A sales intelligence security review goes fastest when you tell reviewers, on day one, exactly which data the tool will touch. The length of the review depends far more on the data category than on the vendor. A tool that reads public company information can clear in weeks. A tool that stores personal contact data, reads your CRM or ingests call transcripts triggers a privacy assessment and a longer legal negotiation.
Procurement, security or legal friction came up in 19 sales and customer calls between June and October 2026, and again in email follow-ups. A BD executive at a clinical-trial technology company described what buying one more tool would mean: "another six months of procurement, data privacy impact assessment, security impact assessment."
What follows is a buyer-side guide, not legal advice.
TL;DR: Three teams review a sales tool. Security asks about hosting, access and certifications. Legal asks about personal data, the DPA and sub-processors. Procurement asks about vendor viability, contract terms and the PO. Review time tracks the data category: public company data is lightest, contact data and CRM access are heavier, call transcripts are heaviest. Prepare a one-page data map, collect the documents before you submit, and scope the pilot to the lowest-risk data that still proves value.
What Do Security, Legal and Procurement Actually Ask?
Security asks whether the vendor can protect data. Legal asks whether you may process it at all. Procurement asks whether the vendor is safe to depend on and pay.
Security (InfoSec or IT). Where is it hosted? How is data encrypted? Who can access production? Is there SSO and an independent attestation? A sales operations lead at a banking software vendor described the handoff on a call: "we would need vendor management ... he's probably gonna do infosec on you, make sure ... you got the SOC 2 stuff." Two frameworks come up by name: SOC 2, which the AICPA describes as an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy, and ISO/IEC 27001, which sets the requirements an information security management system must meet.
Legal and privacy. Does the tool process personal data? On what lawful basis? Is there a data processing agreement? Who are the sub-processors and where are they? An in-house counsel at a media technology company asked a vendor to "confirm exactly whereabouts in the EU and US the sub processors are located."
Procurement and finance. Is the vendor set up in the purchasing system? Is there a purchase order? What are the exit terms? A procurement lead at an IT services firm summed up the rule as no PO, no deal. The wider list of questions enterprise buyers ask sits on top of these.
See Salesmotion on a real account
Book a 15-minute demo and see how your team saves hours on account research.
Why Does One Tool Clear in Weeks and Another Take Six Months?
Reviewers classify a tool by the data it touches, and the four categories common in sales technology sit in very different risk tiers.
A RevOps lead at a software company told us legal approved one AI connector quickly because it carried only public company information and no call transcripts. A second connector, tied deeply into the CRM, was much harder to approve.
| Data the tool touches | Typical tools | What it triggers | Relative review effort |
|---|---|---|---|
| Public company data (news, filings, earnings calls, job postings) | Account intelligence, signal monitoring | Standard security questionnaire, light privacy check | Lowest |
| Personal contact data (names, titles, business emails, phone numbers) | Contact databases, enrichment | Lawful basis, transparency duties, DPA, sub-processor review | Medium to high |
| Your CRM data (accounts, opportunities, notes) | CRM-connected assistants, enrichment sync | Access scoping, field-level review, confidentiality of your customer list | High |
| Call recordings and transcripts | Conversation intelligence, AI note-takers | Recording consent, personal data of third parties, a likely impact assessment | Highest |
The privacy law explains the jump between row one and row two. Information about a company is generally not personal data. Contact data is, and it is usually collected from sources other than the person. GDPR Article 14 requires that people be told when their data was obtained indirectly, within a reasonable period and at most one month. The UK regulator's list of processing that calls for a data protection impact assessment includes data matching from multiple sources, large-scale profiling, and "invisible processing", where data comes from a source other than the individual. A contact database can touch all three.
So the first move is a one-page data map: which of the four categories the tool will touch in your deployment. This is one reason the split between contact databases and account intelligence matters.
“All of the vendors that I've worked with, all of the onboarding that I have had to deal with, I will say, hands down, Salesmotion was the easiest that I have had.”
