# Security Due Diligence for Live Customer Journey Platforms: The Buyer's Checklist Author: Albin Reji Author URL: https://www.zigment.ai/blog/author/albin-reji Published: 2026-10-22 Category: Customer journey orchestration Category URL: https://www.zigment.ai/blog/category/customer-journey-orchestration Meta Title: Security Due Diligence Checklist for Live Journey Platforms Meta Description: Security due diligence for live customer journey platforms: 10 checks on data residency, PII in chats, consent, audit trails, AI models and breach clocks. Tags: Customer Journey orchestration, Security, Compliance, AI Governance Tag URLs: Customer Journey orchestration (https://www.zigment.ai/blog/tag/customer-journey-orchestration), Security (https://www.zigment.ai/blog/tag/security), Compliance (https://www.zigment.ai/blog/tag/compliance), AI Governance (https://www.zigment.ai/blog/tag/ai-governance) URL: https://www.zigment.ai/blog/security-due-diligence-customer-journey-platforms ![Retro halftone cover on a midnight navy ground showing a tall stack of sealed audit folders with the top one glowing open, standing for the evidence pack in vendor security due diligence.](https://prod.superblogcdn.com/site_cuid_cm7ah6s1d005z13xnfz2oplu9/images/security-due-diligence-customer-journey-platforms-card-1793109587298-compressed.webp) **TL;DR** - Security due diligence for live [customer journey platforms](https://www.zigment.ai/blog/top-journey-orchestration-platforms-in-2026) checks what a standard SaaS questionnaire misses. Where conversation data lives, how PII inside messages is handled, whether consent is checked at each send, whether automated decisions are logged, and which AI models see your customers' words. - Ask for documents first. A SOC 2 Type II, an ISO/IEC 27001 certificate, a recent pen test summary, a sub-processor list and a signed DPA settle most of the review. - Compare breach clocks before you sign. GDPR gives a controller 72 hours, HIPAA gives a business associate up to 60 days, and RBI expects banks and NBFCs to report within 6 hours. - Get the AI terms in writing, including whether your conversations train any model and which LLM providers sit in the request path. **48%** of breaches involved a third party in Verizon's 2026 DBIR **$4.99M** global average cost of a breach, IBM 2026 Security due diligence for live customer journey platforms is the review a buyer runs before a vendor gets [real-time access to customer data](https://zigment.ai/blog/what-real-time-journey-orchestration-requires "What Real-Time Customer Journey Orchestration Actually Requires To Work"), customer conversations and the right to send messages in the company's name. It tests where that data lives, how personal data inside messages is protected, how consent is enforced, what gets logged and which AI models touch it. Third parties are now the front door for attackers. [Verizon's 2026 Data Breach Investigations Report](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds), published in May 2026, found a third party involved in 48% of breaches, up from 30% a year earlier. A journey platform reads your CRM, listens on WhatsApp and web chat, and acts while nobody is watching. This checklist is for the RevOps, growth and IT security leads who sign off on one, with worked examples from banking and healthcare. ![Infographic of four risks a standard questionnaire misses in live customer journey platforms: personal data in conversations, autonomous sends, AI models in the request path and decision logs.](https://prod.superblogcdn.com/site_cuid_cm7ah6s1d005z13xnfz2oplu9/images/02-four-risks-a-standard-qu-final-1792737427877-compressed.jpg) ## Why do live customer journey platforms need a different security review? Live customer journey platforms need a different review because they hold three things a typical SaaS tool never does at once. They store [free-text conversations](https://zigment.ai/blog/conversation-intelligence-software-the-features-checklist "Conversation Intelligence Software: The Features Checklist You Actually Need") full of personal data, they decide on their own what to send next, and they often pass customer messages to a large language model to do it. A standard vendor questionnaire asks about encryption, access control and uptime. It misses the risks of a system that talks to customers. ### The four risk surfaces a questionnaire misses - **Unstructured personal data.** A customer types a policy number or a diagnosis into a chat, and that text lands in transcripts, logs and CRM syncs. - **Autonomous send rights.** The platform messages customers without a person approving each send. A consent mistake becomes thousands of messages before anyone notices. - **AI in the request path.** Customer words travel to model providers, each a sub-processor with its own retention terms. - **Decision opacity.