What security questions should RevOps ask before an AI tool analyzes calls, emails and CRM data?
- Your security team is right to slow down. This tool reads calls, emails and CRM together, more than any one system sees alone. Review is the correct response. Ask for the SOC 2 Type II report first.
- But a review slows down on what the vendor will put in writing. Put every answer on paper first. The hard part is knowing what makes security ask again.
- And a certificate will not answer the questions that decide it. A SOC 2 report describes the vendor's controls, not your terms. Where transcripts sit, who reads them and what the model provider keeps are contract answers. Ask for all three separately.
- Send one written list, with a data map, before the pilot. It covers storage, residency, who sees transcripts, model training, access, retention, audit logs and what reopens the review. Add one question for any tool that advises reps: who approved what it says, and which version ran.
- So the answers you send security also show the CRO the guidance ran. A log that records which rep got which guidance, under which approved version, serves both readers. Send Zime the same list.
You run RevOps. The pilot is approved, and the contract is in draft. Then security's questionnaire lands in your inbox, and three lines in it are not about the vendor at all.
"Where do the transcripts sit?" "Who can read a call?" "What does the model provider keep?"
You forward them. The reply comes back fast, with a SOC 2 Type II report attached. Security reads it and sends the same three questions again.
Nobody did anything wrong. The report answered a different question than the one security asked. So what will the vendor put in writing, and what makes security ask again? Follow one review through three moments.
What a SOC 2 report leaves open
First, give the report its due. A licensed CPA examines the vendor's controls and gives an opinion on their design and operation, says the AICPA. Ask for it first.
It does not set your terms. That is the gap.
Three answers sit outside any certificate: where your transcripts live, who may open them, and what the model provider retains. Each differs by data class.
Calls hold your buyers' voices. Emails hold people outside your company. CRM records already sit under your own role rules. A vendor can answer one class well and skip another. The picture shows the three classes and the four answers a certificate does not give.
Stephanie Hunt of HP asked about location on a call in November 2024, before a pilot began.
"Where does this data sit?... Do you have control over where that data resides?"
Stephanie Hunt, HP
That is a contract question: where, and who decides.
Bureau, which sells fraud and risk decisioning to banks and fintechs, reviewed a sales AI tool for an expansion in June 2026. Its information security reviewer, Varun CP, read out a duty Bureau had signed with its own customers.
"...they say the data residency should be in India... we are obliged to... ensure that, you know, this replicates across our vendors."
Varun CP, Bureau
Residency is a promise that travels down a chain of vendors. So ask what yours will pass on in writing. Where the GDPR applies, Article 28 bars a processor from engaging another without the controller's written authorization.
Test one: ask the vendor for one page per data class, calls, emails and CRM. Each page names the region, the roles that can read it and the retention. Pass: three pages with regions, roles and durations. Fail: a link to a trust page, which describes the vendor and not your data.
The review that opens twice
Say the answers are on paper and the pilot is live. Then a connector is added so the tool can read your meeting platform. Security sees a new path for data and opens the review again. A few months later the vendor changes its model provider or adds a region, and security opens it a third time.
This is not hypothetical. In February 2026, a sales AI tool that HP had approved changed. Bellen Shen, who coordinated HP's cybersecurity, privacy and governance approval, said what came next.
"...there is a high probability that we'll need to... undergo yet another cybersecurity, because there's been a material change to what... the application is."
Bellen Shen, HP
Approval attached to the application as it stood that day. A material change meant another round.
On the same call, Bellen Shen checked a limit from the first review. More users had appeared than HP had approved.
"HP has to be able to control who actually can access the tool."
Bellen Shen, HP
Approval covers who may use the tool, not only what it does. So ask who can sign up, and who tells you when that changes.
One customer's pattern is not a rate, and this post claims none.
Test two: ask for the vendor's last change to a model provider or sub-processor, and how customers were told. Pass: a date and a written notice. Fail: "we would tell you."
Then write the notice into the contract: it arrives before a connector, region or model provider changes, and gives you the right to object. A review with a written trigger does not reopen cold.
What changes when the tool advises
So far the tool only reads. Advising reps is another risk. When a tool tells a rep what to say, or writes to the CRM, you need three more answers.
Who approved what it says? Which version produced it? Who saw it?
