Integration Security Review
About this resource
AI tools are increasingly connected to the systems that hold your organization’s information rather than used in isolation, and the moment a tool has access to a mailbox, a file store, or a customer record, it becomes a security question rather than a productivity one. This landscape worksheet gives IT and security a structured review.
It maps data flows in both directions, authentication and how identity is established, the permission scope and whether it exceeds what the use case needs, retention terms and what the vendor keeps, subprocessors and where the data physically sits, model training terms and whether an opt-out exists, and incident response including how you would be told. It is written to be completed alongside a vendor rather than about them.
Most reviews map what goes out and stop. Mapping what comes back, and what it can reach once it is inside, is where the harder questions live.
How to use it
Complete it with the vendor rather than about them, and get the answers into the contract rather than leaving them in a settings menu that somebody can change without telling you. The permission scope question is the highest-value one on the sheet: tools routinely request broader access than the use case requires, and narrowing it at setup costs nothing and removes whole categories of exposure.
Inside the download
What goes out, what comes back, and what it can reach once inside.
Whether the access requested exceeds what the use case needs, which it usually does.
How long the vendor keeps what you send, in the contract rather than the settings.
Whether your data improves their models and how to opt out.
Common questions
Data flows in both directions, how authentication works, whether the requested permission scope exceeds the use case, retention periods, whether data is used for model training and how to opt out, which subprocessors are involved and where data sits, and how you would be notified of an incident.
Where our data is stored and under whose jurisdiction, how long it is retained, whether it may be used to improve your models and how we opt out, whether the answer differs by subscription tier, who your subprocessors are, what happens to our data on termination, and how and how quickly you would notify us of a breach.
It can be, with scoped permissions, contractual clarity on retention and training, and a defined incident path. The common failure is granting broad access at setup because it was easier, then never revisiting it. Narrow the scope to the use case and the risk profile changes substantially.
Free. No email list, no follow-up sequence.
More from the resource library, chosen because they pair well with this one.
What has to be true before an AI tool touches a live workflow, including how to roll it back.
A one-page data rule for everyone who uses these tools. Print it and put it where people can see it.
Ten questions to answer before the purchase order, eight questions for the vendor, and four honest options including doing nothing.
Tell us a little about yourself and this document is yours. We don't have an email list. We collect this so we know who's finding our resources useful, and that's it.
You're downloading
this document
Your information is kept confidential and never shared with anyone.
