Buying an AI agent for inbound sales is a software decision and a security decision at once. The agent reads lead data, writes to your CRM and sends messages in your name. Your security team will want clear answers before it signs off, and the sales leader running the evaluation can save weeks by asking the same questions early.
Bring three groups into the room early: the sales leader who owns the outcome, the security reviewer who owns the risk, and a rep who will work alongside the agent. Each will notice problems the others miss.
Use the questions below with any vendor. Ask for answers in writing, and treat a vague answer as an answer.
Data and access
- Which systems does the agent connect to, and with what permissions? Can access start read-only?
- Is each customer's data kept in a separate workspace, and how is that enforced?
- Who at the vendor can see our lead data, and is that access logged?
- What happens to our data when we leave? How is deletion confirmed?
Hosting, models and subprocessors
These are the questions that most often delay a review, and the answers should be specific.
- Where is our data stored and processed, by region?
- Which AI models are used, and is our data used to train them by the vendor or by the model provider?
- Which subprocessors handle our data, and how are we told when that list changes?
- Which certifications does the vendor hold? Ask to see the evidence, not only the badge.
What the agent can and cannot do
- Can we write rules for when a person takes over, and can we change them ourselves at any time?
- Does the agent send only approved messages, or can it write anything it likes?
- Which actions need a person's approval, and which limits cap how much an agent can send?
- Can the agent negotiate, discount or commit on our behalf? Can we make sure it never does?
- If a rep edits a CRM record by hand, can the agent overwrite that edit?
Your CRM and your reps
The agent will read and write records your reps rely on every day, so a mistake here is felt by the whole team. Ask how the integration behaves when things go wrong, not only when they go right.
- Does the sync run both ways, and which side wins when two edits conflict?
- What happens to a record if the agent loses its connection halfway through an update?
- Can we see exactly which fields the agent is allowed to change?
Audit and traceability
- Is every agent action recorded, with the rule or reason behind it?
- Can a manager open one lead and see everything that was sent and written?
- Can we export the log for our own review?
How the vendor tests its agents
A demo shows the best case. Ask how the vendor finds the other cases.
- Is the agent tested on our own past leads before it goes live, and who decides what a good outcome is?
- What stops a change to a prompt or a model from making things worse? Is there a regression check?
- How is the system tested for prompt injection and data leaks? The OWASP Top 10 for LLM applications is a useful reference for this conversation.
- After launch, what is monitored: quality, speed, cost per action? When something goes wrong, does it become a new test case?
Rollout and exit
- Can we run a pilot on a share of leads and compare it with our team before widening it?
- Can we switch the agents off quickly if we need to?
- What does the vendor do if it finds a security incident that affects us, and how fast do we hear about it?
How to use the answers
Score each vendor on the same list, and share it with security early. The most useful signal is often not the answer itself but how it is given: whether the vendor is specific, whether it commits to written documents, and whether it says plainly what it cannot do.
We share our security documents under NDA as part of an enterprise evaluation. You can see what we cover and request the pack on our security page. Go to the security page