Security & Compliance

Questions to Ask a Chatbot Vendor About Security

By Dante AIOctober 14, 20267 min read

TL;DR: Certification logos and confident security language on a vendor's website are marketing, not evidence. This guide gives you six questions to put to any chatbot vendor in writing: who touches your customers' messages, whether the vendor will sign a data processing agreement, what it says about sub-processors, what happens in a breach, what happens to your data if you leave, and whether you can see evidence rather than a claim. The scorecard tool lets you tick only the answers you actually have in writing, so you know what to chase before you sign.

A vendor's website can show a padlock icon, a list of certification logos and a confident paragraph about "enterprise-grade security" without telling you anything you can act on. Logos are marketing. What protects your business and your customers is what the vendor is willing to put in writing before you sign.

This guide is for a small business choosing a website chatbot or AI customer-service vendor. It is a set of questions to put to any vendor, and a way to score the answers you actually get in writing. It does not tell you how secure AI in general is, and it does not assess whether your own use of a chatbot is compliant with a specific regulation. For the first, see what are the risks of AI in customer service. For the second, see can your AI chatbot handle compliance. This guide sits between them: it is about vendor selection, not risk theory and not your own training process.

Why the written answer matters more than the badge

A certification logo tells you a vendor wants you to know it holds a certification. It does not tell you what was tested, when, or whether the certificate is current. The useful unit is not the logo. It is a specific document or a specific written answer you can keep on file: a certificate with a date and scope, a signed contract clause, a named list.

Two standards come up often enough to be worth understanding before you ask about them. A SOC 2 report is an attestation, defined by the American Institute of CPAs, on a service organisation's controls relevant to "security, availability, processing integrity, confidentiality, or privacy". It is produced by an independent auditor, and the report states its scope and the date or period it covers, so it tells you what was actually examined and when. Some vendors cite ISO/IEC 27001 instead, which is a different standard. Ask a vendor claiming either one to send the report or certificate itself, not a summary, so you can see the scope and the date for yourself.

The questions worth asking before you sign

Each question below is answerable in a way you can keep: a document, a named list, or a specific written commitment. A verbal assurance on a sales call is not a written answer, however confident it sounds.

Who else touches our customers' messages? A chatbot vendor rarely runs everything itself. It may use a cloud host, a model provider and other sub-processors. Ask for the full list in writing. If the list changes later, ask what the vendor's process is for telling you.
Will you sign a data processing agreement? Under UK and EU data protection law, a contract between a business that decides how personal data is used (a controller, which is usually you) and a vendor that processes it on the business's behalf (a processor) is not optional. Article 28(3) of the UK and EU GDPR states that processing by a processor "shall be governed by a contract or other legal act... that is binding on the processor with regard to the controller". If a vendor cannot offer a data processing agreement, that is a direct answer about how it is set up to handle customer data.
What does that agreement actually say about sub-processors? Article 28(3)(d), as explained in guidance from the UK's data protection regulator, the ICO, requires that a processor not engage a sub-processor without the controller's prior written authorisation, and that any sub-processor take on the same data protection obligations. Ask whether you are told about new sub-processors in advance, and whether you have a genuine chance to object.
What happens if there is a data breach? Article 28(3)(f) requires the processor to help the controller meet its own obligations to notify the regulator and the people affected when there is a breach, taking into account the nature of the processing. Ask the vendor, in writing, how and how quickly it will tell you if something goes wrong, not just that it "takes security seriously".
What happens to our data if we leave? Article 28(3)(g) requires that, at the end of the contract, the processor either deletes or returns the personal data, and deletes any further copies, unless the law requires it to keep them. Ask the vendor to confirm this in writing and ask how long it actually takes in practice.
Can we see evidence, not just a claim? Article 28(3)(h), per the same ICO guidance, requires that the processor give the controller the information needed to show it is meeting its obligations, and allow for audits or inspections. You are unlikely to run a full audit as a small business, but you can ask to see the certificate, the report, or a recent summary of a third party's audit, rather than taking a claim at face value.

Use the tool below to score the written answers you have

The tool treats each of the six questions above as a tick you can only make when you have a written answer with some form of evidence behind it, such as a signed agreement, a named list, or a dated certificate. Tick only what you can point to. An unticked box does not mean the vendor is unsafe. It means you do not yet have a written answer, which is itself useful to know before you sign anything.

How to read the answers you get back

A strong written answer is specific: a named list of sub-processors, a dated certificate with a defined scope, a contract clause you can quote. A weak answer restates the question back to you in confident language without adding a document, a date or a name. Watch for a few patterns in particular. A vendor that will not name its sub-processors, or says the list is "confidential", has given you an answer, just not a reassuring one. A vendor that offers to "discuss" a data processing agreement rather than send you one is telling you it is not ready to sign one yet. A certification claim with no certificate, scope or date attached is a claim, not evidence. None of these red flags proves a vendor is unsafe to use. They tell you where to ask a follow-up question, or where to bring in whoever handles contracts or compliance at your business before you commit.

What a good score does not tell you

A full set of written answers tells you that a vendor was willing to commit things to paper. It does not independently verify that the vendor's systems work the way the paperwork says, and it does not replace legal advice on your own contract or your own obligations as a data controller. Treat it as the first filter in a vendor comparison, alongside price, features and support, not as a safety certificate in itself.

Keep asking after you sign

Vendor security and data handling are not a one-off check at signup. Ask the same six questions again when the vendor changes its sub-processor list, when a certification expires or is renewed, or roughly once a year regardless. A vendor's answer today is only as good as the date it was given.

Vendor security scorecard: what did they put in writing?

Without the interactive tool, count the written answers you have. Each one is worth about 17 points out of 100, and an unticked question is one to ask before you sign.

Frequently asked questions

What is a data processing agreement?

It is the contract required by Article 28 of the UK and EU GDPR between a business that decides how personal data is used and a vendor that processes it on that business's behalf. It sets out what the vendor may do with the data and the specific obligations it must meet.

Is a SOC 2 report the same as ISO 27001 certification?

No. SOC 2 is an attestation report produced by an independent auditor against the American Institute of CPAs' criteria for security, availability, processing integrity, confidentiality or privacy. Vendors sometimes cite ISO/IEC 27001 instead, which is a different standard. Ask to see the actual document for either one, including its scope and date.

Does naming its sub-processors mean a vendor is secure?

No. It means the vendor was willing to tell you who else touches your customers' data, which is one of several written answers worth having. It is not an independent test of how secure any of those parties actually are.

What if a vendor will not give a written answer to one of these questions?

That is itself an answer. Ask a follow-up question, or treat the gap as something to weigh against price and features before you choose that vendor.

How often should I ask these questions again?

Whenever the vendor's sub-processor list changes or a certification is renewed, and at least once a year regardless, since a vendor's data handling can change after you have signed.

Start free