Before sending company data to an AI service through a web API, check how that data is handled from input through deletion, how the API is protected, and what evidence supports the vendor’s AI-specific security claims. Start with the risks of your particular workflow: the more sensitive the data and the greater the impact of a bad output or outage, the more specific and testable your review should be.
What should an AI vendor review cover?
Review both the ordinary security of the web service and risks that arise from its AI components. OWASP’s AI Security Verification Standard (AISVS) 1.0, released in June 2026, provides vendor-neutral AI-security requirements that can help structure the AI-specific part of an assessment. Its scope assumes that general application, infrastructure, and supply-chain security are assessed in parallel; it is not a substitute for those reviews.
As an Amazon Associate I earn from qualifying purchases.
Use a consistent record for each concern: what the vendor says, what evidence supports the answer, which contract term or deployed setting applies, and what remains unresolved. Policies and certificates can be useful evidence, but they do not by themselves establish that a particular service configuration is safe for your use case.
Recommended Free Tools
How should you scope the review?
Describe the workflow and consequences
Write down what the API will do, who or what will call it, and whether it can invoke tools or take actions. Note the consequences of an incorrect, unsafe, delayed, or unavailable response. A model that drafts text for human review presents a different risk from one whose output triggers an automated business action.
#1 Best Overall
Classify the information that may be sent
Consider prompts, uploaded files, metadata, logs, feedback, and support requests—not just the main prompt text. Identify whether the workflow could include public material, internal documents, personal information, credentials, financial or health data, contracts, intellectual property, or operational logs. The review should address the most sensitive information the integration could actually transmit, including information users might accidentally include.
Set a proportionate evidence bar
Match the depth of verification to the sensitivity of the data and the consequences of failure. For a low-impact workflow, documented answers and configuration checks may address some questions. Sensitive data or consequential automation calls for more detailed technical evidence, contractual commitments, testing, and review of the deployed configuration. A general claim such as “the service is secure” is not specific enough to resolve a defined risk.
How do you trace data from input through deletion?
Ask the vendor to map each data category to its purpose, location, access path, retention period, and deletion method. The AI TrustMark supplier checklist offers a useful set of vendor-review questions, but it does not establish answers for any particular provider.
Rank #2
- Collection and purpose: What information is collected in prompts, files, metadata, logs, feedback, and support requests? Why is each category needed?
- Processing and storage: Where is each category processed and stored, including in logs and backups? Which vendor personnel, subprocessors, or other parties can access it?
- Retention and deletion: How long is each category retained? What deletion route applies at the end of that period or when the agreement ends, and what evidence of deletion can the customer obtain?
- Training and service improvement: Is customer content used for training, fine-tuning, evaluation, or service improvement? If a setting controls these uses, who controls it, how is its state evidenced, and can it change?
- Subprocessors: Which subprocessors receive data, where are they located, and how will the customer be told about material changes?
- Personal-information roles: What roles do the parties take for personal information, and what information or assistance will the vendor provide for the buyer’s privacy assessment?
Record the answer, supporting evidence, relevant agreement term, and any dependency for every category. A vendor’s general privacy statement may not specify what happens to a particular data type in the customer’s chosen configuration.
How do you assess the web API itself?
NIST SP 800-228, updated in March 2026, addresses API protection risks and controls across API lifecycle stages. Use it as a reference for questions about both preparation before runtime and protections while the service is operating. It describes basic and advanced controls and a risk-based, incremental approach; the right controls depend on the service and architecture.
| Area to review | Questions to resolve | Useful evidence to request |
|---|---|---|
| Authentication and authorization | How are API callers authenticated, and how is access limited to the actions and data each caller needs? | Relevant architecture or control documentation, configuration details, and test results for the customer’s integration and the provider’s service. |
| Inputs and endpoint exposure | How are requests, schemas, and exposed endpoints handled? Which protections apply to the customer-facing API? | Technical documentation, validation and exposure controls, and evidence that applies to the endpoints in scope. |
| Monitoring and vulnerability handling | How are suspicious activity and vulnerabilities identified, assessed, and addressed? | Descriptions of monitoring and vulnerability processes, plus relevant records or assessment results. |
| Incidents and operational changes | How will the customer learn about incidents or changes that affect the service or its security? | Incident-response commitments and relevant contract language or customer-notification procedures. |
Ask the provider to explain how each relevant control works at runtime and what is done before deployment. Check where responsibility sits: a provider’s protections do not automatically secure the customer’s credentials, application, permissions, or handling of API responses. Likewise, the customer’s integration controls do not establish how the provider protects its own service.
