Most AI vendor security questionnaires are a SaaS questionnaire from several years ago with the word AI added to the header. They ask about encryption at rest, single sign-on, backup frequency and breach notification windows. All of that still matters, and none of it describes the parts of an AI system that actually carry your content. A questionnaire built for a database never asks where a prompt is processed, whether the retrieval index enforces the permissions of the documents it was built from, or what a self-contained on-premises install transmits outbound overnight.
The set below is organised by theme so it can be pasted into an RFP or a vendor assessment without rewriting, and each question carries what a competent answer contains and what should give you pause. It assumes you have a view already on the deployment posture your data requires; if that is still open, the on-premises AI guide works through the ladder from region pinning to full air-gap. Ask for answers in writing and ask who wrote them, because an answer from a solutions engineer and an answer from a legal team fail in different directions. Treat a concerning answer as a follow-up rather than a verdict, since what you are measuring is how precisely a vendor can describe their own system.
None of these questions is invented, and it is worth saying which published framework each theme answers to, because "our questionnaire is based on X" is a much shorter conversation with a vendor's compliance team than "we would like to know about Y". Four documents cover the ground between them. NIST SP 800-53 Rev. 5 supplies the control vocabulary in 20 families, and the identifiers used below come from it. NIST AI 100-1, the AI Risk Management Framework 1.0, published in January 2023, organises AI-specific risk work into the functions GOVERN, MAP, MEASURE and MANAGE, of which GOVERN "cultivates and implements a culture of risk management within organizations designing, developing, deploying, evaluating, or acquiring AI systems", and that last word is why a buyer's questionnaire is inside its scope rather than outside it. The OWASP Top 10 for LLM Applications names the failure modes, and two of them, LLM02:2025 Sensitive Information Disclosure and LLM08:2025 Vector and Embedding Weaknesses, are what most of the sections below are testing for. ISO/IEC 42001 is the certifiable AI management system standard, which matters mainly because a vendor holding it has been audited on process rather than merely asserting it.
Prompt and content handling
Everything else depends on this section, because the prompt is where the sensitive material travels. Model weights are not the payload. The case file pasted into a context window is.
| Question |
A good answer contains |
What should concern you |
| Where is a prompt processed, and does that change by feature? |
Region and operator named per feature, generation through embedding |
One region named platform-wide, or storage location given instead of processing |
| Is prompt content retained after the response returns, and for how long? |
A period per component, caches and queues included, with the deletion mechanism |
"We do not store your data", with caches and log pipelines unaddressed |
| Does prompt or retrieved content reach logs, error messages or support tickets? |
What each log level holds, whether content is stripped, and who can read it |
Logs described as metadata only, with metadata undefined |
| What happens to content in a request that fails part-way through? |
Partial artefacts, dead-letter queues and retry buffers under the same rules |
An answer covering only the success path |
The per-feature version of the first question earns its place. Hybrid architectures are common and often undocumented, with retrieval running locally while generation calls a hosted API, which sends every retrieved passage outward inside the prompt while the architecture diagram still looks contained.
Training and model improvement
Every vendor expects the training question and has a prepared answer, so the value sits in the follow-ups.
| Question |
A good answer contains |
What should concern you |
| Is customer content used to train or fine-tune any model? |
An unqualified no, or an opt-in needing separate written authorization |
A no scoped to "production models", leaving fine-tuning and adapters outside it |
| Is it used for evaluation, benchmarking, quality review, safety filtering or abuse monitoring? |
Each purpose answered by name, with retention and access for each |
A training denial that goes quiet once you list the other purposes |
| Do human reviewers, yours or a subprocessor's, ever see customer content? |
The circumstances, the approval path, and whether reviewers are employees |
"Only when necessary to provide support", undefined |
| Which document carries these commitments, and can they change without my agreement? |
The agreement or the data processing addendum, under change control |
A commitment living only on a page the vendor edits unilaterally |
Abuse monitoring and safety filtering are legitimate functions and they are also content-access paths, so establish whether they apply to your deployment model or only to the shared multi-tenant service.
