FAQ · Frequently asked questions
Vendor security questions, answered from what vendors publish.
Real questions buyers ask when reviewing a SaaS or AI vendor's security. SaaSDossier answers them the way it works everywhere: it records what the vendor publishes, marks each field Documented or Question surfaced, and links the source. A dossier does not decide whether a vendor is good or bad.
Disclaimer. Built from vendor-published sources reviewed at the time of preparation. SaaSDossier is a compiled evidence record — not an audit, certification, rating, legal opinion, vendor approval, or substitute for professional vendor-risk, legal, procurement, GRC, vCISO, or security review.
Documented
The field was found in the vendor's published sources, quoted and cited in the vendor's own words.
Question surfaced
Not identified in the vendor-published sources reviewed. This does not establish absence of the control.
DATA RETENTION & DELETION
What should buyers ask a SaaS or AI vendor about retention periods for data, logs, prompts, and deletion triggers?
Retention is an evidence category covering how long a vendor states it keeps customer data, logs, prompts, and outputs, plus what events trigger deletion. Buyers can ask for written retention windows per data type. Where a vendor's own documentation or policy page states a period, SaaSDossier records that field as Documented and source-links it; where no stated period is found, the field reads Question surfaced.
Does a SaaS or AI vendor publish whether Zero Data Retention is available, which endpoints or models are eligible, and how it is enabled?
Zero Data Retention is a configuration category: whether a vendor offers a mode where inputs and outputs are not stored, which endpoints or models qualify, and the steps to enable it. SaaSDossier records each element separately. Where a vendor's docs describe availability, eligible endpoints, or enablement steps, those fields are Documented and source-linked; elements its pages do not address read Question surfaced.
What should buyers confirm about customer data deletion when a vendor contract ends?
Post-termination deletion is an evidence category: what a vendor states happens to customer data once a contract ends — the deletion method, the timeframe, whether it also covers backups and derived data, and whether written confirmation of deletion is offered. Buyers can request these in writing. Where a vendor's terms or docs state each point, SaaSDossier marks it Documented with a source link; unaddressed points read Question surfaced.
Does a vendor publish how long backups are retained after deletion and whether prompts or embeddings are purged from backups?
Backup retention is an evidence category covering how long a vendor states data persists in backups after a primary deletion, and whether prompts, embeddings, or other derived artifacts are purged on the same cycle. SaaSDossier records the backup window and the derived-data handling as separate fields. Where a vendor's documentation states them, they are Documented and source-linked; where its pages are silent, the field reads Question surfaced.
AI TRAINING ON CUSTOMER DATA
Does a SaaS or AI vendor train or fine-tune on customer inputs, prompts, or outputs by default?
Training-on-customer-data is an evidence category covering what a vendor states about using inputs, prompts, or outputs to train or fine-tune models, and whether that use is on by default or opt-in. SaaSDossier records the stated default and any opt-out as source-linked fields. Where a vendor's policy states its position, the field is Documented; where the default is not stated, it reads Question surfaced.
If a vendor sends data or code to an underlying model provider, what does it publish about whether that provider can train on it?
Downstream provider training is an evidence category: when a vendor routes data or code to an underlying model provider, what the vendor states about whether that provider may train on it, and which contractual terms or provider settings apply. SaaSDossier records the vendor's stated position and any named subprocessor terms as source-linked fields. Where documented, the field is Documented; where unstated, it reads Question surfaced.
How can buyers track changes to a vendor's data-use or model-training policy?
Policy-change history is an evidence category covering how a vendor communicates updates to its data-use or model-training terms: effective dates, changelogs, version notes, or archived prior versions. Buyers can check for a dated changelog and subscribe to update notices. Where a vendor publishes dated versions or a changelog, SaaSDossier records that as Documented and source-linked; where no change record is found, it reads Question surfaced.
SUBPROCESSORS & MODEL-PROVIDER DISCLOSURE
Does a vendor publish which subprocessors can see prompt or API request content and which only see metadata?
