Treat vague, absolute or evasive answers about data handling as a prompt to dig, not a reason to walk away. Phrases such as "we never store anything" or "it is all encrypted" are rarely complete. Ask a follow-up that forces a specific, checkable answer.
Why phrasing matters
Sales answers compress. "We don't keep your code" can be true of the main database and untrue of a cache, a log or a support copy. The aim is not to catch anyone out. It is to move from slogans to facts you can record and revisit.
Red flag phrases and better follow-ups
| What you hear | Why it is a flag | Ask this next |
|---|---|---|
| "We never store your code." | Absolute. Caches, logs and snippets may exist. | "What derivatives of our code do you keep, and for how long?" |
| "Everything is encrypted." | Does not say with whose keys, or when. | "At rest, in transit and in backups? Who holds the keys?" |
| "We are fully compliant." | Compliance with what, as of when? | "Which framework, which scope, and what evidence can we see?" |
| "Our AI never uses your data." | Depends on the model and settings. | "Which model providers get data, and under what retention terms?" |
| "Data is deleted on request." | No timeline, no backups, no proof. | "How fast, what about backups, and will you confirm in writing?" |
| "Only authorised staff can access it." | Who is authorised? | "Which roles, approved how, logged where?" |
| "We will send the security pack after signature." | You cannot judge before you commit. | "Please send it now, under NDA if needed." |
| "That is in our standard terms." | May contradict the pitch. | "Please point to the clause." |
Notice the pattern. Each follow-up asks for a role, a number, a date or a document.
Green flag answers
Better answers share some traits:
- They name specifics, such as regions, retention periods and roles.
- They separate what is true today from what is planned.
- They admit limits, for example "backups age out after N days".
- They point to a document you can check.
- They are consistent across people. If sales and security answer the same question differently, trust the more conservative one and ask for the written version.
Run the exercise on a call
Pick five questions that matter most to you, such as code location, retention, support access, sub-processors and breach notice. Ask each of two people at the vendor, say the account executive and a security contact. Compare. Differences show where the real answer is unsettled.
For a structured way to grade answers, see scoring a vendor's data handling answers. Be careful with absolute words in your own answers too, see absolute words to avoid in security questionnaire answers.
Try it yourself
Click through it at your own pace, or open it full screen. Pick one record and ask what data class it belongs to and who could read it.
How Safeguard fits
Safeguard publishes a free scan and supports SaaS, private VPC, on-prem and air-gapped deployment, so you can ask us the same questions and compare the answers.
Quick check
Should one vague answer end the evaluation?
No. Ask the follow up. A good vendor will give specifics, and a weak answer on the second try is more informative than the first.
Who should ask these questions?
A security or privacy person, with procurement present, so answers land in the record.
Last reviewed: 19 October 2026.