Telemetry and phone-home behaviour
This is the section most questionnaires miss entirely. Once software sits inside your own data centre people stop asking what it sends out, on the assumption that on-premises means self-contained. Very little enterprise software is self-contained by default.
| Question |
A good answer contains |
What should concern you |
| What outbound connections does an on-premises install make, to where, how often? |
An egress list with hostname, port, purpose and frequency for every entry |
An assurance that nothing leaves, with no list you could turn into a firewall rule |
| Can crash dumps or diagnostic bundles contain customer content? |
An honest yes, with local-only dumps, scrubbing, and approval before anything leaves |
A flat no, which usually means nobody has looked at a memory dump |
| Does licence or usage metering transmit anything beyond counts? |
The payload described with a sample, and whether metering runs offline |
"Just usage data" |
| Can telemetry be disabled entirely, and what do I lose by disabling it? |
A supported setting, the support consequences, and no licence term breached |
Telemetry removable only by unsupported means, or whose removal voids support |
| Will you support a packet capture during a proof of concept? |
Yes, with help interpreting the result |
Reluctance, or a claim that the traffic pattern is proprietary |
Crash dumps deserve the follow-up. A dump is a snapshot of process memory, and the memory of an inference service holds whatever it was working on when it failed, which is the material you deployed on-premises to contain. Make the egress list a contractual deliverable before signature and re-verify it after major upgrades, because one new feature can add an endpoint nobody mentioned.
Subprocessors and model providers
The subprocessor list is where a system's real perimeter gets written down, and it is the document most likely to be out of date.
| Question |
A good answer contains |
What should concern you |
| Provide the current subprocessor list, with each party's function and country. |
A dated list naming party, function and processing location |
Corporate names with no functions, or model providers left off as "just an API" |
| Is the model provider a subprocessor, and do my terms flow down to it? |
Yes, named as such, with obligations flowed down and evidenced |
Model providers kept outside the data processing addendum |
| How am I notified of changes, with how much notice, and can I object? |
A subscription, notice before the change takes effect, and an objection right |
Notification by web page update, with the customer expected to check |
| Which subprocessors can access content, and which see only metadata? |
The distinction drawn party by party, with the control enforcing it |
An undifferentiated list treating storage and inference alike |
For organizations with a jurisdictional obligation rather than a geographic one, subprocessor country matters more than the primary region. A vendor operating entirely inside your borders can still rely on a subprocessor whose parent is subject to another country's disclosure law, and that mechanism, along with which contractual controls fix it and which only document it, is worked through in data residency and jurisdiction for AI.
Model provenance and versioning
Buyers ask which model a vendor uses. They almost never ask which version, or whether the record of an output names it.
| Question |
A good answer contains |
What should concern you |
| Which model and version serves each feature? |
A per-feature inventory naming family, version and provider, under NDA if needed |
One model named for the whole product |
| Is the model version recorded with each output and kept with the record? |
Version stamped into output metadata, held for the life of the record |
Versions kept only in application logs on a short rotation |
| How are model changes communicated, and with how much notice? |
A release channel, advance notice, and a changelog naming version transitions |
Silent upgrades justified as continuous improvement |
| Can I pin a version, for how long, and is a pinned version still patched? |
Pinning supported, with a stated support window and a patching commitment |
Pinning unavailable, or offered with no commitment to patch it |
An accuracy figure measured during acceptance testing describes the model serving you that week, so without version recording you cannot tell whether a later drop in quality is your data changing or the model changing underneath you. And when an output is relied on in a proceeding, the record has to show which version produced it, from which input, under which prompt, and what a reviewer altered, which chain of custody for AI outputs sets out in full.
Retrieval and index security
A vector index is a derived copy of the corpus it was built from, and it is routinely governed as something less than that. This is not a niche worry. It is OWASP LLM08:2025, which warns that "attackers can exploit vulnerabilities to invert embeddings and recover significant amounts of source information", and that in shared vector databases "there's a risk of context leakage between users or queries". The measured version is Vec2Text, which recovered 92% of 32-token passages exactly and, on clinical notes, 94% of first names and 95% of last names, with the caveats that it needs query access to the same embedding model and degrades as passages lengthen.
