How to Answer Enterprise Security Questionnaires for AI Products

The 8 AI-Specific Question Categories That Kill Deals

1. Model provenance: Which foundation models do you use? Are they open-source or proprietary? What are the training data licences?

2. Data handling: Does customer data get sent to third-party AI APIs? Is it used for model training? How long is it retained?

3. Hallucination controls: How do you detect and prevent hallucinated outputs? What is your false-positive/false-negative rate?

4. Prompt injection defence: What controls prevent adversarial prompt injection? How do you separate system prompts from user inputs?

5. Audit logging: Do you log every AI inference request and response? How long are logs retained? Are they tamper-proof?

6. Access controls: Who in your organisation can access customer data used for AI? Do you enforce least-privilege?

7. Model updates: How are you notified when underlying models change? How do you validate that updates don't degrade performance?

8. Subprocessors: Which third-party AI APIs, vector databases, and cloud providers process customer data?

Model-by-Model Answer Templates

If you use OpenAI API: 'Customer data is transmitted to OpenAI for inference only. OpenAI's Enterprise API does not use customer data for model training under their data processing addendum (DPA). Data is retained for 30 days for abuse monitoring only. We have a signed DPA with OpenAI.'

If you use open-source models (Llama, Mistral): 'We run inference on our own GPU infrastructure. No customer data leaves our VPC. Model weights are stored on isolated compute with no internet egress.'

For hallucination controls: 'All AI outputs pass through a validation layer that: (1) checks citations against source documents, (2) applies confidence scoring, (3) flags low-confidence responses for human review. Outputs below [threshold] are blocked automatically.'

Building a Reusable Security Pack

The investment with the highest ROI in enterprise AI sales is building a security pack once and reusing it for every deal.

Your security pack should include: SOC2 Type II report or in-progress attestation letter; penetration test report (< 12 months old); data processing addendums with all subprocessors; DPDP/GDPR compliance attestation; AI-specific risk assessment; BCP/DR documentation; model governance policy.

Shoppeal Tech builds this security pack for clients in 4-6 weeks. Once built, questionnaire completion drops from 3 weeks to 48 hours for every subsequent deal.