AI Tool Security Checklist: What to Check First

Before company data goes into an AI tool, check six things: whether the vendor trains on your inputs, how long it retains them, which features fall outside any zero-retention deal, where inference runs by default, who the subprocessors are, and what the exceptions section of the SOC 2 report says. Those answers live in the vendor's own documentation, not in a trust-badge grid. This checklist tells you where to look and what a bad answer sounds like.

Key takeaways

• No training and no retention are two different promises, and vendors routinely make the first without the second
• Zero data retention is usually per-feature, and calling an ineligible feature quietly steps outside it
• Residency is at least two settings: where inference runs and where data sits at rest
• A SOC 2 report is a document to read, not a badge — find the exceptions and the duties it assigns to you
• Tool access changes the threat model, and prompt injection has no documented fool-proof fix

Before you paste: the three questions that decide everything#

Every AI procurement argument reduces to three questions. What data class is going in? What can the tool reach on its own? And which written commitment covers this exact plan and this exact feature?

Sort your data into three buckets before you evaluate anything: public, internal, and regulated or contractual. The bucket decides how much of the checklist you need, not the vendor's marketing page.

"No training on your data" is not "no retention of your data"#

These are separate promises, and vendors are usually precise about which one they are making. Training means your text influences model weights. Retention means a copy exists somewhere for a defined period.

Microsoft's Copilot privacy documentation says prompts, responses and Graph data are not used to train foundation models — and, in the same document, that it stores data about those interactions, including the prompt, the response and the citations.

OpenAI's API documentation says API data is not used to train or improve models unless you opt in, and separately that abuse-monitoring logs are retained up to 30 days by default. Anthropic states that commercial inputs and outputs are not used for training by default, with a documented exception: if a user clicks thumbs up or down, the entire related conversation is stored for up to five years.

That last one matters operationally. A feedback button in the UI is a data egress path, and Anthropic documents a "Rate chats" setting under Organization settings that lets a Team or Enterprise owner switch it off.

Retention windows: find the number, then find the exceptions#

The headline number is the easy part. The exceptions are where your risk lives.

Anthropic publishes a 30-day default deletion window for API inputs and outputs, and separately says flagged content can be retained for up to two years, with trust-and-safety classification scores kept up to seven. Feedback submissions carry a five-year window. Some model families carry a mandatory 30-day retention floor, which means a model choice can override a retention setting.

Google's Workspace privacy hub publishes different ranges per surface — 90 days to indefinite for Gemini in Workspace as set by admins, up to 36 months for the Gemini app, and no retention after the session ends for Gemini Notebook. Microsoft takes a different approach again: retention for stored Copilot interaction data is configured by your own admins through Purview retention policies.

So "what is your retention period?" has several correct answers per vendor. Ask instead: what is the default, what extends it, and who controls the setting?

Zero data retention is a per-feature setting, not a vendor property#

This is the item most checklists get wrong. Zero data retention is scoped to endpoints and features, not to your account.

Anthropic publishes an eligibility table marking batch processing, the Files API, code execution, programmatic tool calling, the MCP connector, agent skills and managed agents as ineligible. Batch carries 29-day retention; code execution containers keep data up to 30 days; files are retained until explicitly deleted. OpenAI's documentation shows the same shape, marking Assistants, Threads and Vector Stores as ZDR-ineligible.

Here is the part that should change your controls. Anthropic's docs state the API does not block ineligible features — using one is "a choice to step outside your ZDR arrangement for that specific data." No error, no warning, no ticket.

Also check where ZDR does not apply at all. Anthropic states it excludes Console and Workbench usage and the consumer plans, and that on Amazon Bedrock or Google Cloud the cloud provider is the data processor instead.

Data residency: where the model runs and where the data sleeps#

Ask a vendor "do you support US data residency?" and you will get a yes that answers one of two questions.

Anthropic splits it explicitly: inference geo controls where the model runs per request, and workspace geo controls where data sits at rest plus where endpoint processing such as image transcoding and code execution happens. The default inference geo is global, described as running in any available geography. Workspace geo is fixed at creation and cannot be changed afterward.

Residency also costs money and has limits. On Claude 4.6 and later models, US-only inference is priced at 1.1x standard token rates across every pricing category — input, output, cache writes and cache reads (checked August 2026) — per Anthropic's data residency documentation, and the same page states only "us" and "global" are currently available for inference geo.

Microsoft's Copilot documentation makes the capacity caveat plain: calls route to the closest regional data centers but can go to other regions during high utilization. EU traffic stays inside the EU Data Boundary, while worldwide traffic may be processed in the US, EU or elsewhere.

If your data class is regulated, verify the request-level evidence. Anthropic returns an inference_geo field in the usage object, which is the difference between a claim and a log line. If you are transferring personal data out of the EEA, the mechanism matters too — GDPR Chapter V covers adequacy decisions under Article 45 and appropriate safeguards such as standard contractual clauses under Article 46.

Subprocessors: the list, the notice period, and the contract that changes#

A subprocessor change can move your data, move its region, and change which agreement governs it. This is not hypothetical.

