7 Questions Before Choosing a Secure AI Platform.

You can spot secure AI platforms by how they answer seven questions in writing: where your data goes, what security evidence exists, who gets access, what's logged, how AI-specific attacks are handled, what happens when the AI is wrong or down, and how you can leave. Test those answers with low-risk data before you sign.

The U.S. Census Bureau's Business Trends and Outlook Survey found that 32% of firms with 100 to 249 employees were using AI as of May 3, 2026. That's roughly one in three firms of that size, and someone on your finance team might already be pasting contract language into a chatbot. Ten minutes with these questions can spare you a painful cleanup later.

1. Where Will Our Data Go?

First, find out what happens to everything your team types or uploads. Ask where the provider processes and stores prompts, files, answers, and support emails.

Some providers send that information to outside companies that run the AI models, so request their names. Ask whether the provider trains its models on your content, and how long backups stay on file.

The answers often change by plan, since consumer, business, and developer accounts follow different rules. A 2024 guide from the U.S. National Institute of Standards and Technology lists privacy leaks among twelve risk areas for generative AI.

Good data privacy in AI starts with written answers about the exact product and plan you'll use. A general privacy policy usually skips integrations, which are the links to your other apps. Ask about each one by name, and get the reply in an email or a contract.

Written replies give you something to point to later, and a sales call leaves no record at all. Learning about an outside model provider after signing tends to be an expensive surprise.

2. What Security Certifications and Evidence Can the Provider Supply?

A trustworthy provider can explain its security program and hand over proof, typically under a signed confidentiality agreement. Ask for independent audit reports, results from outside security testing, a written plan for handling security incidents, and a plan for recovering after a disaster.

For instance, ask whether the provider follows an international standard for managing AI. A certificate covers only the service and settings the auditor checked, so confirm that yours falls inside that scope.

Ask for the date of the latest audit and the name of the auditor, since an old report could be missing recent changes. Enterprise AI security reviews run a little faster when the provider keeps this evidence ready.

EMPIST, for example, holds SOC 2 Type II verification, an independent audit of security controls, along with ISO 9001 quality certification, and its website links to a Trust Center. Any provider you compare can show the same kind of evidence.

A slow or vague reply to a plain request tells you what support will feel like later. Keep notes on who answered, how fast, and how clearly.

3. Can We Control Who Accesses the Platform?

Every person on your team needs an individual account with a multi-step sign-in. Shared logins make it nearly impossible to trace who did what, and they let former employees keep access.

Ask whether the platform connects to the login system you already use, like your Microsoft 365 account. Look for separate permissions for administrators and regular users, plus separate workspaces for teams that handle different kinds of data. Ask how fast the platform removes access when an employee or contractor leaves.

Connections to other apps deserve quite a close look, since they let the AI read files outside the platform. Limit each connection to the folders and apps a team really needs, and review that list every quarter. Take account recovery seriously, since a weak reset process lets attackers bypass strong passwords.

Ask the provider to walk you through the admin screen during a trial, and you'll see within minutes whether the controls match the sales page. Small limits today save hours of investigation later.

4. Can We Audit What the AI and Users Are Doing?

You can't investigate what you can't see, so ask what the platform records and how long it keeps those records. Ask whether you can send the records to the tool your security team already uses.

Plans at different price levels sometimes include different logging, and the cheaper plans might be missing key pieces. Confirm the plan you're buying has the full set. Ask for a sample report with names removed, since that shows you far more than a feature list.

AI for regulated industries absolutely needs this record, since auditors and regulators may ask who accessed what, and when. The same record helps your team investigate a data leak or a wrong answer.

A good activity record covers items like these:

• Successful and failed login attempts
• File uploads and downloads
• Changes to permissions and settings
• Calls that connect other software to the platform
• Actions that administrators take

5. How Does the Platform Protect Against AI-Specific Risks?

Regular security tools miss some threats that only affect AI systems. One example is prompt injection, which happens when hidden instructions in a file or web page trick the AI into following them.

Seemingly harmless documents can carry those instructions. The Open Worldwide Application Security Project, a nonprofit that tracks software risks, ranks prompt injection as the number one risk for applications built on AI language models.

Ask how the platform scans uploaded files and keeps outside content completely separate from your own instructions. Ask how it treats email attachments from strangers, since those are a rather easy way to slip in hidden instructions.

Secure AI workflow automation deserves extra scrutiny the moment the AI can change records, send emails, or move money. In that case, require a person to approve high-impact actions, and limit what each connected app can read or change. Ask whether the provider tests its platform against these attacks and publishes the limits it already knows about.

A provider that names its known weak spots earns more trust than one that claims zero risk.

