An AI customer support security review asks the same nine questions of every vendor: which audits it holds, whether your data trains models, who the sub-processors are, where data is stored and where models run, how data is encrypted and accessed, how personal and health data is contracted, how prompt injection is contained, whether every AI decision is logged, and how incidents and exit are handled. For each one, ask for a document you can verify, not a sentence on a sales slide.

This guide maps each check to the public evidence that answers it, so your security team can start the review before the first call and spend the call on the gaps.

Key takeaways

• Ask for the report, not the badge. SOC 2 and ISO/IEC 27001:2022 are attestations you can read under NDA. A logo on a footer is not evidence.

• Separate storage residency from inference. Many vendors keep data at rest in your region but call model providers elsewhere. Ask where each happens.

• Treat model providers as sub-processors. GDPR Article 28 says a processor shall not engage another processor without the controller's written authorisation.

• Test prompt injection yourself. OWASP ranks prompt injection as LLM01 and says it is unclear whether fool-proof prevention exists, so ask about containment, not just prevention.

• Confirm the gaps in writing. If a vendor does not publish PCI DSS, an uptime figure or in-region inference, get its position in the contract.

How we chose and checked these security checks

The nine checks follow the controls that appear in standard vendor questionnaires and in the legal texts security teams cite most: GDPR Articles 28 and 32, the HIPAA business associate rules in 45 CFR 164.314, the OWASP Top 10 for LLM applications and the NIST AI Risk Management Framework. Every vendor fact below was checked on that vendor's own public security or trust page on 22 October 2026, and every regulatory statement links to the text itself. Where a vendor does not publish something, we write "Not published" rather than guess.

Lorikeet publishes this guide and is one of the tools listed. We have tried to describe every product, including our own, using only what each vendor publishes, and we link to the source for each claim.

The security review evidence map at a glance

1. Certifications and audit reports: start with what an auditor signed

The first question is which independent attestations the vendor holds and whether you can read them. The AICPA describes its SOC suite as assurance reports that give users the information they need to assess the risks of outsourcing services. ISO describes ISO/IEC 27001 as guidance for establishing, implementing, maintaining and continually improving an information security management system.

Ask for the full SOC 2 Type II report, the ISO certificate with its scope statement, and the dates of both. Check that the AI product you are buying sits inside the audited scope. The AICPA has also published guidance on the risks of quick-turn SOC engagements, so it is fair to ask who the auditor was.

What Lorikeet publishes: SOC 2 Type II, ISO 27001:2022, HIPAA and GDPR, independently verified and listed on its public Trust Center with reports downloadable under NDA and refreshed annually, per the Lorikeet trust page. ISO 27001 and SOC 2 Type 2 are listed on every plan on the pricing page. Limit: no PCI DSS certification is published.

2. Model training and data retention: will our conversations train anyone's model?

Security teams ask two separate things here: does the vendor fine-tune on customer data, and do the model providers it calls keep any of it. Get both answers in the contract, because a privacy page can change.

Look for a named zero-data-retention arrangement with each model provider and a clear statement on fine-tuning. Vendors differ. Intercom's security page says Fin can use anonymized customer data for model fine-tuning and that customers can opt out at any time, with data deleted within 30 days. Decagon says it enforces zero-data retention with AI providers such as OpenAI and Anthropic.

What we publish: zero-data-retention agreements with all model vendors and no fine-tuning on customer data, so customer data is never used to train AI models. The pricing page lists zero data retention by third party inference providers on every plan.

3. Sub-processors and AI model vendors: who else touches the data?

An AI support platform usually has more sub-processors than a helpdesk, because every model provider in the chain is one. GDPR Article 28 says a processor shall not engage another processor without prior specific or general written authorisation of the controller, and under general authorisation must inform the controller of intended changes, giving it the opportunity to object.

Ask for the current list, the notice period for changes, and which sub-processors see conversation content versus metadata. Check that obligations flow down: Article 28 requires the same data protection obligations to be imposed on the other processor by contract.

What Lorikeet publishes: core sub-processors include Google Cloud Platform, OpenAI, Anthropic and Baseten, with the complete, current list maintained on its public Trust Center.

4. Hosting and data residency: where is data stored, and where do models run?

Residency questions fail when "storage" and "processing" are blurred. A vendor can store tickets in the EU while sending prompts to a model endpoint in another region. Ask for both locations in writing, for each channel you plan to use.

Published positions vary. Intercom says data is hosted in the US, EU or Australia based on your residency needs. Zendesk's trust center lists its compliance programmes and describes add-on controls for data retention and masking.

What we publish: production runs on Google Cloud Platform in a private VPC with US primary hosting, and data storage residency is available in Australia and the EU. The pricing page lists USA residency on Start and Scale and custom residency on Signature. Limit: the residency option covers storage. If you need inference to stay in-region, raise it before contract and get the answer in writing.

