What 'We Take Security Seriously' Actually Means

Every AI vendor says they take security seriously. The sentence costs nothing. What matters is what sits behind it, and you can check.

"We use encryption" should mean: data encrypted in transit and at rest, with named standards, and the vendor cannot read your data casually. Ask which standards and who holds the keys.

"We're SOC 2 compliant" should mean: a current SOC 2 Type II report, which you can request and read. Type I is a point-in-time snapshot; Type II covers operations over months. Ask which one, and how recent.

"We do penetration testing" should mean: regular third-party tests with findings remediated, not a single test three years ago. Ask for the cadence.

"We never train on your data" should mean: a contractual commitment, not a FAQ answer. Marketing pages change. Contracts are harder to rewrite quietly.

None of this requires you to be a security engineer. It requires you to treat reassuring sentences as opening bids and ask for the artifact behind each one. Serious vendors expect this. They have folders ready.

I explain frameworks; I don't give legal counsel.