Last reviewed: October 28, 2026. General information, not legal advice. Send these questions to the vendor with your quote request and keep the written answers with the contract. Published facts quoted in the "why it matters" column were read on the vendors’ own pages on October 28, 2026.
The checklist
| Topic | Ask the vendor | Why it matters |
|---|---|---|
| DPA coverage | Does your Data Processing Addendum cover this exact product, plan and every connector we will use? Please confirm in writing. | Some DPAs cover only certain services. x.ai’s published DPA limits personal data to its ZDR-Enabled API; OpenAI’s DPA is self-serve. Coverage of the product you are buying is what matters. |
| DPA signature | Is the DPA signed by both parties, accepted online, or part of an order form? Who is the contracting entity? | You need to show the contract exists. Save the signed copy or the dated acceptance record. |
| Seat minimums and term | What is the minimum number of seats, the minimum term, and the price per seat at our count? Can we add and remove seats mid-term? | ChatGPT Business is published for teams of 2 to 200. Enterprise minimums are not published by OpenAI or x.ai. |
| Audit logs | Are admin and user activity logs included at this tier? What events do they record, how long are they kept, and can we export them (API or file)? | On ChatGPT, the Compliance API logs platform is listed for Enterprise only. Grok Business lists "advanced audit and security controls"; ask what that includes. |
| SCIM and SSO | Are SAML SSO and SCIM provisioning included at this tier, or only on a higher plan or for an extra fee? | SCIM is Enterprise only on both vendors’ published pages; SAML SSO is listed for ChatGPT Business, and custom SSO for Grok Enterprise only. |
| Data retention | What is the default retention for chats, files, memory and connector data? Can we set it shorter, including zero retention? Does deletion include backups and sub-processors? | The Safeguards Rule expects you to review retention to limit unnecessary data. |
| Training on our data | Is our data used to train models by default? Where is that written in the contract, not just the website? | Both vendors’ business pages say no training by default; get it in the contract. |
| SOC 2 | Please send your current SOC 2 Type 2 report. Does its scope name this product, and what period does it cover? Are there exceptions noted? | OpenAI provides its SOC 2 Type 2 report through its Trust Portal. x.ai lists SOC 2 Type I and II for Business and Enterprise. |
| Sub-processors | Where is your sub-processor list, and how do you notify us of changes? | Keep a dated copy with the DPA. |
| Incident notice | How fast will you notify us of a security incident affecting our data, and to whom? | Your first notice to Fannie Mae is planned within 36 hours under Bulletin 26-01. A vendor promise of "without undue delay" may not be fast enough on its own. |
| Connectors and admin controls | Can admins turn connectors off by default, allow them per user or group, and see which users have connected email or drives? | You need this to run a documented exception for named users. |
| Exit and deletion | When we leave, how do we export our data, and how is it deleted? Will you certify deletion? | Plan the exit before you sign. |
Red flags
- The vendor will not say in writing whether the DPA covers the product you are buying.
- No current SOC 2 report, or a report whose scope does not name the product.
- Audit logs or SCIM only "on the roadmap" for your tier.
- Retention cannot be shortened, or deletion does not reach sub-processors.
- Seat minimums that push you onto a plan you would not otherwise choose.
After the quote
- Record the DPA and SOC 2 status in the portal tracker: not started, requested, signed or on file.
- Add the source links (DPA page, trust portal, sub-processor list).
- Note any gaps as documented exceptions with a review date.
- Update your rollout plan so company-wide use starts only after the DPA is signed.
Related: ChatGPT and Grok plan comparison, AI controls checklist and AI vendor due diligence for mortgage companies.
Send a vendor questionnaire with every quote
The $349 AI Policy Kit includes a vendor questionnaire and an AI use inventory, plus 3 months of Small Shop portal access with the DPA and SOC 2 tracker.
Get the AI Policy Kit, $349AI Policy Starter, $99AI Team Kit, $699Compare kitsFrequently asked questions
What should I ask an AI vendor before signing?
Whether the DPA covers the exact product, seat minimums and term, whether audit logs and SCIM are included at your tier, data retention controls, training on your data, the current SOC 2 report and its scope, sub-processors, incident notice timing, connector controls and exit.
Are Enterprise seat minimums published?
Not by OpenAI or x.ai as of October 28, 2026. Ask in the quote.
Is this checklist free?
Yes. Use it on this page or print it. No email is required.