Before you upload a client's policy to any AI tool, get written answers to nine questions: where the files are stored and how they're encrypted, which AI provider reads them, whether that provider can train on them, how long it keeps them, how your agency's data is kept apart from other customers', who on your team can see what, what gets logged, how people sign in, and what happens to your files when you leave. The answers decide your E&O exposure more than any feature list does.
The nine questions
- Where are our files stored, and are they encrypted? You want a named provider and encryption both at rest and in transit.
- Which AI provider reads the documents? "Our proprietary AI" isn't an answer. Most tools send text to a model provider, and you should know which one.
- Can that provider train on our documents? Ask what the provider's own terms say, not only the vendor's.
- How long does the AI provider keep what it's sent? "Nothing is retained" and "kept for 30 days for abuse monitoring" are very different answers.
- How is our data separated from other agencies'? Separate databases, separate storage, or the same storage with access checks: all exist, and you should know which.
- Who can see what inside our agency? Roles, and whether a producer can see every client or only theirs.
- What is logged? Sign-ins, who viewed or exported what, and whether you can get that record for an E&O defense.
- How do people sign in? Ask about multi-factor authentication and single sign-on.
- What happens to our files if we leave, and can we have a document deleted? Get the retention and deletion terms in the agreement.
And one about certifications: whose SOC 2 report is it? A vendor can hold its own report, or run on providers that hold theirs. Both are worth knowing, but they're different claims.
How ProducerHQ answers the first seven
We build ProducerHQ, so here are our answers. I checked each one against the product's code in October 2026 rather than our marketing, because those two drift.
| Question | ProducerHQ |
|---|---|
| Storage and encryption | Files are stored on Amazon Web Services with AES-256 encryption at rest; uploads and pages use TLS |
| Which AI reads them | A frontier model through its provider's commercial API, which we'll name on request; very long PDFs (over 100 pages) are read by AWS Textract |
| Can it train on them | No. The provider's commercial terms bar training on what we send, and our AWS account is opted out of AI-services training. Your documents are never used to train AI |
| How long the AI provider keeps it | The provider's published policy is to delete API inputs and outputs within 30 days unless other terms apply |
| Separation from other agencies | Every file is stored under your agency's own prefix, and every request is checked against your agency |
| Roles inside your agency | Owner, Admin, Agent and Viewer roles control who can change settings and run work |
| What is logged | Sign-ins, failed sign-ins, views and exports; each AI analysis has a timestamped E&O record |
On certifications: our files are stored on Amazon Web Services, our app runs on Vercel, and our AI provider runs its own service. All three hold independent SOC 2 audit reports. OpSpring doesn't have its own SOC 2 report yet, and I'd rather say that plainly than let a badge imply otherwise.
For the last two questions, sign-in options and deletion terms, ask us on a demo and we'll answer in writing.
Key Takeaways
- Ask any AI vendor where files live, which AI reads them, whether it can train on them and how long it keeps them.
- Ask how your data is kept apart from other agencies' and what is logged for E&O.
- Ask whose SOC 2 report a vendor is citing: its own, or its providers'.
- Get retention and deletion terms in the agreement, not just on a web page.