What your security team will ask, and the answers that satisfy them
6 min readUpdated
Security reviews of AI analytics tools concentrate on four things: whether data leaves your environment, whether access rules are enforced when the query runs rather than when results are displayed, whether every question is logged in one place, and what the AI model provider receives. Preparing answers to those before the review starts is usually the difference between a two-week and a two-month approval.
The four that decide the review
- Does our data leave our environment?Ask exactly what is sent where, including to the AI model provider. A yes is not automatically disqualifying, but an unclear answer extends every subsequent conversation.
- Where are access rules enforced?In the database as part of the query, or in the application after rows come back? Only the first survives an export, an interface nobody anticipated, or an AI assistant.
- Is every question logged in one place?People and AI assistants must land in the same record. Two separate trails means nobody can answer who saw what without joining them by hand.
- What happens if an attribute is missing?If someone's region cannot be resolved, does the query return everything or nothing? Failing open is a common and dangerous default.
The six that follow
- Can we use our own AI model or provider?This decides whether a sovereignty or data-residency requirement can be met at all.
- Can it run inside our own environment?Regulated and sovereign buyers usually need this, and most cloud-only products cannot offer it.
- How are credentials to our systems stored?Ask specifically where and how they are encrypted.
- What certifications do you hold today?Ask for what is held versus what is in progress. Both are legitimate answers, and conflating them is not.
- Can a person ask for data they should not see?Ask for a live demonstration with a junior account rather than a policy statement.
- Can we delete a person's data on request?Ask what happens to that person's past questions and any cached answers.
How to shorten the review
Send the four decisive questions to the vendor before the first call and ask for written answers. A vendor who answers them precisely in writing has been through this before. One who wants a call to explain is usually managing an answer you will not like.