Skip to content
FlashTowerFlashTower home

Free tool

AI Vendor Risk Checker

Before you approve an AI vendor, check how it handles your data. Answer ten questions from the vendor's contract and documentation, and get a risk level, the specific gaps, and a list of questions to send the vendor. For the full review process, read the AI vendor risk review guide.

Last reviewed: September 2026

1.How long does the vendor keep your prompts, files, and outputs?
2.Does the vendor use your data to train or improve its models?
3.Is a data processing agreement (DPA) available — and a BAA if you will share health information?
4.Can you enforce company single sign-on (SSO) and MFA for everyone using it?
5.Can the vendor share an independent security assessment report for you to review (for example a SOC 2 Type II report or an ISO/IEC 27001 certificate)?

Answer based on what the vendor has provided to you, not on marketing claims.

6.Where is your data stored and processed?
7.Does the vendor disclose its subprocessors, including AI model providers?
8.Can your administrators see audit logs of admin and user activity?
9.Does the vendor disclose which AI models and model providers process your data?
10.Does the contract commit the vendor to notify you of security incidents affecting your data?

Vendor review result

0 of 10 answered · Your answers stay in your browser; FlashTower records only anonymous usage events.

Answer the questions based on the vendor's contract, documentation, and answers to you. Choose “Not documented / not sure” when you don't know — that is useful too.

Based only on your answers, using fixed rules. FlashTower has not assessed this or any vendor. Informational only — not a complete vendor review.

FlashTower findings are informational. No security system detects or prevents every threat, and FlashTower does not certify compliance or provide legal advice.

Assess up to 5 AI tools with the Free AI Security Scan