Before you give an AI agent access to your CRM, advertising and payments, get written answers to eight questions. They take an hour of correspondence with the vendor and show in advance how far it can be trusted.
What is at stake
An agent is usually connected to the CRM, ad accounts and payment systems. A CRM holds customers' names and contacts, which is personal data, so a mistake here costs more than a failed report.
OWASP, an open project on application security, maintains a Top 10 list for applications built on large language models. The 2025 edition has ten items, and three matter for our topic: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure and LLM06 Excessive Agency. In plain words (the explanation is ours and is not a quote from the list) these are three situations. In the first, text from an outside source nudges the model into an unwanted action. In the second, the model discloses data to someone who should not see it. In the third, the agent was given more rights than the job needs, and the eight questions below cover all three situations.
Eight questions for the vendor
| Question | Good answer | Worrying answer |
|---|---|---|
| 1. Where are the data and logs physically stored? | The country, the type of hosting and who runs it are named. There is an option to deploy on your side | "In the cloud" with no details |
| 2. Which of the vendor's employees can read our data? | Roles are listed, access is granted on request and recorded | "All engineers, when needed" |
| 3. What rights does the connection to our systems have? | Read only, a separate user or key, and the rights can be narrowed to the data that is needed | They ask for an administrator key |
| 4. Where do requests to the language model go, and does it learn from our data? | The model provider is named, it is stated that data is not used for training, and this is written into the contract | The answer drifts into generalities |
| 5. How long is the data kept and what happens to it when the work ends? | The period is named, and after the services end the data is deleted or returned | Deletion is not mentioned |
| 6. What does the data processing agreement say? | Processing on your instructions, confidentiality, terms on subcontractors, the right to audit | There is no such agreement |
| 7. Is there a log of the agent's requests and actions? | You can see who asked what and which data the agent requested, and the log is available to you | There is no log, or only the vendor can see it |
| 8. What can the agent change on its own? | Changes in the CRM only after a person confirms, or not allowed at all | The agent writes to the CRM without confirmation |
Ask for written answers to questions 1, 4, 5 and 6: you can refer to them if something goes wrong.
What GDPR requires of a vendor
If you work with data of customers from the European Union, an AI agent vendor usually acts as a processor of your data. Article 28 of the GDPR requires you to choose only those who provide "sufficient guarantees" of appropriate technical and organisational measures. Processing must be governed by a contract that binds the vendor. According to the text of the article, the vendor processes data only on your documented instructions, ensures the confidentiality of its staff, follows the conditions for engaging subprocessors, deletes the data or returns it to you after the services end, and provides all the information needed to show compliance, including audits and inspections.
Article 32 adds that the level of protection must match the risk. As examples of measures it names pseudonymisation and encryption, as well as a process for regularly testing that the measures work. This is a general summary of two articles, it is not legal advice, and the text of a contract is worth showing to a lawyer before signing.
How to check before connecting
- Create a separate user or key for the agent in the CRM and ad accounts, with read-only rights.
- Connect a test copy or a limited set of data first, and leave the live environment for later.
- Ask control questions whose answers you know yourself, and check the numbers.
- Open the log and find your own requests in it. If they are not there, question 7 remains unanswered.
- Revoke the key and make sure the access really is gone.
- Ask the vendor to describe how it will delete the data when you finish working together.
These steps are practice, the law does not require them.
When it is better to postpone connecting
Postpone connecting if the vendor does not answer in writing at least questions 1-6, insists on an administrator key or cannot show how to revoke access. Slow down separately when the data includes categories subject to special rules, and discuss such a case with a lawyer first.
What we answer to these questions
Brain runs on your own server (self-hosted) or on our dedicated VPS under an NDA, and all API keys and access stay under your control. This is what the FAQ section on our website says. The remaining questions from the table, including the language model and the contract terms, you can ask us at the free audit, before connecting.
We collected the questions worth asking already connected data in the article "7 questions worth asking your business", and we wrote about checking the agent's own conclusions in "Second Brain vs an in-house analyst".
Where to start
Print the table and send it to any vendor, not only to us. If you want to go through it together with us, start with a free audit. Then 2 weeks of free data collection, connection on a plan, and a subscription from €349 a month.
Sources: GDPR, Article 28; GDPR, Article 32; OWASP Top 10 for LLM Applications, 2025 edition.