Microsoft's own documentation records Anthropic onboarding as a Microsoft subprocessor, and states those models are currently excluded from the EU Data Boundary and, where applicable, from in-country processing commitments. Microsoft enables them by default in most commercial cloud regions, excluding the EU/EFTA and UK, where they are off by default.

The sharper detail sits one layer down. For preview models with data retention, Microsoft documents that Anthropic acts as an independent data processor rather than a Microsoft subprocessor, and that the data is not subject to your Microsoft Customer Agreement, Product Terms or DPA. Enabling that toggle means accepting a different company's terms.

An admin console switch, in other words, can change your governing contract. Your change-management process should treat AI provider toggles as contract changes, not settings.

Subprocessor questions and what a good answer looks like

What to ask	What a good answer contains
Where is the subprocessor list published?	A public URL plus a subscription for change notifications
How much notice before a new subprocessor is authorized?	A stated period — Microsoft commits to naming new subprocessors at least six months in advance
Is there a route to object to a new subprocessor?	A contractual route; GDPR Art. 28 grants this under a general written authorisation
Does any subprocessor sit outside the region commitment?	A named exclusion list rather than a blanket assurance
Can an admin toggle change the governing agreement?	A documented answer naming the toggles that do

Six months is a real benchmark you can hold other vendors to. If a vendor cannot state any notice period, that is your finding.

What SOC 2 actually proves — and the four things to Ctrl-F#

SOC reports are internal control reports created under AICPA standards. A Type 2 report evaluates whether controls were in operation on a specified date and operating effectively over a period; Microsoft's compliance page notes Type 1 audits do not look back over a period of performance at all.

Three structural facts change how you read one. Type 2 examines a rolling 12-month window. Reports are usually issued a few months after that window ends. And under AICPA requirements they are restricted-distribution documents, not public badges — Microsoft requires an existing subscription or trial account to download them.

1. Check the period, not the date on the cover

   Find the audit period and its end date. If the window closed a long time ago, ask what covers the gap.

2. Treat bridge letters as what they are

   Microsoft describes bridge letters as "self-attestations by Microsoft, not reports based on examinations by the auditor." Useful, but not audit evidence.

3. Search the report for 'Management Response'

   That is where exceptions and management replies sit. Microsoft states most examinations have observations on one or more controls and that this outcome is expected. A report with zero exceptions is not automatically better — read what the exceptions were.

4. Search for 'User Entity Responsibilities'

   These are the controls you must operate for the vendor's controls to work. They sit at the very end of the report and they are your homework.

5. Confirm the scope covers the product you are buying

   Microsoft publishes explicit in-scope service tables per environment. A vendor-level claim without a service list is not an answer.

ISO 27001 and ISO 42001: read the scope, not the logo#

ISO/IEC 27001 specifies an Information Security Management System that brings information security under explicit management control. ISO develops voluntary international standards; the audit behind a certificate is run annually by a third-party accredited certification body.

Two practical consequences. Certificates carry multi-year validity windows — Microsoft's current Microsoft 365 certificate runs 2024 to 2027 — audited annually against a defined scope, so ask which services are enumerated. And ask for the Statement of Applicability: Microsoft publishes it as a document separate from the certificate, which means a certificate on its own is not the whole answer.

Microsoft also states you remain responsible for engaging an assessor for your own implementation — a vendor certificate never covers your side of the boundary. Microsoft's Copilot compliance list additionally names ISO 42001 as a standard for AI management systems. Worth asking about, but ask for the scope the same way.

Consumer tier vs business tier: same brand, different policy#

The brand on the tab tells you nothing about the data policy. The edition does.

Google's consumer Gemini privacy hub states that a subset of chats is reviewed by human reviewers, and tells users plainly not to "enter confidential information that you wouldn't want a reviewer to see." Its Workspace privacy hub, covering qualifying business, education and public sector editions, states that customer data is not used for training without prior permission and that content is not human reviewed outside your domain without permission.

Anthropic's zero-retention arrangement excludes its consumer plans and its team and enterprise product interfaces, applying to the API under a per-organization enablement handled by an account team.

The decision rule: if the data class is internal or above, no one uses a consumer tier for it, regardless of how good the model is. Give people a sanctioned business-tier account on day one, because the alternative is a personal account you cannot audit.

Tool access changes the threat model#

A chatbot that only reads what you type is a disclosure risk. A tool that can read your inbox, browse, or run commands is an action risk, and that is a different review.

The 2025 edition of the OWASP Top 10 for LLM Applications ranks Prompt Injection at LLM01, Sensitive Information Disclosure at LLM02, Supply Chain at LLM03 and Excessive Agency at LLM06. OWASP distinguishes direct injection from indirect injection, where the model processes external sources such as websites or files carrying hidden instructions.

Be honest about the ceiling here. OWASP writes that it is "unclear if there are fool-proof methods of prevention for prompt injection," and the UK NCSC states there are "no failsafe security measures that will remove this risk." Microsoft says it uses jailbreak and cross-prompt injection classifiers for Copilot but notes they may not be available in all scenarios.

