Key takeaways
- AI visibility tools break a standard SaaS questionnaire because the vendor is never the only processor. Your prompts also reach model providers, proxy networks and scraping intermediaries.
- Ask for the actual SOC 2 report, not a badge. Vendors sometimes call the same thing "compliant" on one page and "certified" on another.
- Get the plan name in writing for SSO, SCIM, audit logs and API access. Many of these sit behind Enterprise tiers.
- Check the subprocessor list, the data region and the retention terms of upstream AI providers before you sign a DPA.
- Run a pilot with non-sensitive prompts first, and keep the security review inside a three-week window by sending the evidence request on day one.
Why this review is different
Marketing teams buy these tools on a credit card. Security teams find them six months later during an access review. That is the pattern the MaxAEO 34-question vendor review describes, and it matches what I see in most buying processes.
A normal SaaS questionnaire assumes the vendor is the only party touching your data. An AI visibility platform runs your prompts against ChatGPT, Gemini, Perplexity, Claude, Copilot and Google AI Mode, daily and at volume. Every one of those providers processes your text. Your DPA with the vendor means little if the vendor's upstream terms allow retention or training you never approved.
Four things deserve attention that a regular review skips:
- The prompt library you send into third-party models. Your competitive prompt set says a lot about your strategy.
- The AI answers the vendor stores for you as evidence.
- The chain of model providers, proxies and scrapers acting as undisclosed subprocessors.
- Write-level access the tool asks for on your search, analytics and CMS systems.
Encryption at rest, SOC 2 Type II, pen testing cadence and SSO are table stakes. Your existing forms probably cover them. The gap is everything above.
Before you start: figure out what you are actually buying
Security reviews drag on when nobody agrees on the use case. Decide first whether you need monitoring only, competitive benchmarking, content optimization or full execution with publishing. The more the tool can do on its own, the more access it needs, and the more your reviewer will care.
A monitoring-only deployment is the easiest to approve. It needs prompts and a brand name. A platform that publishes to your CMS needs write credentials. A tool that reads server logs needs log access. Write down which of those you actually intend to turn on, because that scopes the review.
Build the data-flow map first
The fastest way to get a reviewer on your side is to hand them a diagram. Ask the vendor for one, or draw it yourself during the first call. It should show:
- Where your prompts are stored and who can read them.
- Which AI engines receive them, and whether the vendor uses APIs or captures answers from consumer interfaces.
- Any proxy or scraping layer between the vendor and those engines.
- Where captured answers and citations are stored, and for how long.
- What connects to your own systems: Google Search Console, GA4, CDN logs, CMS.
- How reports leave the platform: PDF, CSV, API, Slack.
The API versus interface question matters for security as well as data quality. Capturing answers from a consumer chat interface can mean the vendor runs accounts and routes traffic through intermediaries. That is a legitimate method, but you want to know about it and know whose terms apply.
The questions that stop deals
Here are the questions I would put in front of every vendor, grouped by control area. They are condensed from the longer lists published by MaxAEO and by procurement-focused reviews.
Access control
- Is SAML or OIDC SSO available, and on which plan?
- Is SCIM provisioning supported?
- Is there a customer-facing audit log, and is it on the plan you are buying?
- Can you set role-based access per project or workspace?
- Who performs SSO setup, you or the vendor's team?
Data handling
- Which model providers and intermediaries process our prompts?
- Do any of them retain or train on our data?
- Where is data stored, and can we choose a region?
- How do we delete prompts, answers and connected-system tokens on exit, and how fast?
- Is the published or benchmark data aggregated and non-identifiable?
Certifications and evidence
- Does the vendor hold its own SOC 2 Type II report, or does it cite its cloud host's certificates?
- Can you see the report under NDA, and how recent is the audit period?
- When was the last third-party penetration test?
- Is there a trust center with a current subprocessor list?
Connected systems
- What scopes does the tool request on Search Console, GA4 or the CMS? Read-only, or write?
- What log access does a crawler analytics feature need, and does it go through Cloudflare, a CDN integration, a plugin or raw server logs?
- Can tokens be revoked instantly?
Contract
- Is a DPA available before the demo, with EU clauses if you need them?
- Is the product GA or Beta? Beta products are often offered "as-is" with no support duty.
- What happens to the product if the vendor is acquired?
