AI Vendor Security Questions: A Due Diligence List for US Buyers

If you are considering purchasing an AI product or hiring a team to develop one, a security review should extend beyond a standard SaaS questionnaire. When assessing the security of an AI vendor, focus on five key areas to uncover most of the real risks involved. This list is intended for security, procurement, and IT leaders in the United States and should not be considered legal advice. Where a question touches upon legal obligations, such as HIPAA, consult with your legal counsel before relying on any vendor's answers.

Begin by examining the data flow: where does the data go, and what happens to it? An AI feature may send data to a third-party model provider, log it, cache it, or index it in a vector store. Ask the vendor about the data's destination and the data flow diagram, which should include the model provider and the vendor's own servers.

Obtain the list of data processors, their purposes, and a written statement detailing any changes to this list. Inquire whether the vendor uses data for model training or improvement and request confirmation in writing from the vendor and each upstream model provider. Understand the data retention policy, including prompts, outputs, uploaded files, logs, backups, abuse-monitoring copies, and support tooling.

Retention periods may vary across different data types and places, so clarify these details. Determine the geographic locations where data is stored and processed, as this can impact customer contracts and sector regulations, even when no law mandates data to remain within the United States. Confirm the ability to delete data and the specifics of what deletion entails, such as the database, vector index, backups, and fine-tuned artifacts.

If the vendor deploys on a private platform or private cloud, the deletion process may differ. When the AI system retrieves documents, verify if it respects your existing access permissions. For Retrieval-Augmented Generation (RAG) systems, ensure that source-system permissions (e.g., SharePoint, Google Drive, Confluence) are carried over to the index and that access checks occur when documents are retrieved, not merely in prompts.

Role-based access control, single sign-on, and the ability for administrative staff to track who accessed what are essential features to inquire about. When a user loses access to the source document, understand how the index entry is affected. SOC 2 reports are commonly requested by US buyers; therefore, it is crucial to read them thoroughly.

The American Institute of Certified Public Accountants (AICPA) defines SOC 2 as a suite of services offering an examination of controls related to security, availability, processing integrity, confidentiality, and privacy. SOC 2 reports are attestation documents by independent CPA firms and cover the vendor's security controls, but the scope can vary, often focusing on the baseline security aspects.

Some SOC 2 reports may not cover the AI feature you intend to use. Be cautious of Type 1 versus Type 2 reports, as Type 1 provides an attestation of controls at a single point in time, while Type 2 covers a longer period and includes testing of control effectiveness. Examine the report's exceptions and the auditor's opinion, as these may provide insights into ongoing issues or areas requiring improvement.

Lastly, remember that SOC 2 does not address AI-specific risks unless the vendor explicitly includes them in the scope. If a vendor lacks a SOC 2 report, seek alternative evidence such as recent penetration test summaries, completed security questionnaires, documented security policies, and a plan for future audits. Lastly, consider the OWASP Top 10 for Large Language Model (LLM) Applications (2025 edition) as a practical checklist to assess potential vulnerabilities in AI systems, such as prompt injection, sensitive information disclosure, supply chain, data poisoning, output handling issues, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. Transform these concerns into specific questions to ask the vendor.