AI Vendor Security Questionnaire: Questions to Ask

An AI vendor security questionnaire is the list of questions you send to a company before your team starts putting work data into its assistant, chatbot or automation tool. A good one is short enough that the vendor will answer it honestly and specific enough that vague marketing language cannot pass for an answer. This guide gives you the questions that matter, explains what a good and a worrying reply look like, and shows how an assistant can help you prepare the questionnaire and read the replies.

It is written for founders, IT leads, office managers, procurement staff and anyone asked “can we use this AI tool?” without a security department to hand. It is practical rather than legal advice: for regulated sectors, involve your data protection officer or counsel. Throughout, Ask Mio is used as an example only where its own public pages state a fact.

Why AI tools need their own questions

A standard software questionnaire asks about hosting, access control, backups and incident handling. Those still apply. AI tools add questions that older software never raised.

Your inputs may be used to improve the product. Some services train or tune models on customer conversations unless you opt out.
Prompts are free text. People paste contracts, customer lists and source code, so the data is rarely what the procurement form assumed.
Third parties are involved. Many AI products pass requests to other providers, which means your data may cross more than one company.
Outputs are untrusted. A model can be manipulated by text hidden in a document, an issue known as prompt injection, and can state falsehoods confidently.
Connections multiply risk. Assistants that read your mail, files or code repositories carry whatever access you grant them.

Our guide to AI terms of service red flags covers the contract side. This article covers the questions to ask before you read the contract closely.

How to use the AI vendor security questionnaire

Keep the process proportionate. A tool that only drafts marketing copy from public information needs fewer questions than one that reads customer emails. Sort the tool into a risk tier first.

Tier	Typical use	Depth of review
Low	Brainstorming, public-information drafting, learning	Terms, privacy policy, training and retention questions
Medium	Internal documents, meeting notes, code that is not secret, customer-facing drafts	Full questionnaire below, plus a contract check
High	Personal data, health, finance, legal files, credentials, source code that is a trade secret	Full questionnaire, data protection impact assessment, written assurances and a pilot

For the high tier, the process in our guide to data protection impact assessments for AI tools gives a structure to follow.

Section 1: Data use and training

This section matters most, so start here. Questions to ask:

Is customer content, including prompts, files and outputs, used to train or improve any model, yours or a third party’s?
If the answer is “only if you opt in” or “only on free plans”, where exactly is that written, and is the setting per user or per organisation?
Do human reviewers ever read customer conversations, and under what conditions?
Are conversations used for analytics or product research in a form that identifies the customer?

A good answer is short and unambiguous, such as “no, customer content is not used to train models”, with a link to the policy. A worrying answer buries the point in conditions or says “we may use data to improve our services” without defining the term. Ask Mio’s public pricing page states that data is not used to train models and that users can export or delete their chats and files at any time. That is the kind of plain statement to look for, and you should still verify any vendor’s claim against its policy and terms.

Section 2: Storage, retention and deletion

What exactly is stored: prompts, outputs, uploaded files, metadata, logs?
For how long, and can the customer shorten that period?
Can a user or administrator delete conversations, and does deletion also remove backups and copies held by sub-processors? How long does that take?
Can customers export their data in a usable format?
What happens to data when the contract ends?

Watch for answers that confirm deletion in the interface but say nothing about backups or partners. A mature vendor can state a schedule. If you are unsure what retention looks like in practice, our article on AI chat history retention explains the options.

Section 3: Sub-processors and where data goes

Which other companies process customer content on your behalf, for what purpose and in which countries?
Do you send requests to external model providers, and if so, what do those providers contractually agree to about retention and training?
Will you notify us before adding or changing a sub-processor, and can we object?
Is there a list we can see without signing a non-disclosure agreement?

Many services route to several providers behind the scenes. That is not wrong, but it means the vendor’s promise is only as strong as its contracts with those providers. Our guide to AI data residency explains why the location of processing is a legal question, not just a technical one.

Section 4: Security controls

How is data encrypted in transit and at rest?
Does the product support single sign-on, multi-factor authentication and role-based access?
Who inside the vendor can access customer content, and how is that access logged and reviewed?
Do you run independent security tests, and can you share a summary?
Do you hold an independent assurance report or certification? If so, which, for what scope and how recent is it?
How are vulnerabilities reported, and how quickly are they fixed?

Certifications such as SOC 2 or ISO 27001 are useful signals. Read the scope, because a report may cover only part of the service. The pages on SOC 2 and ISO/IEC 27001 explain what each covers. A young company without a certificate is not automatically unsafe, but it should be able to describe its controls clearly. The NIST Cybersecurity Framework offers a neutral vocabulary for what to ask.

Section 5: Model-specific risks

How does the product defend against prompt injection from uploaded documents, web pages and connected sources?
What actions can the assistant take on its own, such as sending mail, editing files or running code, and can those be switched off or require confirmation?
Is generated code run in an isolated sandbox, and what can it reach?
Are outputs filtered or logged, and can we see the logs?
What does the product do to reduce invented facts, and does it show sources when it searches the web?