Lyndsay Thomson
Head of Sales Operations, Cytel
Which GDPR Questions Come Up for a Sales Intelligence Tool?
Four come up almost every time: lawful basis, the processor contract, sub-processors and international transfers.
Lawful basis. B2B prospecting usually relies on legitimate interests under Article 6(1)(f). The ICO sets out a three-part test: is there a legitimate interest, is the processing necessary for it, and do the person's interests override it. Direct marketing by email must also comply with the separate electronic communications rules.
The DPA. Article 28 requires a contract when a vendor processes personal data for you. The ICO lists eight minimum terms: processing only on documented instructions, confidentiality, security, sub-processor controls, help with data subject rights, assistance with breaches and impact assessments, deletion or return at the end of the contract, and audits. One in-house counsel insisted on negotiating a specific DPA clause before a small pilot could start.
Sub-processors. A processor may not engage another processor without your authorization. Ask for the list with purposes and locations. For an AI tool, the model provider is a sub-processor.
Transfers. If a sub-processor sits outside the EEA or UK without an adequacy decision, the DPA should name the transfer mechanism, usually the EU Standard Contractual Clauses and the UK Addendum.
What Do Reviewers Ask About the AI Itself?
They ask whether your data trains a model and which model providers see it. A Director of BD at a CRO put the first question precisely: IT "will want to know (eventually) what data goes where, and how widely it is shared (ie, is it used to train results for other CROs)."
- Training use. Model providers publish their defaults. Anthropic states that by default it does not use inputs or outputs from its commercial products to train models. Microsoft states that Copilot prompts, responses and Microsoft Graph data are not used to train foundation models. Ask which provider the sales tool uses, and on what terms.
- Where each component runs. The same Microsoft page says its EU Data Boundary does not apply to web search queries. If residency matters, ask about every component, not only the database.
- Connector risk. If the tool plugs into an AI assistant through MCP, security will ask who operates the server. Anthropic's guidance is to connect only to servers built and hosted by organizations you trust. More on that pattern in ChatGPT, Claude or Copilot for account research.
The EU AI Act rarely changes the outcome for a research or signal tool. The European Commission's summary of the Act puts most AI applications in the minimal-risk tier with no specific rules. Two points still apply: AI literacy obligations have applied since February 2025, and transparency rules require that people know when they are interacting with an AI system.
“We have very limited bandwidth, but Salesmotion was up and running in days. The template made it easy to load our accounts and embedding it in Salesforce was simple. It was one of the easiest rollouts we've done.”
Andrew Giordano
VP of Global Commercial Operations, Analytic Partners
What Should You Have Ready Before the Questionnaire Arrives?
Collect the documents before you open the vendor-onboarding ticket.
| Reviewer asks | Who asks | What to have ready |
|---|---|---|
| Is there a DPA? | Legal | Vendor DPA, checked against the eight Article 28 terms |
| Who are the sub-processors and where? | Legal | Current list with purpose and location, including the AI model provider |
| Where is it hosted and how is it encrypted? | Security | Hosting region, encryption in transit and at rest, access controls |
| What attestations exist? | Security | Whatever the vendor holds, or a completed questionnaire such as the Cloud Security Alliance's yes/no CAIQ |
| Is SSO supported? | IT | Supported identity providers and the plan that includes it |
| Is customer data used to train AI? | Security, legal | Vendor's written answer plus the model provider's terms |
| Will the vendor be around? | Procurement | Company details, a named contact, exit and data-return terms |
| How is it paid? | Finance | Legal entity names on both sides, PO process, billing terms |
Vendor viability. A GTM engineer at a digital consultancy asked a small vendor directly: "are these guys going to exist in next year? If something goes wrong, who can we call?" The answer is contractual. Ask for a named escalation contact, data export in a common format, and deletion or return on termination.
Email allowlisting (whitelisting). If the tool sends alerts by email, your mail filter may block them. An enablement lead at a global IT services firm told us InfoSec blocked a vendor's notification emails, and that allowlisting had taken weeks elsewhere in the group. For Microsoft 365, Microsoft's documentation ranks the Tenant Allow/Block List as the recommended method and warns against mail flow rules that allow a sender domain without also checking that the message passed DMARC.
