Your First Business Customer Sent A Security Questionnaire: What Your AI Product Needs To Answer It

The buyer is not asking whether you enabled a database setting. They are asking you to describe, in writing, how one customer's data is prevented from reaching another customer, and then to show them evidence that the design holds. This is a different question from the pre-launch check covered in our production-readiness checklist, which is about whether a stranger on the internet can read your tables. Tenant isolation is about whether customer B can read customer A, including through your AI layer. What a security reviewer will ask you to supply: - The isolation model, named. Separate database per customer, separate schema, or shared tables with a tenant identifier. All three are acceptable answers. "I am not sure" is not. - Where the tenant boundary is enforced. Database, application layer, or both. If it is only enforced in application code, say so, because a reviewer will assume the worst if you are vague. - The AI-specific paths. Vector stores, retrieval indexes, prompt caches, fine-tuned models and conversation history are all places tenant data pools. Each one needs its own answer. - Proof. A test account in customer A's tenant that provably cannot read customer B, run as part of your test suite, is the cheapest evidence you can produce. The failure is not theoretical. On 20 March 2023 a bug in the redis-py library let ChatGPT users see other users' chat titles, and OpenAI's own post-incident update said the same bug exposed billing details for 1.2 per cent of ChatGPT Plus subscribers active during a nine-hour window. That happened to a company with a full security team.

Every questionnaire asks who inside your company can access customer data, on what basis, and how that access is reviewed. A one-person company still has to answer it, and "just me" is a valid answer only if you write down what it means in practice. This matters more than founders expect because human error is a leading cause of Australian breaches, not a rounding error. The OAIC's January to June 2025 reporting period attributed 37 per cent of all breaches to human error, up from 29 per cent in the previous period (OAIC, 4 November 2025). The answer a reviewer accepts has four parts: - A named list of roles and what each can reach. Founder with production database access, contractor with read-only logs, support person with an admin console that shows customer records. - A rule for production access. Whether staff can query the production database directly, and whether they need a second person's approval to do it. - A record of when it happened. Support staff impersonating a customer account is normal in software. Doing it without logging who, when and why is what fails a review. - Joiners, movers and leavers. How access is granted on day one and removed on the last day. For a contractor, that means a specific date, not an intention. Write this as a one-page internal access policy. It takes an hour and it answers a dozen questions on every questionnaire you will ever receive.

A log is for diagnosis. An audit trail is for accountability, and a reviewer asking for one wants a record that attributes actions to people and survives long enough to settle a dispute. We draw that distinction in detail in our guide to seeing what your AI agent is doing. For an AI product sold to a business, the events a buyer expects to see recorded are narrower than a full log and much more specific: - Sign-ins, failed sign-ins and multi-factor changes - Permission and role changes inside the customer's account - Any staff access to customer data, including support impersonation - Data exports and bulk downloads - Deletion of customer records - Configuration changes to the AI itself: which model, which prompt, which data sources it can reach Three questions follow, and they are the ones small vendors usually fail. Can the customer see their own audit trail, or does it live only in a tool you own? How long is it kept, in days? And can it be edited by anyone who can edit application data, because if it can, it is a log wearing a costume. Append-only storage, a stated retention period and an export the customer can request are enough at this stage. Nobody expects a small vendor to have tamper-proof cryptographic logging. They expect you to have thought about it.

Retention is how long you keep customer data. Residency is which country it physically sits in. Both are direct questions on every standard questionnaire and neither has a defensible answer unless you decided it deliberately. For retention, a buyer wants a schedule, not a philosophy. Name each store you hold and how long data lives in it: the primary database, backups, logs, analytics, error monitoring, email records, and the AI conversation history. Then answer the deletion question. When a customer leaves, what happens, within how many days, and does that include backups. "Within 30 days of termination, excluding encrypted backups which expire on a 35-day rolling cycle" is a real answer. "We delete it" is not. For residency, Australian buyers in government, health and finance will ask where the data is stored and processed, and they will ask the same about your AI provider. This is answerable, but be precise about which half you have. OpenAI lists Australia among its at-rest data residency regions for eligible API, ChatGPT Enterprise and Edu customers (OpenAI, 25 November 2025). At-rest residency is not in-region inference: model execution defaults to the United States, and in-region GPU inference is offered only in the United States and Europe (OpenAI, 16 January 2026). Data stored in Australia while inference runs offshore is a normal and acceptable answer. Claiming Australian residency without that distinction is not. Google Cloud lets you pin Vertex AI workloads to a region, including australia-southeast1 in Sydney, and states it does not use customer data to train its foundation models without permission. Anthropic's models are reachable through AWS Bedrock and Google Vertex in regional deployments as well as its own API. The honest position, which reviewers accept: name where each part of the chain runs today, and say plainly whether AI inference happens offshore. Do not claim residency you do not have.