** When a journey branches on a model's reading of intent, the reason for each message has to exist in a log. Review the platform as a system that speaks for your company, because that is what it does. ## Which certifications and reports should a vendor hand over first? Ask for the evidence pack before the first security call. A vendor that sells to banks and hospitals should produce most of it within a week. EvidenceWhat it provesWhat to checkSOC 2 Type II reportAn independent auditor tested the vendor's controls over a period of timeSecurity in scope, plus Confidentiality or Privacy. Period ended within the last 12 months, or a bridge letter covers the gapISO/IEC 27001:2022 certificateThe vendor runs a certified information security management systemCertificate scope names the product you are buying, not only a head officePenetration test summaryAn outside firm attacked the production applicationTest date, scope, and whether the AI and messaging components were tested. Status of every high and critical findingSub-processor listEvery third party that touches your dataNames, purposes and hosting countries, including LLM providersData processing agreementThe legal terms for how your data is handledInstructions, security, deletion, audit rights and breach timelines in writingISO/IEC 42001 certificate (if offered)A certified AI management systemTreat as a strong signal for now SOC 2 is a report from the [AICPA's System and Organization Controls suite](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) covering security, availability, processing integrity, confidentiality and privacy. A Type I looks at whether controls are designed well on one date. A Type II tests whether they worked over months, which is the version that matters for a live system. [ISO/IEC 27001:2022](https://webstore.iec.ch/en/publication/79694) certifies the management system around security. [ISO/IEC 42001:2023](https://webstore.iec.ch/publication/90574) is the newer standard for AI management systems. Few journey vendors hold it yet, so treat its absence as a question to ask. A certificate tells you a process exists. The scope line tells you whether it covers the product you are buying. ![Infographic of four data locations to check in a customer journey platform security review: database, backups, logs and model inference, with inference highlighted.](https://prod.superblogcdn.com/site_cuid_cm7ah6s1d005z13xnfz2oplu9/images/03-ask-about-four-data-loca-final-1792737429971-compressed.jpg) ## Where does the data live, and where does it travel? Data residency is the question of which countries hold your customer data at rest, and which countries it passes through while being processed. Ask about four locations separately, the primary database, the backups, the logs and the place where model inference runs. A platform can host its database in Frankfurt and still send every customer message to a model endpoint in another region. ### What the rules actually require - **GDPR.** Transfers outside the EU need a legal basis, most often [standard contractual clauses under Article 46](https://gdpr-info.eu/art-46-gdpr/). Ask which tool covers each sub-processor. - **India's DPDP Act 2023.** No blanket localisation. [Section 16](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) lets the government restrict transfers to countries it notifies, and stricter sector rules still apply. - **RBI-regulated entities.** The [RBI Master Direction on Outsourcing of IT Services](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12486) of April 2023 requires data to be stored only in India where existing regulations demand it. Payment system operators must store all payment system data in India under the [RBI's 2018 circular](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11244). Ask where inference runs. It is the location vendors most often leave out. ## How does the platform handle PII inside conversations? Personal data in conversations is harder to protect than data in form fields, because nobody knows where it will appear. A customer can paste an account number into a reply about a delivery date. - Does redaction happen before data is stored and before it is sent to a model, or only in the display layer? - Which identifier types are detected? Names, phone numbers, account and policy numbers, government ID formats and health details each need a rule. - Are redaction rules visible as configuration you can review and change? - How long are raw transcripts kept, and can you set a shorter retention period per channel? ### Test it in the demo Bring synthetic records, run them through a live conversation, and ask to see every place the data landed, from the transcript and logs to the CRM record and the prompt sent to the model. A vendor that cannot show you the prompt has not tested redaction either. ## Is consent checked at the moment of send? Consent should be checked at the moment each message is sent. Checking once when a contact enters a journey leaves a gap. A customer who opts out of WhatsApp on Tuesday should not get Wednesday's scheduled reminder because the journey cached their status on Monday. Ask the vendor to show three things live. 1. Withdraw consent for one channel on a test contact in your CRM. 2. Trigger the next journey step for that contact. 