TL;DR
- Security due diligence for live customer journey platforms checks what a standard SaaS questionnaire misses. Where conversation data lives, how PII inside messages is handled, whether consent is checked at each send, whether automated decisions are logged, and which AI models see your customers' words.
- Ask for documents first. A SOC 2 Type II, an ISO/IEC 27001 certificate, a recent pen test summary, a sub-processor list and a signed DPA settle most of the review.
- Compare breach clocks before you sign. GDPR gives a controller 72 hours, HIPAA gives a business associate up to 60 days, and RBI expects banks and NBFCs to report within 6 hours.
- Get the AI terms in writing, including whether your conversations train any model and which LLM providers sit in the request path.
Security due diligence for live customer journey platforms is the review a buyer runs before a vendor gets real-time access to customer data, customer conversations and the right to send messages in the company's name. It tests where that data lives, how personal data inside messages is protected, how consent is enforced, what gets logged and which AI models touch it.
Third parties are now the front door for attackers. Verizon's 2026 Data Breach Investigations Report, published in May 2026, found a third party involved in 48% of breaches, up from 30% a year earlier. A journey platform reads your CRM, listens on WhatsApp and web chat, and acts while nobody is watching.
This checklist is for the RevOps, growth and IT security leads who sign off on one, with worked examples from banking and healthcare.
Why do live customer journey platforms need a different security review?
Live customer journey platforms need a different review because they hold three things a typical SaaS tool never does at once. They store free-text conversations full of personal data, they decide on their own what to send next, and they often pass customer messages to a large language model to do it.
A standard vendor questionnaire asks about encryption, access control and uptime. It misses the risks of a system that talks to customers.
The four risk surfaces a questionnaire misses
- Unstructured personal data. A customer types a policy number or a diagnosis into a chat, and that text lands in transcripts, logs and CRM syncs.
- Autonomous send rights. The platform messages customers without a person approving each send. A consent mistake becomes thousands of messages before anyone notices.
- AI in the request path. Customer words travel to model providers, each a sub-processor with its own retention terms.
- Decision opacity. When a journey branches on a model's reading of intent, the reason for each message has to exist in a log.
Review the platform as a system that speaks for your company, because that is what it does.
Which certifications and reports should a vendor hand over first?
Ask for the evidence pack before the first security call. A vendor that sells to banks and hospitals should produce most of it within a week.
| Evidence | What it proves | What to check |
|---|---|---|
| SOC 2 Type II report | An independent auditor tested the vendor's controls over a period of time | Security in scope, plus Confidentiality or Privacy. Period ended within the last 12 months, or a bridge letter covers the gap |
| ISO/IEC 27001:2022 certificate | The vendor runs a certified information security management system | Certificate scope names the product you are buying, not only a head office |
| Penetration test summary | An outside firm attacked the production application | Test date, scope, and whether the AI and messaging components were tested. Status of every high and critical finding |
| Sub-processor list | Every third party that touches your data | Names, purposes and hosting countries, including LLM providers |
| Data processing agreement | The legal terms for how your data is handled | Instructions, security, deletion, audit rights and breach timelines in writing |
| ISO/IEC 42001 certificate (if offered) | A certified AI management system | Treat as a strong signal for now |
SOC 2 is a report from the AICPA's System and Organization Controls suite covering security, availability, processing integrity, confidentiality and privacy. A Type I looks at whether controls are designed well on one date. A Type II tests whether they worked over months, which is the version that matters for a live system.
ISO/IEC 27001:2022 certifies the management system around security. ISO/IEC 42001:2023 is the newer standard for AI management systems. Few journey vendors hold it yet, so treat its absence as a question to ask.
A certificate tells you a process exists. The scope line tells you whether it covers the product you are buying.
Where does the data live, and where does it travel?
Data residency is the question of which countries hold your customer data at rest, and which countries it passes through while being processed. Ask about four locations separately, the primary database, the backups, the logs and the place where model inference runs.
A platform can host its database in Frankfurt and still send every customer message to a model endpoint in another region.
