Everybody has the list. It sits on a dozen pages including one of ours, and the questions barely differ between them. What differs is what a firm accepts as an answer, and that is where the exercise is won or lost. You already do that work for a living, on the other side of the desk.
- A vendor’s answer is a representation by an interested party. You would not sign off a balance because the client said it was right.
- Non-answers work by substitution rather than evasion, and the substitution is nearly always in the scope rather than the tone.
- A conditioned answer beats a flat one. The condition is usually the operative part, and checking it against your own facts is the job.
- Where the answer lives decides what it is worth, and the contract you accepted may already have voided the email you were sent.
An answer is a representation
In your own work you separate what you were told from what you corroborated, and you set the weight you put on each accordingly. A representation is not worthless. It is a starting point, it is something you can hold a person to, and it is the thing you go looking for evidence about. The discipline is entirely in not confusing the two.
A vendor questionnaire is that exercise run outward instead of inward, and firms handle it with far less care than they would handle a client. Twelve questions go out, twelve answers come back, the answers go in a folder, and the folder now looks like diligence. Nothing has been corroborated. What you are holding is a set of assertions by the party with the commercial interest in your decision, collected in the week you were most inclined to like them.
None of that argues for suspicion, which is the wrong instrument and makes you no better at this. It argues for grading. Four things to read off every answer you get back: what its scope is, what has to be true for it to hold, which document it lives in, and whether you can test it yourself. Those four take longer than writing the original list, and they are the part that turns a folder into a file.
So the order of work is the reverse of how it feels. Composing the questions is an afternoon and it is finished. Reading the answers is the week afterwards, and it is what the rest of this page is about.
The scope is where the substitution happens
A non-answer rarely sounds evasive. It sounds complete, arrives promptly, and answers a question sitting next to the one you asked. Five shapes cover most of what comes back.
A narrower verb. You asked about training and got a sentence about selling. “We do not sell your data” is true, checkable and about a different act entirely. Write down the verb you asked about before you read the reply, and read the reply for that verb only.
A different noun. This is the one peculiar to AI products, and the one firms miss. Your mail is not the only thing in the system that came from your mail. Anything that ranks and summarizes makes derived material: summaries, extracted tasks, search indexes, the numeric representations that let a search work by meaning rather than by spelling. A promise made about “your email” may not reach any of it, and the derived material is what the product actually runs on. The shape you want is the one Point’s own list takes, itemizing them beside the content they came from, so what the software made from your mail is disclosed along with the mail (subprocessors, effective 7 July 2026, checked 19 August 2026). Ask the noun question in as many words: does this cover what you generate from my mail as well as my mail.
A sentence with nobody in it. “Data is encrypted.” By whom, in which state, and which parts are not. A sentence with no actor cannot be checked, and putting the actor back is usually enough to turn it into one that can.
A certificate standing in for a control. A security audit report tells you an auditor tested a described set of controls over a stated period and what the exceptions were. That is real evidence about a described set. It does not tell you whether the processing your mailbox will go through is inside the description. You read scope paragraphs professionally. Read that one, and keep your specific questions rather than retiring them because a report arrived.
A tense that stops at today. “We do not currently.” “We have no plans to.” Both are honest, both are answers about this morning, and your engagement runs a year while the retention runs longer.
Notice that not one of the five is a lie, which is why a reader looking for dishonesty finds nothing and files the lot. You are not looking for deception. You are looking for the gap between the scope of the question and the scope of the answer.
The condition is the answer
Here is the part where a practitioner’s instinct beats a buyer’s, because it runs against the way a purchase feels.
A conditioned answer looks weaker than a flat one and is almost always the stronger of the two. A flat answer usually means nobody with a duty to keep it has read it yet. Conditions appear when somebody who will be held to a sentence has gone through it, which makes the conditions the part worth your afternoon.
Two live examples, from documents you can go and read rather than from a hypothetical. On deletion, Point’s data processing addendum says Point will “delete or return Customer Personal Data within 60 days at Customer’s choice if supported by the Services and specified in the Agreement; otherwise Point may delete it”, and that backups “may be retained until overwritten” (terms, Schedule 1, checked 19 August 2026). The number is the least interesting thing in that sentence. Whether return rather than deletion is supported, whether it is specified in your agreement, and what your exposure is while backups turn over: three questions with three answers of your own, and the sixty days addresses none of them.