3. Watch the platform suppress the message, or switch to a channel the contact still allows, and log the reason. India's DPDP framework adds a wrinkle for [BFSI teams](https://zigment.ai/blog/conversational-ai-is-changing-customer-journeys-in-banking "How Conversational AI Is Changing Customer Journeys in Banking"). The [DPDP Rules 2025](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014), notified in November 2025, introduce registered Consent Managers and phase in most duties over 18 months. A platform that reads consent from a single field in your CRM will need to read it from wherever your consent record of truth ends up. Consent cached at journey entry is consent that goes stale by the second message. ## Can the audit trail explain every automated decision? A good audit trail records who or what took each action, what data it used, and why. For a platform that branches on AI, that means logging the inputs to each decision, the model or rule that made it, and the action taken. Your team will need it the first time a customer complains. [GDPR Article 22](https://gdpr-info.eu/art-22-gdpr/) gives people the right not to be subject to decisions based solely on automated processing where those decisions have legal or similarly significant effects. A loan offer or a claims decision can cross that line. A delivery reminder usually does not. For healthcare buyers, the HIPAA Security Rule requires [audit controls](https://www.law.cornell.edu/cfr/text/45/164.312) that record and examine activity in systems holding electronic protected health information. Ask the vendor: - Can we export the full decision log for one customer, in order, with timestamps? - How long are logs kept, and can we set that period? - Can logs stream to our own SIEM? ## Which AI models see your data, and on what terms? Every model provider in the request path is a sub-processor. Treat each one with the same scrutiny as the vendor itself. The [OWASP Top 10 for LLM Applications 2025](https://genai.owasp.org/llm-top-10/) lists prompt injection as LLM01 and sensitive information disclosure as LLM02. Both are live risks on a platform that reads untrusted customer text and acts on it. The [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) gives a voluntary structure for asking how a vendor governs them. Get written answers to these questions. - Is any customer data, prompt or transcript used to train or improve the vendor's models or any third-party model? - Which LLM providers are called, from which regions, and with what retention terms for prompts and outputs? - What stops a customer message from instructing the model to reveal other customers' data or take an action outside the journey? - Can the model trigger actions directly, or does every action pass through rules the journey owner set? The stakes are measurable. [IBM's 2026 Cost of a Data Breach report](https://www.ibm.com/reports/data-breach), based on 602 organisations, found that 92% of organisations with an AI-related breach [lacked proper AI access controls](https://zigment.ai/blog/responsible-ai-for-enterprises "Responsible AI for Enterprises: A Framework for Security, Trust, and Visibility"). Ask the training question in writing. Only the contract answers it. ![Infographic for security due diligence on live customer journey platforms: three clay pedestals on a track compare breach notification clocks, RBI 6 hours, GDPR 72 hours and HIPAA 60 days.](https://prod.superblogcdn.com/site_cuid_cm7ah6s1d005z13xnfz2oplu9/images/01-breach-clocks-run-from-s-final-1792737426042-compressed.jpg) ## What breach notification clocks apply? Breach clocks differ by law and by role, so lay them out side by side before signing. Your contract should give the vendor a deadline shorter than your own. RuleWho notifies whomDeadline[GDPR Article 33](https://gdpr-info.eu/art-33-gdpr/)Controller to supervisory authorityWithin 72 hours where feasibleGDPR Article 33(2)Processor to controllerWithout undue delay[HIPAA, 45 CFR 164.410](https://www.law.cornell.edu/cfr/text/45/164.410)Business associate to covered entityWithout unreasonable delay, no later than 60 calendar days after discovery[RBI IT Outsourcing Direction 2023](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12486)Service provider to bank or NBFC, then to RBIFast enough for the regulated entity to report within 6 hours of the provider detecting it[DPDP Act 2023, Section 