What certifications really tell you
A SOC 2 Type II report certifies the vendor's own control environment. It says nothing about whether your prompt set went through a residential proxy network. Treat it as a floor.
Two habits save you grief. First, ask for the report, not the badge. seoClarity noted that one vendor calls SOC 2 Type II "compliant" on some pages and "certification" on others. Second, watch for inherited certificates. Some vendors list the SOC and ISO certifications of the cloud provider they run on, which is a different thing from being audited themselves.
Where the vendors stand
The table below summarizes what third-party reviews and vendor pages said in the research I gathered. Much of it comes from Rework's procurement review of 12 vendors and vendor pages. Treat it as a starting point, because I did not verify report dates, pen-test summaries or LLM-provider retention terms. Check each vendor's trust center directly.
| Vendor | Reported security posture | Watch for |
|---|---|---|
| Profound | SOC 2 Type II, SAML or OIDC on Enterprise, SCIM, Enterprise audit log, HIPAA assessment | Confirm which features need Enterprise |
| Conductor | SOC 2 Type II, ISO 27001:2022, ISO 42001, SAML SSO, annual third-party pen tests | Broader SEO platform scope |
| Scrunch | SOC 2 Type II, audit logs, Trust Center | SAML Enterprise-only; Sitecore now owns it |
| Goodie | SOC 2 Type I and II, SAML, SCIM, Trust Center | Review found no DPA or audit log |
| AthenaHQ | "SOC II" with type not stated, public DPA with EU clauses | Ask which type and which period |
| Peec AI | SAML 2.0 only, Google Cloud hosting, unlimited seats | Says it is pursuing SOC 2, not yet certified; no OIDC or SCIM |
| Otterly | Cites AWS data center certifications, hosts in AWS Frankfurt | Public monitoring data sits in the US |
| HubSpot AEO | Parent platform has SOC 2 Type 2 | Beta product, "as-is" |
| Trakkr | Enterprise from $1,000/mo, prices SSO and security review | No SOC 2 of its own |
| Ahrefs | SOC 2 in progress | Not yet complete |
| Rankscale | Cites its cloud host's certificates | Thin enterprise paperwork |
Some of these have catalog entries if you want to read more first: Profound, Conductor, Scrunch, Goodie, AthenaHQ, Peec AI, Otterly, Ahrefs and Rankscale.
Profound
Otterly.AI
A few patterns stand out. Only Ahrefs ($1,499 a month, annual commitment) and Trakkr (from $1,000 a month, billed annually) publish an Enterprise price that includes SSO, according to Rework. Most others route you to sales, sometimes while holding the strongest paperwork in the group. And a Beta product from a strong parent is a stop sign for most procurement teams, however good the parent's certificates look.
Match the vendor to what your reviewer blocks on
Different companies fail reviews for different reasons. A quick mapping helps you avoid shortlisting tools you can't get approved.
| If your review blocks on | Shortlist direction |
|---|---|
| SOC 2 Type II report plus SAML or OIDC plus SCIM | Profound or Goodie; Scrunch if SCIM isn't a gate |
| A contract you can read before a demo | AthenaHQ, then Peec AI's published terms |
| A printed Enterprise price | Ahrefs, Trakkr |
| AEO inside an existing SEO contract | Semrush, Ahrefs, Conductor |
| GDPR-first European vendor | Peec AI (Berlin), Rankscale (Austrian law in its terms) |
| Healthcare or pharma | Profound (HIPAA assessment) |
That table follows Rework's decision framework. I would add one caution: written-in-the-contract beats claimed-on-the-website every time.
Get the plan named in writing
This is the single most common way a deal goes sideways. Sales says SSO is available. Then it turns out SSO, SCIM, the audit log and the API all sit on a tier twice the price. Rework's checklist weights access control (SSO, SCIM, audit log) at 20% and data location with a DPA at 10%, and for each asks for the configuration doc and the plan it requires. Do the same. A one-line email saying "SSO, SCIM, audit log and API are included in the plan quoted" is worth more than any slide.
Crawler analytics and log access
Some platforms go beyond prompt tracking and read your server or CDN logs to show which AI bots visit. That is useful, and it is also the feature your security team will question hardest.
Ask what log access is needed, whether it is read-only, and where logs are stored. Integration route matters: a Cloudflare, Vercel, Fastly or CDN-based connection is a different risk profile from raw server logs or a plugin on your CMS. Promptwatch, for example, supports crawler analytics through Cloudflare, Vercel, Fastly and raw server logs, so the questions to ask are which of those you would use and what the connection can see.