On who else handles the mail, the same document says Point may add, remove or replace subprocessors, and will give notice and an opportunity to object “where required by Applicable Data Protection Law”. That condition is the entire clause. A practice inside the UK or the EU has a law that fires it. A US practice with US clients should establish which law it is relying on before treating that as a notice commitment, because the commitment runs to the law rather than to you, and the answer differs between two firms reading the identical sentence.
Neither of those is a criticism of the drafting. Both are how a competent contract gets written, and a supplier whose answers carry no conditions at all has either not thought about the edges or is not the party who would be held to them. What matters is that “yes” and “yes, if” are different answers, and only the second one tells you what to do next.
Where the answer lives
The same sentence is worth different amounts depending on where it sits, and the ladder is short. A salesperson’s reply, a help page, a published policy, the terms you accepted, a document signed with your name on it.
Two ordinary clauses collapse the bottom of that ladder, and they are in nearly every software contract rather than being anybody’s trick. An entire agreement clause says the contract supersedes prior discussions, and the questionnaire that reassured your firm is a prior discussion. And where regulated material is concerned the terms tend to say it outright: no sales material, security questionnaire, privacy policy statement, support response or product feature creates the commitment unless the separate document is actually executed (terms, section 1.5, checked 19 August 2026). The reply that settled it for you in July was, by the agreement you accepted in August, not a term of anything.
That is architecture rather than a trap, and knowing it makes your list a far better instrument, because it changes the question you put. You stop asking whether an answer is true, which a supplier will always say yes to, and start asking where they will put it. For a firm inside the Safeguards Rule this is not merely prudent either, since the rule has its own view about safeguards belonging in the contract rather than on a page, and what that requires of the choosing itself is an argument of its own.
Which produces the follow-up that does more work than anything on the original list. Will you put that in the order form. Willingness to move a sentence up one rung is itself the answer, and it costs you nothing to ask. A supplier who will write down what they already believe to be true tends to say yes within the day. A long explanation of why it cannot be documented has answered your original question more completely than the original answer did. The order in which these documents have to exist, and why the client’s own permission cannot ride along inside your engagement letter, is a separate piece of work.
The ones you can test instead of asking
An answer you can verify yourself belongs in a different class, and it costs a trial period rather than a lawyer. Four worth doing in the first fortnight.
Ask for your data back. Not whether export exists, which every product says yes to. Do it, time it, and open what arrives. The distance between “export is supported” and a file a human can read is where the real answer lives, and you will never have a cheaper moment to find out.
Take a seat away. Remove someone and confirm what they can still reach and for how long. That is the only control operating at the grain your own standard is written at, and what it means inside a firm belongs with the confidentiality question.
Raise a support ticket about a real thread. Who at the vendor can read your mail is the question everybody forgets, and support behaviour answers it more honestly than a policy paragraph. Watch what the reply turns out to know.
Look for a version and a date on the subprocessor list. A dated list is a falsifiable statement, and you can compare it with the copy you kept. An undated page is a mood. This is the difference between noticing a change and waiting to be told about one, and model and infrastructure providers can be swapped under a service without anything visible changing in it.
An answer you cannot test is not worthless. It simply has a ceiling on the weight you can put on it, and the honest move is to record it as a representation rather than promote it in your own mind because it was delivered with confidence.
Asking again
What the exercise produces is a document, not a feeling, and the document is what an insurer, an examiner or a client will eventually ask you for. Four columns against each answer: the date, who gave it, which rung it sits on, and whether you tested it or accepted it. That is not bureaucracy. It is the difference between having done the work and remembering that you did.
Then the re-ask, because these answers expire at different rates and some of them expire quietly. Terms in this category typically take effect when they are posted. Providers underneath a service can change without the product looking any different. So the trigger is an event rather than a date in the diary, and three events cover it.
The renewal, which you already keep, and which is where a periodic assessment of your suppliers lands anyway. A change notice of any kind, where the thing to read is what changed rather than the summary of what changed. And any decision to let the software do more than it did last month, which is the trigger nobody writes down and the one that matters most: a set of answers that was adequate for software reading your mail is not the same set once it is drafting and sending, and which of those you have allowed is what actually sets your exposure.
