Ask for evidence, not a badge list
Security requirements depend on your information, users and contracts. Start with the records the service will hold and who should access them. Ask the provider to demonstrate controls and explain their limits. This checklist is not a claim of certification, universal encryption or a guaranteed service level for VasKem.
Walk through access and separation
Test an administrator, an ordinary operator and a user from a different company. Check which screens, exports and AI answers each can access. Ask how leavers are disabled, how roles are reviewed and whether changes leave a trace. A hidden menu alone is not an access control.
Separate backup from recovery
Ask what is backed up, how long copies remain, who can restore them and when restoration was last tested. Agree the responsibility for data exports and the support path for an incident. Also review hosting locations and any relevant processing arrangements with your adviser.
Include AI and offboarding
For Ask VasKem, confirm company access, approved knowledge and the current retention controls. Staff should check source records before acting on an answer. Before signing, understand how to retrieve operational data, cancel access and request deletion, including any separate backup or legal retention. Use anonymised examples for an initial product discussion.