Security questionnaire answers › AI
Which AI providers process our data? How to answer it in a security questionnaire
Why buyers ask this
AI providers are subprocessors. Buyers want names, locations and safeguards.
What a strong answer includes
- Name each provider, what data is sent, and region.
- State retention and training terms.
- Mention fallback or failover providers and whether data flows to them.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
We use [provider(s)] to power [feature]. Only [the minimum text needed] is sent, over encrypted connections, to [region]. Providers are contractually prohibited from training on the data and retain it for no more than [X days]. They are listed on our subprocessor page.
Evidence to attach
- Subprocessor list
- AI use policy
- Provider DPA
Common mistakes
- Leaving AI providers off the subprocessor list.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.