Jorge LewisDisclosure: GTM Bud is our product. We include it alongside competitors to give you a complete picture, and we call out its limitations honestly.
Most teams run their AI SDR security and data privacy questions after the tool is already connected to the CRM, which is the one moment the answers can no longer change anything. This questionnaire is built to run earlier, before any vendor touches your prospect data, your inbox, or your LinkedIn account. It covers the question vendors most often dodge, the third-party model and subprocessor chain in buyer terms, the SOC 2 catch hiding behind the badge, and what GDPR, the CCPA, and the EU AI Act actually expose an outbound team to.
We answer from the vendor side of the table. Our parent agency, Referral Program Pros, has booked more than 7,000 meetings across 4,000+ outbound campaigns, and GTM Bud was built on that agency playbook, backed by a written guarantee of 5 percent positive replies on LinkedIn or 1.5 percent on email, or a full refund. That vantage point is exactly why we want buyers running this checklist: every question below applies to us too, and we answer them when asked. A vendor that will not should not get your data.
What data does an AI SDR actually touch?
An AI SDR touches four classes of data, each with a different risk profile. First, prospect records: the names, work emails, LinkedIn profiles, and enrichment data that make up your targeting. Second, conversation data: every reply a prospect sends, which can carry anything from pricing objections to confidential project details. Third, credentials: the connected LinkedIn account, the email inboxes, and the CRM keys that let the software act as you. Fourth, derived data: what the vendor’s models learn or store about your prospects and your messaging performance. A standard procurement questionnaire, written for ordinary SaaS, covers the first and third classes with encryption and access-control questions and says nothing about the second and fourth, which is precisely where AI vendors differ most. The questions in this article exist to cover that gap, and every one of them can be asked by a buyer with no security team.
If you are still mapping what the software does with each class, our explainer on what an AI SDR is draws the workflow boundaries. The security questions below follow that same flow: data in, models in the middle, actions out.
The question vendors dodge: is our data training your models?
Ask the model-training question first and in writing: is any data from our account, including prospect records, message content, and prospect replies, used to train or improve your models or your subprocessors’ models, and where does the contract say we can opt out? Language I/O, a translation software company, opens its ten-question AI vendor security guide with exactly this question, because it is the one that decides whether your data stays yours. The strong answer has three parts: a flat contractual prohibition in the data processing agreement, not a settings toggle; confirmation that the prohibition extends to the vendor’s model providers, not just the vendor itself; and a named retention window for prompts and outputs. The dodge sounds like “we take privacy seriously” or “data is anonymized before training.” Anonymized training is still your conversation data improving a model that serves your competitors, so treat it as a no.
This question goes first because it is the one vendors most reliably answer with marketing language instead of contract language. Everything you learn from how a vendor handles it, evasive, crisp, or surprised, predicts how the rest of the questionnaire will go.
Which third-party LLMs and subprocessors sit underneath your AI SDR?
Almost no AI SDR runs on its own models. The product you buy is typically a workflow layer over large language models from major providers, which means your prospect records and reply threads travel inside prompts to companies you never signed a contract with. In buyer terms: a subprocessor is any company your vendor passes your data to in order to deliver the service, and the model provider is usually the most important name on that list. Procurement teams at larger companies review the subprocessor list as a standard step; small teams should copy that habit, because the list is where the real data flow is written down.
Three specifics turn this from a formality into a real check. Ask the vendor to name its model providers, since “proprietary AI” with no names behind it usually means an undisclosed third-party dependency. Ask what the vendor’s own agreements with those providers say about training and retention on data sent through the API, because your DPA only protects you as far down the chain as the vendor’s contracts carry it. And ask how you hear about changes: a public subprocessor page with advance notice of additions is the standard a serious vendor meets. The fact that AI SDR vendors themselves now publish security explainers, Laxis’s guide on AI SDR and data security among them, tells you these questions are standard in the category. A vendor surprised by them is behind its own market.
The SOC 2 badge without the type
A SOC 2 badge on a website answers almost nothing by itself, because SOC 2 reports come in two types with very different weight. A Type I report, as audit firm A-LIGN explains, assesses whether controls are suitably designed at a single point in time; a Type II report tests whether they actually operated effectively over a period, typically three to twelve months. A young vendor’s badge is usually a Type I, which means the controls existed on the day the auditor looked. The second catch is scope: Glean’s analysis of what a SOC 2 report leaves unanswered notes that a clean opinion covers prompts, models, and training data only when the vendor put those systems in scope. So the question is never “are you SOC 2 compliant.” It is: which type, covering which period, with the AI pipeline inside or outside the audit scope, and will you share the report under NDA.
