Somewhere between the demo and the contract, every AI sales agent purchase hits the same wall: the security review. Procurement sends a questionnaire, IT asks about SSO, legal asks where the call recordings live, and a vendor that sailed through the pilot suddenly goes quiet. This checklist is written for the buyer’s side of that exchange. It covers the enterprise AI sales agent requirements that actually appear in security reviews — identity, data protection, governance and operational maturity — with the reason each item matters and the exact question to put to any vendor, ours included.
At a glance: An enterprise-ready AI sales agent platform must clear four tiers of scrutiny: identity and access (SAML SSO, SCIM provisioning, role-based access control), data protection (encryption, contractual data residency, a published sub-processor list), governance (immutable audit logs of every agent action, independent attestations such as SOC 2 or ISO/IEC 27001), and operational maturity (uptime SLAs, incident response, observability). Ask each vendor to evidence every line — a security page full of adjectives is not evidence.
Why AI agents deserve a harder review than ordinary SaaS
A reporting tool that leaks data embarrasses you. An autonomous agent that misbehaves acts on your behalf — it calls prospects, sends messages and writes to your CRM. That is why AI-specific risk frameworks exist alongside classic information security. The OWASP Top 10 for LLM Applications (2025) names prompt injection (LLM01), sensitive information disclosure (LLM02) and excessive agency (LLM06) among the leading risks for LLM-based systems, and NIST’s voluntary AI Risk Management Framework (released January 2023) is built around four functions — Govern, Map, Measure and Manage — precisely because AI risk is an ongoing management discipline, not a one-off audit. Your checklist should therefore test two things at once: is this a well-run software company, and is this a well-governed agent?
Tier 1: Identity and access
SAML single sign-on
Why it matters: shared logins and vendor-managed passwords are how ex-employees keep access and how credential leaks spread. SSO puts authentication under your identity provider, your MFA policy and your offboarding process.
Ask the vendor: “Do you support SAML 2.0 or OIDC SSO with our identity provider, on which plan, and can we enforce SSO-only login for all users?”
SCIM provisioning and deprovisioning
Why it matters: SSO controls the front door; SCIM controls the guest list. Without automated provisioning, a departed rep’s account lingers until someone remembers to remove it — in a platform that can place calls in your name.
Ask the vendor: “When a user is deactivated in our directory, how quickly is their access revoked, and is that automatic or manual?”
Role-based access control
Why it matters: an SDR does not need to edit agent guardrails, export the full contact database or change telephony settings. RBAC limits blast radius — of mistakes and of compromised accounts alike. For agent platforms, roles should cover not just data but agent configuration: who may change scripts, prompts, escalation rules and channel permissions.
Ask the vendor: “Show me the permission model. Can we separate the people who configure agent behaviour from the people who review conversations?”
Tier 2: Data protection and residency
Encryption in transit and at rest
Why it matters: sales conversations contain names, phone numbers, intent and sometimes financial detail. Encryption claims are easy to make and rarely specified.
Ask the vendor: “Document your encryption in transit and at rest, including how keys are managed and who can access production data.”
Data residency
Why it matters: an AI agent pipeline has many hops — telephony, transcription, model inference, storage, CRM sync — and data can leave your preferred jurisdiction at any of them. For Australian organisations this is a legal question, not a preference: the OAIC’s APP 11 guidelines require entities to take reasonable steps to protect personal information “from misuse, interference and loss, as well as unauthorised access, modification or disclosure”, and to destroy or de-identify it when no longer needed. You cannot evidence reasonable steps over infrastructure you cannot locate. We cover the Australian angle in depth in our guide to AI agent data sovereignty in Australia.
Ask the vendor: “For each processing step — voice, transcription, inference, storage — name the region. Will you commit to residency in the contract, and what are our options if you can’t?”
Sub-processor transparency
Why it matters: most AI platforms are assembled from other companies’ services. Your data protection is only as strong as the weakest sub-processor you have never heard of.
Ask the vendor: “Publish your sub-processor list — including model providers and telephony carriers — and notify us before adding one.”
Retention, deletion and training use
Why it matters: conversation recordings and transcripts are personal information with a shelf life. Separately, you need a written answer on whether your prospects’ conversations are used to train models that serve other customers.
Ask the vendor: “What is your default retention period, can we set our own, how is deletion verified, and are our conversations used for model training?”
Private deployment
Why it matters: for banking, government, health and any contract that forbids shared-cloud processing, the strongest answer to residency and control questions is architectural — run the models on infrastructure you control, so conversation data never crosses your boundary. See our full guide to private AI deployment for sales agents for the trade-offs.
Ask the vendor: “Can the platform run as a private deployment on our infrastructure — and if so, which components stay inside our boundary?”
Tier 3: Governance and auditability
Immutable audit logs of agent actions
Why it matters: when a prospect disputes what an AI agent said, “we think it went fine” is not a defence. You need a tamper-evident record of every call, message, CRM write and configuration change — who or what did it, when, and under which version of the agent’s instructions.
Ask the vendor: “Can we export a complete, timestamped log of every agent action and every admin change, and can anyone edit or delete those logs?”
Observability of agent behaviour
Why it matters: logs tell you what happened; observability tells you what is happening. Enterprise buyers should expect live conversation review, escalation queues and the ability to pause an agent instantly. This is where human-in-the-loop controls and written agent guardrails stop being documents and become controls — enforced by systems outside the model, and checked against logs.
