Free tool
AI vendor due-diligence checklist
Before trusting an AI tool or service with your data, ask the vendor these questions. “Unknown” means you have no assurance yet.
Data retention is documented in writing.
Our data is not used to train its models (or this can be switched off).
Data is encrypted in transit and at rest.
It has organizational access control (business accounts, roles, 2FA).
It holds a recognised security certification (e.g. ISO/IEC 27001, SOC 2).
The data storage location is known.
It commits to notify security incidents.
We have a contract or business terms covering data protection.
We can request deletion of our data.
It discloses the other companies that can access the data.
Serving users in Iran is lawful and stable for it.