25 procurement questions for AI chatbot vendors

In which regions is customer data stored at rest?

SLAtech: Hosting in your own jurisdiction is available on request (Enterprise deployments); single-tenant deployments can pin to a single region.

Which sub-processors process customer data and where?

SLAtech: By category: a cloud hosting provider, our language-model provider (US, LLM inference), a vector-search provider, an error-monitoring provider (US, errors), a CDN / edge-security provider (global edge, WAF / CDN), a transactional email provider (US, transactional email). Category list at /en/sub-processors/ kept current within 14 days of change. The full list with vendor names is provided under NDA or in our Data Processing Agreement on request.

What standard contractual clauses govern non-EEA transfers?

SLAtech: SCC 2021/914 - current European Commission template. Transfer-impact assessment available on request.

Can customer data residency be pinned to a single region?

SLAtech: Yes - Enterprise tier offers a single-tenant deployment pinned to a single region of your choosing. Multi-tenant tiers (Starter / Pro) auto-failover across regions.

Are backups stored in the same region as primary data?

SLAtech: Yes. Daily backups with 35-day retention; point-in-time recovery within the last 24 hours. Backup region matches primary unless customer pins otherwise.

Is the vendor SOC 2 compliant?

SLAtech: Type I report targeted Q3 2026; Type II Q2 2027. Operational controls listed at /en/security/ independently auditable on request.

Is the vendor ISO 27001 certified?

SLAtech: Certification targeted Q4 2026. ISMS scope = production infrastructure + customer-data processing systems.

Is the vendor HIPAA BAA-eligible?

SLAtech: Yes - on the Enterprise tier with single-tenant deployment. Standard BAA template available via security@slatech.ai.

Is the vendor GDPR-compliant and will it sign a DPA?

SLAtech: Yes - DPA executed on Enterprise signup; standard DPA template downloadable for review.

How is the vendor's PCI-DSS scope managed?

SLAtech: SLAtech does not store, process or transmit cardholder data - payments are handled by an external PCI-DSS Level 1 payment provider. SAQ-A applies.

Describe encryption at rest and in transit.

SLAtech: AES-256-GCM at rest, TLS 1.2+ in transit with HSTS preload. Key rotation runs annually + on personnel changes.

Describe identity, authentication and authorization controls.

SLAtech: Argon2id password hashing, per-tenant password policy, RBAC, audit log of admin actions. SAML SSO ships on Enterprise tier (Okta, OneLogin, Azure AD, Google Workspace).

Describe the vulnerability management program.

SLAtech: Dependabot dependency updates on production, GitHub CodeQL static analysis on every PR, annual external pen test (next Q4 2026), coordinated vulnerability disclosure policy.

How are security incidents detected and notified?

SLAtech: Error monitoring per backend service with PII scrubbing, synthetic transaction monitoring at 5-minute cadence, real-time status page at status.slatech.ai. Incident-notification SLA: within 24 hours for significant incidents (NIS2 alignment).

What is the pricing model?

SLAtech: Five-tier flat pricing: Free $0/mo, Starter $49/mo, Pro $249/mo, Enterprise $499/mo, Custom Solutions custom-quoted. Each tier includes a monthly resolution allowance (Free 100, Starter 500, Pro 5,000, Enterprise 15,000); beyond it, add capacity or move up a tier. No per-resolution or per-message billing.

Is there a free tier?

SLAtech: Yes - a permanent Free tier at $0/mo, no credit card required. Upgrade to any paid tier (Starter / Pro / Enterprise) or Custom Solutions at the buyer's choice.

What's included in the standard MSA?

SLAtech: GDPR-compliant DPA, sub-processor list, SCC 2021/914 references, 99.9% uptime SLA with service credits on the Enterprise tier.

What's the termination and data-export policy?

SLAtech: Termination for convenience with 30 days notice. On termination, customer data exportable for 90 days (Markdown / JSON knowledge content + JSONL conversation history). Then permanently deleted.

What's the typical time-to-first-widget-live?

SLAtech: 10-30 minutes self-service for the web widget. Telegram and WhatsApp Business add another 20 minutes. No implementation-consultant engagement required.

What integrations ship out-of-the-box?

SLAtech: Telegram, WhatsApp Business (Cloud API, your own number), Shopify, Google Calendar, Zapier, generic JSON-POST webhook (for in-house CRMs). HubSpot, Salesforce and Pipedrive are reached through the signed lead webhook on the Pro tier and above, directly or via Zapier / Make - there are no native CRM connectors. WhatsApp connects with your own Cloud API number and token; one-click signup through Meta is awaiting Meta's review.

What knowledge formats are supported for ingest?

SLAtech: PDF, DOCX, plain text, Markdown, scraped web pages, FAQ-pair upload, manual article authoring. Chunking + embedding runs as a Worker job; reconciliation nightly.

What's the vendor's revenue runway / financial transparency?

SLAtech: Privately-held; founder-led. Customer-data export-rights survive vendor solvency events per the MSA's continuity clause.

What's the disaster-recovery posture?

SLAtech: RTO 4 hours, RPO 1 hour. Daily backups with 35-day retention; multi-region failover for high availability. DR runbook tested quarterly.

How is concentration risk on LLM providers managed?

SLAtech: Multi-provider abstraction layer - a primary language-model provider, with alternative providers available on the Enterprise tier for failover or per-tenant pin. Provider switching doesn't require customer-side migration.

How are eval / quality regressions detected?

SLAtech: Answers built on retrieved content are scored for factuality per query and flagged when unsupported; the results are visible to the customer for their own site. No fixed benchmark is published today - see /en/eval/ for what is measured and what is not.