The same reading applies to ISO 27001 and any other certificate a pricing page displays. A certificate names a scope, and the scope is the answer. Ask for the document, read the three fields that matter, and weight an unreleasable report at zero.
What do GDPR, the CCPA, and the EU AI Act expose you to?
Start with the honest frame: the figures below are statutory ceilings, and real enforcement starts far lower. But the ceilings define who carries the risk, and in outbound that is you, the customer, not the tool.
GDPR. A prospect record is personal data, your AI SDR vendor is your processor, and you are the controller who answers for what that processor does. Article 83 of the GDPR sets fines in two tiers: up to 10 million euros or 2 percent of total worldwide annual turnover for the lower tier, and up to 20 million euros or 4 percent for breaches of basic principles and data subject rights, whichever is higher. Cross-border transfer is the trap built into this category, since most AI SDR vendors process data in the United States: the DPA has to name a transfer mechanism, not just a region. The sending rules themselves, lawful basis included, run jurisdiction by jurisdiction in our guide to whether cold email is legal under GDPR and CAN-SPAM.
CCPA. The CCPA stopped being a consumer-only question for outbound teams on January 1, 2023, when the exemptions for B2B and employee data expired, as Morgan Lewis documented at the time. Since then a California prospect’s business contact record carries the same rights as any consumer record: to know, to delete, to opt out of sale or sharing. The law covers for-profit businesses meeting statutory thresholds, including handling the personal information of 100,000 or more California consumers or households in a year, and where it applies, your vendor sits in the service provider role. The contract has to say so, because service provider terms are what stop the vendor using your prospect data for its own purposes.
EU AI Act. The number the vendor guides quote is real but misplaced. The Act’s maximum fines, set by Article 99, reach 35 million euros or 7 percent of total worldwide annual turnover, whichever is higher, and that top tier is reserved for the prohibited practices of Article 5, such as manipulative systems and social scoring, not sales outreach. The tier that can touch an outbound workflow runs lower under the same article, up to 15 million euros or 3 percent of turnover for breaching other obligations, including the transparency duties on interactive AI that became enforceable in August 2026. Whether those duties reach your workflow depends on whether the AI drafts or converses, a line we walked provision by provision in our guide to disclosing AI in sales outreach.
The buyer’s questionnaire at a glance
These seven questions extend the seven operational ones in our guide to evaluating an AI SDR before you buy. Run both lists in the same call, and score the security answers the same way: contract language counts, marketing language does not.
| The question | Why it matters | A good answer sounds like | The red flag |
|---|---|---|---|
| Is our data training your models or your subprocessors’ models? | Your prospect and reply data could improve a model serving rivals | A contractual prohibition in the DPA that extends to model providers | A settings toggle, or the word anonymized doing the heavy lifting |
| Which third-party LLMs sit underneath, and on what terms? | Your data flows to companies you never contracted with | Named model providers plus the training and retention terms of those API agreements | Proprietary AI, with no names behind it |
| Where is your subprocessor list, and how do we hear about changes? | Every subprocessor is another place your data can leak | A public page plus contractual notice before additions | A list available only on request, or none |
| Which SOC 2 type, which period, and is the AI pipeline in scope? | A Type I badge proves design on one day, not operation over time | Type II, a recent three-to-twelve-month window, AI systems in scope, report under NDA | The badge alone, with the report unavailable |
| Where is our data stored, and how does it cross borders? | GDPR restricts transfers out of the EU without a named mechanism | Named regions and a named transfer mechanism in the DPA | We are in the cloud |
| What are your retention defaults, and what happens on cancellation? | Data that outlives the contract is risk with no benefit | Defined windows per data class, deletion on exit, backups included | Indefinite or undocumented retention |
| What can the AI do in our inbox and CRM without human review? | Autonomy widens the breach surface and your disclosure duties | A scoped permission list and a human gate on outbound actions | Full access requested at connection, with no action log |
What can a small team verify without a security function?
