You're offline, showing the last version we saved.
Build with AI · Using AI safely

AI vendor jargon, explained: SOC 2, DPAs, subprocessors and more

Before you approve an AI tool, the vendor will send you documents full of terms. Here’s what each one means in plain English, and the question to ask.

For beginners · Checked 11 November 2026 · Not advice

In plain English

You don’t need to be an IT expert to approve an AI tool. You need to know what a handful of words mean, ask for the right documents, and write down what you decided.

If a vendor can’t explain any of these simply, that tells you something too.

The words, and what to ask

SOC 2 Type 1 and Type 2
An independent audit of a vendor’s security. Type 1 checks the design at one point in time; Type 2 checks it worked over a period, often six to twelve months. Ask to see the Type 2 report and the period it covers.
ISO 27001
An international certificate for how a company manages information security. Ask which parts of the business the certificate covers.
Data processing agreement (DPA)
The contract that limits what the vendor can do with your data to what you instruct. Ask whether your plan includes one, and keep a copy.
Controller and processor
Your firm decides why the data is used (controller); the vendor handles it for you (processor). You stay responsible for what goes in.
Subprocessors
Other companies the vendor passes your data to, such as cloud hosting or the AI model provider. Ask for the list and where each one is.
Data residency
Where data is stored. Processing can happen somewhere else, so ask about both: where it’s stored and where it’s processed.
Retention
How long the vendor keeps your data, including logs. Ask how long, and whether you can delete it.
Encryption in transit and at rest
Data is scrambled while it travels and while it’s stored. Standard for any serious vendor: ask to confirm both.
Single sign-on and MFA
Signing in through your firm’s Microsoft or Google account, with a second check such as a phone prompt. Ask whether you can require it for everyone.
Audit logs
A record of who did what, and when. Ask whether you can see them.
Prompt injection
Hidden instructions in a document, email or web page that try to steer the AI. Ask what happens when the tool reads a malicious document.

Plain-English summaries to help you ask good questions, not legal or technical advice.

For beginners

Approve an AI vendor in five steps

  1. Step 1: Find their trust centre

    Most vendors publish security and privacy pages. Search the vendor’s name with “trust” or “security”.

  2. Step 2: Ask for three documents

    The SOC 2 Type 2 report or ISO 27001 certificate, the data processing agreement, and the subprocessor list.

  3. Step 3: Send the questionnaire

    Our free AI vendor security questionnaire covers the rest. A good vendor answers quickly.

  4. Step 4: Check your plan matches

    The protections often only apply to business plans. Make sure that’s the plan you’re buying.

  5. Step 5: Record the decision

    Approved, approved with conditions, or not approved, who decided, and when you’ll review it. Add it to your AI tools register.

Red flags

When to slow down

None of these means no on its own, but each needs a good answer.

  • No independent security audit or certificate
  • No data processing agreement on the plan you’re buying
  • Can’t say where data is stored or processed
  • Trains on your data by default, with no way to switch it off
  • Won’t share the subprocessor list

Use these next

Please read: use these at your own risk

  • These prompts, guides and tools are general information, not professional, legal, privacy or IT advice. The Firm takes no responsibility for how they are built, changed or used, or for anything that results.
  • AI writes a slightly different tool each time. Whatever you build or download is yours to check, test and approve before you rely on it or use it with client data.
  • Check your AI provider’s current settings and terms for how your data is stored and whether it is used to train its models. Plans and settings change.
  • Bring your own judgement, and follow your firm’s AI policy and your professional and privacy obligations.

Questions firms ask

What is SOC 2 Type 2?

An independent audit of a company’s security controls over a period of time, often six to twelve months. A Type 1 report only checks the design at one point in time, so Type 2 tells you more. Ask to see the report and the period it covers.

What is a data processing agreement, and do I need one?

A contract that limits what a vendor can do with your data to what you instruct. It’s what you can show a client or regulator about how their data is handled. Business plans usually include one; check yours does before client data goes in.

What are subprocessors?

Other companies a vendor passes your data to, such as its cloud host or the AI model provider underneath. Ask for the list, and where each one stores and processes data.

Does client data have to stay in Australia?

Not automatically. Under the Australian Privacy Principles, sending personal information overseas means taking reasonable steps to make sure it’s protected, and your firm stays accountable for it. Some clients or contracts require local storage, so check yours.