8(6)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) and DPDP Rules 2025Data fiduciary to the Data Protection Board and affected peopleDetailed report to the Board within 72 hours once the Rules take effect Ask the vendor to notify you within 24 hours of detecting an incident that touches your data, with a named contact and an agreed format. ## How does the checklist play out in banking and healthcare? The same checklist plays out differently by sector. ### An NBFC with customers in India and the EU Daniel Price leads vendor risk at an Indian NBFC that also lends in the EU. Applicants type income figures and account numbers into WhatsApp, so he asks first where inference runs. The RBI direction gives him due diligence duties and a right to audit the provider and its sub-contractors. His red line is the incident clock. He gets the vendor's "without undue delay" rewritten to a fixed number of hours, and adds standard contractual clauses for the EU book. ### A hospital network running appointment journeys Laura Bennett is privacy officer at a US hospital network moving reminders and intake onto a journey platform. Patients reply with symptoms, so the vendor is a business associate and needs an agreement under [45 CFR 164.502(e)](https://www.law.cornell.edu/cfr/text/45/164.502). Her demo test sends a synthetic message with a date of birth and a medication name, then asks for the prompt that reached the model. She also wants a no-training clause covering every LLM sub-processor. The [IBM 2026 report](https://www.ibm.com/reports/data-breach) puts healthcare breaches at $6.64 million on average, the highest of any sector. ## The security due diligence checklist for live customer journey platforms Use this table as the working document. Every row pairs a question with the evidence that answers it. AreaQuestionEvidenceRed flagAssuranceIs there a current SOC 2 Type II with Security in scope?Report under NDA, bridge letterType I only, or period ended over a year agoTestingWhen was the last independent pen test?Summary or attestation letterOlder than 12 months, AI layer out of scopeResidencyWhere are data, backups, logs and inference hosted?Architecture diagram, sub-processor listInference region unknownPIIIs redaction applied before storage and before the model?Live demo with synthetic dataDisplay-layer masking onlyConsentIs consent checked at each send?Live opt-out testConsent read once at journey entryAuditCan one customer's decision log be exported?Sample exportLogs only for admins, not decisionsAI termsIs customer data used for training?Contract clauseAnswer only in a sales emailAI safetyHow is prompt injection handled?Test results, design notesNo answer, or "the model handles it"BreachWhat is the vendor's notification deadline?DPA clause"Without undue delay" with no hoursExitHow is data returned and deleted at contract end?DPA clause, deletion certificateNo deletion confirmation offered ### How to run the review without stalling the deal 1. Send the evidence request on the same day as the first demo. 2. Run the redaction and consent tests during the technical demo, with your security lead present. 3. Mark up the DPA in parallel with commercial terms. 4. Score the table, list open red flags, and agree a fix date for each before signature. For the capabilities side of the same shortlist, see how we score [adaptive workflow orchestration tools](https://zigment.ai/blog/adaptive-workflow-orchestration-tools) on live customer data, and what [adaptive journey orchestration](https://zigment.ai/blog/adaptive-journey-orchestration) means in practice. If your platform runs AI agents, our guide to [securing agentic AI systems](https://zigment.ai/blog/how-to-actually-secure-your-agentic-ai-systems) goes deeper on the model layer. ## The one question to ask before the demo ends Ask the vendor to show you the exact text that reached the model for one of your synthetic customers, and the log entry that explains what the platform did next. A vendor that can show both in five minutes has built for buyers like you. One that needs a follow-up email has told you something too. Zigment is a Conversational Revenue Orchestration Platform for GTM teams that sits on top of HubSpot and Salesforce. Run this checklist on every vendor on your shortlist, us included, and [bring your questions to a conversation with our team](https://zigment.ai/contact-us). ## FAQs Q: What should a SOC 2 bridge letter cover? A: A bridge letter, sometimes called a gap letter, is a statement from the vendor's management covering the time between the end of its last SOC 2 report period and today. It should confirm there were no material changes to the system or its controls and disclose any known incidents or control failures. The auditor does not test it, so accept one for a few months at most and ask when the next report period