| Question |
A good answer contains |
What should concern you |
| Where does the index live, where does embedding run, and who operates each? |
Both locations and operators named, with an option to keep them local |
A vendor-held index over customer-held documents, called local retrieval |
| Is the index encrypted, and do embeddings carry their source classification? |
Encryption stated, and embeddings inheriting classification in policy and access control |
Embeddings treated as anonymised data outside the controls on the originals |
| Does retrieval enforce source permissions at query time, or a copy taken at ingest? |
Delegated passthrough, or an ingest-time mapping revalidated at query time |
A flattened index where anything indexed is retrievable by anyone |
| What happens when a document is deleted, sealed or narrowed? |
Propagation within a stated interval, with behaviour defined for queries in flight |
Reindexing nightly or weekly with no interim suppression |
Permission flattening does the most damage in practice, because it turns a retrieval assistant into a bypass for every access control the organization spent years configuring. A document an employee cannot open in the source system becomes summarisable and quotable through the chat window. Ask for a demonstration rather than a statement, using two accounts at different permission levels asking the same question.
Key custody and staff access
| Question |
A good answer contains |
What should concern you |
| Who holds the encryption keys, and can we hold them ourselves? |
Custody per layer, with a customer-managed key option and its consequences |
"Encrypted with AES-256" offered as an answer about custody |
| What standing access do your staff have to production systems holding our content? |
Zero standing access, with elevation required per incident |
Persistent support access to production, justified by response times |
| How is break-glass approved and bounded, and do we see the log? |
Documented approval, time-boxed sessions, enforced MFA, session logging, and the log shared |
Break-glass logged internally and not disclosable, or access only the vendor can remove |
| Where are the people who could reach our content, and how are they screened? |
Locations and screening described, with support confinable to one jurisdiction |
An answer that omits subcontracted after-hours cover |
On-premises deployment moves operational responsibility to the customer without automatically removing vendor access, because remote support tunnels usually survive the move. Ask whether the support path is inbound to your network or initiated outbound from it, who can open it, and whether it closes on its own.
Disconnected operation
Ask these even if you never intend to run disconnected, because the answers reveal how much of the product depends on the vendor's cloud.
| Question |
A good answer contains |
What should concern you |
| Does the product run with no outbound internet, and which features stop? |
A named list of what degrades, what disappears, and what runs wholly local |
"It supports on-premises deployment" offered as the answer |
| How do weights, images, patches and detection signatures reach a disconnected site? |
Media transfer with checksums and signatures, and a review step at the boundary |
An update path that quietly assumes a proxy to the internet |
| How does licensing work offline, and what happens when a licence lapses? |
Offline licence files with a stated term and grace behaviour that warns |
Validation that phones home and blocks when it cannot reach the vendor |
| What does support look like for a site you cannot reach? |
Export and review of sanitised diagnostics, by staff who have done it before |
Support that assumes remote access into the environment |
Which capabilities survive disconnection, which change shape, and which break outright is covered in air-gapped AI and what works with no internet.
Compliance claims, and how to test them
Certifications get abbreviated in sales conversations until the abbreviation stops carrying information. The discipline that fixes this is to ask for the artefact rather than the name, and to establish who holds it.
For a certification, request the certificate, with issuing body, certificate number, issue and expiry dates, and the scope statement. Scope is where the useful detail hides, since a certification can legitimately cover one office, a corporate IT function, or a single service line rather than the product you are buying. ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements", and ISO/IEC 42001:2023, "Information technology — Artificial intelligence — Management system", are both certifiable, so a certificate number exists and can be checked. The second is the one to ask about specifically for AI work, because ISO describes it as specifying "requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations", which is process assurance about how a vendor runs AI rather than about the product.
SOC 2 is a different instrument and the difference matters. The AICPA publishes the Trust Services Criteria across five categories, Security, Availability, Processing Integrity, Confidentiality and Privacy, and describes them as being for use "in attestation or consulting engagements to evaluate and report on controls". So ask for the report rather than a certificate, along with the audit period, the categories in scope and the exceptions the auditor recorded. Then check whose report it is, because an infrastructure provider's attestation covers the infrastructure and leaves the application on top of it outside the audit boundary. A vendor offering their host's SOC 2 as their own has answered a different question than the one you asked.
For an authorization, ask which legal entity holds it and for which service offering, then confirm it against the public listing the authorizing programme maintains. Software deployed onto authorized infrastructure inherits infrastructure controls without becoming authorized itself, which is the real difference between a vendor saying their platform is deployable on FedRAMP High-authorized infrastructure and a vendor saying they hold a FedRAMP authorization. Only one of those has to appear in a marketplace listing.