This is a data-flow disclosure category. SaaSDossier records what a vendor's own subprocessor list or documentation states about which subprocessors process prompt or request content versus only metadata. Where a vendor's page names those roles, the field is Documented and source-linked. Where its published materials do not address the distinction, the item is marked Question surfaced — an open question, not a claim the vendor lacks such controls.
Does a vendor publish which LLM or model provider it uses, the model version, and who hosts the model?
This is a model-provenance category. SaaSDossier records what a vendor's own documentation says about the model or provider it uses, the model version, and where the model is hosted. Each element a vendor names on its pages becomes a Documented, source-linked field. Elements its published materials do not mention are marked Question surfaced — an open question for the buyer to raise.
If buyers adopt an AI vendor, what should they ask about disclosing that vendor or its AI provider as a subprocessor to their own customers?
This is a downstream-disclosure category. Buyers can ask whether a vendor's published subprocessor list and DPA name the AI provider, and whether terms address the buyer's own duty to notify their customers. SaaSDossier records what those vendor pages state as Documented, source-linked fields, and marks anything the published materials leave unaddressed as Question surfaced — a prompt to ask the vendor.
What does a vendor publish about subprocessor-change notice periods and objection rights?
This is a subprocessor-governance category. SaaSDossier records what a vendor's own DPA or subprocessor policy states about advance notice before a subprocessor changes and any right to object. Where the vendor's pages specify a notice period or objection process, those become Documented, source-linked fields. Where the published materials are silent, the item is marked Question surfaced — an item to raise with the vendor, not a claim none exists.
ATTESTATIONS & ASSESSMENT ARTIFACTS
What SOC 2 details should a buyer look for in a vendor's published materials?
This is an attestation-artifact category. In a vendor's published materials, a buyer can look for whether a SOC 2 report exists, its type (Type I or Type II), the report period, the scope or Trust Services Criteria covered, and how to request it. SaaSDossier records each stated element as a Documented, source-linked field, and marks unstated ones as Question surfaced.
Does a vendor publish whether external penetration test or audit reports are available, and whether access requires an NDA?
This is a report-availability category. SaaSDossier records what a vendor's own pages state about whether external penetration test or assessment reports can be requested, and whether access requires an NDA. Where the vendor names availability or an NDA condition, those are Documented, source-linked fields. Where its published materials do not say, we mark Question surfaced — an open question for the buyer.
Does an AI vendor publish whether its model or service has been assessed by an external third party?
This is an external-assessment category. SaaSDossier records what an AI vendor's own materials state about whether a third party has assessed its model or service — for example a named report, review, or letter, and how to obtain it. Each element the vendor states becomes a Documented, source-linked field. Where its pages do not address this, we mark Question surfaced — an open question.
EVIDENCE ACCESS & QUESTIONNAIRE FRICTION
Will a vendor complete a buyer's security questionnaire, or only provide a SOC 2 report or trust portal?
This concerns how a vendor handles buyer diligence requests. SaaSDossier records only what the vendor's own pages state: whether it offers a trust portal, publishes a SOC 2 report, or describes completing questionnaires. Where a vendor states its process, the field is marked Documented and linked to the source. Where the reviewed vendor-published sources do not identify that process, the field is marked Question surfaced — not a conclusion that the practice is missing.
What source-linked evidence can buyers request behind a vendor's security claim, beyond a policy statement?
Beyond a policy statement, a vendor may publish concrete artifacts: a SOC 2 report, a penetration test report, a subprocessor list, or a DPA. SaaSDossier records which of these the vendor's own pages name or link. Each named artifact reads Documented, tied to its source. Where the reviewed vendor-published sources do not link an artifact or source for a field, the field is marked Question surfaced for buyers to pursue.
Is another party's SOC 2 report, such as a subprocessor or data-center report, enough evidence for the vendor's own security review?
SaaSDossier does not judge whether any report is sufficient. It records whose attestation is published: the vendor's own SOC 2 report versus a subprocessor's or data-center's report, and the scope each states. When the vendor links its own report, that field reads Documented. When only another party's report is referenced, that is recorded as such, and the field is marked Question surfaced about the vendor's own coverage.
Does a vendor publish whether it charges for security questionnaires or requires an NDA before sharing evidence?
