“Is this tool safe?” is the wrong question, because the same tool can be fine on one plan and a problem on another. These are the 5 we ask, and where we look for the answers.
- Does the vendor train on our content, on this plan? The answer is in the terms or the data agreement, not the marketing page.
- How long is it kept, and can we shorten that? Retention is separate from training. A tool can do neither, one or both.
- If we connect it, what can it see and do? Reading and acting are different permissions.
- What controls do we get? Single sign-on, an audit log, and the ability to turn features off.
- What happens when we leave? Export, deletion, and whether deletion covers backups.
Where the answers come from
Only from the vendor’s own documentation, with the date we read it. Policies change, sometimes monthly, so an answer without a date isn’t worth much.
We publish what we find in the AI tool register, and the questions themselves are in the vendor risk assessment template if you want to run them on a tool we haven’t covered.
What we don’t do
We don’t rank tools or recommend one over another. We have no product to sell and take no referral fees, so the register can say what the documentation says and stop there.
