HECVAT Category
Privacy and AI
Privacy and AI covers controls and questions related to that domain. It outlines expectations institutions typically require from vendors. The category helps assess risk posture and operational maturity. It provides structure for consistent evaluation during security reviews.
Assessment Questions
Does your service use AI for the processing of institutional data?
AI processing of institutional data is the point of this item, namely whether your service uses AI to process data belonging to the assessing institution. 'Processing' in this context refers to any operation performed on data, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, or any other form of handling.
Is any institutional data retained in AI processing?
Data persistence within AI processing is the concern, specifically whether any institutional data is retained by your AI systems during or after processing. 'Institutional data' refers to any information owned by or pertaining to the institution, which could include student records, research data, administrative information, or other sensitive data.
Do you have agreements in place with third parties or subprocessors regarding the protection of customer data and use of AI?
Third-party AI safeguards are the focus, specifically whether formal agreements with subprocessors and other parties address how customer data is protected when used in AI systems. As AI systems often require large amounts of data for training and operation, there are specific privacy and security concerns about how this data is handled.
Will institutional data be processed through a third party or subprocessor that also uses AI?
AI in the supply chain is the concern here: the question is whether institutional data will pass through any third party or subprocessor that itself relies on AI.
Is AI processing limited to fully licensed commercial enterprise AI services?
At issue is how tightly AI use is constrained, namely whether processing is confined to fully licensed commercial enterprise AI services rather than open-source, custom, or consumer-grade tools.
Will institutional data be used or processed by any shared AI services?
Shared AI services and institutional data intersect here, and the question is whether data belonging to the institution will be used or processed by any shared AI service. 'Shared AI services' typically refers to third-party AI platforms like OpenAI's ChatGPT, Google's Vertex AI, Microsoft Azure AI, or similar services where the AI models are hosted and maintained by another company.
Do you have safeguards in place to protect institutional data and data privacy from unintended AI queries or processing?
Guarding data against unintended AI processing is the concern: whether you have safeguards that keep institutional data and privacy protected from inadvertent AI queries or processing.
Do you provide choice to the user to opt out of AI use?
User choice over AI is what's being checked: whether you let users opt out of AI features or processing within your product or service.
ResponseHub is the product I wish I had when I was a CTO
Previously I was co-founder and CTO of Progression, a VC backed HR-tech startup used by some of the biggest names in tech.
As our sales grew, security questionnaires quickly became one of my biggest pain-points. They were confusing, hard to delegate and arrived like London busses - 3 at a time!
I'm building ResponseHub so that other teams don't have to go through this. Leave the security questionnaires to us so you can get back to closing deals, shipping product and building your team.
