When a vendor says no customer data was affected, ask what that statement is based on. Useful follow ups cover how far the investigation has gone, which systems and logs were reviewed, whether credentials or tokens were exposed, what the dates are, and whether the statement may change. A confident sentence early in an incident is often revised later.
Ask what the claim rests on
"No evidence of access" and "we confirmed no access" are different statements. The first can be true because the logs needed to see access did not exist. Ask whether the vendor had the logging to detect access to your data, and for how long logs are kept.
Ask about scope
Which systems were involved? Is your data stored there, processed there, or only passing through? Vendors define "customer data" in different ways. Some mean the content you store. Others also hold metadata, support tickets, configuration, and credentials, which can be just as sensitive.
Ask about credentials and integrations
Even if content was untouched, an intruder who reads tokens or keys can reach your systems through the integration. Ask whether any secrets that connect to your accounts were exposed, and rotate those that the vendor cannot rule out. The FTC business guide notes that stolen credentials stay useful until changed, so rotation is often the cheapest protective step.
Ask about dates
When did the intrusion start, when was it detected, and when did the investigation conclude? A statement made on day two cannot cover what is found on day twenty.
Ask about the investigation
Is a third party forensic firm involved? Will you receive a final report or summary? Is there a point of contact? You are entitled to ask, and your contract's notification clause may give you specific rights.
Do your own checks
Look at the audit logs on your side for the vendor's integration: unusual API calls, new tokens, access from unfamiliar addresses. Review which of your own data sits with the vendor and what its sensitivity is.
Decide what to tell your customers
If your customers' data is held by the vendor, you may have notification duties of your own. Check contracts and applicable law, and use accurate, plain wording. Do not repeat the vendor's reassurance as your own conclusion before you have checked.
Record the exchange
Keep the vendor's statement with its date, your questions, their answers, and your actions. If the story changes, you will have a clear timeline.
Quick check
Is it reasonable to ask for logs?
You can ask for relevant log excerpts or a written summary. Many vendors share a summary rather than raw logs.
Should I rotate keys if the vendor says nothing was accessed?
If the key is powerful and rotation is cheap, yes. The cost of rotating is usually lower than the cost of being wrong.
Sources
Last reviewed: 19 October 2026.
