Staff are already using AI tools, approved or not. Before you pick a company-wide tool, get written answers to these questions. SARVO does not certify any tool, so verify each answer with the vendor's own security and legal documents.

Ten questions for every AI vendor

  1. Training: is our data used to train your models? Is that stated in the contract?
  2. Hosting: where is our data processed and stored? Is India or a chosen region available?
  3. Retention: how long are prompts, files and outputs kept, and can we set it?
  4. Access: which vendor staff can see our data, and under what conditions?
  5. Security reports: which independent audits or certifications do you hold, and can we see the reports?
  6. Sign-on and roles: do you support single sign-on and role-based access?
  7. Audit logs: can admins see who used the tool and what was shared?
  8. Permissions: does the assistant respect existing file permissions when it searches?
  9. Subprocessors: which other companies handle our data?
  10. Exit: can we export and delete our data when we leave?

Think about DPDP

India's Digital Personal Data Protection Act puts duties on businesses that handle personal data, including consent, purpose and breach handling. If staff paste customer data into an AI tool, those duties still apply. Ask your legal adviser how it affects your use.

Set rules for staff

  • List what must never be pasted (customer IDs, passwords, unreleased financials).
  • Provide an approved tool so people are not tempted to use personal accounts.
  • Train people to check AI output before using it.

Get help

A partner can set permissions, logging and policies when deploying a tool. Browse AI tools and partners, and use the AI vendor evaluation checklist alongside this list.