What the rules actually require
- GDPR. Transfers outside the EU need a legal basis, most often standard contractual clauses under Article 46. Ask which tool covers each sub-processor.
- India's DPDP Act 2023. No blanket localisation. Section 16 lets the government restrict transfers to countries it notifies, and stricter sector rules still apply.
- RBI-regulated entities. The RBI Master Direction on Outsourcing of IT Services of April 2023 requires data to be stored only in India where existing regulations demand it. Payment system operators must store all payment system data in India under the RBI's 2018 circular.
Ask where inference runs. It is the location vendors most often leave out.
How does the platform handle PII inside conversations?
Personal data in conversations is harder to protect than data in form fields, because nobody knows where it will appear. A customer can paste an account number into a reply about a delivery date.
- Does redaction happen before data is stored and before it is sent to a model, or only in the display layer?
- Which identifier types are detected? Names, phone numbers, account and policy numbers, government ID formats and health details each need a rule.
- Are redaction rules visible as configuration you can review and change?
- How long are raw transcripts kept, and can you set a shorter retention period per channel?
Test it in the demo
Bring synthetic records, run them through a live conversation, and ask to see every place the data landed, from the transcript and logs to the CRM record and the prompt sent to the model.
A vendor that cannot show you the prompt has not tested redaction either.
Is consent checked at the moment of send?
Consent should be checked at the moment each message is sent. Checking once when a contact enters a journey leaves a gap. A customer who opts out of WhatsApp on Tuesday should not get Wednesday's scheduled reminder because the journey cached their status on Monday.
Ask the vendor to show three things live.
- Withdraw consent for one channel on a test contact in your CRM.
- Trigger the next journey step for that contact.
- Watch the platform suppress the message, or switch to a channel the contact still allows, and log the reason.
India's DPDP framework adds a wrinkle for BFSI teams. The DPDP Rules 2025, notified in November 2025, introduce registered Consent Managers and phase in most duties over 18 months. A platform that reads consent from a single field in your CRM will need to read it from wherever your consent record of truth ends up.
Consent cached at journey entry is consent that goes stale by the second message.
Can the audit trail explain every automated decision?
A good audit trail records who or what took each action, what data it used, and why. For a platform that branches on AI, that means logging the inputs to each decision, the model or rule that made it, and the action taken.
Your team will need it the first time a customer complains. GDPR Article 22 gives people the right not to be subject to decisions based solely on automated processing where those decisions have legal or similarly significant effects.
A loan offer or a claims decision can cross that line. A delivery reminder usually does not.
For healthcare buyers, the HIPAA Security Rule requires audit controls that record and examine activity in systems holding electronic protected health information.
Ask the vendor:
- Can we export the full decision log for one customer, in order, with timestamps?
- How long are logs kept, and can we set that period?
- Can logs stream to our own SIEM?
Which AI models see your data, and on what terms?
Every model provider in the request path is a sub-processor. Treat each one with the same scrutiny as the vendor itself.
The OWASP Top 10 for LLM Applications 2025 lists prompt injection as LLM01 and sensitive information disclosure as LLM02. Both are live risks on a platform that reads untrusted customer text and acts on it. The NIST AI Risk Management Framework gives a voluntary structure for asking how a vendor governs them.
Get written answers to these questions.
- Is any customer data, prompt or transcript used to train or improve the vendor's models or any third-party model?
- Which LLM providers are called, from which regions, and with what retention terms for prompts and outputs?
- What stops a customer message from instructing the model to reveal other customers' data or take an action outside the journey?
- Can the model trigger actions directly, or does every action pass through rules the journey owner set?
The stakes are measurable. IBM's 2026 Cost of a Data Breach report, based on 602 organisations, found that 92% of organisations with an AI-related breach lacked proper AI access controls.
Ask the training question in writing. Only the contract answers it.
What breach notification clocks apply?