Ask the vendor: “Show me how a supervisor watches, intervenes in and halts agent activity — and how guardrails are enforced outside the model itself.”
Independent attestations: SOC 2 and ISO/IEC 27001
Why it matters: attestations replace “trust us” with third-party examination. Per the AICPA, a SOC 2 report is an examination of controls at a service organisation relevant to security, availability, processing integrity, confidentiality or privacy. ISO/IEC 27001 takes a management-system route: it specifies requirements for establishing, implementing, maintaining and continually improving an information security management system, including assessment and treatment of information security risks. Neither certifies that an AI agent behaves well — that is what the governance items above are for — but both tell you the company’s security programme has been independently examined.
Ask the vendor: “Provide the current report or certificate, its scope and period, and any exceptions noted. If you hold neither, what independent security evidence can you offer instead?”
Tier 4: Operational maturity
Uptime and SLA
Why it matters: an outbound agent that is down during your calling window is missed pipeline; an inbound agent that is down is missed revenue. A public status page and a contractual SLA with remedies show the vendor prices its own reliability.
Ask the vendor: “What uptime do you commit to in writing, where is your status history, and what are the remedies when you miss it?”
Incident response and breach notification
Why it matters: the question is never whether incidents happen but how fast you find out. Notification windows belong in the contract, not in goodwill.
Ask the vendor: “What is your contractual breach-notification window, and when did you last run an incident response exercise?”
Change management and model updates
Why it matters: agent behaviour can shift when the vendor swaps or updates underlying models. Enterprise readiness means you hear about material changes before your prospects do.
Ask the vendor: “How are model and prompt changes tested, versioned and communicated, and can we pin or stage them?”
Startup-grade vs enterprise-ready: the quick comparison
| Criterion | Startup-grade | Enterprise-ready |
|---|---|---|
| Login | Email/password, shared team logins | SAML SSO enforced, MFA via your identity provider |
| User lifecycle | Manual invites and removals | SCIM provisioning; access revoked on directory deactivation |
| Permissions | Everyone is an admin | RBAC separating configuration, review and export rights |
| Audit logs | None, or application logs on request | Immutable, exportable trail of agent actions and admin changes |
| Data residency | Unknown region, silent sub-processors | Contractual residency per processing step — or private deployment |
| Security evidence | Questionnaire answers and a badge wall | Independent SOC 2 report or ISO/IEC 27001 certificate with stated scope |
| Agent oversight | Fire-and-forget automation | Live observability, escalation queues, instant pause, enforced guardrails |
| Reliability | Best effort, no status page | Contractual SLA, public status history, defined remedies |
Where Zian sits on this checklist
We built this checklist to be vendor-neutral, so we will make exactly one claim about ourselves. Zian AI’s distinctive answer to the data-residency and control tier is architectural rather than certificate-led: the platform supports private model deployment on customer infrastructure, which keeps inference and conversation data inside your own boundary instead of relying on attestations about someone else’s. Every other line above — identity, logging, SLAs, sub-processors — you should put to us in a security review exactly as you would to any vendor. Our published security and privacy whitepaper describes our practices and the certifications held by the infrastructure providers we build on; read it as a starting point for your questions, not as an attestation in Zian’s own name.
Frequently asked questions
What does a SOC 2 report actually tell you about an AI sales agent vendor?
It tells you an independent CPA has examined the vendor’s controls against defined criteria. Per the AICPA’s description of its SOC 2 reporting framework, the examination covers controls at a service organisation relevant to security, availability, processing integrity, confidentiality or privacy. It does not evaluate whether an AI agent says accurate things on calls, respects consent rules or escalates when it should — so treat SOC 2 as necessary hygiene for the company, and test agent governance separately.
Is ISO/IEC 27001 the same as SOC 2?
No. ISO/IEC 27001 is a certifiable standard that, per the IEC’s official listing, specifies requirements for establishing, implementing, maintaining and continually improving an information security management system, including assessment and treatment of information security risks. SOC 2 is an attestation report on controls rather than a certification of a management system. Global vendors often hold both; what matters to a buyer is the scope and currency of whichever they present.
Do AI agent platforms need a different security review from ordinary SaaS?
Yes — an extra layer, not a replacement. All the classic SaaS questions still apply, but autonomous agents add risks that standard questionnaires miss: prompt injection, sensitive information disclosure and excessive agency all appear in the OWASP Top 10 for LLM Applications. Add questions about guardrail enforcement, action-level audit logs, escalation to humans and the vendor’s process for testing model updates before they reach your prospects.
Does private deployment remove the need for the rest of the checklist?
No. Private deployment answers the residency and data-control questions decisively, because inference happens on infrastructure you control — but you still need SSO, role-based access, audit logs, guardrails and an operations team that patches and monitors the stack. Private deployment relocates responsibility; it does not shrink the checklist.
Which residency questions matter most for Australian buyers?
Start from APP 11: the OAIC’s guidelines require reasonable steps to protect personal information from misuse, interference and loss, as well as unauthorised access, modification or disclosure, and to destroy or de-identify it when it is no longer needed. So ask where every hop of the pipeline runs — voice, transcription, inference, storage — whether the vendor will commit to onshore processing in writing, how retention and deletion are enforced, and whether an onshore or private deployment option exists if it will not.
Run the checklist before you run the pilot
A pilot proves an agent can book meetings. This checklist proves the platform deserves your data and your brand’s voice. If your evaluation includes private deployment, agent guardrails and honest answers over badge walls, we would like to be on your shortlist.