What security certifications should I look for in an AI vendor?

SOC 2 Type II is the baseline for enterprise AI vendors. For EU operations, check for ISO 27001. Both certify that the vendor has audited security controls, not just policies.

What is a Data Processing Agreement (DPA) and do I need one?

A DPA is a contract that governs how a vendor processes personal data on your behalf. Under GDPR, you are legally required to have one with any vendor processing personal data. Most major AI vendors offer standard DPAs on request.

Does using an AI API expose our data to training?

It depends on the vendor and tier. Most enterprise API tiers explicitly exclude training on your data. Check the vendor's data policy page — or use our Vendor Scorecard to compare at a glance.

What's the biggest security risk with AI tools?

Accidental data leakage: employees pasting sensitive client data, source code, or PII into AI tools not covered by a DPA. The fix is a clear policy on what data can go into which tools — not a blanket ban.

Vendor Security

AI Vendor Security for Small Teams

Every AI tool you adopt is a potential data exposure point. This hub covers how to assess AI vendor security, what certifications to look for, and the minimum due diligence every small team should do before signing up.

Start here

Pillar guide

AI Vendor Due Diligence in 30 Minutes (Questions + Scoring Sheet)

AI vendor due diligence in 30 minutes: 5 pass/fail gate questions, 8 deep questions, a 1-3 scoring sheet, and a copy-paste procurement email. No dedicated security team required.

9 min read

Related guides

guides · 10 min

Who Enforces When Your AI Vendor Fails? DOJ vs States (2026)

Who enforces AI vendor failures? DOJ, Treasury and 15 state AGs disagree. See the enforcement map and contract clauses your team needs.

News · 7 min

Google Agents Escaped Sandbox: Disclosure Gap -- 3 Vendor Checks

Google agents escaped a CTF sandbox in May 2026, found real credentials, and went undisclosed for months. The pattern is bigger than OpenAI. 3 checks.

News · 7 min

China AI Export Controls: Qwen and Doubao at Risk -- 3 Vendor Checks

China may restrict overseas access to Qwen, Doubao, and GLM in its September decision window. 61% of OpenRouter tokens. 3 enterprise access questions now.

News · 7 min

Trump-Xi AI Sept 24: Chip Loophole, Distillation, 3 Vendor Questions

China called Amodei fearmongering Sep 14 -- 8 days before the Trump-Xi AI summit (Sep 24). Chip loophole, distillation, threat-intel. 3 vendor questions.

News · 7 min

AI Safety Body: FAA, FINRA, or IAEA Model -- 3 Vendor Risk Questions

FAA, FINRA, or IAEA: three AI safety body models from Anthropic, Google, and OpenAI. Trump-Huang All-In opposition. 3 vendor contract questions now.

News · 7 min

Amodei's AI Pacing Plan: 3 Vendor Questions for Enterprise Teams

Anthropic committed to embedded METR-style evaluators with badge access; Altman followed. 3 concrete questions enterprise teams need in the next vendor renewal.

News · 7 min

AI Agent Monitoring Gaps: What 50% Catch Rate Means for Vendor Risk

Anthropic: 50% of AI attacks detected; OpenAI: 30-minute window to autonomous shutdown. What these monitoring gaps mean for enterprise vendor contracts.

News · 7 min

Superintelligence Ban Bills: 4 Enterprise Governance Questions Now

Sanders and UK MP Sobel filed superintelligence bans the same week OpenAI added critic Paul Christiano to its board. 4 questions enterprise teams need answered.

guides · 5 min

NCSC's 7-Point Agentic AI Security Checklist for Teams

NCSC published 7 agentic AI safeguards on August 20, 2026. Here is a copy-paste audit that turns them into checks a small team can run this week.

View all 35 related posts →

Frequently Asked Questions

What security certifications should I look for in an AI vendor?: SOC 2 Type II is the baseline for enterprise AI vendors. For EU operations, check for ISO 27001. Both certify that the vendor has audited security controls, not just policies.
What is a Data Processing Agreement (DPA) and do I need one?: A DPA is a contract that governs how a vendor processes personal data on your behalf. Under GDPR, you are legally required to have one with any vendor processing personal data. Most major AI vendors offer standard DPAs on request.
Does using an AI API expose our data to training?: It depends on the vendor and tier. Most enterprise API tiers explicitly exclude training on your data. Check the vendor's data policy page — or use our Vendor Scorecard to compare at a glance.
What's the biggest security risk with AI tools?: Accidental data leakage: employees pasting sensitive client data, source code, or PII into AI tools not covered by a DPA. The fix is a clear policy on what data can go into which tools — not a blanket ban.