What data-security evidence should buyers request, and is SOC 2 enough?

Request evidence of the controls protecting your specific data flow; a SOC 2 label alone does not answer every security or production-quality question. AICPA describes SOC 2 examinations in relation to controls over security, availability, processing integrity, confidentiality and privacy; buyers still need to examine what is in scope. (aicpa-cima.com)

NYDFS’s 21 October 2025 third-party guidance says covered entities cannot delegate cybersecurity compliance responsibility to a provider. It also discusses data access, downstream providers, continuity, contractual protections and oversight—useful diligence areas even though its legal applicability is specific to covered entities. (dfs.ny.gov)

A proposed evidence request should cover:

• A data-flow diagram, including AI services and human subcontractors.
• Hosting, processing and remote-access locations.
• Access controls, individual accounts and authentication.
• Encryption and tenant-separation arrangements.
• Retention, deletion, backups and legal-hold handling.
• Whether inputs, outputs or metadata are used for model training or other secondary purposes.
• Subprocessor identities and change-notification procedures.
• Incident notification, investigation cooperation and continuity testing.
• Relevant independent reports, their scope, exceptions and remediation.

Specify model-training restrictions contractually rather than assuming them. Test deletion and export procedures before full deployment.

For public calculators or early procurement diagnostics, use aggregate figures and synthetic or appropriately redacted examples. Do not collect live policyholder files merely to generate a marketing preview.