5. Encryption, access control and isolation: how is the data protected?

GDPR Article 32 lists the pseudonymisation and encryption of personal data, the ability to restore availability and access in a timely manner after an incident, and a process for regularly testing the effectiveness of security measures. Map each of these to a named control.

Ask for encryption standards in transit and at rest, how tenants are isolated, how staff reach production, and whether you can enforce SSO for your own users. Decagon publishes AES-256 for storage and backups and TLS 1.2+ in transit. Zendesk publishes TLS 1.2 or higher for UI and API traffic.

What Lorikeet publishes: TLS 1.3 in transit and AES-256 at rest, no public internet access to production, row-level-security tenant isolation, and Google SSO with hardware-key MFA.

6. Personal data, PHI and the DPA or BAA: is the contract in place before data flows?

For healthcare, a business associate contract comes before any protected health information. 45 CFR 164.314 requires the business associate to ensure its subcontractors agree to the same requirements and to report any security incident it becomes aware of to the covered entity. For EU personal data, the Article 28 processing agreement plays the same role.

Ask which agreement is standard, which is negotiable, and how personal data is minimised in logs and transcripts. Decagon says sensitive data is detected and redacted using Google's DLP service. Zendesk says a HIPAA-enabled account requires a paid add-on.

What Lorikeet publishes: it is HIPAA compliant and signs BAAs for healthcare customers, with PHI handled on a minimum-necessary basis and automatically redacted. A DPA or BAA (including HIPAA) is standard on Start and Scale and custom on Signature. Healthcare teams such as easykind run patient support on the platform.

7. Prompt injection and runtime guardrails: what happens when a customer attacks the agent?

An AI agent reads untrusted text all day, so injection is the threat that most separates an AI review from a helpdesk review. OWASP lists prompt injection as LLM01:2025, says injections do not need to be human-readable to work, and says it is unclear whether fool-proof prevention exists. Its mitigations include least-privilege access, handling privileged functions in code rather than giving them to the model, and human approval for privileged operations.

Ask the vendor to show its test suite, how it limits what tools the agent can call, and what triggers an escalation to a person. Then run your own red-team prompts during the trial.

What we publish: runtime guardrails detect sensitive topics and escalate to your team, and Coach quality-scores every conversation, human or AI.

8. Audit trail and explainability: can we reconstruct any AI decision?

Regulators and internal audit will ask why the agent said or did something. The NIST AI Risk Management Framework is a voluntary framework for managing AI risks to individuals, organisations and society, and its generative AI profile helps teams identify risks specific to generative AI. Both expect you to be able to trace outcomes.

Ask for a sample record of a single conversation: the inputs, the knowledge used, every action taken in your systems, and who changed the configuration that produced it. Check retention periods and export formats.

What Lorikeet publishes: every customer interaction, model choice and action is tracked and fully explainable, not a black box.

9. Penetration testing, incident response and exit: what if something goes wrong?

The last check covers the bad days. Ask for the date and scope of the most recent third-party penetration test, the incident notification timeline in the contract, and what happens to your data when you leave. GDPR Article 28 requires the processor, at the controller's choice, to delete or return all personal data after the service ends.

Uptime belongs here too. Intercom publishes a 99.8% uptime SLA for its services including the AI Agent. Payments teams should also check card scope: the PCI Security Standards Council says PCI DSS applies to entities that store, process or transmit cardholder data.

What we publish: third-party penetration testing. Limits: no uptime figure or SLA and no PCI DSS certification appear on the trust or pricing pages, so ask for both positions in writing.

Tools that help: what AI support vendors publish for security reviews

The table shows only what each page states. Read the full reports before relying on any row, including ours. Fin publishes the widest set of AI-specific certifications here, and Zendesk is the only one of the four listing PCI-DSS.

Questions to ask before you sign

• Is the AI product inside the scope of the SOC 2 and ISO 27001 audits, and when do they expire?

• Which model providers see conversation content, in which region, and under what retention terms?

• What notice do we get before a new sub-processor is added?

• Which tools can the agent call, and which actions need a person to approve them?

• Can we export a full audit record for any conversation on request?

• What are the incident notification timeline and the deletion terms at exit?

For the technical questions a CISO or CTO will add, see our CISO and CTO security checklist. If you are moving from another vendor, the vendor migration guide covers exports and contract exit. For healthcare specifics, read HIPAA and personal AI agents in healthcare support, and for the wider buying process, the regulated industries buyers guide.

What still needs a human

No public page replaces your own judgement. Your security team still has to read the audit reports, confirm the AI product is in scope, decide your data classification, approve the tool permissions the agent gets, and sign off on residency and incident terms. Compliance and legal own the DPA or BAA. Run your own injection tests during a trial rather than relying on any vendor's description, including this one.

You can start that testing on a 30-day free trial with no charge until the trial ends, and read the evidence on the Lorikeet trust page first.