Vendor Security & Compliance Risk Review

How to use

1. Describe the vendor, what data it would access, and your intended use case in {{vendor_and_use_case_info}} — be specific about data types.
2. Use the red flags and compliance sections as an actual checklist to send to the vendor's sales or security team before signing.
3. Bring the contractual safeguards recommendations to whoever handles your contracts or legal review.
4. Re-run the assessment if the vendor's answers reveal something different from your original assumptions (e.g. they do train on customer data).

Example input

Act as a security and compliance reviewer... Vendor: a customer support chatbot tool that would have access to our customer support ticket history, including names, emails, and order details, to generate suggested responses. Use case: integrating it into our helpdesk to reduce response time.

Example output

1. Data exposure assessment: this vendor would receive customer names, emails, and order details — classified as confidential and likely regulated PII depending on jurisdiction (e.g. under GDPR if any EU customers are included).
2. Compliance relevance: GDPR is likely relevant if any customers are in the EU/UK; a signed Data Processing Agreement (DPA) should be required. SOC 2 Type II report should be requested to confirm the vendor's own security controls, given they'll be handling customer PII.
3. Access and blast radius: the vendor needs read access to ticket history to generate suggestions, but confirm it does not require write access to your helpdesk or the ability to directly send messages to customers without human review, since that would significantly increase blast radius if compromised.
4. Red flags to verify: confirm data residency (where customer data is actually stored and processed), confirm whether ticket data is used to train the vendor's own models on other customers' data (a common and risky practice), confirm they have a documented breach notification process with a specific timeframe commitment.
5. Contractual safeguards: require a DPA with an explicit sub-processor disclosure clause, require a clause prohibiting use of your data for model training without explicit opt-in, and require a breach notification clause with a maximum 72-hour disclosure window.
6. Overall risk rating: Medium — the data sensitivity is meaningful (PII) but the access scope can likely be limited to read-only with human-reviewed responses; risk would drop to Low if the vendor confirms no model training on your data and provides a current SOC 2 report.

Customization tips

• — If you operate in a specific regulated industry (healthcare, finance, government), mention it explicitly so the compliance relevance section is accurate to your actual obligations.
• — Ask for the output reformatted as a vendor questionnaire you can send directly to their team.
• — This is not a substitute for legal or professional security review — use it as a first-pass framework, then involve qualified legal/security counsel for anything rated Medium or High risk.

Tags

FAQ

Related Skills

Related Articles