Data flow
Map what enters the service, which systems process it, what is returned, and where institutional boundaries apply.
Institutional assurance
Security review starts with your deployment scope.
The useful answer is not a wall of generic badges. It is a shared understanding of data, identities, integrations, operational responsibilities, and the controls required for your intended use.
Review areas
Build the assurance pack around the actual use case.
Identity and access
Review user roles, authentication path, administrative access, and the integration pattern in scope.
Retention and deletion
Align content and account lifecycle questions with the intended use and institutional policy.
Service operations
Review support, incident contacts, continuity questions, and responsibilities across both teams.
Supplier evidence
Work through the institution’s questionnaire and identify which answers require deployment-specific confirmation.
Pilot controls
Limit a pilot to the people, content, integrations, and duration required for its decision question.
Published privacy position
Submitted content is processed to provide the requested analysis.
The current privacy notice describes collection, processing purposes, service-provider sharing, institutional access, retention, and user rights. Review that notice alongside the intended deployment and contract terms.
Read the privacy policy →Claim discipline
We do not claim certifications on this page that have not been published and verified.
Ask for the current evidence relevant to your review. Deployment choices, subprocessors, retention requirements, and contractual controls need confirmation in the context of the proposed engagement.
Security review questions
- What does an AI Sentinels security review cover?
- Six areas. Data flow, meaning what enters the service, which systems process it, what is returned, and where institutional boundaries apply. Identity and access, covering user roles, authentication path, and administrative access. Retention and deletion. Service operations, including support, incident contacts, and continuity. Supplier evidence, working through your questionnaire. Pilot controls, limiting scope to the decision at hand.
- Do you provide a standard security certification pack?
- The review is scoped to your deployment rather than answered with a generic pack. Deployment choices, subprocessors, retention requirements, and contractual controls all need confirming in the context of the proposed engagement, so the useful step is to ask for the current evidence relevant to your review rather than to rely on a fixed document set.
- Can a pilot be limited to specific people and content?
- Yes. Pilot controls are part of the review. A pilot is limited to the people, content, integrations, and duration required for the decision question it is meant to answer, so an institution can evaluate the service without opening access wider than the evaluation needs.
- Will you complete our supplier security questionnaire?
- Yes. Supplier evidence is one of the six review areas. The process works through the institution's own questionnaire and identifies which answers can be given directly and which require deployment-specific confirmation, so that no answer is asserted more broadly than the proposed deployment supports.
- How are data retention and deletion handled?
- Retention and deletion are one of the six review areas, so content and account lifecycle questions are worked through as part of it. The current privacy notice describes collection, processing purposes, service-provider sharing, institutional access, retention, and user rights, and states that content is retained for as long as the account exists or according to institutional retention policies. Confirm the applicable requirements in the deployment and contract terms.
Bring your review framework