Handling other people's data in an AI product, before a customer asks

A small AI company selling to a business will, at some point, be handed a security and privacy questionnaire. It is usually the moment a deal either accelerates or stalls for two months. Most of what it asks is the same. Where is the data stored and in what region. Who on the team can access it and how is that controlled. Is it encrypted in transit and at rest. Is customer data used to train models — and the expected answer is no, unless explicitly agreed. How long is it retained and how is deletion handled. Which subprocessors are involved, which means naming the model provider and the hosting provider. What happens in an incident and how quickly is the customer told. None of that requires a compliance department at the start. It requires deciding the answers, writing them down, and making the product match them. A short data processing page and a current subprocessor list answer most of the questionnaire before it is sent. Two decisions are worth making early because they are expensive to reverse. Separate customer data properly rather than relying on a filter in application code. And keep logs that contain customer content on a shorter, explicit retention clock than the rest — debugging logs are where sensitive data quietly accumulates. If the product will touch health data, financial data, or children's data, the requirements are not general good practice — they are specific legal regimes, and that belongs in front of a lawyer before the first customer rather than after. This article is general information, not legal, tax or financial advice. Rules change and every deal is different — check your own case with a licensed professional. Alberto Zaltzberg — Adonait · adonait.com