Then comes the category that teaches you the most, a framework with no certifying body at all. CJIS is the clearest example. The CJIS Security Policy, currently version 6.1 dated 06/25/2026, is issued by the FBI's CJIS Division and enforced through the state CJIS Systems Agency, which audits the agency holding the data rather than the agency's software vendors. The policy places contractors inside that audit rather than beside it, requiring that private contractors performing criminal justice functions "shall be subject to the same extent of audit review as are local user agencies". No body issues a CJIS certification to a vendor and no registry of certified vendors exists. What does exist is a vendor signing the CJIS Security Addendum, which the policy defines as an addendum "approved by the Director of the FBI, acting for the U.S. Attorney General", personnel screening under PS-3 including state-of-residency and national fingerprint-based record checks, literacy training under AT-2, and technical controls such as SC-13's requirement for FIPS 140-3 modules at a minimum 256-bit symmetric key, with FIPS 140-2 certificates unacceptable after 21 September 2026. Ask a vendor for the certificate number and the date, and you will learn quickly whether they have read the policy. A vendor advertising itself as CJIS certified is telling you either that they have not read how the policy is enforced, or that they have and published the claim anyway. You have learned something about their rigour before asking a single technical question, and their other claims deserve the same scepticism.
| Question |
A good answer contains |
What should concern you |
| Send me the certificate or the report itself. |
The document, with issuing body, identifier, dates and scope statement |
A logo wall, or "after NDA" repeated once the NDA is signed |
| Which legal entity and which services are in scope? |
Entity and services named, matching the product on the order form |
Scope covering a parent, another subsidiary, or corporate IT |
| Is this authorization yours or your hosting provider's? |
A split between inherited infrastructure controls and what you hold yourself |
Infrastructure certifications presented as the vendor's own |
| For a framework with no certifying body, what backs the claim? |
Alignment claimed explicitly, with a control mapping and who performed it |
A certification claim for a framework nobody certifies |
The same questions, pointed at us
An article arguing that vendors should answer precisely has to answer precisely.
VIDIZMO holds ISO/IEC 27001:2022 certification under certificate RA-2507091, and that is the only third-party certification VIDIZMO holds. VIDIZMO's processes and software are aligned with NIST SP 800-53, and the platform is deployable on FedRAMP High-authorized infrastructure, either Project Hosts' FedRAMP-authorized environment or Microsoft Azure Government with agency sponsorship. VIDIZMO does not hold its own FedRAMP authorization. VIDIZMO is CJIS Security Policy-aligned, the agency holds the CJIS compliance obligation, and VIDIZMO's controls support it. Where SOC 2 Type II appears in a control inheritance discussion it belongs to the Microsoft Azure infrastructure and is not a VIDIZMO audit.
On training, AI does not train on customer data by default, and doing so requires explicit written authorization. On staff access, VIDIZMO holds no standing access to customer environments, with break-glass access only, time-bound, MFA-enforced and logged. Security incidents are publicly documented on the VIDIZMO helpsite, and affected customers are notified within 2 business days of confirmation. In on-premises and air-gapped deployments, generation runs against self-hosted models on the customer's own hardware rather than a hosted API, and the same holds for speech-to-text, translation, OCR, detection, entity detection and embedding generation.
Reading the answers as a set
Individually these answers look like a list of controls. Together they show whether the vendor holds an accurate model of their own system, which is what you are really assessing, because a vendor who cannot describe their data flows cannot defend them either.
Look for internal consistency first. A vendor confident about data residency who cannot enumerate outbound connections has answered a marketing question and never mapped the architecture. A vendor with a crisp subprocessor list who cannot say which model version served an output has strong legal process and thin engineering discipline. Then look at the shape of the denials, because a bounded no with named exceptions is better evidence than a sweeping assurance. The vendor who says crash dumps can contain content, and here is how we keep them local, is more trustworthy than the one who says nothing ever leaves.
Finally, check that the contract carries what the questionnaire says, because intent that appears in no signed document changes at the vendor's convenience. Move the commitments that matter into the agreement, then re-run the set at renewal and after any major upgrade, since a single release can add a new endpoint, a new subprocessor and a new model provider without any of them surfacing in a release note you would have read.
