Key takeaways
- GEO and AI visibility platforms touch more than a typical marketing tool: CDN logs, CMS publishing rights, Search Console data, visitor analytics, and sometimes autonomous content agents. Your questionnaire should reflect that.
- Standard questionnaires (SIG, CAIQ) cover the basics but can miss AI-layer risks: training on your data, prompt retention, autonomous action limits, and sub-processor disclosure.
- Send the questions before the demo, not after. A vendor that answers vaguely in writing will not get clearer on a call.
- Give every question a red-flag answer and a score, so the outcome is approve, conditional, pilot, or decline instead of a gut call.
- Answers are claims made on one day about a product that changes weekly. Ask for evidence and re-check at renewal.
Why GEO vendors need their own questionnaire
A GEO platform is not a normal dashboard tool. To do its job it often needs a log drain from your CDN, a token to publish into your CMS, read access to Google Search Console, a tracking script on your site, and a pile of your brand, competitor, and positioning data. Some also run agents that write and publish pages for you.
That is a lot of surface area for something that usually gets bought by a marketing team and reviewed by security as an afterthought.
General vendor questionnaires are a fine starting point. Reco's AI vendor security questionnaire (40 questions across six domains, July 2026) makes the case well: a vendor can hold a clean SOC 2, encrypt everything at rest, and still route your data to a third-party model or retain prompts indefinitely. Standard questionnaires may not fully cover training on customer data, prompt retention, autonomous action limits, and sub-processor disclosure.
The Cloud Security Alliance's 10 questions (originally from Vanta) cover the universal baseline: certifications, encryption in transit and at rest, incident response. This guide builds on both and adds the parts specific to GEO tooling.
How to use this questionnaire
Send it as a written document at least a week before the demo. Ask for answers in writing, with links to evidence (trust center, audit reports, DPA, sub-processor list). Then score each answer.
A simple rubric works fine:
| Score | Meaning | Action |
|---|---|---|
| 2 | Clear answer with evidence | Pass |
| 1 | Answer given, no evidence or partial | Ask for follow-up |
| 0 | Evasive, missing, or matches the red flag | Flag for review |
Add up by section. Any zero in the data handling or access sections should block a purchase until it is resolved, whatever the total.
Section 1: Certifications and governance (questions 1-4)
- Which security certifications do you hold, and can you share the reports? Look for ISO/IEC 27001 and SOC 2 Type II. Red flag: "in progress" with no date, or a certificate that covers a different legal entity than the one signing your contract.
- What is the scope of the certification? A certificate that covers only the corporate office and not the product environment is worth little. Ask for the statement of applicability.
- Do you have an AI-specific governance policy? You want to hear about model selection, change control for AI features, and who approves new model providers. Red flag: "we follow general best practice."
- When was your last independent penetration test, and can we see a summary? Annual at minimum. Red flag: only internal testing.
Section 2: Data handling and AI models (questions 5-11)
This is the section general questionnaires underweight. Be strict here.
- Is our data used to train or fine-tune any model, yours or a third party's? The only acceptable answer is a clear, contractual no.
- Which third-party model providers process our data, and where? Ask for the full sub-processor list including LLM providers. Red flag: "we use leading providers."
- How long are prompts, responses, and generated content retained, and can we set the retention period? Look for configurable retention and a deletion process with a stated timeline.
- What customer data do you actually need? A good vendor can list the minimum: tracked prompts, brand and competitor names, domain, and optionally analytics. Red flag: requests for broad admin access when read-only would do.
- Where is data stored and processed, and do you offer EU or regional residency? Relevant for GDPR. Ask whether the contracting entity is in the EU and whether data leaves the region for model calls.
- How do you handle deletion at offboarding? Ask for a written timeline and a deletion certificate on request.
- Is any of our data visible to other customers, including through shared prompt libraries, benchmarks, or aggregated datasets? Aggregated and anonymized research is common in this category. Ask exactly how anonymization works and whether you can opt out.
Section 3: Data collection methods (questions 12-14)
GEO tools get their data in different ways. Some call model APIs. Others monitor the real user interfaces of ChatGPT, Gemini, Perplexity, and Google AI Overviews, because user-facing answers and citations can differ from API output. Both are legitimate, but each has risk.
- How do you collect AI responses: official APIs, real interface monitoring, or scraping through third parties? Follow up with where the infrastructure runs and who operates it.
- Do you use any customer-supplied accounts or credentials to query AI platforms? The answer should be no. Red flag: asking for your ChatGPT login.
- Does collection comply with the terms of the AI platforms you query? You are inheriting some of this legal risk. Ask for a plain-language answer from legal, not sales.
Section 4: Access, integrations, and autonomous actions (questions 15-20)
This is where a GEO platform differs most from a normal reporting tool.
- What permissions do your integrations request? Cover CMS (WordPress, Webflow, Framer), Google Search Console, Bing Webmaster Tools, and analytics. You want scoped, revocable access. Red flag: full admin tokens when draft-only publishing is enough.
- Can publishing run in draft mode with human approval? If the vendor has a content agent, ask whether it can be set to a review inbox, and whether fully hands-off mode is optional rather than the default.
- What can your agents do without a human in the loop, and how do we limit it? Ask for budgets, publish windows, and kill switches. The Reco guide lists autonomous action limits as one of the gaps in standard questionnaires, and it is a real one here.
- How are API keys and tokens stored, scoped, and rotated? Look for project-level and read-only scopes, plus a way to revoke instantly. If the product has an API or MCP server, ask how write tools are gated.
