1. Do they NOT train foundation models on your data?

Yes No / Not sure

Enterprise OpenAI, Anthropic, and Azure OpenAI all have this.

2. Is retention configurable (30 days or less)?

Yes No / Not sure

Shorter retention = smaller breach blast radius.

3. SOC 2 Type II report available?

Yes No / Not sure

Baseline for enterprise use.

4. DPA available and signable?

Yes No / Not sure

Required for EU / HIPAA / CCPA contexts.

5. Single-tenant isolation option for regulated data?

Yes No / Not sure

Needed in finance / health / gov.

6. Clear data-residency options (US / EU)?

Yes No / Not sure

Jurisdictional compliance.

7. Audit logs exportable for your SIEM?

Yes No / Not sure

Detect anomalies / privilege escalation.

8. Customer-managed encryption keys (CMK) support?

Yes No / Not sure

For the most-regulated verticals.

9. Breach notification SLA documented?

Yes No / Not sure

< 72 hours is modern standard.

10. Transparency around sub-processors?

Yes No / Not sure

Your data may touch their vendors too.

11. Cyber insurance of their own?

Yes No / Not sure

Signals the financial responsibility.

12. Can you export all data on exit?

Yes No / Not sure

Avoid vendor lock-in.

AI Vendor Risk Checker