The short answer
Standard vendor security questionnaires (such as SIG or CAIQ) focus heavily on traditional cloud infrastructure risks—such as firewall rules, SOC 2 reports, and encryption at rest. They miss the unique vulnerabilities inherent to AI SaaS: model training defaults, prompt log retention, sub-processor GPU routing, and prompt injection defenses.
To conduct a rigorous security review of an AI vendor, security teams must add an AI-specific audit questionnaire covering data usage rights, inference boundaries, zero-data-retention options, and liability.
The 5 Essential AI Security Audit Pillars
When evaluating an AI vendor, organize your assessment into five security pillars:
1. Data Governance & Model Training
- Does the vendor train public or shared foundation models on customer prompts, completions, or embeddings?
- Is training disabled by default across all plan tiers, or does it require manual account opt-out?
- Does the vendor use customer data to fine-tune tenant-specific models, and if so, how are those weights isolated?
2. Prompt Retention & Logging
- How long are customer prompts and completions retained in vendor databases?
- Are prompt logs subject to human safety reviews by vendor personnel or third-party contractors?
- Does the vendor offer a Zero Data Retention (ZDR) configuration for API endpoints?
3. Architecture & Data Residency
- Where does prompt inference take place? Does inference occur in the same region as static data storage? Read our analysis on EU data residency for AI: inference vs storage.
- What sub-processors are utilized for GPU hosting or safety filtering, and where are they located?
4. Vulnerability & Model Defense
- Does the vendor implement automated prompt injection filtering on inputs and outputs? Read our guide on prompt injection explained.
- How does the vendor handle system prompt leakage and vector embedding isolation in multi-tenant environments?
5. Contractual & Compliance Guarantees
- Does the vendor provide a signed GDPR Article 28 Data Processing Addendum (DPA)?
- Does the vendor offer intellectual property (IP) indemnification for generated code or text outputs?
AI Vendor Security Questionnaire Template
Copy and send these 12 core questions to vendor security teams during procurement:
### Section A: Data Usage & Model Training
1. Are customer prompts, completions, uploaded files, or embeddings used to train, retrain, or improve foundation models?
2. If model training can be disabled, is opt-out enabled by default for our subscription tier, or is manual configuration required?
### Section B: Data Retention & Access
3. What is the standard data retention period for prompt logs and API requests?
4. Are customer prompts or completions subject to human review by vendor staff or contractors for trust, safety, or quality control?
5. Do you support Zero Data Retention (ZDR) where prompts are purged immediately after inference?
### Section C: Data Residency & Sub-processors
6. In which geographic regions is customer data stored at rest?
7. In which geographic regions does model inference execute?
8. Please provide a link to your current list of named sub-processors, including GPU cloud providers.
### Section D: Security Controls & Compliance
9. Do you maintain an active SOC 2 Type II report and/or ISO 27001 certification covering your AI processing infrastructure?
10. Do you provide a standard GDPR Article 28 Data Processing Addendum (DPA)?
11. What technical controls prevent cross-tenant data access in vector databases or fine-tuned model environments?
12. Do you offer IP indemnification against third-party copyright claims for generated outputs?Vendor Evaluation Scoring Matrix
Use this matrix to assign risk scores to vendor responses:
| Question Area | Low Risk (Pass) | Medium Risk (Caution) | High Risk (Fail) |
|---|---|---|---|
| Model Training | Strictly prohibited by contract | Opt-out available in settings | On by default / No opt-out |
| Data Retention | ZDR or <= 30-day automated purge | 30–90 days with admin access | Indefinite retention |
| Human Review | Excluded / No human access | Restricted to flagged safety logs | Regular human review |
| Inference Location | Guaranteed regional (e.g., EU) | Contractual region with fallback | Global unconstrained routing |
| DPA & Compliance | Signed DPA + SOC 2 Type II | Standard DPA without SOC 2 | No DPA / Consumer terms |
To review existing vendor dossiers and security profiles, visit our provider directory and consult our guide on how to judge an AI provider.