Breach clocks differ by law and by role, so lay them out side by side before signing. Your contract should give the vendor a deadline shorter than your own.
| Rule | Who notifies whom | Deadline |
|---|---|---|
| GDPR Article 33 | Controller to supervisory authority | Within 72 hours where feasible |
| GDPR Article 33(2) | Processor to controller | Without undue delay |
| HIPAA, 45 CFR 164.410 | Business associate to covered entity | Without unreasonable delay, no later than 60 calendar days after discovery |
| RBI IT Outsourcing Direction 2023 | Service provider to bank or NBFC, then to RBI | Fast enough for the regulated entity to report within 6 hours of the provider detecting it |
| DPDP Act 2023, Section 8(6) and DPDP Rules 2025 | Data fiduciary to the Data Protection Board and affected people | Detailed report to the Board within 72 hours once the Rules take effect |
Ask the vendor to notify you within 24 hours of detecting an incident that touches your data, with a named contact and an agreed format.
How does the checklist play out in banking and healthcare?
The same checklist plays out differently by sector.
An NBFC with customers in India and the EU
Daniel Price leads vendor risk at an Indian NBFC that also lends in the EU. Applicants type income figures and account numbers into WhatsApp, so he asks first where inference runs. The RBI direction gives him due diligence duties and a right to audit the provider and its sub-contractors.
His red line is the incident clock. He gets the vendor's "without undue delay" rewritten to a fixed number of hours, and adds standard contractual clauses for the EU book.
A hospital network running appointment journeys
Laura Bennett is privacy officer at a US hospital network moving reminders and intake onto a journey platform. Patients reply with symptoms, so the vendor is a business associate and needs an agreement under 45 CFR 164.502(e).
Her demo test sends a synthetic message with a date of birth and a medication name, then asks for the prompt that reached the model. She also wants a no-training clause covering every LLM sub-processor. The IBM 2026 report puts healthcare breaches at $6.64 million on average, the highest of any sector.
The security due diligence checklist for live customer journey platforms
Use this table as the working document. Every row pairs a question with the evidence that answers it.
| Area | Question | Evidence | Red flag |
|---|---|---|---|
| Assurance | Is there a current SOC 2 Type II with Security in scope? | Report under NDA, bridge letter | Type I only, or period ended over a year ago |
| Testing | When was the last independent pen test? | Summary or attestation letter | Older than 12 months, AI layer out of scope |
| Residency | Where are data, backups, logs and inference hosted? | Architecture diagram, sub-processor list | Inference region unknown |
| PII | Is redaction applied before storage and before the model? | Live demo with synthetic data | Display-layer masking only |
| Consent | Is consent checked at each send? | Live opt-out test | Consent read once at journey entry |
| Audit | Can one customer's decision log be exported? | Sample export | Logs only for admins, not decisions |
| AI terms | Is customer data used for training? | Contract clause | Answer only in a sales email |
| AI safety | How is prompt injection handled? | Test results, design notes | No answer, or "the model handles it" |
| Breach | What is the vendor's notification deadline? | DPA clause | "Without undue delay" with no hours |
| Exit | How is data returned and deleted at contract end? | DPA clause, deletion certificate | No deletion confirmation offered |
How to run the review without stalling the deal
- Send the evidence request on the same day as the first demo.
- Run the redaction and consent tests during the technical demo, with your security lead present.
- Mark up the DPA in parallel with commercial terms.
- Score the table, list open red flags, and agree a fix date for each before signature.
For the capabilities side of the same shortlist, see how we score adaptive workflow orchestration tools on live customer data, and what adaptive journey orchestration means in practice. If your platform runs AI agents, our guide to securing agentic AI systems goes deeper on the model layer.
The one question to ask before the demo ends
Ask the vendor to show you the exact text that reached the model for one of your synthetic customers, and the log entry that explains what the platform did next. A vendor that can show both in five minutes has built for buyers like you. One that needs a follow-up email has told you something too.
Zigment is a Conversational Revenue Orchestration Platform for GTM teams that sits on top of HubSpot and Salesforce. Run this checklist on every vendor on your shortlist, us included, and bring your questions to a conversation with our team.