The OWASP Top Ten is the standard reference for web application risks, and OWASP also maintains guidance specific to language-model applications. Our explainer on prompt injection shows what the attack looks like in plain terms. A good vendor will describe a boundary, such as “connectors read only unless you enable write actions”, rather than say “our AI is safe”.

Section 6: Incidents, availability and support

What is your process if customer data is exposed, and within what time will you notify us?
Has there been a security incident in the past three years, and what changed afterwards?
What is the uptime history and what happens to our work if the service is unavailable?
Who do we contact for a security issue, and how fast do you respond?

For your side of a breach, see our guide on what to do after an AI data leak. The honest vendors are the ones who answer the incident question directly instead of saying “none to date” and moving on.

Section 7: Business and legal

Which legal entity provides the service, and under which country’s law does the contract operate?
Will you sign a data processing agreement before we use the service with personal data?
What are your limits on liability, and are there exclusions for data incidents?
How do you handle our confidential information in the terms?
Can we leave easily, and is there a price lock or notice period for changes?

This list is long, so trim it. Thirty-three questions is a lot for a small vendor; pick the ones that match your risk tier and send those. The point is not to impress the vendor with paperwork but to learn what you cannot see from the marketing page.

Using an assistant to prepare and review

An assistant is useful on both sides of the process, provided you do not paste confidential material into a tool you have not vetted.

Preparing the questionnaire

Describe the tool, what staff will use it for and the data involved, and ask Mio to select and reorder the questions for your risk tier. Ask for a version in plain language for a non-technical vendor, and a short cover note. This turns the full list into a one-page request that gets answered.

Reading the answers

Paste the vendor’s reply, with company details removed if you wish, and ask for three things: statements that are specific and verifiable, statements that are vague or conditional, and questions the reply avoided. This catches the common pattern where a long answer never addresses the one thing you asked. Then verify the important claims yourself against the vendor’s published policies.

Comparing two vendors

Give the assistant both sets of answers and ask for a table covering the same dimensions. Check it against the original text. Our guide for procurement teams has related prompts.

Turning answers into a decision

Mark each question as satisfied, partly satisfied or unsatisfied.
Identify deal-breakers for your tier, such as training on customer content or no deletion route.
Decide which gaps can be handled by policy, for example forbidding pasting customer data until a data processing agreement is signed.
Record the decision, the date and who made it. Review it at renewal, because products change.

Pair the decision with a usage policy. Our guide to a company AI use policy shows how to set the rules, and the piece on shadow AI at work explains why banning tools outright tends to push use out of sight.

Cost and plan notes

Preparing and reviewing a questionnaire is ordinary Chat and Write work. Ask Mio’s free plan includes 600 points a month with a normal chat reply costing 1 point and a long one 3, so a full questionnaire cycle fits comfortably. Uploading a vendor’s PDF policy for analysis needs a paid plan, from €5 a month. The Business plan at €29 a month adds team and shared projects for sharing the questionnaire with colleagues, with 5 seats according to the live pricing page.

Frequently Asked Questions

How long should an AI vendor security questionnaire be?

Match the length to the risk. For low-risk uses, ten questions on training, retention and deletion are enough. For tools touching personal or confidential data, use the full list of about thirty and add a data protection impact assessment. Long forms often get copied answers, so shorter and specific questions usually produce more honest replies.

What is the single most important question to ask?

Whether customer content is used to train or improve models, and where that is stated in writing. It decides whether your confidential information could influence a system other customers use. Ask for the exact policy wording, not a summary, and check whether the answer differs between free, paid and business plans.

Do I need a certification such as SOC 2 from the vendor?

Not always, but it is a helpful signal for higher-risk uses. Ask which report, what scope and what date. A young company without one should still describe its controls clearly: encryption, access logging, testing and incident handling. Treat a refusal to discuss security at all as a bigger warning than the absence of a certificate.

Can I use an AI assistant to fill in questionnaires sent to me?

Yes, for drafting, but the facts must come from your own records and a person must approve the answers. An assistant cannot know your actual controls and may produce confident but wrong statements. Use it to structure answers and tidy the wording, then have the responsible owner check each claim before sending.

What should I do if the vendor will not answer?

Treat silence as information. Restrict use to low-risk tasks with no confidential or personal data, document the decision and look at alternatives. If the tool is already in use, find out who uses it and for what, then decide whether to move that work or ask for the answers again with a deadline.

How often should I repeat the review?

At least yearly and whenever the vendor changes its terms, adds sub-processors or launches major features such as connectors that read your files or mail. Add a reminder at contract renewal, and keep the original answers so you can see what has changed.

The Bottom Line

An AI vendor security questionnaire works when it is proportionate, specific and followed by a decision someone owns. Start with data use, retention and sub-processors, add model-specific questions about prompt injection and actions the assistant can take, and record what you accept and why. If you want to see what clear public statements look like, compare vendors with the plain facts on the Ask Mio pricing page and start on the free plan with non-sensitive work.

AI Vendor Security Questionnaire: What to Ask Before Buying