A subprocessor list is the set of third parties that touch customer data on your behalf, and for an AI product every model provider belongs on it. Most small vendors publish a hosting provider and forget the model. Buyers now check this specifically. Vanta's 2025 AI governance survey found 42 per cent of organisations say their vendor risk management process has become more rigorous because of concerns about AI tools, and the World Economic Forum's Global Cybersecurity Outlook 2025 reported that while 66 per cent of organisations expect AI to have the biggest impact on cybersecurity in the coming year, only 37 per cent have processes to assess the security of AI tools before deploying them. Your list needs a row per provider with four columns: what it does, what data it sees, where it processes, and whether it trains on your input. The last column is where free tiers bite. | Provider tier | Published position on training | |---|---| | OpenAI API and business tiers | "By default, we do not use your business data for training our models" (Enterprise privacy at OpenAI, updated 8 January 2026) | | OpenAI consumer ChatGPT Free and Plus | Governed by different settings, with model improvement on by default | | Anthropic Commercial Terms (API, Team, Enterprise) | Commercial Terms state Anthropic may not train models on customer content | | Google Vertex AI and paid Gemini API | Google states it does not use customer data to train its foundation models without permission | | Unpaid Gemini Developer API tier | Google's terms state submitted content is used to provide, improve and develop Google products, and may be reviewed by humans | That last row is the trap. A small vendor prototyping on a free API key and shipping it to a paying customer has put that customer's data into a training pipeline, and the questionnaire will ask the question that exposes it. Check which key your production system is using before you answer. Also state your retention with each provider. OpenAI states it may retain API inputs and outputs for up to 30 days to provide the service and identify abuse, after which they are removed unless it is legally required to retain them. Certain endpoints are excepted, and zero data retention is available for eligible use cases (Enterprise privacy at OpenAI, updated 8 January 2026).

A Data Processing Agreement is the contract that says what you may do with your customer's data, and enterprise procurement will not complete without one. Have a version ready rather than negotiating one from scratch under deal pressure. The clauses buyers look for are consistent across published SaaS agreements: - Roles. The customer is the controller and you are the processor. You process only on their documented instructions. - Subprocessors. Your published list, plus notice before you add a new one. Adding an AI provider is a subprocessor change and buyers increasingly treat it that way. - Security measures. A short, concrete schedule of what you actually do: encryption in transit and at rest, access control, logging, backups. - Breach notification to the customer. A stated window. Published SaaS agreements commonly commit to notifying the customer without undue delay, and many name a fixed period such as 48 or 72 hours. Pick one you can meet. - Deletion and return on termination. Matching the retention schedule you wrote in the previous step. - Audit and assistance. What you will provide if the customer is audited, and how you help them respond to a privacy request. One point of Australian nuance, stated carefully because it is a legal question rather than a technical one. The Australian Privacy Principles do not impose the same explicit written-contract requirement that Article 28 of the GDPR does, but Australian Privacy Principle 11 still makes an entity responsible for the security of personal information it holds, including where handling is outsourced. Our guide to the Privacy Act and Australian Consumer Law covers the obligations. Have a lawyer look at your DPA before you sign it.

Every questionnaire asks whether you have an incident response plan, and Australian buyers will ask specifically about the Notifiable Data Breaches scheme. You need a document, a named person and a set of timeframes. The volume is not trivial. The OAIC received 1,205 data breach notifications in the 2025 calendar year, an 8 per cent increase on the 1,112 received in 2024 and the highest since the scheme commenced in 2018. In the January to June 2025 period, malicious or criminal attacks caused 59 per cent of breaches, at 308 notifications, and the average cyber incident affected just over 10,000 individuals (OAIC, 4 November 2025). Under the scheme, an entity that suspects it may have had an eligible data breach must carry out a reasonable and expeditious assessment, and section 26WH of the Privacy Act 1988 sets 30 days as the outer limit for completing that assessment. If the breach is eligible, the entity must notify the Commissioner and affected individuals as soon as practicable. Confirm the specifics against the OAIC's own guidance rather than this page, because the obligations turn on facts. Carly Kind, Australian Privacy Commissioner, made the supply chain point directly in the OAIC's statistics release of 4 November 2025: "organisations are responsible for the actions of third-party providers when outsourcing their personal information handling. Organisations that implement strong supplier risk management frameworks, together with more robust security measures, can substantially minimise the impact of a data breach in the supply chain." Read that from your buyer's side. When they send you a questionnaire, they are discharging that responsibility. Your plan needs five things: who declares an incident, how you contain it, how you assess whether it is notifiable, who tells the customer and within what window, and where you write down what happened.

