GUIDE
Confidentiality questions to ask a vendor
Questions a firm can put to a vendor, and which parts of a record help answer them.
Updated September 15, 2026
Does the vendor train models on customer data?
The training or data-use statement on each record shows the vendor's own wording and labels it as a no-training commitment, a mixed statement, or an affirmative data-use statement.
A no-training commitment is shown only when the vendor says it in writing. A mixed statement is one where the vendor declines third-party training but reserves some internal use. Both are quoted, and the label describes the wording rather than the product.
Who inside the vendor can reach client data?
Some vendors publish access limits tied to the firm's own permissions. Where that language exists, the record quotes it.
This is the question to put to a vendor directly when the published material is silent. The record will show Not stated, and the vendor's answer becomes the evidence.
Where is the data stored?
Where a vendor publishes a hosting or data-location claim, the record quotes it and links to the source. Where the vendor publishes nothing, the record says Not stated.
What happens when the product is retired?
Products are discontinued and absorbed. The graveyard records retirements only when an official path redirects, a vendor announces discontinuation, or another source establishes that the product was absorbed.
Each retirement entry carries the same date and source discipline as a live record.
Sources
- CounselAtlas quotes vendor statements verbatim and records silence as Not stated. Open ↗