AI Data Security and Privacy: What to Ask Before You Deploy

Does your data train their model?

This is the question to ask first, because it is the only one that cannot be undone. Data used to train a shared model is absorbed into weights that serve other customers. You cannot retrieve it, and deletion of the source record does not remove its influence.

Vendor answers fall into three categories. Some do not train on customer data at all. Some train by default with an opt-out, which means your data is in scope until someone remembers to change a setting. Some train on aggregated or de-identified data, and the important follow-up is exactly what de-identification means and who verified it.

The acceptable answer depends on your data. For a restaurant's booking calls the stakes are modest. For a law firm's client calls or a clinic's patient interactions, the only safe posture is no training use, stated in the contract rather than a support article. Nexivo does not use customer data to train public models.

Retention: the risk you can simply delete

Every recording, transcript, and log you keep is a liability with an indefinite tail. It can be breached, subpoenaed, or exposed by a misconfiguration years after anyone remembered it existed. Data you no longer hold carries none of that risk.

Most AI agent vendors default to keeping everything indefinitely, because storage is cheap and it is useful for debugging. That default serves the vendor, not you. Ask what the retention period actually is, whether you can configure it, and whether deletion means deleted or merely hidden from your dashboard while remaining in backups.

Set retention to the shortest period that meets your operational and legal needs. For most voice agent deployments, transcripts for 90 days and recordings for 30 covers quality review and dispute resolution. Longer needs a specific reason, and where you have a regulatory retention requirement, that requirement sets the floor — not the vendor's convenience.

Encryption, access, and the minimum-necessary rule

Encryption in transit and at rest is table stakes, and any vendor without both should be eliminated immediately. It is worth confirming rather than assuming, but it is not a differentiator.

Access control is where real differences appear. On your side, ask who in your organization can pull transcripts and recordings — that should be a defined role, not everyone with a login. On the vendor side, ask which of their employees can access your data, under what circumstances, whether that access is logged, and whether you can see those logs. 'Our engineers can access customer data for support purposes' is common and often acceptable, but you should know it rather than discover it.

Then apply minimum necessary as a design constraint rather than a policy document. An appointment-booking agent needs a name, contact details, and appointment type. It does not need the full customer record or the clinical chart. Every field you do not send is a field that cannot leak, and scoping integrations narrowly is the cheapest security control available.

• Encryption in transit and at rest — confirm both explicitly.
• Role-based access on your side; no blanket transcript access.
• Documented and logged vendor-side access, visible to you.
• Integration scoped to the fields the task genuinely requires.
• Configurable retention, with deletion that removes data from backups too.

Compliance: ask for artifacts, not adjectives

Compliance claims on marketing pages are worth very little. What matters is whether the vendor can hand you the underlying document, and whether it covers the system you are actually buying.

For SOC 2, ask for the report — Type II, not Type I, since Type I only confirms controls existed on a single day while Type II tests that they operated over a period. Check the report's scope covers the product you are deploying rather than a different part of the vendor's infrastructure. Nexivo is SOC 2 Type II compliant.

For healthcare, you need a signed Business Associate Agreement before any protected health information reaches the system. For EU or UK personal data, you need a Data Processing Agreement naming sub-processors, and you should know which regions data is stored and processed in. A vendor who cannot produce these during evaluation will not produce them faster after you have signed.

Control over AI memory

Agents that remember across conversations introduce a category most security reviews miss. Persistent memory is what makes an assistant useful, and it is also a store of accumulated personal and commercial detail that sits outside your normal data inventory.

The requirements are straightforward: you should be able to see what the agent has remembered, correct it when it is wrong, export it, and delete it — all without contacting support. An agent whose memory you cannot inspect is an agent you cannot audit. Nexivo lets users export or delete their AI memory at any time.

Also consider memory scope in team deployments. One person's assistant should not surface another person's private context, and shared knowledge should be explicitly shared rather than accidentally pooled. Ask how memory is partitioned before rolling an assistant out beyond a single user.