Usually not at your first enterprise deal, and the cost is the reason to be sure before you commit. A written answer with attached evidence clears most first reviews. The numbers, converted at roughly 1.55 Australian dollars to the US dollar and worth rechecking against the current rate. US compliance advisory firm bdemerson put first-year all-in SOC 2 at 30,000 to 90,000 US dollars in an analysis dated 2 July 2026, which is around $47,000 to $140,000 AUD, with the audit fee itself only 7,000 to 25,000 US dollars for a Type I and 12,000 to 45,000 for a Type II. Other 2026 vendor guides put small-company year one lower, clustering around 25,000 to 80,000 US dollars. Worth knowing before you budget: every published estimate comes from a firm selling audits or compliance software, and no independent benchmark appears to exist. The auditor directory soc2auditors.org, updated 10 August 2026, lands in the same place, quoting planning bands of 10,000 to 30,900 US dollars for a Type I and 15,000 to 50,000 for a Type II, with readiness, software, penetration testing and internal labour all on top. A SOC 2 Type II also needs an observation window, and the AICPA minimum is 3 months with 6 months the common recommendation, so a first Type II report typically lands 6 to 12 months after you start. Type I proves your controls were designed correctly at a point in time. Type II proves they operated over the window, and that is what enterprise procurement generally wants. The Essential Eight is a separate question again. It is the Australian Signals Directorate's set of eight mitigation strategies with four maturity levels, and its maturity model was first published on 30 June 2017 and last updated on 27 November 2023. The ASD's own document is clear about certification: "there is no requirement for organisations to have their Essential Eight implementation certified by an independent party. However, Essential Eight implementations may need to be assessed by an independent party if required by a government directive or policy, by a regulatory authority, or as part of contractual arrangements." If you are selling to a Commonwealth entity, expect it in the contract. If you are selling to a mid-sized private company, expect it never. "Nobody buys your first product because you hold a certificate," says Callum Holt, Founder of 13Labs. "They buy it because you answered forty questions without flinching and sent the evidence the same day. The certificate matters at the point where a buyer's policy says it does, and not one deal earlier. Spend the $50,000 when a signed contract is waiting on it." The sequence that works: write the eight answers above into one document, attach the evidence you already have, and put a line in your reply saying when you intend to start SOC 2. Buyers accept a credible plan far more often than founders expect.

What do I do when a questionnaire asks something I do not have? Answer honestly, describe the compensating control, and give a date. "We do not have single sign-on today. Accounts require multi-factor authentication and we plan SSO by March 2027" passes review far more often than a blank cell or a hopeful yes. A wrong yes discovered later ends the relationship. Is enabling row-level security enough to answer the tenant isolation question? No. That check answers whether an anonymous visitor can read your database. Tenant isolation asks whether one paying customer can reach another, including through vector stores, prompt caches and conversation history, and the reviewer wants the design described plus evidence that it holds. How long should I keep an audit trail? Longer than your buyer's dispute cycle, which is usually months rather than days. Most Australian business records must be kept for five years under ATO rules, so if the AI's actions form part of a business record, write them somewhere you control instead of relying on a platform history tab. Confirm record-keeping periods with your accountant. Does my AI provider go on the subprocessor list? Yes. Anything that processes customer data on your behalf is a subprocessor, and the model provider processes every prompt. List it with what data it sees, where it processes, its retention period and its published position on training. Free API tiers usually have different training terms from paid ones, so check which key production uses. How much does a first SOC 2 cost in Australian dollars? Published 2026 estimates cluster around 25,000 to 80,000 US dollars all-in for year one at small-company scope, which is roughly $39,000 to $124,000 AUD at about 1.55, and most startups are reported in the lower half of that. Every published figure comes from a firm that sells audits or compliance software, and no independent benchmark appears to exist, so treat them as indicative rather than authoritative. The auditor's fee is the smaller part. Readiness work, a compliance platform, a penetration test and your own time make up the rest. Second-year costs are reported to fall by roughly 20 to 40 per cent. Will a buyer accept answers instead of a certificate? Often, for a first deal. What they will not accept is inconsistency. If your questionnaire, your DPA, your privacy policy and your public trust page say different things about retention or subprocessors, that is the finding that stops the deal, not the missing certificate.