What employees say when somebody actually listens is the most sensitive data an organization holds about itself. Not the most regulated, which is personal data, and not the most valuable, which is usually commercial. The most sensitive, in the sense that it is candid, specific, attributable and durable all at once.
A conversation record describing how a process really works contains the organization's weaknesses stated in the words of its own staff. Scale that across a function and the security standard it deserves is higher than the one applied to an employee survey, which is where most review processes start from.
The organizations that work with this kind of data at enterprise scale set the standard themselves. Their security teams define what adequate looks like, and a provider holding that material has an obligation to meet it rather than to argue about it.
Why employee conversation data is its own asset class
Four properties, and it is the combination that matters rather than any one of them.
Candid. A discovery conversation produces value when the person describes what actually happens, including the workarounds and the steps that should not exist. A survey response can be defensive and still count. A conversation record cannot, which means the content is unusually revealing by design.
Attributable. Role-level detail identifies individuals in small teams. A description of one person's daily work in a nine-person function is personal data in effect, whatever the field labels say.
Operationally specific. Interview content names systems, counterparties, exception paths and the conditions under which controls are bypassed. That last category is directly useful to anyone looking for a way into an organization.
Durable. A process description remains accurate for months. An account of how exceptions get handled stays useful longer than that. Unlike a metric, it does not decay into harmlessness.
| Data type | Candid | Attributable | Operationally specific | Durable |
|---|---|---|---|---|
| Engagement survey results | Partly | Aggregated | No | No |
| HR records | No | Yes | No | Yes |
| System event logs | N/A | Yes | Partly | Yes |
| Employee process interviews | Yes | Yes | Yes | Yes |
The bottom row is the only one carrying all four, which is the argument for treating it under its own standard rather than inheriting the one applied to survey tooling.
Control layers
Four layers, reviewed in this order
| Layer | Question it answers | Failure mode if skipped |
|---|---|---|
| Platform | Is the infrastructure and access control sound? | Breach or unauthorized internal access |
| Model | What happens to content passed to a model? | Content retained or used for training |
| Boundary | Who inside the customer sees what? | Candid input reaching the wrong manager |
| Lifecycle | How long does it exist and who can delete it? | Indefinite retention of an attributable record |
Most reviews cover the first layer thoroughly and the other three briefly. The failures that damage a discovery programme come from the bottom two.
Layer one: platform controls
The standard enterprise review, and the part most vendors are prepared for. Six items worth confirming rather than assuming.
| Control | What to require |
|---|---|
| Certification | An independent attestation such as ISO/IEC 27001 or SOC 2 Type II, with the report available and the scope checked |
| Encryption | In transit and at rest, with key management described |
| Access control | Role-based, least privilege, with a named list of internal roles that can read raw transcripts |
| Authentication | Single sign-on support and enforced multi-factor authentication for administrative access |
| Audit logging | Who accessed which records and when, available to the customer rather than only internally |
| Hosting and residency | Named regions, with a position on data residency requirements |
The item most often missing is the third one. Ask specifically which roles at the vendor can read an unredacted transcript, how many people that is, and whether access is logged and reviewed. A vendor who can answer with a number has thought about it.
ISO/IEC 27001 is the relevant reference here and it covers the management system rather than a specific configuration. It requires access to be controlled on a need-to-know basis, information to be classified, and security in supplier relationships to be agreed and managed, which extends the review to the vendor's own subprocessors.
Layer two: model controls
This is where review processes designed for traditional software are weakest, because the questions did not exist five years ago.
Training and retention. Is interview content used to train, fine-tune or improve any model serving other customers? The required answer is no without separate written consent, and the vendor should be able to state which model providers they use and what those providers' retention terms are.
Provider terms, not just vendor terms. A discovery vendor using a third-party model inherits that provider's handling terms. Ask which commercial tier they are on and what it specifies about retention and training, since consumer and enterprise terms differ materially.
Prompt and context handling. What organizational content is included in a model request, and is it scoped to the specific conversation or does it carry broader context. Over-broad context is a quiet way for one function's material to influence another's session.