There is a bonus for the security team here. Promptwatch Data's AI crawler traffic report covers IP-verified requests from June 8 to September 6, 2026, counting only requests whose source IP matches the operator's published ranges, so spoofed user agents are excluded. OpenAI made up 79.8% of those requests in the week of August 31 to September 6, down from 94.8% in the week of June 8. The report advises checking robots.txt, CDN and WAF rules for every provider, and comparing your own logs against that mix. A provider that is large in the chart but near zero in your logs suggests you are blocked. That is a security-adjacent exercise your team can run regardless of which vendor you pick. The underlying dataset is aggregated and non-identifiable.
Governance: put the tool in your AI risk register
An AI visibility platform is also an AI system in your estate. If your company runs an AI governance program, treat the purchase like any other entry: purpose, owner, risk tier, review cadence. Harness's practical framework uses four pillars: policy, risk assessment, monitoring and audit, and accountability. It also gives a sample register entry (purpose, risk tier, next review) that is worth copying.
For a monitoring-only visibility tool, a medium or low tier with quarterly review is a reasonable starting point. Raise it if the tool gets CMS write access. A Slack thread is not an audit record, as the Harness piece puts it, so write the decision down.
There is also the third-party angle. The Kovrr evaluation guide points out that many platforms miss exposure created by AI embedded in vendor products, and that under the EU AI Act's deployer accountability provisions this is a real gap. Your visibility vendor is one of those vendors.
Should you build instead?
Sometimes the honest answer is a warehouse and a cron job. Rework estimates that at 500 prompts on three engines, search-tool fees alone come to about $328 a month before tokens, which is below most vendor bills. A build also lets you use your own IAM and BI governance.
What you give up: AI Overviews coverage, parsing and dashboards you must write yourself, and a match to what a buyer actually sees in the interface. You also get no vendor SSO, no audit logs and no trust center for your reviewer, because you are the vendor. If your security team is the blocker and the use case is simple monitoring, it is worth a serious look. If you need breadth and reporting, buying wins.
A three-week path through review
Week 1. Day one, send every shortlisted vendor the same evidence request: SOC 2 report under NDA, DPA, subprocessor list, data region, SSO and SCIM plan, pen-test summary, retention and deletion terms. Draw the data-flow map. Decide scope: monitoring only or also write access.
Week 2. Score the evidence. A simple weighted model works: access control 20%, data location and DPA 10%, certifications and reports, upstream model-provider terms, connected-system scopes, contract terms. Anything with a weak answer on upstream retention or a Beta label gets flagged for a decision, not buried.
Week 3. Run a pilot on non-sensitive prompts with SSO configured. Check the audit log actually records what the vendor claimed. Confirm deletion works. Then sign.
During the pilot, use the commercial checks too. Red flags from buyer guides apply here as well: a platform that tracks only one engine, reports a single unexplained "AI visibility score", or has no API and no export is a silo, and silos are painful to exit.
Red flags that should stop a deal
- The vendor will not name its model providers or intermediaries.
- SOC 2 is "in progress" and you were told it is done.
- SSO exists only on a plan nobody quoted you.
- No deletion process, or deletion measured in "best effort".
- Write-level access requested for a monitoring use case.
- Your prompts or answers may be used for training upstream and the vendor shrugs.
- A Beta product with an as-is clause and no support duty.
Practical tips for the buyer
Keep your prompt set clean. Don't put unreleased product names, M&A targets or sensitive client names into a pilot. Use brand and category prompts that you would be comfortable seeing in a vendor's logs.
Give each connected system the narrowest scope. Read-only Search Console. A dedicated GA4 viewer role. Revocable tokens with an owner.
Write the exit plan on day one. Export formats, deletion confirmation, and who holds the data after cancellation.
If you want to go on exploring options after the security filter, the directory at bestgeosoftware.com lists GEO platforms, and ai-rank-tools.com covers AI rank trackers.
The short version
A security review of an AI visibility platform is mostly a review of who else touches your prompts. Map that chain, get the paperwork in writing with plan names attached, verify SOC 2 reports rather than badges, and keep write access out of scope until the monitoring pilot is clean. Do that and the three-week window is realistic.