This is about the conditions a vendor attaches to sharing evidence — whether a fee applies to questionnaires, or an NDA is required first. SaaSDossier records only what the vendor states about these terms. Where the vendor publishes such conditions, the field reads Documented and links to the source. Where the terms are not stated anywhere published, the field is marked Question surfaced rather than assumed.
DPA, LEGAL & IP OWNERSHIP
Does a vendor publish a DPA, its key terms, and whether it will execute one with customers?
A DPA is a data processing agreement governing how a vendor handles customer data. SaaSDossier records what the vendor publishes: whether a DPA is available, its stated key terms, and whether the vendor says it will execute one with customers. Each stated element reads Documented and links to its source. Elements the vendor's pages do not address are marked Question surfaced.
Does a vendor publish whether it will sign a BAA, support HIPAA-regulated use, and whether that depends on tier or cost?
A BAA is a business associate agreement used for HIPAA-regulated data. SaaSDossier records what the vendor publishes: whether it will sign a BAA, whether it states support for HIPAA-regulated use, and whether either depends on plan tier or cost. Each stated point reads Documented, linked to the vendor's page. Points the vendor does not address are marked Question surfaced.
What does a vendor publish about ownership of customer data and IP rights in AI-generated outputs?
This concerns the vendor's published terms on who owns customer-supplied data and who holds IP rights in AI-generated outputs. SaaSDossier records what those terms state — for example, ownership assignment, license grants, or usage rights — each field reading Documented and linked to the vendor's terms or documentation. Where the published terms are silent on a point, the field is marked Question surfaced for the buyer to raise.
What does a vendor publish about legal holds or compelled retention orders and how those interact with deletion commitments?
This is about how a vendor's stated deletion commitments interact with legal holds or compelled retention orders. SaaSDossier records what the vendor publishes — for instance, whether deletion may be suspended under a legal hold and how that is described. Each stated term reads Documented, linked to its source. Where the vendor's pages do not address the interaction, the field is marked Question surfaced rather than inferred.
BREACH & INCIDENT HISTORY
What does a vendor publish about security incidents or breach-notification history?
Vendors sometimes publish an incident-history page, a status page, or a security page describing breach-notification commitments and past disclosures. SaaSDossier records what those sources state: a documented notification timeline or incident-response process links to the vendor's own page and is marked Documented. Where the reviewed vendor-published sources do not identify this, the field is marked Question surfaced.
Does a vendor publish whether it carries cyber insurance and what the coverage is?
Some vendors mention cyber-liability or cyber insurance in a trust center, FAQ, or security overview, occasionally noting coverage type or limits. SaaSDossier records whatever the vendor's own page states and links to it, marking that field Documented. Where the reviewed vendor-published sources do not identify insurance coverage, the field is marked Question surfaced.
What does an AI vendor publish about detecting and managing incidents affecting models, RAG systems, or agent tooling?
An AI vendor may publish how it detects and manages incidents affecting model behavior, RAG pipelines, or agent tooling, for instance monitoring, abuse handling, or an incident-response process covering these systems. SaaSDossier records what the vendor's own documentation says, source-linked and marked Documented. Where the reviewed vendor-published sources do not identify this, the field is marked Question surfaced.
ACCESS CONTROL & PERSONNEL SECURITY
Does a vendor publish who can access customer data and what approval, logging, or support controls govern that access?
Vendors sometimes publish who can access customer data and what governs that access: role-based controls, approval steps, access logging, or support-access policies. SaaSDossier records what the vendor's own security page or documentation states, links to it, and marks each such field Documented. Where the reviewed vendor-published sources do not identify a control, the field is marked Question surfaced.
Does a vendor publish personnel security controls such as NDAs, background checks, and security-awareness training?
Vendors often publish personnel-security practices such as employee NDAs, background checks, and security-awareness training, typically on a security or trust page. SaaSDossier records what those sources state, links to them, and marks each present item Documented. Where the reviewed vendor-published sources do not identify a practice, the field is marked Question surfaced.
