Free resource

Ten Questions to Ask Any AI Vendor About Supporter Data

Last updated: October 28, 2026 · Jason Brown

Why this checklist

Ask these ten questions before any AI tool touches your supporter data. Each answer should arrive in writing, from the vendor, before you sign.

AI tools now sit inside CRMs, email platforms, and stand-alone products. Each one handles donor names, gift histories, and contact details differently. Marketing pages rarely say how.

Use this list if you are a development director, database manager, privacy lead, or executive director reviewing an AI vendor. No technical background is needed. Every question has a plain test for a good answer and the red flags to watch for.

The ten questions

A strong vendor answers all ten in writing, without hedging. Two or more red flags is reason to pause.

Ten questions for AI vendors, with a good answer and red flags for each
Number	Question	A good answer	Red flags
1	Does the system store supporter data in its own warehouse, or does data stay in systems we control?	Source records stay in systems your organization owns or controls. The vendor names exactly what it copies, where, and why, keeps any copy isolated to your organization, and deletes it on a stated schedule.	A vague “we store what we need.” A separate vendor database with no stated purpose or retention limit.
2	Is the integration read-only, or does the tool write to our CRM and email platform?	Read-only by default. Any write access is named, scoped to specific fields, and switched off unless you approve it.	Broad write permissions requested at setup. No list of which records the tool changes.
3	Does the system send messages to supporters on its own?	No. Staff review, edit, and send every message. Any automation is opt-in and documented in the contract.	Auto-send features switched on by default. “Smart” sequences that run without a staff approval step.
4	Is our data used to train AI models, confirmed in writing?	No training on your data, stated in the contract or data processing agreement, for the vendor and every AI provider it uses.	A verbal “no” only. Training opt-outs buried in settings. Silence on what the AI providers do.
5	Which AI providers process our data, and what are their retention periods?	A named list of sub-processors, each with its retention period and a link to its terms. Zero-retention options named where offered.	“We use leading AI models.” No named providers. No retention figures.
6	Are insights generated by statistical rules, or by a language model guessing?	Patterns are confirmed by defined rules (recency, frequency, thresholds) before any AI writes text. Each insight shows its reasoning.	The language model decides who to flag. No way to see why a supporter appeared.
7	What data does the AI see for each request?	A declared field list per request, limited to what the task needs. Payment details and government IDs excluded.	“The AI has full context on your donors.” Whole records or exports sent to the model.
8	What happens to our data when we disconnect?	Access ends the moment you revoke it. Copies are deleted within a stated window, with written confirmation on request.	No deletion timeline. Data kept for “product improvement” after you leave.
9	Where does our data live, and is Canadian residency available?	Named hosting regions for every component. A Canadian residency option, or a clear statement of which components sit outside Canada.	“In the cloud.” No region named. No answer for AI providers’ processing locations.
10	What is logged, and what is the breach notification commitment?	A description of access and activity logs. A written notification timeline, measured in hours or days, and a named contact.	No breach timeline in the contract. Logs unavailable to you.

Scroll the table sideways to see every column.

How to use this in procurement

Send the ten questions to every shortlisted vendor at the same time, and compare written answers side by side.

Send the questions before any demo. Ask for written answers within two weeks.
Ask for the documents behind each answer: the data processing agreement, the sub-processor list, and the breach notification clause.
Score each answer as clear, partial, or missing. Treat “we’ll get back to you” as missing.
Bring your privacy lead and database manager into the review, alongside the fundraising team.
If you hold personal information on Quebec residents, confirm the vendor supports a privacy impact assessment. Quebec’s Law 25 requires one before personal information leaves the province.
Write the answers into the contract. A promise on a sales call carries no weight once you sign.

This checklist supports, and does not replace, advice from your own privacy counsel.