Buying decisions

Your own security review is the slowest part, and you can shorten it

The pilot took two weeks and the procurement took five months. Everyone blames the vendor's paperwork, and the paperwork is rarely the problem: the delay is almost always a question nobody inside the organisation owns - who signs off a processor, who assesses the risk, who decides what data may leave. Knowing which of those you have before you start is worth more than any vendor's certificate.

Decide internally what class of system this is

An assistant answering published website content is not the same purchase as one reading your internal documents, and the second is not the same as one that can act on a system of record. Most security reviews stall because they begin without that distinction and end up applying the strictest category to the mildest case. Classify it in one sentence first, and the review that follows is proportionate rather than theatrical.

The questions that actually determine the answer

Where the data is processed and under what legal basis; who the sub-processors are and whether the list is available; what happens to a conversation and for how long; whether anything is used to improve a model; how deletion works and what it leaves behind; who can read a transcript inside the vendor. Six questions. A vendor that cannot answer all six in writing has answered the only question that matters.

A certificate is evidence of a process, not of your case

An audit report tells you an organisation has controls; it does not tell you what happens to the document your team is about to upload. Read the certificate for what it covers and then ask the specific question anyway. The buyers who get this right ask narrow things - what happens if we delete a site, who can see an unanswered question - rather than collecting attachments.

Write the answers down once, because you will be asked again

The same six questions come back at renewal, when a second department wants the same tool, and when somebody new takes over security. Organisations that keep a short internal record of what was asked, what was answered and what was accepted shorten the next review from months to a meeting. Nobody does this, and it is the cheapest thing on this page.

Frequently asked questions

What should we ask a vendor first?
Where conversations are processed, who the sub-processors are, and whether anything is used to train a model. Those three answers eliminate most vendors for most regulated buyers, and getting them at the start saves a procurement cycle spent on a tool that was never going to pass.
Do we need a data protection impact assessment?
That depends on what the assistant will handle, which is why the classification comes first. An assistant limited to published marketing content is a different assessment from one touching staff or customer records. Ask your own data protection function, with the classification in hand, rather than asking the vendor what you need.
The vendor says it is GDPR compliant. Is that enough?
It is the beginning of the conversation. Compliance is a claim about a process; what you need is the specific mechanism - the legal basis for transfers, the sub-processor list, the retention period, the deletion behaviour. A vendor willing to put those in writing is demonstrating the thing the badge only asserts.
How long should this take?
Weeks rather than months, if the classification is done first and the six questions are asked in the first meeting. The long reviews are long because they discover halfway through that nobody decided whether internal documents were in scope.
Can we run a pilot before the review finishes?
On published content, often yes, and that is one argument for classifying narrowly at the start. A pilot answering questions from your own public website involves no data the public does not already have, which is a much easier case to approve while the larger review proceeds.

Get in touch

Leave your details and we will reply. You do not need a sales call to get an answer.