AI vendor evaluation often starts with model quality.
Accuracy. Latency. Price. Context window.
Then procurement asks:
“Do you have SOC 2?”
Privacy questions arrive last.
That order should change.
If customer data is sent to an AI provider, you need to know what the provider does with the input and output, how long it keeps them, where processing happens, and which downstream providers are involved.
The 15 questions
1. What data can we send?
Be specific. Prompts, uploaded documents, metadata, identifiers, support text?
2. Is input retained?
For how long and for what purpose?
3. Is customer data used for model training?
Do not accept vague answers like “we do not use your data to improve our services” without defining what that means operationally.
4. Can training use be disabled contractually or technically?
5. Are prompts and outputs logged?
Where?
For how long?
6. Who can access the data?
Employees, trust and safety teams, support teams, subprocessors?
7. Where is the data processed?
Country and region matter.
8. Who are the subprocessors?
9. Can the vendor delete a specific user's data?
Ask how.
10. What happens to backups?
11. What is the breach notification process?
12. What contractual privacy terms apply?
13. Can the vendor change its data-use practices without notice?
14. What telemetry is collected outside the model input?
Billing, abuse monitoring, diagnostics, device data, and usage logs can all be relevant.
15. What happens if we terminate the contract?
Can all customer data be returned and deleted?
Turn answers into an architecture decision
Do not file the questionnaire away.
Map the answers:
Provider
→ input data
→ purpose
→ region
→ retention
→ subprocessor
→ deletion
→ contract
Then connect the result to the product's data map.
Classify AI vendors by risk
A generic text-generation tool used only with public data is different from an AI service receiving:
- KYC documents
- Medical notes
- Financial records
- Children's data
- Large-scale customer conversations
The latter deserve deeper review.
The best test question
Ask the vendor:
“Show me what happens when one of our users asks us to delete their data.”
If nobody can explain the workflow, you have learned more than the sales deck would tell you.
Where Privra fits
Privra can surface AI vendors as part of your wider processor and data-flow inventory, then track their role, data categories, contractual status, retention, and deletion path.
The best AI vendor is not only the model with the best benchmark.
It is the one you can govern.