AI procurement is moving faster than privacy review. The useful approach is to assess the actual processing activity, not the vendor's marketing category. Use this checklist with the broader AI vendor privacy due diligence questions.
1. What exactly is sent?
List fields, not “customer data.”
2. Why is it sent?
Write the purpose in one sentence.
3. What is the vendor's role?
Determine whether it processes on your behalf or determines its own purposes.
4. Are prompts used for training?
Check default settings, API behaviour and enterprise controls.
5. How long are prompts retained?
Ask about abuse monitoring, debugging, support and backups.
6. Where is data processed?
Ask about region, support access and disaster recovery.
7. Who are the sub-processors?
Get the current list and understand what each receives.
8. Can prompts and outputs be deleted?
Ask for the actual mechanism and evidence.
9. What happens to embeddings?
Deleting a source document does not necessarily delete derived embeddings. Map both.
10. What happens to fine-tuning data?
Understand storage, isolation, access and deletion of training artefacts.
11. Who can access production data?
Review support access, approval, logging and human review.
12. What is the breach pathway?
Your contract should make notification and escalation operationally clear.
13. Does the DPA match the product?
Compare the DPA with API behaviour and product settings.
14. Can you stop the flow?
Build a kill switch or gateway so the vendor can be disabled without rewriting the application.
15. Can you prove what was sent?
For a production request, can you answer which user's data was sent, to which service, when, for what purpose and under which configuration?
The scorecard
| Area | Question |
|---|---|
| Purpose | Why are we sending it? |
| Data | Which fields? |
| Retention | How long? |
| Training | Used for model improvement? |
| Location | Where processed? |
| Sub-processors | Who receives it? |
| Deletion | How is it deleted? |
| Security | How is it protected? |
| Access | Who can see it? |
| Evidence | What can we prove? |
Where Privra fits
Privra connects AI vendor reviews to actual data flows, so the assessment starts from what your systems really send rather than a generic procurement form.