Skip to content
Deploris

15 questions for every AI vendor.

From encryption through data governance, exit clauses, and the EU AI Act. Tick what your current or prospective vendor meets. Score and critical gaps appear immediately.

  • Vendor encrypts customer data at rest with keys you can rotate (or BYOK/HSM available)

    Security·critical

  • TLS 1.2+ enforced on every ingress and egress path

    Security·critical

  • SAML/OIDC SSO available on the plan you can afford

    Security·important

  • Admin audit log is complete, immutable, and exportable

    Security·important

  • Customer data is explicitly excluded from model training, in writing

    Data governance·critical

  • Prompt/response retention controllable (zero-retention option exists)

    Data governance·important

  • EU data residency available (Frankfurt or similar) under SCCs or new EU-US framework

    Data governance·important

  • Public uptime history (not just a promised SLA target)

    Operational·critical

  • Named incident-response contact, median response time disclosed

    Operational·important

  • Full data export in a documented format, included on every plan

    Operational·critical

  • Pricing is transparent or at least a defensible band is given before DocuSign

    Commercial·important

  • Exit clause: pro-rata refund + data return within 30 days of cancellation

    Commercial·critical

  • SOC 2 Type II or ISO 27001 certificate (not "SOC 2 planned")

    Compliance·important

  • Standard DPA/AV-Vertrag available without renegotiation

    Compliance·critical

  • Written stance on the EU AI Act and the risk tier they operate under

    Compliance·nice-to-have

Scored locally in your browser. No answers are stored or transmitted.

Next steps