The AI Vendor Security Assessment Checklist

Before approving any AI vendor, work through this checklist. These questions are based on real vendor assessments and the issues we've found.

Data Handling (Critical)

1. Where is data processed geographically?

2. Is data used for model training? Can this be disabled?

3. What is the data retention period?

4. How is data encrypted at rest and in transit?

5. Who can access customer data internally?

Security Controls

6. SOC 2 Type II certification?

7. Penetration testing frequency and scope?

8. Vulnerability management program?

9. Incident response capabilities?

10. Subprocessor management?

Compliance

11. GDPR compliance documentation?

12. HIPAA BAA available if needed?

13. Data Processing Agreement terms?

14. Right to audit provisions?

15. Breach notification timeline?

Red Flags

• No SOC 2 certification and no timeline to achieve it
• Data used for training by default with no opt-out
• No geographic restrictions on data processing
• Vague answers about subprocessors
• Resistance to security questionnaires

Deal Breakers

• Cannot provide SOC 2 report
• Training on customer data with no disable option
• No encryption at rest
• No incident response process
• Refuses to sign DPA

This checklist won't catch everything, but it will filter out the vendors that aren't ready for enterprise use.

This article reflects research and analysis by the ZeroShare editorial team. Statistics and regulatory information are sourced from publicly available reports and should be verified for your specific use case. For details about our content and editorial practices, see our Terms of Service.