Rank #3
UK government code guidance says organizations using an external component should conduct AI security risk assessment and due diligence, and that developers offering APIs to external customers or collaborators should use controls against attacks through those APIs. Treat this as government guidance, not a universal legal rule; verify the current version and its relevance to your role and jurisdiction.
What AI-specific evidence should you request?
Use AISVS to turn broad assurances into requirements that can be checked. For each applicable topic, ask what is in scope, what verification level is appropriate, and what evidence the vendor can provide. The standard’s topics include:
- Training-data integrity and traceability.
- Input validation and model lifecycle or change controls.
- Deployment security, access controls, and model supply-chain provenance.
- Output control and safety assurance.
- Memory systems and vector databases.
- Orchestration, agent, and MCP security where those features are used.
- Adversarial robustness and relevant testing.
Evidence might include test reports, change records, architecture details, or independent assessments. Check that it covers the models, components, endpoints, features, regions, and configuration used in your workflow. AISVS is intended to support procurement and vendor evaluation, but an assessment against AI-specific requirements does not replace general application and infrastructure security assessment.
Rank #4
- API Security in Action
- Manning Publications
- ABIS BOOK
Ask about models and updates
Where relevant, ask how the vendor documents model selection, training and evaluation data, update cadence, testing, and component provenance. NIST IR 8596, an initial preliminary draft published in December 2025, discusses supplier trust, data and evaluation transparency, AI-specific due diligence, and adversarial testing. It is a draft reference, not a set of final requirements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which privacy or domain rules apply?
Determine applicable privacy, sector, and jurisdictional obligations separately from the vendor’s security review. A standard or code may have a defined scope, and its provisions should not be presented as universal rules for every AI API.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11For example, NIST SP 800-63-4 Digital Identity Risk Management addresses AI/ML used in identity systems. In that context, it says organizations should provide relying entities information about training methods, datasets, model update frequency, and testing results, and document privacy risk assessments for personal information processed by those systems. Those statements are identity-specific; do not generalize them to unrelated AI services.
Best Value
How should you compare vendors or review approaches?
Compare evidence against the same workflow and risk scope, rather than comparing security slogans. These dimensions help expose differences that a general assurance statement can hide:
- Scope: Which models, endpoints, features, regions, subprocessors, and customer settings are covered?
- Data handling: What specific data uses, retention periods, access paths, and deletion commitments apply?
- Security evidence: How current, independent, and technically relevant are the test results and control records?
- AI assurance: Are model changes, evaluation methods, provenance, limitations, and AI-specific tests documented?
- Operational response: How are incidents, vulnerabilities, model changes, service disruptions, and subprocessor changes communicated?
- Residual risk: What happens if an output fails, and what human review, fallback, or containment is needed?
There is no vendor ranking implied by these questions. The comparison is useful only when answers relate to the actual service configuration and the agreement governing the customer’s data.
What should the review record before approval?
Close the review with a decision record that connects the intended use to evidence and remaining risk. A practical record includes:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Use case and data: State what the API does, who or what calls it, what data may be transmitted, and what impact a failure could have.
- Data flow: Capture purposes, processing and storage locations, access, retention, training or improvement use, subprocessors, and deletion for each relevant data category.
- API controls: Record which provider and customer controls protect the endpoints and integration, and what evidence supports that conclusion.
- AI-specific assurance: Note applicable model, data, lifecycle, output, testing, monitoring, and orchestration controls, together with the evidence reviewed.
- Contract and configuration: Link each material assurance to the relevant agreement term or deployed setting; note who can change the setting and how changes are communicated.
- Open risks and decision: Identify unresolved dependencies, mitigations, human review or fallback, the accountable decision-maker, and any conditions for approval.
Revisit the record when the use case, data, service configuration, model or components, subprocessors, or relevant terms change. Standards, codes, and vendor terms can change too, so confirm that the versions and contractual commitments used for the decision remain current.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
