Vendor Security Questionnaire for AI Email Tools: 6 Domains, 30 Questions

A generic SaaS security questionnaire — CAIQ, SIG Lite, the Google Doc your CISO keeps in a drawer — asks the right questions about tenancy, encryption at rest, and single sign-on. It goes quiet on the six things that actually decide whether an AI email tool is safe to install: whose model reads the message, what happens to the draft it produces, how much action the agent can take without a human, and what you can rewind if it acts wrong.

This is the AI-specific overlay. Six domains, roughly thirty questions, and the shape of the answer that should make you walk away. Send it alongside your base questionnaire or bolt it in as a supplementary sheet — most procurement teams accept the second, and it keeps reviewers scanning what CAIQ or SIG already handle well without duplicating the work.

We build AI Emaily, so we sit on the receiving end of this document more often than most vendors. Where our own answers fail a control today, we say so in the verdict below, in the same words we would have to use on the form itself.

The short answer#

An AI-vendor questionnaire is not a replacement for CAIQ or SIG — it is the sheet that fills the gap those frameworks leave. Ask across six domains: identity and access, data handling, model and inference, agent autonomy, logging and monitoring, and continuity and exit. Cloud Security Alliance's CAIQ covers the first two well and touches the last one; the rest is where you are on your own.

Aim for roughly thirty questions in total, not three hundred. A short, sharp questionnaire returns real answers from an engineer at the vendor. A SIG Full arriving in a compliance intern's queue produces a PDF nobody on your side reads either. The point is a document a real person can sit down and answer in an hour.

Score each reply by the shape of the answer rather than its warmth. "Here is the clause in the DPA and the paragraph in the sub-processor list" is a pass. "We take privacy very seriously" is not. Treat the second phrasing as an unanswered question, not a soft yes.

Criteria that actually matter#

The six domains map onto the risks CAIQ and SIG were not built for, and each has a shape of question those frameworks miss.

Identity and access is where the base questionnaires overlap most, so ask only the AI-specific extensions: OAuth scopes requested versus scopes actually used, admin-side revocation across every user in one action, refresh-token storage and rotation. A vendor requesting broad Gmail or Microsoft Graph scopes at install with a plan to "narrow them later" is describing scope creep that never reverses.

Data handling is where CAIQ starts and OWASP's LLM Top 10 finishes. Ask what content leaves your tenant to reach the model provider, whether prompts and responses are logged by that provider, and whether the vendor trains any model on user mail. The answer to the last should be a flat no, in the DPA, not on a marketing page.

Model and inference is the domain nobody has a template for. Which models, hosted by whom, under what data-processing agreement between the vendor and the provider? A vendor who cannot name the provider and the retention window in one sentence is a vendor whose supply chain you cannot audit — and therefore whose data-handling promises you cannot audit either.

Agent autonomy is the AI-specific version of change control. What can the agent do without a human? Is there a mandatory approval mode, and is it the default? What is the undo window on an autonomous send? A vendor whose default posture is send-without-review has decided your risk appetite for you.

Logging and monitoring covers audit trails and the OWASP LLM concerns around prompt-injection detection. If email content is untrusted input to the agent — and it is — you need a log that shows what the agent did in response, which tools it called, and which instructions found inside a message body it refused.

Continuity and exit is the domain buyers skip and then regret. Export format, key ownership, subprocessor-change notice, what happens to AI-produced labels and drafts on cancellation. The right question is not "can I export my data" but "in what format and with what fidelity does an AI-produced label or draft survive the export."

Scoring table: the thirty questions and the red-flag answers#

Below is a sendable sheet. Copy it into a Google Doc, drop your logo on top, and email it to a vendor with a two-week deadline. Score each row 0 for a red-flag answer, 1 for a hedge that leaves a follow-up, 2 for an answer that closes the question by citing a DPA clause, a scope name, or a specific retention window.

Worked example: three replies, one afternoon#

Pretend you have sent this sheet to three vendors: a legacy desktop client that added AI features, a Gmail-only AI overlay, and a general AI email agent. Replies land within a week and now you have to score.

Total the scores out of 60, but the total is not the point. The pattern of zeros is. A vendor at 45 with all five zeros stacked in one domain has bigger problems than a vendor at 40 spread across the sheet. Two zeros in the same domain is where the phone call happens; three is where the evaluation ends.

Then read the ones. A one is a hedge, and hedges cluster: a vendor who hedges on prompt-injection response also hedges on autonomy defaults, because both admit the product has not been tested against a real adversarial user yet. Ones on the same row for two different vendors let you separate the vendor who has done the work but writes cautiously from the vendor who has not.

Resist weighting the domains. A tempting move in the spreadsheet is to inflate data-handling scores and discount continuity-and-exit, because data feels urgent and exit feels theoretical. It is exactly backwards — the exit questions are what your legal team will read twenty-two months into the contract, when the vendor swaps model provider without warning and asks you to accept a revised DPA. What you have on file that day is what decides whether you can walk.

Red flags that end the evaluation before the score adds up#

A handful of answers should end the review before the total matters. These are the ones you do not soften into a one.

• "We do not train on user mail today." Today is not the commitment. The DPA either says never or it doesn't.
• Any refusal to name the model provider or the tier under which prompts are sent. An unauditable supply chain makes every downstream question unanswerable too.
• A default autonomous mode that sends without approval, with no exposed setting to make approval mandatory tenant-wide. The default determines the ceiling on damage.
• No per-tenant audit log, or a log that cannot be exported. If you cannot produce your own record of what the agent did, you have no defence in an incident review.
• A subprocessor-change policy that is post-hoc notice with no right to object. That is what a vendor writes when it wants to swap model providers without asking you.
• "Full mailbox scope on install; we will narrow it later." Scope creep never reverses, and a vendor asking for the maximum on day one has revealed its posture.

What we would pick, honestly — and where we fail this sheet#

We build AI Emaily. This is the section where we answer our own questionnaire in the same words we would have to use on the form itself.

The domains where we answer cleanly: agent autonomy — we ship three modes (Manual, Copilot, Autopilot), with Copilot's approve-before-send the working default and Autopilot scoped to explicit rules, every send has an undo window, and every action lands in a per-user audit log. We treat email content as untrusted input to the agent by design, so instructions found inside a message body do not trigger tool calls. Data handling — we do not train any model on user mail, message bodies live in object storage referenced by ID rather than pasted into logs, and OAuth tokens are envelope-encrypted with keys held in a dedicated key store. All LLM calls route through OpenRouter under our contract, which we will name if you ask.

The domains where we answer honestly but without a certificate: we are not SOC 2 Type II today. It is on our security roadmap, and "on the roadmap" means "not yet" for a buyer whose procurement gate requires a Type II report in hand. We do not sign a Business Associate Agreement and are not HIPAA-configured — if that is your gate, stop here and send this sheet to a vendor built for it. Our public security page names what we do today, not what we intend to hold, because a promise on a page is asserted evidence, not proven.

Where a competitor is genuinely stronger: vendors with a published SOC 2 Type II report will clear a procurement gate faster than we can right now. Superhuman ships a security package that details its current posture — verify against their live security page rather than taking our word for the state of it. If a signed Type II is the one control that decides your review, that is where to look first.

The reader we are the right answer for is a founder, operator, or team lead buying an AI email tool because someone on the team is drowning, whose security review is a written commitment plus a working audit log rather than a wall of badges. That is the buyer this questionnaire tends to produce a yes on with us. Our seven-day free trial covers Pro and Autopilot on individual signups (card is taken; nothing is charged if you cancel before day seven) — see the AI Emaily pricing page for the current number and the team-plan mechanics.