How Long Does Review Take, Realistically?
Buyers who shared dates reported three to seven weeks for a scoped tool, and six months in the heaviest case. These are reported durations, not industry averages.
| Stage | What happens | Reported duration |
|---|---|---|
| Confidentiality agreement | A mutual CDA before a target-account list is shared | Signed before the first call at one mid-size CRO |
| Legal review of DPA and terms | Redlines on DPA clauses, questions on sub-processor locations | About three weeks for one three-month pilot |
| Vendor onboarding and PO | Supplier setup, PO raised before an invoice can be released | Unpredictable; one onboarding ticket went unanswered |
| Full vendor qualification | Verbal yes to approved vendor | About seven weeks at one life-sciences services firm |
| Contact-data tool with privacy assessment | Full procurement, privacy and security impact assessments | Six months at one clinical-trial technology company |
The VP of Commercial Operations behind the seven-week figure called it "a slow process navigating vendor approval" and dropped SSO from the first phase to speed things up. Mechanics cost weeks too, such as a paying entity that differs from the using entity.
How Do You Scope a Pilot So the Review Is Proportionate?
Scope the pilot to the lowest data category that still proves value, and say so in the first line of the request.
A worked example: a 12-rep team wants to test an account intelligence tool on 120 named accounts for three months.
- Data map. Public company signals and research briefs: in scope. CRM connection: out of scope for the pilot. Call transcripts: out of scope. Contact data: business contact details only, for accounts on the list.
- Access. Named users invited by an admin. SSO deferred to rollout if it would add a ticket queue.
- Contract. Month-to-month or a fixed three-month term with an out-clause. A revenue operations lead at an adtech company asked for exactly that after finance pushed back on vendor contracts.
- Requests filed on day one. Vendor onboarding, PO, email allowlisting.
- Expansion gate. CRM integration and SSO go through a second, separate review once the pilot shows results.
This turns one large review into a small one now and a targeted one later, which is how a sales intelligence pilot should run anyway.
Salesmotion's security page describes an intelligence layer built on publicly available company information, lists the customer data the platform does store (workspace settings, user accounts, business contact data, the CRM fields you choose to sync, usage analytics), and says standard questionnaires, including DDQ and CAIQ-style formats, are typically returned within a few business days. Its DPA incorporates the 2021 EU Standard Contractual Clauses and the UK Addendum, commits to security-incident notification within 72 hours, and lists each sub-processor with its purpose and location.
Whatever you buy, hand reviewers the data map before they ask. The review then covers the tool you are deploying, not the riskiest tool in its category.
Frequently Asked Questions
What is a sales intelligence security review?
It is the vendor risk assessment a company runs before approving a sales intelligence or AI sales tool. Security checks hosting, access and attestations. Legal checks personal data, the DPA and sub-processors. Procurement checks viability, terms and payment setup.
How long does a vendor security review take for a sales tool?
Buyers reported about three weeks of legal review for a small pilot, about seven weeks from verbal yes to approved vendor, and six months for a contact-data tool. The data category and your own onboarding queue drive the range.
Is a sales intelligence tool GDPR compliant if it only uses public data?
Public company information such as filings, news and job postings is generally not personal data. Once a tool adds named contacts, business emails or phone numbers, it processes personal data even when the source is public. You then need a lawful basis, Article 14 transparency and a DPA.
Does a sales tool need SOC 2 or ISO 27001 to pass review?
That depends on your company's policy. Some organizations require an attestation for every vendor. Others accept a completed questionnaire when the data in scope is low risk. Ask your security team for its threshold before you shortlist.
How do I stop IT from blocking a vendor's alert emails?
Raise an allowlisting request with your mail administrator when you start vendor onboarding. On Microsoft 365, the Tenant Allow/Block List is Microsoft's recommended method.
