Pillar detail

Procurement & security

We treat procurement as more than pricing: SSO availability by tier, role templates, audit logs, retention settings, training opt-outs, and what finance should verify before renewal. Small teams often discover too late that “enterprise features” live only on a quote they never saw. For AI tools specifically, the security conversation must include what happens to prompts and outputs after the request completes—because your customer contract may not care about your model benchmark, but it will care about retention and subprocessors.

Identity and the least-privilege habit

Start with who can administer the tenant, who can export data, and whether those permissions inherit correctly when you add a new team. In a hurry, teams grant broad admin “just to unblock the pilot.” That decision ages poorly at renewal, when auditors or customers ask for evidence of segregation. The seven-layer framework begins with identity for a reason: if you cannot offboard a contractor cleanly, you do not have a secure baseline—only a faster way to leak context into an AI chat.

Data processing and subprocessors

Ask for a current subprocessor list in writing, and ask which categories of customer content can touch each subprocessor. Map that to your own privacy policy commitments. Building an AI stack that respects customer data walks through retention, training defaults, and what to say when a customer emails asking where their data goes—without turning your answer into marketing fluff.

Commercial terms that bite after month six

Fair-use clauses, token overages, and API throttling belong in the same mental model as the subscription fee. Marketing pages rarely surface them clearly; contracts do. Read fair-use and “unlimited” pricing before you model next year’s budget. If your usage spikes because the product actually works, that is success—unless the pricing ladder was designed for a different usage shape than yours.

Security questionnaires: signal versus theater

Vendor questionnaires have become a genre: hundreds of yes/no rows that reward confident answers over accurate ones. Lean teams should invert the process—start from your top five risks (export paths, admin impersonation, retention after deletion, subprocessors for customer content, training defaults) and demand evidence for those, not a PDF of generic controls. If a vendor cannot show how an admin action appears in an audit log, “SOC 2” on the cover does not fix the gap. Tie answers to named artifacts: latest DPA, subprocessor list with dates, and a plain-language description of what happens to prompts at rest. That discipline pairs with stack coherence so procurement does not approve a tool that your architecture will route around next quarter.

Incidents, SLAs, and the gap between marketing and operations

Uptime percentages and “enterprise support” labels rarely describe what you experience during a real outage: whether status pages update honestly, whether your API keys are rotated safely, and whether customer-facing automations fail open or closed. Before renewal, walk through a tabletop exercise: authentication provider down, model route degraded, integration returning partial payloads. Document who notifies customers, who pauses automations, and which systems must not accept writes until truth is restored. Those answers belong beside your vendor contacts—not only because auditors like them, but because your team will not invent them calmly at 2 a.m.

Exit planning before you are angry enough to leave

Procurement should assume churn is possible even when you love the product. Export formats, bulk deletion timelines, and whether embeddings or derived artifacts survive export matter the moment you migrate. Capture a quarterly snapshot: data inventory by object type, integration list with owners, and API dependencies. If leaving would require a forensic project, you are not buying software—you are entering a marriage with expensive divorce. Maintenance habits keep that inventory from rotting; onboarding documentation should record import paths so export is not a one-way door.

Adjacent pillars

Security without workflow discipline becomes policy theater; procurement without stack clarity becomes duplicate spend. Continue to workflow design, operations ROI, and stack coherence when you move from “what we bought” to “how it runs in production.”