- Do you provide an audit log showing who or what changed what? Ideally it distinguishes dashboard, API, MCP client, and chat-agent changes. Ask which plan includes it, because it is often gated.
- What roles and SSO options exist? Owner, editor, and viewer roles with project-level access are the minimum. SSO often sits on enterprise tiers, so confirm what your contract includes.
Section 5: Crawler logs and site data (questions 21-23)
Many GEO platforms now ingest AI crawler logs from your CDN or host. That means server-level data leaves your perimeter.
- What exactly is in the logs you ingest, and do you strip IP addresses, cookies, and query strings? You want the minimum fields needed to identify AI bots, not full request logs with user data.
- How do you verify that a crawler is who it claims to be? User agents are trivially spoofed. Better vendors verify requests against each operator's published IP ranges. Promptwatch Data's AI crawler traffic report (June 8 to September 6, 2026) counts only IP-verified requests for this reason, and notes that OpenAI made up 79.8% of verified AI crawler requests in the week of August 31 to September 6, down from 94.8% in early June.
- Which AI crawlers do you identify, and how fast do you add new ones? The list changes quickly. Meta-WebIndexer, for example, went from about 2% to nearly 38% of tracked AI crawler requests between mid-July and August 9, 2026, according to Promptwatch's Meta-WebIndexer data. A vendor working from a stale user-agent list would have missed it. Ask whether they cover at least OpenAI (GPTBot, OAI-SearchBot, ChatGPT-User), Anthropic (ClaudeBot, Claude-User, Claude-SearchBot), Google, Perplexity, Meta, Mistral, and xAI agents.
Also ask how logs arrive: Cloudflare Logpush, a deployed Worker, CloudFront, Fastly, Vercel, or a plugin. Each has a different trust model, and your infrastructure team should review the one you pick.
Section 6: Resilience and contract terms (questions 24-25)
- What are your incident response and breach notification commitments? Ask for a notification window in hours, in the contract, not just a policy page.
- What happens if you are acquired, or if a sub-processor changes? Ask for advance notice of sub-processor changes and the right to object. This matters in a market where vendors are raising money, merging, and swapping model providers quickly.
Red flags that should stop the process
- No written answer to question 5 (training on your data)
- A sub-processor list that is missing or says "available on request" after you requested it
- Requests for credentials to AI platforms
- Agents that publish live by default with no approval step
- Certifications that are "coming soon" for a vendor you plan to give CDN log access
- Answers that change between the written response and the demo
What good answers look like in practice
Vendors in this category vary. Some publish a trust center, hold ISO/IEC 27001, state GDPR compliance, and process data through an EU-based company. Promptwatch, for example, is ISO/IEC 27001 certified and GDPR compliant, offers an organization audit log on its Business and Agency Scale plans, scoped project, organization, and read-only API keys, and owner, editor, and viewer roles. Its CMS publishing can push drafts or publish live, and its Content Agent has a review inbox with approve, edit, and decline controls. That is the kind of specificity to look for from any vendor, and you should verify each claim yourself, including on its pricing page to see which tier unlocks which control.
Other enterprise-oriented platforms worth putting through the same questionnaire include Profound, Bluefish AI, Scrunch, Evertune, and Conductor. The point is not that one passes and another fails. It is that you get comparable written answers.
For a wider shortlist, the GEO software directory at bestgeosoftware.com lists tools by category.
A quick comparison grid for your shortlist
Copy this into a spreadsheet and fill it in per vendor.
| Control | Vendor A | Vendor B | Vendor C |
|---|---|---|---|
| ISO 27001 / SOC 2 Type II (with reports) | |||
| Contractual no-training clause | |||
| Full sub-processor list incl. LLMs | |||
| Configurable retention and deletion | |||
| Regional data residency | |||
| Scoped, revocable integration tokens | |||
| Draft-only publishing option | |||
| Audit log by source (UI, API, agent) | |||
| SSO and role-based access | |||
| IP-verified crawler detection | |||
| Breach notification window in contract |
Verify, do not just collect
A completed questionnaire is a snapshot. The Reco guide makes a point worth repeating: answers are claims made on one day about a product that changes weekly. Three habits help.
First, run a pilot with minimum access. Start with read-only Search Console, no CMS write token, and a single project. Expand only after you have seen the audit log behave as described.
Second, check the sub-processor list again at renewal and whenever the vendor announces a new AI feature. New features often mean new model providers.
Third, test the claims you can test. If a vendor says it verifies crawlers by IP, compare its numbers against your own server logs. Promptwatch's crawler report suggests exactly this kind of cross-check: a provider that is large in the market data but near zero in your logs points to blocking or unreachability, which is also a useful sanity test of the vendor's detection.
Who should own this process
Marketing usually picks the tool and security usually blocks it late. Flip that. Have marketing write the use case (what data, which integrations, which publishing rights), then let security score the answers. If you are also deciding whether to hire outside help to run GEO, the same questions apply to agencies that will hold your CMS and analytics credentials. 1001 SEO Media, which publishes this site, works with senior specialists on monthly reporting and no long-term contracts, and like any provider should be willing to answer the same access and data-handling questions in writing.
The short version
Twenty-five questions is enough to separate vendors who have thought about security from vendors who have a trust page. Send them before the demo, insist on written answers with evidence, score them, and start any pilot with the least access that still lets the product work. If a vendor will not tell you which models touch your data, that is your answer.