closes. Q: What should a data processing agreement with a customer journey vendor include? A: GDPR Article 28(3) requires the contract to bind the processor to your documented instructions, confidentiality for its staff, Article 32 security measures, agreed rules for sub-processors, help with data subject requests and breaches, deletion or return of data when the service ends, and support for audits. India's DPDP Act 2023 allows a Data Processor to be engaged only under a valid contract. For a journey platform, also fix transcript retention periods, breach notification timelines and hosting regions in writing. Q: What if a vendor will not name its LLM providers? A: Under GDPR Article 28(2), a processor cannot engage another processor without the controller's prior written authorisation, and a model provider that receives your customers' messages is one. A vendor that will not name its providers leaves you unable to authorise or object. Treat it as a blocking issue and ask for provider names, regions and retention terms under NDA at minimum. Q: Should we send an AI-powered journey vendor the SIG or the CAIQ questionnaire? A: Either works as a base. The SIG from Shared Assessments is common in financial services third-party risk programmes, and the CAIQ from the Cloud Security Alliance maps to its Cloud Controls Matrix. Neither was written with LLM features in mind, so add a short AI addendum on training use, model providers, prompt retention and prompt injection testing. Accepting a vendor's already completed standard questionnaire usually saves weeks. Q: How should a vendor handle changes to its sub-processors? A: GDPR Article 28(2) requires your prior written authorisation for sub-processors. Under a general authorisation, the vendor must tell you about intended additions or replacements so you can object. RBI's 2023 IT outsourcing directions require regulated entities to approve material sub-contracting in advance and keep the provider responsible for its sub-contractors. Ask for the current sub-processor list with locations, a notice period before changes, and a right to object or exit. Q: Can we include a right to audit in a customer journey platform contract? A: Yes. GDPR Article 28(3)(h) requires processors to allow and contribute to audits, including inspections, by the controller or an auditor it appoints. RBI's 2023 IT outsourcing directions require regulated entities to keep audit rights over the provider and its sub-contractors, and to have the provider accept RBI's power to inspect. Many buyers accept a current SOC 2 Type II for routine assurance and keep on-site audit rights for incidents or regulatory requests. Q: Does a healthcare provider need a HIPAA BAA with a messaging or journey orchestration vendor? A: Yes, if the vendor creates, receives, maintains or transmits protected health information on your behalf. That makes it a business associate under 45 CFR 160.103. Under 45 CFR 164.504(e) the agreement must cover safeguards, breach reporting, flow-down to subcontractors, and return or destruction of PHI when the contract ends. HHS limits the conduit exception to transmission-only services with temporary storage, so a vendor that stores patient conversations does not qualify. Q: Do WhatsApp conversations need a separate data transfer review? A: Usually yes, because a WhatsApp message passes through Meta's infrastructure as well as the journey vendor's. Ask the vendor whether it connects through Meta's Cloud API or a business solution provider, where messages are stored after delivery, and which party acts as processor at each step. Every extra party belongs in your sub-processor record with its own transfer basis. Q: What should a deletion certificate at contract exit confirm? A: GDPR Article 28(3)(g) requires a processor to delete or return all personal data when the service ends, unless law requires it to be kept, and HIPAA's 45 CFR 164.504(e) requires return or destruction of PHI where feasible. A useful certificate names the data sets covered, including transcripts, logs, backups and copies held by sub-processors, plus the deletion date and anything retained with its legal reason. Agree the backup purge window in the contract, since backups usually expire on a schedule. Q: How long does a security review of a customer journey vendor usually take? A: Timing depends mainly on how complete the vendor's evidence pack is on day one. A current SOC 2 Type II, a recent pen test summary, a completed standard questionnaire such as SIG or CAIQ, a signed DPA template and a sub-processor list can close a review in a few weeks. Missing items or AI-specific questions on model data use usually add rounds. Start the security track alongside the commercial evaluation so neither waits on the other. --- This blog is powered by Superblog. Visit https://superblog.ai to know more. ---