insurance?
Section 02

Data usage and model training

  1. Will our data ever be used to train your models?
  2. Will prompts, outputs, documents, logs, or feedback train third-party models?
  3. Is customer-data training opt-in or opt-out?
  4. Can we disable training permanently?
  5. Can you contractually commit that our data will not be used for model training?
  6. Are prompts and outputs retained? If yes, for how long?
  7. Can we configure retention windows?
  8. Can we delete our data on request, and can you prove deletion?
Section 03

Model provider and hosting architecture

  1. Which model providers do you use?
  2. Which specific models do you use in production?
  3. Where does inference happen?
  4. Is inference hosted by OpenAI, Azure, AWS, Google Cloud, Anthropic, your own infrastructure, or another provider?
  5. Does customer data ever leave approved regions?
  6. Are any foreign-hosted services in the processing path?
  7. Do you use open-weight models, and where are they hosted?
  8. Do you fine-tune models on customer data?
  9. Can we choose or restrict model providers?

Open-weight models are not automatically unsafe. The question is where the model runs, who controls infrastructure, whether customer data is logged, and whether the vendor has real operational controls.

Section 04

Deployment model

  1. Is your product SaaS, single-tenant, private cloud, customer VPC, on-prem, or hybrid?
  2. What deployment models are supported?
  3. Does the product require VPN, database access, API access, file exports, or user credentials?
  4. Can the product run with read-only access first?
  5. Can write actions be gated by human approval?
  6. How do you separate customer environments?
  7. How do you manage secrets and credentials?
  8. Do you support data residency requirements?
Section 05

Access control and identity

  1. Do you support SSO through SAML or OIDC?
  2. Do you support SCIM user provisioning?
  3. Do you support role-based access control?
  4. Can permissions mirror our existing business roles?
  5. Can access be restricted by department, region, business unit, or data type?
  6. Can admins see who accessed what?
  7. Can we revoke users immediately?
  8. Do you support MFA?
Section 06

Data integration and system access

  1. Which systems do you need to connect to?
  2. Do you use APIs, database connections, files, RPA, browser automation, or screen scraping?
  3. Do you require write access?
  4. Can access be scoped to specific objects or tables?
  5. How do you handle rate limits, failures, and retries?
  6. How do you prevent the AI from taking unauthorized actions?
  7. Can customers approve system actions before execution?
  8. How are credentials stored and rotated?
Section 07

AI agent controls

  1. What actions can the AI agent take?
  2. Which actions are read-only?
  3. Which actions can change business records?
  4. Can high-risk actions require human approval?
  5. Can we restrict actions by role, department, or workflow?
  6. Can the agent explain why it made a recommendation?
  7. Can the agent cite the source data it used?
  8. Can the agent be stopped, paused, or rolled back?
Section 08

Prompt injection and AI-specific security

  1. How do you defend against prompt injection?
  2. How do you prevent users or documents from overriding system instructions?
  3. How do you isolate user content from system prompts?
  4. How do you prevent the model from leaking confidential data?
  5. How do you prevent insecure output handling?
  6. How do you test for jailbreaks and adversarial prompts?
  7. How do you evaluate model behavior before releases?
  8. Do you red-team your AI workflows?
Section 09

Auditability and observability

  1. Do you log prompts, outputs, tool calls, and system actions?
  2. Can customers access audit logs?
  3. Can logs be exported to a SIEM?
  4. Do logs show which data sources were used?
  5. Can we trace an output back to source records?
  6. Do you monitor hallucinations, failures, escalations, and overrides?
  7. Do you provide workflow-level analytics?
  8. Can we review agent actions before and after deployment?
Section 10

Industry-specific data protection

  1. Can you support PHI, PCI, PII, financial data, legal documents, source code, or other regulated data?
  2. Do you sign BAAs for healthcare data?
  3. Do you support PCI-sensitive workflows without storing card data?
  4. Can sensitive fields be masked or tokenized?
  5. Can access be restricted by data classification?
  6. Can data be excluded from prompts?
  7. Can customer-specific retention policies be applied?
  8. Can production data be separated from test data?
Section 11

Subprocessors and third parties

  1. Who are your subprocessors?
  2. Which subprocessors see customer data?
  3. Which subprocessors see prompts, outputs, files, logs, or metadata?
  4. Can we review and approve subprocessors?
  5. Do you notify customers before adding subprocessors?
  6. Are subprocessors bound to equivalent security obligations?
  7. Where are subprocessors located?
  8. Can any subprocessor use our data for training?
Section 12

Data retention and deletion

  1. What data do you retain?
  2. How long do you retain prompts, outputs, files, embeddings, logs, and metadata?
  3. Can retention be configured?
  4. Can data be deleted on request?
  5. Can embeddings be deleted?
  6. Can backups be deleted or aged out?
  7. What happens at contract termination?
  8. Can you provide deletion certification?
Section 13

Model changes and release management

  1. How often do you change models?
  2. Do customers receive notice when models change?
  3. Can customers pin a model version?
  4. Do you test workflows before changing models?
  5. Do you run regression tests?
  6. Do you measure accuracy, latency, cost, and failure rates?
  7. Can customers review release notes?
  8. Can customers opt out of major behavior changes?
Section 14

Incident response

  1. Do you have a written incident response plan?
  2. What is your breach notification timeline?
  3. Who is responsible for incident communication?
  4. Do you test incident response?
  5. Do you have a process for AI-specific incidents?
  6. How do you handle data leakage, unauthorized action, or model misbehavior?
  7. Can customers suspend access immediately?
  8. Do you provide post-incident reports?

Review vendors with a clear AI roadmap in mind.

Get a free AI roadmap consultation