Are our files or outputs used to train models, yours or a third party's?

Why it matters: This is the question most specific to AI tools. Some vendors state a position publicly; for example Karmen says project documents are never used to train shared models. Tip: Ask for the contract clause, not just a web page, and whether the answer differs by plan.

Which third-party AI model providers or subprocessors see our data?

Why it matters: Many AI tools call outside model providers. Each one is another place your data goes. Tip: Request the subprocessor list and the provider's data-retention terms for API traffic.

Do you have a current SOC 2 Type II report, and will you share it?

Why it matters: A SOC 2 report is an independent auditor's examination of a service organization's controls (see AICPA). Type II covers how controls operated over a period, not just their design. ALICE says it is SOC 2 Type II; Karmen says it shares SOC 2 reports on request. Tip: Ask for the report under NDA and check its date, scope (which product), and any exceptions noted.

How long are files kept, and how do we delete them?

Why it matters: Bid documents can be sensitive long after bid day. Tip: Ask for retention periods for uploads, derived data, and backups, and how deletion is confirmed.

Where is the data stored and processed?

Why it matters: Some public owners and clients restrict data location. Some vendors state a location; Foreman AI says it uses US-based servers. Tip: Ask for the hosting regions, including where AI processing happens.

Who can access our projects, including vendor staff?

Why it matters: Some products include human review of AI output, which means people at the vendor see your documents. Buildcheck, for example, says in-house experts verify findings. Tip: Ask who at the vendor can see files, under what controls, and whether access is logged.

Is data encrypted in transit and at rest, and do you support SSO?

Why it matters: These are baseline controls; ALICE and Karmen both describe encryption in transit and at rest. Tip: Ask for TLS and at-rest details, SSO/SAML availability, and which plan includes SSO.

How do you handle AI errors and incidents?

Why it matters: The NIST AI Risk Management Framework is a voluntary U.S. framework for managing AI risks; it is a useful checklist for how a vendor governs model behavior, not a certification. Tip: Ask how wrong outputs are reported and fixed, and how you are notified of a security incident.

Home / Guides / Data security questions to ask an AI construction software vendor

Data security questions to ask an AI construction software vendor

Bid sets, contracts, and cost history are often confidential to you or your client. Before uploading them to an AI tool, get these answers in writing. These are general due-diligence questions, not legal or security advice; your IT team, counsel, and client contract terms come first. Where we mention a vendor, it is something that vendor publishes.

SUGGESTIONS, NOT FINDINGS. No tool has been tested by Means & Methods Lab. Vendor facts are desk research from vendor websites and are not verified. Updated 2026-10-14.

The questions (8)

Q01Are our files or outputs used to train models, yours or a third party's?
WHY IT MATTERS · This is the question most specific to AI tools. Some vendors state a position publicly; for example Karmen says project documents are never used to train shared models.
WHAT TO ASK FOR · Ask for the contract clause, not just a web page, and whether the answer differs by plan.
Q02Which third-party AI model providers or subprocessors see our data?
WHY IT MATTERS · Many AI tools call outside model providers. Each one is another place your data goes.
WHAT TO ASK FOR · Request the subprocessor list and the provider's data-retention terms for API traffic.
Q03Do you have a current SOC 2 Type II report, and will you share it?
WHY IT MATTERS · A SOC 2 report is an independent auditor's examination of a service organization's controls (see AICPA). Type II covers how controls operated over a period, not just their design. ALICE says it is SOC 2 Type II; Karmen says it shares SOC 2 reports on request.
WHAT TO ASK FOR · Ask for the report under NDA and check its date, scope (which product), and any exceptions noted.
Q04How long are files kept, and how do we delete them?
WHY IT MATTERS · Bid documents can be sensitive long after bid day.
WHAT TO ASK FOR · Ask for retention periods for uploads, derived data, and backups, and how deletion is confirmed.
Q05Where is the data stored and processed?
WHY IT MATTERS · Some public owners and clients restrict data location. Some vendors state a location; Foreman AI says it uses US-based servers.
WHAT TO ASK FOR · Ask for the hosting regions, including where AI processing happens.
Q06Who can access our projects, including vendor staff?
WHY IT MATTERS · Some products include human review of AI output, which means people at the vendor see your documents. Buildcheck, for example, says in-house experts verify findings.
WHAT TO ASK FOR · Ask who at the vendor can see files, under what controls, and whether access is logged.
Q07Is data encrypted in transit and at rest, and do you support SSO?
WHY IT MATTERS · These are baseline controls; ALICE and Karmen both describe encryption in transit and at rest.
WHAT TO ASK FOR · Ask for TLS and at-rest details, SSO/SAML availability, and which plan includes SSO.
Q08How do you handle AI errors and incidents?
WHY IT MATTERS · The NIST AI Risk Management Framework is a voluntary U.S. framework for managing AI risks; it is a useful checklist for how a vendor governs model behavior, not a certification.
WHAT TO ASK FOR · Ask how wrong outputs are reported and fixed, and how you are notified of a security incident.

What to bring

Your client contract's confidentiality terms.
Your IT or security team's standard vendor questionnaire, if you have one.
A non-sensitive sample set to use until the answers come back.

Sources

AICPA & CIMA: SOC suite of services (includes SOC 2) https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services
NIST AI Risk Management Framework https://www.nist.gov/itl/ai-risk-management-framework

Tools mentioned (alphabetical, not ranked)

ALICE · Scheduling
Buildcheck · Drawing review & QA
Document Crunch · Contract & document review
Foreman AI · Estimating copilot
Karmen · AI scheduling co-pilot
Provision · Contract & document review

Side-by-side comparisons

Means & Methods Lab has no commercial relationship with any vendor on this page. Rankings and placement are never for sale. See how we make money.