Before your organization signs up for an AI tool, you can ask the vendor a short set of questions about what happens to your data. This lesson gives you those questions, shows you how to read the answers, and explains why an answer only counts once it is in writing. If a new tool or a renewal is on your desk this month, this is the week to send them.

The idea: ask before you sign

A vendor’s website tells you what the vendor wants you to hear. The questions in this lesson tell you what the vendor will commit to. Those are often different things.

The best time to ask is before you sign. At that point you are a possible customer, and vendors tend to answer possible customers quickly. After you sign, your staff are already typing client notes and uploading files, and switching tools is slow and costly.

You do not need technical knowledge to ask these questions. You need to ask them clearly, get answers you can understand, and keep a record. The questions fall into 7 areas.

Training

Is our content used to train or improve your models, by default and under the plan we are buying?
Can we turn that off for the whole organization, not one user at a time?

A good answer names your plan and says clearly whether training is on or off. Many vendors treat free plans and paid plans differently, so the plan matters.

Retention and deletion

How long do you keep our prompts, uploaded files and outputs?
What happens when we delete something?
What happens to our data when we stop being a customer?

A good answer gives a time period and explains what “delete” means in practice. “We keep data as long as needed” is not a time period.

Access

Can your staff or contractors read our content, for example to review abuse or to help with a support request?
Which subprocessors (other companies the vendor uses to run the service) handle our content?

A good answer explains when people can see your content and lists the subprocessors, or tells you where the list lives.

Location

Where is our data stored and processed?
Can we choose a region?

This matters if your funders, partners or local rules expect data to stay in a particular country or region.

Assurance

Which certifications or audit reports do you have?
Will you share them with us?

Examples you may hear are a SOC 2 Type II report, ISO 27001 and ISO 42001. You do not have to read a full audit report. It is useful to know that one exists, that it is recent, and that the vendor will share it, often under a confidentiality agreement.

Admin and security

Do you offer single sign-on, so staff log in with their work account?
Can we add and remove users centrally?
Do you keep audit logs showing who did what?
How will you tell us if there is a security incident that affects our data?
How do you handle security flaws reported in your product?

These answers tell you whether you can control the tool when someone joins or leaves, and whether the vendor will warn you when something goes wrong.

Contract

Will you sign a data processing agreement?
Does the contract say what your privacy page says?

A privacy page can change without notice. A signed contract is what holds.

A worked example

Here is an illustration, not a real case. A small housing charity wants a transcription tool to turn recorded case meetings into notes. The recordings include tenants’ names, addresses and sometimes health details. The office manager narrows it to 2 vendors that cost about the same.

She copies the questions above into an email and sends it to both vendors’ sales contacts on a Monday.

Vendor A replies the next day. The reply says, for the paid plan the charity would buy, recordings and transcripts are not used for training, and an administrator can confirm that setting for the whole account. It states how long files are kept, says deletion requests are honored, and explains what happens at the end of the contract. It lists its subprocessors and offers to share its audit report. It attaches a data processing agreement, already signed on the vendor’s side.

Vendor B replies with a link to its general privacy page. The page talks about security in broad terms but says nothing about whether customer content is used for training. The email does not answer the other questions.

Vendor B may have perfectly good practices. The charity cannot tell. With tenants’ health details involved, the office manager does not want to guess. She files both replies with the date, recommends Vendor A to the director, and notes in one line why Vendor B was not chosen.

The features were close. The answers made the decision.

The steps to take

Pick the tool. Start with one AI tool you are about to buy or renew.
Copy the questions. Use the list above, or the fuller version in our AI vendor assessment questions guide. Paste them into one email so the vendor can reply point by point.
Say what you will use it for. One line such as “We plan to use this for meeting notes that include client names” helps the vendor give a relevant answer.
Name the plan. Ask the vendor to answer for the specific plan you would buy.
Ask for written answers. Email is fine. If the vendor offers a call, take it, then ask them to confirm the key points by email afterward.
File the reply with the date. Save it in a shared folder with a clear name, such as the tool name and today’s date. Vendors change their terms, and you will want to know what they told you and when.
Compare the answers with the contract. Before signing, check that the contract or data processing agreement says what the email said. If the email promises something the contract does not, ask for it to be added.
Decide and write down why. A vague answer or no answer is not a pass. Treat it as a risk to weigh. Sometimes the risk is acceptable for low-sensitivity work, like drafting a newsletter. Sometimes it is not, like anything involving client records. Write one or two sentences on what you accepted and why.

How to read the answers

You are looking for answers that are specific, that apply to your plan, and that the vendor will stand behind. Some signs to watch for:

Specific: “Customer content on this plan is not used to train our models.” Vague: “We take your privacy seriously.”
Specific: a time period for keeping files. Vague: “for as long as necessary.”
Specific: a list of subprocessors. Vague: “trusted partners.”
Specific: an offer to share an audit report. Vague: “industry-leading security.”

If an answer is vague, reply once and ask the question again in plainer words. If it is still vague, record that.

Common mistakes

Relying on the privacy page. It is general, it can change, and it may not cover your plan. Ask anyway.
Asking on a phone call only. Spoken answers are easy to misremember and hard to prove. Get the key points in an email.
Asking about the wrong plan. The free plan and the paid plan can have different rules on training and retention. Name the plan you are buying.
Treating silence as a yes. If a vendor ignores a question, that is information. Weigh it.
Not filing the answers. A reply you cannot find in a year is almost as weak as no reply.
Forgetting renewals. Terms change. When a tool comes up for renewal, send the questions again and compare with what you filed last time.
Checking only once per tool, not per use. If staff start using a tool for more sensitive work than you planned, read the answers again with that new use in mind.

Try it this week

Set aside 15 minutes.

Choose one AI tool your organization already pays for. If you are not sure which tools those are, the tools pages on this site can help you recognize common ones.
Copy the questions from this lesson into an email to that vendor’s support or account contact. Add one line saying what your staff use the tool for, and name your plan.
Send it.
Create a folder for vendor answers. When the reply arrives, save it there with today’s date in the file name.

If the reply is clear and complete, you now have a record. If it is vague or never comes, you have learned something important about a tool you are already using.

Key takeaways

Ask your questions before you sign, when vendors have the most reason to answer.
Cover 7 areas: training, retention and deletion, access, location, assurance, admin and security, and the contract.
Get every answer in writing, file it with the date, and check that the contract matches it.
Treat a vague answer or no answer as a risk to weigh, never as a pass.
Send the questions again at renewal, because vendor terms change.

Vendor questions to ask before you sign