Skip to main content
gpodz

Guide

Security questions to ask any company-model vendor

Ask where your material goes, how long it is kept, who else processes it, what independent assurance exists, and how you connect and report problems. Below is each question with our current answer. Several answers are "in progress" or "not in place", and we say so.

Ask Gee about this guide

Gee is an AI demo and can be wrong. Don’t share confidential information. Conversations aren’t stored.

How to use these questions

Ask every vendor the same questions and compare the answers side by side. A vendor that says "in progress" or "not in place" is giving you usable information. A vendor that answers everything with a yes and no detail is not.

The statuses below follow our trust page. Designed means part of the platform design and supported by its code, not independently verified.

Where your material goes

  • Is our material kept separate from other customers?

    Designed

    The storage layout keeps each organization's material, adapters, and adapter versions under that organization's own paths. Contract terms are being finalized with counsel.

  • Who else processes it?

    In progress

    The list of service providers that process customer data is being finalized with counsel.

Retention and deletion

Until periods are published, ask about any deletion request directly. Include retired adapters in the question, because an adapter trained on your material is itself something that may need to be deleted.

  • How long is it kept, and how is it deleted?

    In progress

    Retention periods and deletion timelines, including for retired adapters, are being set with counsel.

Assurance and access

  • Do you hold independent security attestations?

    Not in place

    No attestations or certifications today, and no independent penetration test yet.

  • Can we connect our identity provider?

    Not in place

    Identity provider integration is not available today.

  • Is there an audit trail?

    Designed

    Append-only and hash-chained. Per-organization export is designed but not yet offered.

Reporting and legal documents

Vulnerability reporting is in progress. The security reporting mailbox is being set up. Until it is live, raise security questions during scoping. The privacy notice, terms of service, and data processing addendum are being finalized with counsel. Ask for their current status during procurement.

What to ask for in writing

For each answer that is in progress or not in place, ask what would change it and when. Ask for the reply in writing. Check it against the trust page, which lists each item and is dated.

Your adapters are trained on material you approve. By design, the shared base model is not retrained on it.

Questions on this topic

Do you hold security certifications?

No. We do not hold independent security attestations or certifications today, and no independent penetration test has been completed yet.

Are your legal documents ready?

Not yet. The privacy notice, terms of service, and data processing addendum are being finalized with counsel.

Can we connect our identity provider?

Not today. Identity provider integration is not available, so ask us about current sign-in options during scoping.

Where can we see current status?

The trust page lists each item as available, designed, in progress, or not in place, and it is dated.

Send us your questionnaire.

Tell us what your review requires. We will answer from the trust page and say where we cannot meet a requirement today.

Talk to us