Generative AI & data privacy: What to look for in an AI vendor

Generative AI (genAI) is already revolutionizing the sales landscape, offering unprecedented opportunities to leverage data in ways that were once unimaginable. It's helping reps work smarter and faster than ever before. For sellers looking to stay ahead of the curve, understanding this powerful technology is no longer optional—it's essential.

But with great power comes great responsibility — especially when it comes to data. As you evaluate vendors for AI sales prospecting solutions, it's crucial to consider their approach to data privacy. 

In this article, we’ll explore five fundamental criteria you should use to assess potential AI solutions, ensuring they meet essential data protection standards and align with your security requirements. At the end, we’ll share some examples of questions you can ask about different elements of data privacy and security that you can ask during conversations with vendors. Armed with this information, you’ll have an easier time separating the wheat from the chaff and be able to identify the vendors that take data privacy and protection as seriously as you do.

Without further ado, let’s dive in.

Evaluation criterion #1: Certifications & guarantees

When it comes to data privacy, the vendor’s certifications and guarantees provide tangible (and explicit) evidence of their commitment to protecting your information. 

Here are some basic “credentializing” criteria you should keep an eye out for when vetting AI vendors:

• Confidentiality guarantees: Your proprietary data should be handled with the utmost confidentiality.
  • Make sure your vendor has clear policies on how they protect and manage your sensitive information.
• Industry-standard certifications: SOC 2 and GDPR compliance should be a must-have.
  • These certifications underscore a vendor's commitment to unparalleled data security.

Evaluation criterion #2: Data sourcing procedures & policies

Understanding how an AI prospecting solution obtains and manages data is critical to ensuring ethical and compliant practices. 

Here are some basic data sourcing-specific criteria you should keep an eye out for when vetting AI vendors:

• Minimal data requirements: There are a lot of companies out there that claim that they have more data so their AI is inherently “better.” However, that’s a myth: a good AI system should be able to do a high-quality job with the least amount of information possible.
  • The functions of an AI Agent that require massive amounts of data are the language component that’s powered by the large language model (LLM) — like OpenAI’s GPT or Anthropic’s Claude — that the Agent sits on top of. Those LLM systems are so advanced that fine-tuning them with extra proprietary data does not materially improve the performance. 
  • The place where data is king is in how good an Agent is at learning from its real-time interactions with your prospects and adjusting its tempo and messaging accordingly. 
  • Many solutions – including Regie.ai – can start with just an email address. This simplicity ensures that your prospecting process respects privacy while remaining highly effective.
• Persona development: You can get a lot of useful information about the prospects’ roles and personas without needing to get into their personal information.
  • Ideally, AI vendors should be able to build high-quality personas using the least amount of information about a prospect; many really only need a job title to get the job done. 
  • This allows for more relevant outreach without getting too personal. By focusing on job titles, these systems can craft nuanced personas that allow for targeted, personalized outreach while complying with stringent data protection standards.
• Third-party data sources: Good AI vendors often use reputable third-party data sources like Apollo.io and ZoomInfo for prospect data.
  • This approach means that you – the customer – aren’t responsible for providing this sensitive information, thereby limiting your exposure in the event of a data breach.

{{cta-1}}

Evaluation criterion #3: Data retention policies & protocols

A crucial aspect of data privacy is how long and in what manner AI vendors store your information. 

Here are some basic data retention-specific criteria you should keep an eye out for when vetting AI vendors:

• Automatic data purging: The best AI systems will delete unnecessary data without you even having to ask.
  • This simplifies your data management process and ensures no unnecessary data accumulation. 
  • Ultimately, this means that you won’t have to micromanage data deletion requests for either third-party or first-party data: your vendor will handle it all, removing the burden from your internal processes.
• Clear data retention policies: Ideally, AI systems should have strict policies in place that guide the retention of third-party data.
  • For example, Regie.ai’s policy is that we only retain third-party data only for as long as necessary to serve our customers’ prospecting needs or for a maximum of 30 days – whichever comes first. 
  • This applies to both prospecting data and any custom fields pulled from your CRM.
• Ethical audience expansion: The best AI solutions are set up to help you find new prospects that are similar to your existing leads, but delete that data within a reasonable period of time (typically 30 days).
  • This approach allows for responsible data use while respecting privacy concerns.
• Data encryption: Look for AI vendors who have procedures in place to rigorously encrypt your data.
  • Some solutions may even use an advanced encryption approach in which a key (managed by a third-party like Amazon) is needed in order to decrypt the data. 
  • In these scenarios, your AI vendor would retain exclusive access to the decryption key, ensuring that even if a physical drive were to be compromised, the data would remain inaccessible without the key.
• Secure storage: Ideally, your AI vendor would also have policies or procedures in place to safeguard your data, both in transit and at rest.
  • Some vendors use database management systems like MongoDB for their flexibility and robust security features.
• Strict data removal protocols: When a piece of data is no longer needed — or you make a specific request for its deletion — your AI vendor should be able to remove it from their database accurately and completely.
  • This should be a straightforward process, giving you more control over your information. 

