Key takeaways
- Ask in writing whether your data trains any model, and accept only a clear answer.
- Check what the assistant can do without approval, action by action.
- Separate certifications held today from those still in progress.
- Pilot on a real segment with success criteria agreed beforehand.
Which questions to ask AI sales vendors about your data
Ask every vendor the same written questions about where your data goes, who can see it and whether it trains any model. Identical questions make the answers comparable; vague answers to them are an answer in themselves.
- Is any of our data, prompts or output used to train a model, yours or a provider's?
- How is our data kept apart from other customers' data?
- Which third parties process our data, and where?
- What happens to our data when we disconnect a tool or leave?
- How do people sign in, and who can see what inside our workspace?
Which approval controls should an AI sales assistant have
An AI sales assistant should let you decide, per action, whether it runs on its own, waits for approval or is only planned. Sending email, changing CRM records and starting lead searches carry different risks and deserve different settings.
Ask for a demo of the controls, not a description. Watch what happens when the assistant wants to send an email or change a record, and check which actions always ask, whatever the setting.
How do you check a vendor's certifications
Ask which certifications are held today, which are in progress and for the evidence behind each. A certification in progress is a plan, not a control you can rely on yet.
Read the vendor's trust page and request the documents your security team needs. Make sure the certification covers the parts of the product you will use, such as the email connection.
What should an AI SDR vendor checklist cover beyond security
Beyond security, the checklist should cover fit with your tools, the quality of the writing, the limits of the lead data and how pricing grows with use. A secure tool that cannot reach your mailbox or CRM will not get used.
- Connections: your mailbox, calendar, CRM and the other tools the team already uses.
- Context: how the assistant learns your offer, customers and brand voice.
- Lead data: where it comes from, what each search returns and its limits.
- Writing: drafts on your real segment, judged by the people who will send them.
- Pricing: what a seat includes and what uses up credits or allowances.
How do you run a pilot before choosing an AI sales assistant
Run a pilot on one real segment, with a named owner and success criteria agreed before it starts. A pilot on made-up data proves only that the demo works.
Keep the scope small and the review honest: the drafts the team actually sent, the time spent correcting them and whether the controls behaved as promised. Compare vendors on the same segment where you can.
AI sales assistant evaluation, step by step
Run the same steps for every vendor on the shortlist.
- Write down the jobs you want the assistant to do and the tools it must work with.
- Send each vendor the same written questions on data use, training, controls and certifications.
- Check every answer against the vendor's trust page and product documentation.
- Run a pilot on one real segment, with agreed success criteria and a named owner.
- Compare the pilot results and the written answers side by side before you sign.
A worked example: Pebbles Ai's answers
How Pebbles Ai answers the checklist above, as an example of the detail to ask for.
| Pebbles Ai's answer | |
|---|---|
| Model training | No. Your company information is never used to train an AI model. |
| Data separation | Tenant-Isolated AI, the Pebbles Ai architecture for tenant isolation and data security: each business works in its own secured tenant. |
| Held | CASA II and Microsoft 365 certified; GDPR compliant. |
| Pending | SOC 2 Type II and ISO 27001 are pending, with a Q2 2027 target. |
| Approval controls | Auto, Plan and Manual execution modes; the web app starts in Manual. |
| Sign-in | Google, Microsoft or an emailed one-time code, with no passwords. |
| CRM | A built-in CRM in Beta; Attio and Pipedrive through MCP, each write approved under the execution mode. |
From the Pebbles Ai trust page and product records, November 2026.
Where Pebbles Ai fits
- CapabilityAI workspaceIn Manual mode, where the web app starts, email sends, CRM writes, MCP calls and starting lead generation wait for approval; Plan queues them and Auto runs them without asking. Template send and calendar delete always ask, in every mode.
- FoundationIntegrationsGmail, Outlook, Google Calendar, Notion and Slack connect natively, and MCP catalogue servers such as Attio and Pipedrive connect with each service's own sign-in (the catalogue may change).
Common questions
What is the most important question to ask an AI sales vendor?
Whether your data, prompts or output are used to train any model, theirs or a provider's. The answer should be a plain yes or no, in writing.
Is a pending SOC 2 Type II report enough when you buy?
That depends on your security policy. If it requires SOC 2 Type II, ask whether it is held today or pending, and treat pending as not yet held.
How long should an AI sales assistant pilot run?
Long enough to cover research, drafting and replies for one segment, often a few weeks. Agree the success criteria before it starts.
About this page. Written by the Pebbles Ai team for people who run sales, marketing and growth. Last updated .