ENCRYPTION, KEYS & TENANT ISOLATION
Does a vendor publish how customer data is separated between tenants and how tenant isolation is enforced?
Vendors may publish how customer data is separated between tenants and how tenant isolation is enforced: logical separation, per-tenant keys, or architectural descriptions. SaaSDossier records what the vendor's own documentation states, source-linked and marked Documented. Where the reviewed vendor-published sources do not identify this, the field is marked Question surfaced.
Does a vendor publish whether vector embeddings of customer data are encrypted and subject to the same retention and deletion rules?
An AI vendor may publish whether vector embeddings of customer data are encrypted and whether they follow the same retention and deletion rules as the source data. SaaSDossier records what the vendor's own documentation states, links to it, and marks each addressed field Documented. Where the reviewed vendor-published sources do not identify this, the field is marked Question surfaced.
AI-SPECIFIC SECURITY
What does an AI vendor publish about defenses against prompt injection, including indirect prompt injection from retrieved or ingested content?
This category covers what a vendor writes about prompt-injection handling — input filtering, output constraints, and treatment of untrusted retrieved or ingested content. SaaSDossier records where the vendor's own documentation or security pages describe these controls, linking each claim as Documented. Where the vendor's sources say nothing on a specific control, that field reads Question surfaced. We record what the pages state, not whether the defenses work.
What does a vendor publish about RAG access controls and defenses against retrieval or corpus poisoning?
This category covers what a vendor publishes about controls on its retrieval-augmented setup — who can read or write to the corpus, how ingested documents are validated, and how it addresses poisoning of the retrieval store. SaaSDossier marks each control the vendor's own pages describe as Documented, with a source link. A control the sources do not mention is recorded as Question surfaced.
Does a vendor publish how its AI service supports traceability or framework mapping such as EU AI Act Article 12, NIST AI RMF, or ISO 42001?
This category covers whether a vendor publishes mappings between its AI service and named frameworks such as EU AI Act Article 12, the NIST AI RMF, or ISO/IEC 42001. SaaSDossier records each mapping, statement of alignment, or logging-and-traceability description the vendor's own pages present, marked Documented with a source link. Where a framework is not addressed in those sources, the field reads Question surfaced.
Does a vendor publish whether external LLM traffic is routed through a private API or public endpoint, and whether traffic is isolated?
This category covers what a vendor publishes about how requests reach external large language models — whether traffic uses a private connection or a public endpoint, and how it is isolated or kept within a tenant boundary. SaaSDossier records the routing and isolation details stated on the vendor's own architecture or security pages as Documented, source-linked. Details the sources omit are recorded as Question surfaced.
VENDOR VETTING & REVIEW SCOPE
What does a vendor publish about handling confidential customer data?
This category covers what a vendor publishes about handling confidential customer data — classification, encryption in transit and at rest, access restrictions, retention, and whether data is used to train models. SaaSDossier records each practice the vendor states on its own security, privacy, or data-processing pages, or in a DPA, as Documented with a source link. Practices the sources do not address are recorded as Question surfaced.
How should buyers decide how much vendor security review is proportionate for a lower-risk SaaS tool?
Proportionality is the buyer's own call, not something SaaSDossier decides. Buyers often weigh the data a tool touches, its access scope, and its role before choosing how deeply to look. SaaSDossier's part is narrow: it records what each vendor publishes across evidence categories, marking each field Documented or Question surfaced with source links. That lets a buyer see what a vendor states and set their own review depth.
How does a vendor publish its continuous monitoring of third-party or subprocessor controls after onboarding?
This category covers what a vendor publishes about watching its subprocessors and third parties over time — reviews, contractual requirements, a subprocessor list with update or notification practices, and how it tracks their controls after onboarding. SaaSDossier records each practice the vendor states on its own pages as Documented, source-linked. Where ongoing monitoring is not described in those sources, the field is recorded as Question surfaced.
Disclaimer. Built from vendor-published sources reviewed at the time of preparation. SaaSDossier is a compiled evidence record — not an audit, certification, rating, legal opinion, vendor approval, or substitute for professional vendor-risk, legal, procurement, GRC, vCISO, or security review.