Output review. Whether generated findings are checked before they reach a customer dashboard, and by what mechanism.
Agency limits. If any part of the system can take action rather than only produce text, what it can do and what requires a human decision.
Two published references are worth bringing to this part of the review. ISO/IEC 42001 specifies requirements for an artificial intelligence management system, which is the closest formal analogue to a certification for this layer. The OWASP Top 10 for Large Language Model Applications names the specific failure modes to ask about, including sensitive information disclosure, excessive agency and prompt injection, and it is written plainly enough to use as a question list in a vendor call.
Layer three: boundary controls
The layer that determines whether the programme survives, and it concerns the customer's own structure rather than the vendor's.
A discovery conversation happens on an understood scope: this goes to the transformation team, management sees patterns and not quotes, and it will not appear in a performance conversation. If that scope is enforced by a reporting convention, it will break the first time somebody wants more detail.
| Control | What to require |
|---|---|
| Separated areas | Structural separation per function or programme, so visibility is a property of the workspace rather than of a report |
| Anonymization | Applied by configuration, with a minimum group size stated as a number |
| Role-based visibility | Defined before the first conversation, with who sees raw content written down |
| Re-identification check | The ability to assess what a given report would reveal about a small team before it circulates |
| Performance-use prohibition | A written internal commitment that operational input is not used in individual assessment |
| Participant access | A person can see what was recorded about their own input |
The fifth row is an internal policy rather than a product feature and it is the single cheapest control on this list. The sixth is uncommon and it changes how people participate, because the ability to check what was recorded removes the need to self-censor against an unknown.
Layer four: lifecycle controls
Four questions, each with a date or a name as the answer.
Retention. How long are raw transcripts kept, by default and by configuration. A default of indefinitely is common and should be changed.
Deletion on termination. What happens to transcripts, recordings and derived artifacts when the engagement ends, with a deadline and written confirmation.
Export. Whether the customer can take the full record out, in a usable format, without a dependency on the vendor remaining a supplier.
Incident notification. The notification window, who is contacted, and whether it covers incidents at subprocessors.
The export question is worth asking even when it is not a security concern, since the answer reveals whether the record is a customer asset or a vendor asset.
The review sequence
Six steps, in an order that avoids spending the review on the easy layer.
1. Classify the data before sending a questionnaire
Decide internally that employee conversation records are a distinct class with their own requirements. A questionnaire built for survey tooling asks the wrong questions and the answers will all be satisfactory.
2. Confirm the platform layer with documents, not conversation
Certifications, scope statements and audit reports. This part is binary and should take an hour.
3. Spend the vendor call on layers two and three
Model handling and boundary enforcement are where the answers vary and where a vendor's actual thinking is visible. These need a conversation rather than a form.
4. Define the internal boundary before the first conversation
Who sees raw content, who sees patterns, and the written commitment on performance use. This is the customer's work and it does not depend on vendor selection.
5. Get the lifecycle terms into the contract
Retention default, deletion deadline, export right and notification window. All four are specific and none requires negotiation of principle.
6. Tell participants what the controls are, in plain language
Three sentences before the first conversation. Who sees this, what happens to it, and what it will not be used for. A programme with excellent controls and no statement about them produces defensive answers anyway.
Where Horizon fits
Horizon is an AI-powered continuous discovery platform, and the security posture is a condition of the product working rather than a procurement requirement. Candid conversations happen when the handling is trustworthy, so the controls and the quality of the output are the same question.
Workspaces provide separated areas with anonymization and spend limits, which places boundary enforcement in the structure rather than in a reporting convention. The Insights Dashboard holds findings with traceability to the inputs behind them, which is what makes a re-identification assessment possible before a report circulates rather than after.
Horizon participates in OpenAI's Trusted Access for Cyber programme, which gives verified organizations access to frontier models for authorized internal security research, red teaming and threat analysis. The reason to be in it is the same logic that applies to the customers: defending a system requires being able to see it.