Because prevention is not guaranteed, design so exploitation cannot cause damage — NCSC's systems-level advice. OWASP's excessive agency entry names three root causes: excessive functionality, excessive permissions and excessive autonomy. Its mitigations are concrete: prefer granular tools over open-ended ones like broad shell access, run in the user's context with minimal scopes, and require user approval for high-impact actions. Logging and rate limiting, OWASP notes, reduce damage but do not prevent the vulnerability.

If you are wiring AI into workflows, pair this with error handling that fails closed rather than retrying a bad action.

What to never paste, and the first hour after someone does#

OWASP's sensitive information disclosure entry lists the categories at risk through LLM applications: personally identifiable information, financial details, health records, confidential business data, security credentials, and legal documents, plus the proprietary training methods and source code behind a model. That is a workable never-paste list as written.

Add two of your own: anything under NDA from a third party, and unreleased financial figures.

1. Rotate first, investigate second

   If a credential went in, treat it as disclosed. Rotation is cheap; certainty is not.

2. Delete in the product and check what deletion means

   Anthropic documents that deleted chats leave history immediately and back-end storage within 30 days. Immediate UI removal is not immediate erasure.

3. Check whether the content could have been flagged

   Flagged content follows a much longer tail — up to two years for inputs and outputs and up to seven years for classification scores in Anthropic's published policy.

4. Record it in the AI register and fix the sanctioned path

   People paste into unsanctioned tools when the sanctioned one is slower. Fix that, or it recurs.

OWASP's prevention list opens with sanitization — data sanitization techniques and input validation — and carries user education about unintentionally providing sensitive data as its own category. You need both: one control runs in your code, the other runs in the person's head before every prompt.

The copy-paste vendor questionnaire#

Send these 18 questions as written. Each has a red-flag answer attached, so a non-specialist reviewer can score the reply.

18-question AI vendor questionnaire with red-flag answers

Question to send	Red-flag answer
Do you train on customer inputs or outputs, and what are the documented exceptions?	A one-word no with no link to a written policy
Which in-product actions (feedback, bug reports, opt-ins) change that default?	The question is treated as not applicable
What is the default retention window for prompts, outputs and uploaded files?	Retention described as "as long as necessary"
What conditions extend retention beyond the default?	No mention of trust-and-safety flagging or legal requirements
What does deletion mean, and how long until back-end erasure?	Deleted means removed from the interface only
Do you offer zero data retention, and which endpoints are ineligible?	ZDR presented as an account-level switch with no exclusion list
What technically prevents an engineer calling an ineligible endpoint?	Nothing technical, policy only
Where does inference run by default, and where is data stored at rest?	One answer given to what are two separate questions
Can a region be pinned, is the setting reversible, and does it cost more?	Region described as fixed at signup with no further detail
Do responses report the region a request actually ran in?	No per-request evidence available
Where is your subprocessor list published and how are changes notified?	Available on request only
How much notice before a new subprocessor is authorized?	No stated notice period
Can any admin setting change which legal agreement governs customer data?	Answered as hypothetical rather than documented
Is the full SOC 2 Type 2 report available under NDA?	A logo, a summary page, or a Type 1 only
What period does the report cover, and what covers the gap since it ended?	A closed window with no bridge letter and no explanation
Which services are in scope for the report and for the ISO certificate?	The company name with no enumerated service list
Please send the Statement of Applicability and the user entity responsibilities.	Unfamiliarity with either artifact
Which plan or edition do these commitments apply to?	Commitments described as applying to "the product"

If you are running a wider evaluation alongside this, evaluating AI tools before buying covers the non-security half of the same decision.

Who this checklist is not for#

Skip most of this if you are a solo user putting public marketing copy into a consumer chatbot. The never-paste list still applies; the questionnaire does not.

Skip it too if you are in a regulated sector with a mandated third-party risk process. Use yours, and lift only the ZDR, residency and subprocessor questions that older vendor questionnaires do not cover.

It also will not help you pick a model. For that, the comparison of AI coding assistants covers capability rather than data handling.

Make it repeatable: tiers, triggers and a register#

Three artifacts turn this from a one-off review into a process.

Approval tiers: public data gets self-service approval, internal data gets a documented review against the questionnaire, regulated data gets legal sign-off plus the SOC 2 report and Statement of Applicability on file. Re-review triggers: a new subprocessor notice, a plan change, a new feature touching files or tool access, an expiring certificate, or a residency change. An AI register: tool, owner, data class, plan, retention answer, residency answer, and the date you last checked.

Triggers beat calendar reviews, because vendor documentation changes between your quarterly meetings. Subscribe to the subprocessor notification feed and the docs changelog for every tool in the register.

The commitment#

Do these four things this month, in this order. Publish a never-paste list built from OWASP's sensitive-data categories. Buy business-tier accounts for anything above public data. Ask every vendor the 18 questions and file the answers with a date. Then read one actual SOC 2 report end to end, searching for "Management Response" and "User Entity Responsibilities" so you know what those sections look like.

If you only have an hour, spend it on the ZDR and residency questions. Those are the two places where a written commitment you already signed can be lost by a config change nobody reviewed — and they are the two that almost no standard questionnaire asks.