On 19 October 2026 the AICPA wrote that AI agents now hold credentials, call APIs and act inside core systems. A failure is increasingly a security breach.
John Volkering ran the European sales engineering team at Versa Networks, where calls run without managers listening in.
"My team doesn't like their managers to be on their calls and get micromanaged."
John Volkering, Director of Systems Engineering, Versa Networks
Who can open a call is a question about people first. Ask for the default by role, and ask who can change it.
Log which rep received which guidance and which approved version produced it. That answers security. It answers the CRO as well, because it shows the guidance ran.
Test three: pick one recommendation from last week and ask for its approver and its version. Pass: names and a version in a minute. Fail: a shrug.
Now replay the opening. This time you sent the nine questions and a data map before the pilot began. The vendor's reply held one page per data class, with regions, roles and retention. Security found its three answers on paper and signed off. Nobody forwarded the same three questions twice.
When the connector arrived, the notice was already agreed, so the review did not open cold. Later, the CRO asked whether reps ran the guidance on live calls. You opened the log and showed the CRO which reps got which version, under which approver.
Zime runs on Claude, and its website shows SOC 2 Type II, GDPR and HIPAA badges. Every recommendation traces to its source, its approver and its version. Central policy sets who can see what and who approves what reps are told. Private Deployment runs Zime on hardware you control.
Zime's answers on training, retention and regions are not in this post. Ask for them on paper.
The list to send
Send security and the vendor one page: nine questions and a data map, each with the answer you want and the red flag. The question on what reopens the review sets the speed.
| Question to send | The answer you want | The red flag |
|---|---|---|
| Where is each data class stored? | A named region for calls, emails and CRM | One answer for all three, or a trust-page link |
| Can we choose the region, and what crosses borders? | Region choice; sub-processors listed by region, in writing | "Global" with no list |
| Who can see a transcript by default? | Defaults set by role, and you can change them | Everyone with a login |
| Do any models train on our data, the provider's included? | No training, stated for vendor and provider | "We don't train", nothing on the provider |
| What can the tool read, and what can it write back to the CRM? | Read and write scopes per object; write off until enabled | Broad access granted at install |
| How long is each data class kept, and how is it deleted? | A period per class; deletion on request, confirmed | "As long as needed" |
| What do the logs record? | Access, plus each recommendation's approver and version; exportable | Logs for admins only, no export |
| What reopens the review? | Written notice before a new connector, region or model provider, with a right to object | "We would tell you" |
| Who approved what it tells reps, and which version ran? | Names and a version in one minute | No approver on record |
Start with the row on what reopens the review.
Bring the list. Ask all nine.
Keep your questionnaire and your reviewer. Zime adds guidance reps run, with the source, approver and version recorded on every recommendation. Bring the list, one call, one email thread and one CRM object to the demo, and ask all nine. Book a demo →
FAQ
What security questions should RevOps ask before letting an AI tool analyze sales calls, emails and CRM data? Ask nine, in writing, per data class: where the data is stored, whether you can choose the region, who can see a transcript, whether any model trains on it, what the tool can read and write, how long it is kept, what the logs record, what reopens the review, and who approved what the tool tells reps. The last two matter once the tool advises reps: they show who authorized the guidance and that it ran.
Is a SOC 2 report enough for an AI sales tool? No. It is an outside auditor's opinion on how the vendor's controls are designed and run. It does not set your terms on region, readers, model provider or retention. Ask for the report first, then put the nine questions to the vendor.
Do these questions apply to a CRM's built-in AI or a meeting recorder? Yes. Each class can answer them. Conversation intelligence captures calls well. CRM-native AI sits inside records you already govern. Meeting recorders are quick to start. General assistants connected by plug-ins reason well. In-house builds give you control. Send each the same list.
How do I ask about model training when the vendor uses a model provider? Ask for the no-training statement in writing, for the vendor and for each model provider, and ask which providers touch your transcripts. If EU personal data is involved, the GDPR also expects your written sign-off before a processor brings in another one.
What do I send security along with the list? Send a data map: the three data classes, the users and roles that touch each, what the tool reads, and what it writes back to the CRM. Add the vendor's SOC 2 report and sub-processor list, so security sees the whole path at once.
