MCCM Wiki
Vendor questions for AI tools
Ask where data is processed, whether prompts are used for training, how long logs are kept, and how you export or delete them. If a vendor cannot answer those four points in writing, do not put live company data into the tool.
What to ask before the pilot
Put data residency, training opt-out, retention, subprocessors, and deletion into one page. Require written answers, not a sales slide.
Security vs convenience
Consumer tools are fine for public text. Work data needs a contract, admin controls, and an owner who can revoke access.
How MCCM uses this
Every AI pilot includes a short vendor note next to the process owner and KPI.
Done looks like
Staff know which tools are approved and why. New tools wait until the four answers exist.