AI procurement has a trust problem: capabilities are easy to demo, but data handling is invisible. The gap between vendors is enormous, and it doesn't show up in the sales deck. These are the questions we believe every buyer should ask — with our answers on record, so you can hold us to them.
Data handling
Ask: Is our data used to train models? (Ours: no — we operate under enterprise API terms with training explicitly excluded.) Where is data processed and stored, and can you meet our residency needs? (Configurable per client, with US and EU processing available.) What's retained after a conversation ends, and for how long? (Retention is contract-defined per client; the default keeps transcripts for quality review with configurable expiry, and you can request zero-retention modes for sensitive flows.)
Ask: Who at the vendor can see our data? (Access is role-restricted to your named engineering pod, logged, and reviewable.) What happens at contract end? (Export in standard formats, then verified deletion with certification.)
System behavior
Ask: What stops the agent from being manipulated into leaking data or taking unauthorized actions? Serious vendors will talk about layered controls — input isolation, action allowlists, per-integration permission scoping, and rate limits — rather than claiming a model is 'aligned'. Prompt injection is an engineering problem you contain, not a solved research question, and any vendor who says otherwise is a red flag.
Ask: What can the agent actually do in our systems, and what requires human approval? You should receive an explicit action inventory with permission tiers — and it should be shorter than you expect. The best deployments grant narrow, auditable capabilities and expand them with demonstrated reliability.
Finally, ask for the audit trail. Every action our agents take is logged with the triggering context, the decision path, and the outcome. When something goes wrong — and in any real system, something eventually does — the difference between a contained incident and a crisis is whether you can reconstruct exactly what happened in minutes.