Use a representative document task and record what your organization needs confirmed. This summarizes published product capabilities; it is not a certification, contract, or completed security assessment.
Describe what you want to share or analyze
- Documents and sensitivity:
- Internal users and external recipients:
- Required output and human reviewer:
- AI models, external clients, tools, and connectors:
- Retention, deletion, and export requirements:
- Proposed plan, review owner, and date:
Understand the data flow
- Documents enter a Site. Membership and Role-Based Permissions determine access. Check sources, users, and supported download or expiry controls.
- AI uses permitted context. AI Chat and search use permitted Site context; Agents use defined sources, model settings, and tools.
- The chosen route processes context. Review Private Model or Provider Model selection and enabled tools or connector destinations. Zero Data Retention applies only to supported arrangements; it does not remove workspace documents, conversations, generated files, or run records.
- People review the result. Inspect citations and generated files. Add Human Approval checkpoints when a step needs review before proceeding.
- Recipients access approved material. Check their delivered view before inviting clients or partners. Engagement signals do not prove comprehension or approval.
- Records support later review. Available retention settings and exports depend on configuration and plan.
Compatible external AI clients can access permitted context through MCP. Review the client’s own data handling. MCP operations are audited; substantive content reads and cited answers can produce governed evidence.
Verify your requirements
| Area | Evaluate in the product | Confirm for your deployment |
|---|---|---|
| Access | Membership, roles, recipient view, download and expiry | External-user needs and plan entitlement |
| Identity | Passkeys, two-factor authentication, sessions | SSO/SCIM needs; published pricing assigns these to Enterprise |
| AI | Permitted sources, selected model, tools and connectors | Provider arrangements and approved destinations |
| Human review | Citations, output inspection, approval steps | Who reviews and when |
| Records | Run history and evidence export | Retention period, export scope, access roles |
| Deletion | Ordinary deletion, archiving, blocked deletion where supported | Permanent deletion and backup handling |
| Sharing | Delivered view, supported watermarks | Download, expiry, redaction needs |
| Continuity | Required recovery and support process | Contractual recovery, availability, support commitments |
Watermarks support attribution; they do not conclusively identify a disclosure source. Signed evidence and hashes help detect changes; they do not establish that a business conclusion was correct.
Resolve with Clear Ideas
Record an answer and supporting document for each applicable requirement:
- Hosting and processing locations, including selected AI routes.
- Current provider/subprocessor information and applicable data-processing agreement.
- Workspace, audit, AI-record, deleted-content, and backup retention.
- Incident-notification process and contractual timeframes.
- Availability, recovery, support, and escalation commitments.
- Any independent assessment or certification your organization requires.
These details are not established by this checklist. Request applicable material rather than assuming a requirement is satisfied.
Complete the evaluation
- Test permitted sample documents and an external recipient’s access.
- Trace a finding to its source and inspect a generated file and associated record.
- Confirm controls and limits for the chosen plan.
- Record unresolved questions and an owner for each.
- Agree who can approve operational use.
Security · Pricing · Privacy · Request a security discussion