AI SDR security and compliance checklist for buyers: data handling, DPA, opt out

Ask an AI SDR vendor sixteen questions in four groups: where data lives and who touches it, how accounts connect, how the product handles opt outs and deletion, and what the vendor proves versus claims. Insist on a signed data processing agreement, a sub-processor list and a written statement on model training. We answer all sixteen below, and we say plainly that we make no claim of an audit, a certification or a penetration test report.

An AI SDR holds contact data, conversation history and access to your LinkedIn, email and WhatsApp accounts. That deserves a proper review, and most vendor security pages are written to reassure, not to answer. Use this list in any evaluation, ours included. The answers marked Sellinger come from our security page, privacy policy and DPA, which are the places where each statement is made.

A. Data and where it lives

1. Where is the data stored? Ask for the region and the provider. Sellinger: database, sign in and file storage on Supabase (Amazon Web Services, Stockholm); application servers and background workers on Google Cloud (Finland); web hosting on Vercel. The main database and servers are in the European Union.

2. Who are the sub-processors? A vendor should list each company that processes your data, what it does and where. Ours are in the privacy policy, including Unipile SAS, which connects LinkedIn, email, WhatsApp and Instagram accounts and is in France.

3. Is data encrypted? Ask about transit and rest. Sellinger: TLS in transit; databases, file storage and backups are encrypted at rest by the hosting providers.

4. Is customer data used to train models? Ask in writing. Sellinger: we do not use customer data or output to train AI models, ours or anyone else's.

5. What happens to backups and deletion? Sellinger: the database has automated backups with point in time recovery; deleted data leaves backups as they rotate, unless the law requires us to keep it (DPA, section 11). Retention for each kind of data is in section 9 of the privacy policy.

B. Accounts and access

6. How are your channel accounts connected? Look for a hosted login and no stored password. Sellinger: you connect through a hosted login, and we do not store your LinkedIn password. You can connect LinkedIn through your own proxy if you need one.

7. How do your people sign in? Sellinger: email, Google or Microsoft. Single sign on by company domain is available on request for Enterprise.

8. How are API keys handled? Sellinger: keys are stored only as SHA-256 hashes, can be revoked or set to expire, and carry per minute and per day limits.

9. What does the assistant connector expose? If you connect Claude or ChatGPT, ask about scoping and logs. Sellinger's connector uses OAuth with tokens scoped to one workspace and one access level (Full access or Read only), requests are logged, and access ends when you disconnect.

C. Opt outs, deletion and sending controls

10. What happens when someone says stop? Sellinger: a reply such as STOP or unsubscribe, in English, Bulgarian or German among other forms, puts the contact on the team's suppression list, the agent stops and the lead is closed out. An unclear phrase never writes the permanent record; the agent stops and a person decides.

11. Is the suppression list checked before every send? Sellinger: before every send on email, LinkedIn and WhatsApp, the platform checks the list and refuses the send when the contact is on it or when the check cannot be completed. See outreach rules.

12. Can you erase a person? Sellinger: an erasure function takes an email address, phone number or LinkedIn address, anonymizes the matching leads in the workspace and adds the identifiers to the suppression list so the person cannot be imported and contacted again.

13. What limits protect your accounts and your reputation? Ask about daily caps, quiet hours and approval. Sellinger: per account limits the agent cannot exceed (LinkedIn defaults of 20 invitations a day and 150 a week, 50 emails a day per mailbox), a sending schedule and an approval mode where every message waits for a person.

D. What is proven and what is claimed

14. Is there a signed DPA? Sellinger publishes a DPA. It sets terms for breach notice, sub-processors and deletion. Ask any vendor for theirs before you load data.

15. What happens after a breach? Sellinger: notice without undue delay after becoming aware of a personal data breach that affects your data, and where feasible within 48 hours (DPA, section 9).

16. What does the vendor not claim? This is the question that tells you most. Sellinger's security page makes no claim of an audit, a certification or a penetration test report, and says no system is completely secure. If you need a SOC 2 or ISO report for procurement, we are not the right vendor today. Vendors that claim certifications should show the report and its date.

How do you score the answers?

Mark each of the sixteen: clear and documented, clear but verbal, or evasive. A "clear but verbal" answer needs to be written down in the contract. An evasive answer on questions 4, 11 or 14 is a stop.

Add three practical checks:

• Read the DPA yourself. Look at the sub-processor change process and deletion timing.
• Test the stop path. Reply STOP to your own test campaign and watch the result.
• Ask for a named contact. Who answers a security question on a Sunday?

How do you run the review in practice?

A buying decision needs evidence, not reassurance. Use a simple process.

1. Send the sixteen questions to each vendor in writing before the first demo, and ask for answers in writing.
2. Ask for the DPA and the sub-processor list as documents, not as a link to a marketing page.
3. Score the answers using the three grades above.
4. Ask the security contact one question that is not on the list, and see how fast a named person answers.
5. Have counsel read the DPA, in particular the breach notice, sub-processor change and deletion sections.
6. Run a trial with test data first. Reply STOP to the test campaign and check the suppression list.

A vendor that will not answer in writing has answered.

A scorecard you can copy

The grades below are made up for an imaginary vendor, to show how the scoring works.

This imaginary vendor gets one stop (question 4) and two answers that need to be written into the contract. The right move is to hold the purchase until the training answer is in writing.

Which questions matter most for an outbound tool?

Every question on the list applies, but an outbound tool adds risks that a generic SaaS review misses, because it sends messages in your name.

• Questions 10 to 13 decide whether a person who says stop is respected, whether the check can fail open, whether a person can be erased and what limits protect your accounts. Sellinger's answers are that the check fails closed, an erasure function exists and per account limits cannot be exceeded.
• Question 6 decides what happens to your channel accounts. A hosted login with no stored password is the baseline. As for LinkedIn, no tool can guarantee that LinkedIn will never restrict an account, and a vendor that says otherwise should be asked how it knows.
• Questions 4 and 5 decide what happens to your contacts' data over time, including after you leave.

What if you are in a regulated market?

Ask your counsel. Rules differ by country, and this checklist is not legal advice. For cold email and consent, read is cold email legal. For the wider buying questions, see the AI SDR buyer's checklist, and for what we publish about security, the security page.