Key facts
- Regulation S-P requires an SEC-registered adviser's incident response program to be reasonably designed to ensure service providers notify the adviser as soon as possible and no later than 72 hours after becoming aware of a breach (17 CFR 248.30(a)(5)(i)(B)).
- An SEC-registered adviser must notify affected individuals as soon as practicable and no later than 30 days after becoming aware that unauthorized access to sensitive customer information has occurred or is reasonably likely to have occurred.
- The FTC Safeguards Rule, which covers state-registered advisers, requires contractual oversight of service providers but sets no fixed breach-notification deadline for them.
- Advisers Act Rule 204-2(a)(25)(v) requires SEC-registered advisers to keep the written documentation of any contract or agreement entered into under Regulation S-P's service-provider provision.
- A usable answer to a breach-notification question names the clause and the document it lives in; a description of security commitments that names neither is not an answer.
Most vendor security questionnaires are long, generic, and produce answers nobody reads. They are built to be completed rather than to be informative, and a capable vendor can fill one in without telling you anything you did not already assume.
The nine questions below are shorter and harder than a standard questionnaire. Each one has an answer that would change whether you sign, or change what you write into the contract before you do. Send them in writing, keep the reply, and file it where your next examiner or your next successor can find it.
The breach-notification clock comes first because the firm's own deadline depends on it
1. Will you notify us within 72 hours of becoming aware of a breach? Please point to the clause and tell us which document it is in.
The 72 hours is not arbitrary. If you are SEC-registered, your incident response program has to be reasonably designed to get service providers to notify you within that window, because your own notice to affected clients is due as soon as practicable, and in any event no later than 30 days after you become aware. A useful answer names a clause and a document. An answer that describes a commitment to security without naming either is not an answer, and this is the one question where the response tells you something no matter what it says. A vendor who can point to the clause in a day has thought about your obligation.
2. Are those calendar hours or business hours, and can our contract override the period?
Both of those qualifiers, business hours and contractual override, appear in real vendor agreements, and both change what the 72-hour number means. Business hours can stretch a 72-hour commitment across a weekend and beyond, and a clause that defers to your master services agreement means the governing number is in your paperwork rather than on their website. Ask which one you have. Then check that your paperwork says what you think it does.
If your firm is state-registered rather than SEC-registered, the 72-hour figure has no hook in the federal rule that covers you, because the FTC Safeguards Rule requires the contract but sets no deadline. The clause is still worth asking for. The reason is your contract rather than a regulator's clock.
Where your client data goes, including to subprocessors and model providers
3. Where is our client data physically processed, including by any subcontractor?
The answer for the vendor's own systems is usually easy. The answer for their subcontractors is the one that matters, because that is where processing quietly moves to a jurisdiction or a provider nobody evaluated. A good answer is specific about regions and says who else is in the chain.
4. Please name every subprocessor and every model provider that touches our data.
A list, by name, with the ability to be notified when it changes. Model providers are the part firms most often miss: the vendor may be a thin layer over someone else's model, and the terms that matter may be that other company's terms. If the vendor cannot tell you which model provider sees your data, they cannot tell you whose privacy commitments you are actually relying on.
5. Is our data used to train any model, yours or a third party's, in any form including de-identified?
Ask about all three: their own models, any third party's, and de-identified data. "We do not train on customer data" sometimes means the vendor does not, while the model provider underneath might. De-identification is worth naming explicitly because it is the common exception, and because removing obvious identifiers does not by itself make client information appropriate for a system your firm has not approved.
What you can get back from the vendor: retention, deletion, and audit exports
6. What is your retention period, and what happens to our data when we terminate?
Two dates: how long they hold it during the relationship, and how long after it ends. Get the deletion commitment in writing along with whatever confirmation you will receive. This is also the question whose answer tends to change when you ask it a second time, in the contract rather than in email.
7. Can we export our complete audit trail without requesting your permission?
Not a report they run for you. An export you can take yourself, on your schedule, without a support ticket. If the answer requires the vendor's cooperation, then your ability to reconstruct what happened depends on a company that may be the subject of the question you are trying to answer.
8. Do your records satisfy Advisers Act Rule 204-2, or do your terms disclaim that?
Advisers Act Rule 204-2 is your recordkeeping obligation, not the vendor's. Many vendor agreements disclaim any recordkeeping role, which is fine as long as you know it and keep the records yourself. Worth knowing: since the Regulation S-P amendments, Rule 204-2(a)(25)(v) requires SEC-registered advisers to retain the written documentation of any contract or agreement entered into pursuant to Regulation S-P's service-provider provision. So the clause you negotiate in answer to question one is a record in its own right, and the vendor's reply is worth keeping with the contract that 204-2(a)(10) already requires you to hold.
Who carries the loss when something goes wrong
9. What is your liability cap, and do you indemnify us?
Liability caps are often set at some multiple of fees paid, which for an inexpensive tool can be a small number against a large loss. That may still be an acceptable trade. The point is to know the number before an incident rather than to discover it during one, and to decide deliberately whether the exposure sits with them, with you, or with your insurer.
How to use the nine questions
Send all nine questions at once, in writing, and give the vendor a date for the reply. The pattern of the response is as informative as its content: which questions get a clause reference, which get marketing copy, and which get a promise to follow up.
Then file the answers with the contract. The value of this list is not the afternoon you spend on it. It is that two years from now, when someone asks what you knew about this vendor and when, there is a document that answers.
Questions
What are the nine questions to send an AI vendor before signing?
Whether the vendor will notify the firm within 72 hours of a breach and where that clause lives; whether the hours are calendar or business hours and whether the contract overrides them; where client data is processed; every subprocessor and model provider; whether data trains any model; retention and deletion terms; whether the audit trail can be exported without permission; whether the vendor's records satisfy Advisers Act Rule 204-2; and the liability cap and indemnity.
Which of the nine vendor questions matters most?
The first one, on 72-hour breach notification. For an SEC-registered adviser the firm's own notice to clients is due no later than 30 days after it becomes aware of a breach, so the vendor's clock decides how much of that window the firm keeps. A vendor who can name the clause and the document in a day has thought about the firm's obligation.
Do the nine questions apply to a state-registered adviser?
Yes, with one change in the reasoning. The FTC Safeguards Rule, which covers advisers not registered with the SEC, requires the firm to contract with and monitor service providers on safeguards but sets no 72-hour deadline. The notification clause is still worth obtaining; the reason is the firm's contract rather than a regulator's clock.
What should a firm do with the vendor's answers?
Send all nine questions at once, in writing, with a reply date, and file the answers with the contract. Rule 204-2(a)(25)(v) makes the written documentation of a Regulation S-P service-provider agreement a required record, and the contract itself is already held under Rule 204-2(a)(10). The pattern of the replies, clause references versus marketing copy, is as informative as the content.
Advisor Insights provides general professional information, not individualized investment, legal, cybersecurity, or compliance advice. Which rules apply to your firm depends on your registrations, your systems, and your contracts, and should be confirmed with counsel. Regulatory descriptions are U.S. federal and current as of August 2026.
Primary sources
General information from ValaisOS LLC, not legal, compliance, tax, or investment advice. Confirm requirements for your firm with counsel. See Terms of Use.