BONUS: Advanced AI data retention policies

We know there are a lot of questions that come up about whether AI systems can “learn” from previous queries, and if that information gets shared with other customers who use the same vendor. 

If these are concerns you have, make sure to look out for vendors who have either (or both) of the following types of policies in place:

• Zero-data retention (ZDR): This type of policy means that once your query is answered by their solution, all traces of it disappear.
  • This should help address any concerns about data training and long-term storage.
• Zero-shot prompting (ZSP): This type of policy means that each interaction that your prospects have with a third-party LLM provider — like OpenAI or Anthropic — is treated as brand new.
  • This means that the third party’s model never learns from your data and — more importantly — there isn’t any data carryover.  This ensures that your proprietary data isn't used to train the AI for future interactions with other customers.
  • Your AI vendor should provide a custom model specific to your business for other functions of the agent, and all of that data is 100% confined to your company. No other company has access to another company’s model or data.
  • Think about it this way: Your business and market are unique, so the only information that’s really valuable for it to learn from are your specific prospects anyway; it wouldn’t be helpful for the agent to take in information about other businesses’ prospects because they’d have different needs and pain points that don’t align with those of your own prospects.

If a vendor has either or both of these policies in place, it indicates that they’re committed to using your data responsibly and are taking active measures to address concerns about data training and retention head on.

{{cta-1}}

Evaluation criterion #4: Support for ABM strategies

For account-based marketing (ABM), less is often more. 

Here are some basic ABM-specific criteria you should keep an eye out for when vetting AI vendors:

• Minimal data requirements: For ABM campaigns, good AI vendors only need account names and email domains, and should steer clear of any deeper proprietary details or sensitive information.
  • This focused approach ensures efficiency without compromising security or privacy.
• Focused prospecting: Look for systems that can use your existing lead or contact lists to identify and target additional, similar prospects – all without needing to access more sensitive deal information. 
• Limited data access: Ensure that the AI vendor doesn't have access to detailed proprietary information like deals, account history, or other proprietary data about active accounts.
  • That information should remain securely within your CRM and under your control. 
  • The only information your AI solution should be given are the account names and email domains necessary to execute targeted ABM campaigns – and that should be provided by you directly.
• Stringent retention & removal policies: Ideally, your AI vendor should have policies in place that guide the storage and removal of any information tied to your ABM campaigns.
  • For example, a typical policy would include a 30-day storage period for any downloaded data, after which it’s automatically deleted from their systems.

Evaluation criterion #5: Tech stack integrations

Your AI solutions should play nice with your existing tech stack. 

Here are some basic integration-specific criteria to keep an eye out for when vetting AI vendors:

• Integrations with commonly used platforms: Look for secure connections with common sales tech and CRM platforms like Salesforce, Outreach, Snowflake, and Marketo.
• Data encryption & security protocols: Make sure that your AI vendor has procedures in place to allow for the secure flow of data between their system and the rest of your tech stack.
  • Encrypted data transfers are a must, ensuring data integrity across all platforms.
  • Whether it's pulling data for analysis or pushing insights and actions back into these platforms, every data transaction is encrypted and handled with the highest standards of security. 
  • This includes utilizing secure APIs and adhering to the data privacy regulations that govern each system.
• Observe CRM permission settings: The AI vendor should respect existing permission settings in your CRM.
  • For example, it should integrate as a user in Salesforce with carefully controlled access to only the necessary fields.
• Precision access control: The best systems allow you to fine-tune permissions, ensuring the AI only accesses the data necessary to perform its functions — such as email addresses and company domains — without exposing any sensitive or confidential information.

{{cta-1}}

30+ questions to ask AI vendors about their data privacy protocols

We know that vetting tech vendors isn’t a favorite activity for most people. There’s so much to think about and so many details to keep track of. 

To help you out, we’ve compiled a list of questions – organized by the specific criteria they address – that will help you get a better sense of how your prospective vendors handle data privacy and security. Scan the list and click on the link to jump to the specific criterion you want to learn more about:

• Access controls
• Customizable privacy settings
• Data backup & recovery
• Data encryption
• Data isolation
• Data portability
• Data retention & deletion
• Incident response plan
• Regulatory compliance
• Security audits
• Third-party integrations
• Transparency in AI decision-making
• Transparency in AI training

Ultimately, the goal is that these questions will help you determine the level of commitment each vendor is making towards keeping your data – and more importantly, your customers’ data – as secure as possible.

