← Tools

AI vendor read

Give me a vendor. I read what they publish, their terms, DPA, sub-processor list and trust page, and send you a plain read: what looks fine, what I'd look at more closely, and what to ask them before you sign. Every point names the document it came from. This is a direction, not a compliance ruling.

Tell me the vendor

Name, website, what you'd use it for, what data goes in. About a minute.

I read what they publish

Terms, DPA, privacy policy, sub-processors, trust centre, and any enforcement history. Nothing behind their login, nothing they'd have to hand over.

You get my read by email

Within a business day, after I've read it myself. What stood out, what looks fine, and the questions to send them.

What I'll assume

The form is short on purpose. What you'd use it for, and what data would go in, are the two things that change what I look at, so those are the two I ask. Anything you leave blank, I assume the cautious answer and say so in the read.

What I send is my read of public documents on the day I read them. It is not a compliance assessment, not a certification, and not legal advice. Use it to decide where to look harder.

How this is made

I spent years leading security and compliance work, HIPAA and SOC 2 among it, and reviewing vendors was a large part of the job. This read is that work written down: forty-odd checks, in the order I run them by hand, from what the terms say about training on your data to whether the liability cap matches what you are putting in.

Software runs those checks across the vendor's public documents and writes the first draft. I read every draft, correct it, and sign it before it goes to you. The judgment is mine; the machine does the reading.

Vendor name Vendor website The product's main site. I'll find their legal pages from there. Your work email Where the read goes. One vendor per company. What you'd use it for (optional) One line is plenty. It changes what I look at. Plan you'd be on (optional) Security features often differ by plan. Leave it blank and I read the lowest paid plan.

What data would go into it?

Personal data (names, emails, customer details) Health data Payment or financial data Source code or proprietary IP Credentials or secrets Nothing sensitive

Tick what applies. If you're not sure, leave it and I'll assume the cautious answer.

Free. One vendor per company. My read within a business day.

What you get

One page you can forward. My overall read in a sentence, then what looks fine and what I'd look at more closely, or "too little published to say" when that's the honest answer.

Every point names the document, the clause and the date I read it. Where I'm giving an opinion, it says so.

And a list of what I couldn't see, with the question to send the vendor for each.

Example vendor · Pro planWorth proceeding, three things to settle first

Illustrative. 18 of the 24 things I look for were answerable from public documents

Topic	What I found	My read
Training	Terms allow training on your content unless you opt out; contractual exclusion is Enterprise-only	Settle first
Sub-processors	List published; no notice period or right to object stated	Look closer
Security	SOC 2 Type II asserted; report available under NDA	Looks fine
Breaches	Notification window not stated in the public DPA	Ask them