A team with no security hire can still verify five concrete artifacts, and the work takes an afternoon, not an audit. Everworker, an AI agent vendor, frames the bar in its guide to customer data security for AI sales development tools as demonstrable GDPR controls with precise retention defaults; the artifacts below are how a non-specialist checks for exactly that.
- The DPA. Read two clauses yourself before anyone signs: the training clause and the deletion clause. If either is missing or soft, nothing else in the document rescues it.
- The subprocessor page. It should be public, it should name the model providers, and it should describe how changes are announced. Five minutes, no expertise required.
- The SOC 2 report. Request it under NDA and read three fields: the type, the period covered, and the scope description. You are not auditing the controls, only checking that the badge means what the pricing page implies.
- The retention defaults. Find them in the documentation or the product settings. Named windows per data class are the pass; silence is the fail.
- The permission screen. At connection time, note what the tool requests from your CRM, inbox, and LinkedIn account, and grant the minimum that makes the workflow run. Data the vendor never receives is data no question above has to protect.
If running this diligence yourself argues against the tool route entirely, that trade has a price too, and we worked it through in our AI SDR vs lead generation agency comparison: a provider that runs the whole motion also carries the data handling, and these questions change addressee instead of disappearing.
Frequently asked questions about AI SDR security and data privacy
Do you need a data processing agreement before using an AI SDR?
Yes whenever prospects in the EU or UK are in scope, and it is worth signing one regardless. GDPR Article 28 requires a contract between you as the controller and the vendor as your processor, and the DPA is also where the useful commitments live: the training prohibition, the subprocessor list, the deletion timeline, and the transfer mechanism for data leaving the EU. A vendor with no standard DPA on request is telling you nobody has asked before, which is its own answer.
Is it safe to connect your CRM to an AI SDR?
It can be, if you treat the connection as a permission grant rather than a sync. Connect only the objects and fields the tool needs for targeting and logging, prefer a one-way flow where possible, and read the permission screen at connection time: a tool that requests full read and write access to every record is asking you to skip data minimization on its behalf. Review the access again after onboarding, because trial-phase permissions have a way of becoming permanent.
Does privacy law still apply to prospect data that is publicly available?
Yes. The GDPR definition of personal data contains no carve-out for information that is public, so a scraped LinkedIn profile is regulated the same way as a purchased record, and you still need a lawful basis to process it. Public availability changes how easily data is gathered, not whether the law covers it, and each jurisdiction’s sending rules then apply on top, whatever tool does the gathering.
What happens to your data when you cancel an AI SDR subscription?
Whatever the contract says, which is why the question belongs before the signature. Get the deletion timeline in writing, confirm it covers backups and the vendor’s subprocessors, and export your campaign data and conversation history before the last day of access. Treat a vendor that cannot name its deletion window as a vendor that keeps your prospect data indefinitely, because operationally that is what an unnamed window means.
Do the security questions change for a fully autonomous AI SDR?
Yes, they widen. An agent that reads and answers replies on its own needs standing access to your inbox and CRM, so permission scope, action logging, and the disclosure duties on interactive AI all move from theoretical to live. A supervised workflow keeps the grant much narrower for the same output, and if you are weighing an autonomous agent against a supervised system, our AiSDR alternative comparison shows what that narrower permission set looks like in practice.
Guard the two assets you cannot buy back
Run the AI SDR security and data privacy questions before the connection, because the assets at stake are the two your outbound cannot function without: your prospect data and your domain reputation. The data question is this whole article. The reputation question is simpler and harsher: under Google’s bulk sender guidelines, spam complaint rates above 0.3 percent damage your sending domain, not your vendor’s, so a tool with sloppy sending practices spends an asset that takes months to rebuild. A vendor worth connecting answers the training question in contract language, names its model providers, shows the report behind the badge, and accepts a permission grant scoped to the job.
We built GTM Bud to be held to that standard: $600 per month per connected LinkedIn account with capacity for about 1,000 leads a month, setup in about 15 minutes, a 14-day trial, and the written guarantee of 5 percent positive replies on LinkedIn or 1.5 percent on email, or a full refund. We will not ask you to take the security answers on faith either. Bring this questionnaire to us the way you would to any vendor, starting with an AI SDR for small business, and make us answer it in writing before we touch a single record.