Let's dive in.

Access controls

Look for vendors that implement strict access controls, which can enable you to limit who can view or manipulate your data within their systems. 

Here are three questions you can ask to better understand how they approach this:

• How do you manage user access to our data?
• Do you support multi-factor authentication?
• Can we set custom access permissions for different team members?

Customizable privacy settings

Look for solutions that allow you to tailor privacy settings to your specific needs and risk tolerance. 

Here are three questions you can ask to better understand how they approach this:

• Can we customize data retention periods?
• Are there options to limit data sharing or processing?
• Can we control which features of the AI have access to our data?

Data backup & recovery

Verify that the vendor has reliable backup systems and can quickly recover your data in case of system failures. 

Here are three questions you can ask to better understand how they approach this:

• How often is our data backed up?
• Where are backups stored?
• How long does data recovery typically take?

Data encryption

Ensure the vendor uses robust encryption methods to protect your data both in transit and at rest. 

Here are three questions you can ask to better understand how they approach this:

• What encryption standards do you use?
• How do you manage encryption keys?
• Is data encrypted end-to-end, including during processing?

Data isolation

Ensure your data is kept separate from that of other customers to prevent accidental exposure or cross-contamination. 

Here are three questions you can ask to better understand how they approach this:

• How do you isolate our data from other customers’?
• Do you use multi-tenant or single-tenant architecture?
• What safeguards prevent data leakage between customers?

{{cta-1}}

Data portability

If you ever have to switch to another vendor, you want to know how easy (or hard) it’ll be to export your data and transfer it to your new solution. 

Here are three questions you can ask to better understand how they approach this:

• In what format can we export our data?
• Are there any limitations on data export?
• Do you provide support for data migration to other platforms?

Data retention & deletion

It’s important to understand how long the vendor retains your data, and what happens to it after you stop using their service. 

Here are three questions you can ask to better understand how they approach this:

• How long do you keep our data?
• Can we request complete deletion of our data?
• How do you ensure data is securely and completely erased?

Incident response plan

Ensure that the vendor has robust incident response plans in place for handling data breaches, as well as other types of data security incidents. 

Here are three questions you can ask to better understand how they approach this:

• What is your incident response process?
• How quickly do you notify customers of potential breaches?
• What support do you provide in the event of a data breach?

Regulatory compliance

Verify that the vendor you're evaluating complies with relevant data protection regulations like CCPA, GDPR, HIPAA, or industry-specific standards. 

Here are three questions you can ask to better understand how they approach this:

• Which data protection regulations do you comply with?
• How do you ensure ongoing compliance as regulations evolve?
• Can you provide documentation of your compliance?

Security audits

Look for vendors who conduct regular security audits and are willing to share the results. 

Here are three questions you can ask to better understand how they approach this:

• How often do you conduct security audits?
• Are these audits performed by independent third parties?
• Can you provide recent audit reports?

{{cta-1}}

Third-party integrations

Does the AI solution play nice with other tools? If so, does it integrate with them in a way that enhances the security of your data? 

Here are three questions you can ask to better understand how they approach this:

• How do you vet third-party integrations for security?
• Can we control which integrations have access to our data?
• How is data protected when shared with integrated services?

Transparency in AI decision-making

Seek out vendors who can explain how their AI makes decisions, especially when it comes to using or processing your data.

Here are three questions you can ask to better understand how they approach this:

• Can you explain how your AI uses our data to make decisions?
• Is there an audit trail for AI actions involving our data?
• How can we verify the AI is using our data as intended?

Transparency in AI training

Understand how the vendor trains their AI models and whether they use customer data for this purpose. 

Here are three questions you can ask to better understand how they approach this:

• Do you use customer data to train your AI models?
• If so, how do you ensure privacy and prevent data leakage?
• Can we opt out of having our data used for training purposes?

Final thoughts

As sellers, we're always looking for an edge. AI gives us that edge, but it's up to us to use it responsibly. By choosing solutions and vendors that prioritize data security and privacy, we're not just protecting ourselves: we're building trust with our customers and prospects. This trust is the foundation of every great business relationship.

The future of sales is AI-powered, but it doesn't have to come at the cost of privacy or security. By understanding these best practices and demanding them from our tech partners, we can harness the power of AI while keeping our data—and our relationships—safe and sound. So go forth, sell smarter, and remember: in the world of AI, being secure is just as important as being cutting-edge.