Where does Point fit?
Point is an AI email client, so every question on your list can be put to it, and the useful thing to say here is where each kind of answer lives rather than how good it is.
- The documents this page tells you to read are published rather than described. Subprocessors names the companies and what each one processes, carrying a version and an effective date. The terms hold the training position, the deletion window with its conditions, and the regulated-data carve-out. Read those two before any security page.
- The training answer is scoped rather than sweeping, which is the shape worth wanting. Point will not use your content to train generalized third-party models unless you authorize it, and says separately that it may process your content to provide, secure, support and improve the service for you. Two sentences, because those are two different things, and a single sweeping one would have covered less.
- The noun problem is answered in the list instead of left to inference. Indexes, embeddings, summaries and outputs are itemized beside content, so the material Point makes from your mail is disclosed along with your mail.
- If your mailbox carries return information, the standard service does not reach it. Tax return information is named among the excluded categories, and only a separate written supplement changes that. Ask for it before you connect rather than after your staff have grown fond of the product.
- What Point did is written down in plain language, and most of it can be turned down or reversed. A delivered message is the exception, because by then it is sitting on somebody else’s server. That log is the one answer on this page you get to test every working day.
- How far Point goes is a dial, held separately for each kind of work, from suggest only, through preparing something and waiting on you, to handling it. Review is where every kind starts. Where you have it set is the fact that decides which of your vendor answers still cover you.
Everything Point does is the full inventory, and Point for accountants puts the same ground in a practice’s language. The unhurried version of all of it is Point.
Common questions
The vendor answered every question. Is that enough?
It is the beginning of the work rather than the end of it. What you are holding is a set of representations by the party with an interest in your decision, and your own discipline says a representation gets corroborated wherever corroboration is available. Several of these answers are testable inside a trial, so test those. For the rest, establish which document each sentence lives in. A folder of confident replies is the version of diligence that looks finished.
They will not put it in writing. Is that a deal breaker?
Not automatically, but read the refusal as data rather than as friction. Asking whether a sentence can move up one rung, from an email to a policy to the order form, costs you nothing and tells you what the sentence was worth. A supplier who will document what they already believe to be true usually agrees quickly. A long account of why it cannot be documented has told you something the original answer did not.
Is a security certification enough on its own?
It answers a real question, just not this one. An audit report says an auditor tested a described set of controls over a stated period and reports the exceptions, which is genuine evidence about that described set. Whether the processing your mailbox goes through sits inside the description is a scope question, and you read scope paragraphs for a living. Ask for that section, and keep the specific questions rather than retiring them because a report arrived.
How often should we run this again?
Not annually for the sake of it. Three events should set it off: the renewal, any change notice, and any decision to let the software do more than it did before. The third is the one nobody writes down and the one that matters, because answers that were adequate while a tool only read your mail stop covering you the moment it is composing and sending on your behalf.
We are a two-person firm. Is this proportionate?
The list scales down. What it produces should not. A small practice cannot commission an audit and has no need to, but it can send eight questions by email, note the date and who answered, test three of the answers during a trial, and record which document each one sits in. That is an afternoon, it survives a change of software, and it is more than most firms of any size can actually produce when asked.
The short version
- Everybody has the list, and the list is the cheap half. What separates diligence from a folder is what your firm accepts as an answer.
- A vendor’s answer is a representation by an interested party. Grade it the way you grade any other assertion: its scope, its conditions, where it lives, and whether you can test it.
- Non-answers substitute rather than evade. A narrower verb, a different noun, no actor in the sentence, a certificate standing in for a control, or a statement that stops at today.
- A conditioned answer is usually the stronger one, because conditions appear when somebody who will be held to the sentence has read it. Check each condition against your own facts.
- The same sentence is worth more one rung up the ladder. Ask whether they will move it, and read the refusal as carefully as you would have read the answer.
The general list, the duty that stays with you and who should not connect a mailbox at all are in the client data guide. What an AI email client is defines the category, AI email for accountants covers which of the five kinds of product a firm is choosing between, and what the profession’s own rule book already says about handing work to an outside supplier is in AI and the CPA Code.