6. What Happens When the AI Is Wrong or the Service Fails?

AI tools can give answers that sound confident and still turn out wrong. Decide before launch who reviews the output, and which decisions need a human check. Decisions about law, money, health, hiring, safety, and customers clearly need that review.

Ask whether the platform shows the source documents behind each answer, and whether administrators can require approvals.

An answer you can't trace to a source is hard to check. Ask whether the platform warns users when it lacks enough information, or whether it fills the gap with a confident guess. Ask how users report a bad answer and how the provider fixes it.

Outages definitely need a plan too. Ask how often the service stays running under the contract, how quickly the provider reports an incident, and what your team does in the meantime. Even a simple backup process, just a shared folder of approved templates, keeps work moving during an outage.

7. Can We Leave Without Losing Control of Our Data?

Switching providers costs less when you plan the exit before you sign. Mid-sized company AI solutions sometimes come with usage limits and licensing terms that make a later move expensive.

Pricing deserves the same attention as the data terms. A low starting price can climb significantly once usage grows past the plan limits.

Read the contract sections on how long the provider keeps data, how it deletes data, when it must report a breach, and which outside vendors it uses. Ask how quickly the provider deletes your data after a request, and whether deletion thoroughly reaches backups.

Get a lawyer or contract reviewer to check the exit terms before anyone connects sensitive files.

How Do We Test Secure AI Platforms Before We Commit?

Sort your information into public, internal, and private groups. Run a small pilot with sample data that contains nothing real. Keep every written answer the provider gives you, since a demo shows only the best moments.

Share the results with the people who will use the platform every day. Their feedback surfaces problems that a security checklist misses.

Try these checks during the pilot:

• Sign in as a basic user and try to open restricted files
• Upload a file with hidden instructions and watch what the AI does
• Ask questions with known answers and score each response
• Request a full export of the pilot data
• Report a fake incident and time how fast the provider replies

Frequently Asked Questions

Which Regulations Should Shape Our AI Platform Choice?

The rules depend on your industry and where your customers live. Healthcare organizations that handle patient records usually need a signed agreement with any vendor that touches that data, under HIPAA. Financial firms follow the Gramm-Leach-Bliley Act, which expects you to oversee the vendors that handle customer data.

If you serve customers in Europe, GDPR requires a written contract with any company that processes their personal data. Many states add their own privacy laws, too.

Rules change often, so ask your lawyer to check the list before you sign. Then ask the provider which of these agreements it will sign for your account type.

Do We Need an AI Acceptable Use Policy Before Rollout?

Yes, write it first. A short policy tells your team which AI tools they can use, what information they can type in, and who reviews the output. Keep it to one or two pages, since long policies rarely get read.

Name an owner, usually someone in operations or IT, who answers questions and updates the document. Add a simple rule for the data groups you sorted during your pilot. For example, public information is fine and customer records are off limits.

Share the policy during onboarding, then bring it up again at least once a year.

How Do We Handle Employees Using Unapproved AI Tools?

Blocking tools alone rarely works. People who save an hour a day with a chatbot usually find another way to keep using it. Start by asking your team which tools they already use and which tasks those tools help with.

Next, offer an approved option that covers the same tasks. Set up a quick way to request new tools, and answer each request within a few days. Then adjust your network and device settings to flag the riskiest sites.

People follow rules more often when they get an easy, approved way to work.

What Does an AI Platform Cost Beyond the Subscription?

The subscription price covers the software and little else. Expect to pay for setup, for connecting the platform to your email, files, and finance systems, and for training your team. Staff time adds up quickly, since someone has to review output and keep permissions current.

Some providers charge extra for storage, additional connections, or priority support. Ask for a quote that lists every fee for the first year, then add your own estimate of internal hours. That total gives you a fair comparison between providers.

How Often Should We Reassess Our AI Provider?

Review your provider at least once a year, and sooner when something changes. Good triggers include a contract renewal, a new feature that touches more of your data, a security incident at the provider, and a change in the rules for your industry.

At each review, repeat the seven questions and compare the new answers with the old ones. Check the usage and activity reports, and look for access that nobody needs anymore. Write down the results, so the next reviewer starts with a clear record.

Your Next Step Toward Secure AI Adoption

Secure AI platforms hold up when you ask about data handling, evidence, access, logging, AI-specific attacks, failure plans, and exit terms, then verify the answers in a pilot. A short pilot now beats a migration later.

EMPIST is a managed IT and cybersecurity partner with SOC 2 Type II verification, ISO 9001 certification, and 26+ years of experience. The same partner that runs your 24/7 MDR and manages Microsoft 365, Azure, and AWS also builds your AI guardrails and assistants. Schedule a free AI strategy session and we'll map a clear next step for your first pilot.