At Despegar, a cycle covered more than 170 collaborators and produced 124 hours of conversation and 45 initiatives, with participants rating the experience 9.1 out of 10. A hundred and twenty four hours of candid operational conversation is a material volume of exactly the asset class this guide is about, and the satisfaction figure is the signal that the handling was experienced as trustworthy by the people who produced it. These figures describe one engagement and they are evidence rather than a guarantee.
The question worth asking any provider: how many people at your company can read an unredacted transcript from our organization, and is that access logged and available to us?
Checklist for a vendor security review
- Have you classified employee conversation records as their own data class internally?
- Is there an independent certification, and does its scope cover the service you are buying?
- Which roles at the vendor can read raw transcripts, as a number, and is access logged?
- Is interview content excluded from model training without separate written consent?
- Which model providers are used, on which commercial terms, with what retention?
- Is anonymization applied by configuration, with a minimum group size stated numerically?
- Can you assess what a report would reveal about a small team before circulating it?
- Is the internal visibility boundary defined, and is there a written performance-use prohibition?
- What is the retention default, and the deletion deadline on termination?
- Can you export the full record without remaining a customer?
Items 3, 5 and 7 are the three that most reviews omit and that most distinguish vendors.
Common mistakes
Reusing the survey vendor questionnaire. It asks about aggregated responses, and every answer will be satisfactory while the questions that matter go unasked.
Stopping at the certification. ISO/IEC 27001 and SOC 2 cover the management system. Neither answers what happens to content passed to a model or who inside your own company sees a quote.
Accepting the vendor's terms without checking the model provider's. A vendor's commitment is limited by the terms of the provider underneath them.
Treating anonymization as a binary. Without a stated minimum group size, it means whatever the reporting template happens to do, which in a small team is nothing.
Leaving the internal boundary undefined. The most common failure in discovery programmes is candid input reaching a manager it was not meant for, and that is the customer's control rather than the vendor's.
Defaulting to indefinite retention. It is usually the default and it is rarely what anyone would choose deliberately.
Having good controls and not describing them. Participants who do not know who sees their input will protect themselves, and the output degrades regardless of how sound the platform is.
FAQ
Why does employee interview data need a higher standard than survey data?
Because it is candid, attributable, operationally specific and durable at the same time. A survey response can be defensive and still serve its purpose. A conversation record is valuable precisely because it is not, which means it contains specific weaknesses described by the people closest to them.
What should a security review of an AI discovery vendor cover?
Four layers. Platform controls, which certifications largely cover. Model controls, meaning training, retention, context scope and agency limits. Boundary controls, meaning who inside your own organization sees what. And lifecycle controls, meaning retention, deletion, export and notification.
Is ISO 27001 certification enough?
It covers the information security management system, which is necessary and not sufficient here. It does not answer what happens to content sent to a model, which commercial tier the vendor uses with their model provider, or who inside your company can read a quote.
What standard applies specifically to AI systems?
ISO/IEC 42001 specifies requirements for an AI management system and is the closest formal analogue to a certification for the model layer. For the specific failure modes to ask about, the OWASP Top 10 for Large Language Model Applications is usable directly as a question list in a vendor call.
What is the most overlooked control?
The internal visibility boundary. Most programme damage comes from candid input reaching a manager it was not intended for, which is enforced by the customer's configuration and policy rather than by the vendor's security posture.
Should employees be able to see what was recorded about them?
It is uncommon and it improves the output. A participant who can check their own record does not need to self-censor against an unknown, and the resulting account is more accurate. It also makes the stated scope verifiable rather than asserted.
The standard is set by the people who trusted the process
An organization asking its staff to describe how work really functions is asking for something that only arrives once. The controls around that material determine whether it arrives at all, which makes security a property of the method rather than a condition attached to it.
Four layers, reviewed in order, with the two that matter most sitting furthest from the certification. The platform question has a document for an answer. The others need a conversation and a number.
See it. Fix it. Stay ahead.