Enterprise Customer Feedback Platform Security Checklist: SSO, Permissions, and Data Residency

It pulls the most sensitive parts of your other systems into one place: customer names, word-for-word complaints, call recordings, account revenue from your CRM, and OAuth tokens into Zendesk, Intercom, Salesforce, and Slack.

AI adds two more paths out. The vendor sends your data to model providers, and your team connects Claude, ChatGPT, or Cursor to the platform, a path most security reviews never map. Review it like a system of record, not a survey tool.

Copy this into your vendor review doc. Each line is a yes or no, and a "no" on a line your contracts require ends the evaluation.

# Customer Feedback Platform Security Checklist

## Identity and Access
- [ ] SAML 2.0 SSO with our identity provider, on the plan we will buy
- [ ] SSO can be enforced, with password sign-in turned off
- [ ] SCIM 2.0 provisioning and deprovisioning, or a documented manual step
- [ ] MFA or passkeys for any sign-in that is not SSO
- [ ] Only admins can connect integrations, create API keys, turn on AI assistant access, and change privacy settings
- [ ] Removing a user also revokes their API keys, OAuth tokens, and AI assistant connections

## Integrations
- [ ] Read-only scopes for support, CRM, chat, and survey tools
- [ ] A written list of every system the vendor can write to
- [ ] Tokens stored in a secrets manager or vault, never sent to the browser
- [ ] Disconnecting an integration revokes its token

## Data Location, Isolation, and Encryption
- [ ] Hosting region that matches our customer contracts (US, EU, APAC)
- [ ] Written exceptions list: model providers, sign-in, analytics, email, backups, AI chat history
- [ ] Tenant isolation explained: shared database with row scoping, or a dedicated database
- [ ] TLS in transit and encryption at rest
- [ ] Customer-managed keys, only if a contract requires them

## Retention and Deletion
- [ ] Retention period for active and inactive accounts
- [ ] Deletion deadline in writing, after a request and after cancellation
- [ ] Deletion covers derived data: insights, summaries, embeddings, clips, and backups
- [ ] Export in an open format (CSV or API) before we leave

## AI and Model Use
- [ ] Named model providers
- [ ] Written commitment that our data does not train vendor or provider models
- [ ] Provider retention stated: zero data retention, or a number of days
- [ ] Where model calls are processed
- [ ] PII redaction: before storage or only at display, and which fields
- [ ] AI write actions need a person's approval; admins can turn AI assistant access off

## Monitoring
- [ ] Audit log of sign-ins, role changes, exports, and integration changes, with retention and export
- [ ] Admin view of connected AI assistants and active API keys

## Assurance and Contracts
- [ ] SOC 2 Type II report (check the period end date) or ISO 27001 certificate (check the scope)
- [ ] Recent penetration test summary
- [ ] Subprocessor list with change-notice terms
- [ ] DPA, with standard contractual clauses for EU data
- [ ] Breach notification window in the contract

Judge vendors against your obligations, not their feature lists. If you sell B2B software, you likely process your customers' personal data under a DPA, and a feedback tool that reads their tickets and call transcripts becomes a subprocessor of that data.

GDPR Article 28 says a processor needs the controller's written approval to use subprocessors, and under a general approval it must give advance notice of new ones so customers can object (GDPR Art. 28). Many B2B DPAs turn that into a fixed notice period, so read yours before the pilot, not after.

Ask your legal or security lead three questions before you shortlist anyone:

1. Is this tool a subprocessor under our customer DPA, and how much notice do we owe customers?
2. Which certifications must our subprocessors hold: SOC 2 Type II, ISO 27001, or both?
3. Which regions must customer data stay in, and are any customers stricter than the default?

Set the bar by who your customers are, not by your headcount. The columns below are rules of thumb, not standards, and a 30-person startup selling to banks belongs in the right-hand one.

Don't let SSO pricing pick your tool. Plenty of vendors gate SAML behind a top plan, but for feedback data the controls that matter more are integration scopes and AI data flow, and those rarely appear on a pricing page.

Good SSO means SAML 2.0 with your identity provider, enforced so nobody falls back to a password. "Sign in with Google" counts only if Google Workspace is your identity provider and the vendor lets you enforce it. SCIM (RFC 7644) closes the other gap by removing accounts when people leave.

Check which plan includes each. Productboard puts SAML SSO, SCIM, and audit logs on Enterprise, with Google SSO and MFA on Business (Productboard pricing). Canny lists Okta, OIDC, Entra ID, and OneLogin SSO on Business (Canny pricing). Deck includes SAML/SSO on Business ($249 per month) and Enterprise.

Then run a 15-minute offboarding test during the trial. Provision a test user through your identity provider, have them create an API key and connect an AI assistant, then deprovision them and check what still works an hour later.

Most teams need fewer roles than they think, but tight control of a few risky actions. Admin and member are enough if only admins can connect integrations, create API keys, export data, turn on AI assistant access, and change privacy settings.

You need finer control when people outside product sign in and some accounts are sensitive, such as a sales team that shouldn't see a strategic customer's call transcripts. Row-level visibility is not standard in feedback tools, so ask about it first.

Then ask how tenant isolation is enforced. "Every query is scoped to your organization" is the baseline; a dedicated database per customer is stronger.

Grant the least access that still works. A breach at your feedback vendor becomes a breach of every system it holds a token for, up to the scopes you granted, so get the exact OAuth scopes per integration before you connect anything.

• Use read-only access. Connect support and CRM tools through a read-only service account where the tool allows it. Deck's PostHog setup, for example, asks for a personal API key limited to one project with read-only access (Deck PostHog docs).
• List the write paths. A tool that posts to Slack, updates CRM fields, or creates tickets can turn an AI mistake into something customers or colleagues see.
• Ask who holds the tokens. A good answer names a secrets manager or token vault and says tokens never reach the browser.
• Check revocation. Disconnecting an integration should revoke the token, not just hide it.

You need them once more than one team uses the tool or a customer contract asks for access records. A useful log covers sign-ins, role changes, exports, integration changes, API keys, and AI assistant connections. As a rule of thumb, it keeps records for at least 90 days (a year if a contract asks) and exports to your security tools.

No audit logs? Cover part of the gap with your identity provider's sign-in logs, an admin group of two or three people, and a quarterly access review. Write those controls into your review so the exception is a decision, not an accident.

A region picker is table stakes. The real answer is the exceptions list, the data that leaves your chosen region anyway, so ask for it in writing. Common exceptions in AI feedback tools:

• Model providers, which may process requests in the US
• Sign-in providers, which often run in one region
• Product analytics and error tracking
• AI chat history and workflow logs kept by hosting providers
• Connected AI assistants, which handle data under their own terms
• Backups and disaster recovery copies

Deck's answer, as an example: you choose North America (Oregon), Europe (London), or Australia (Sydney) at setup on every plan, and the choice covers the database, full interview recordings, and video snippets. The same privacy policy says AI processing may happen in the US, Clerk may process sign-in data in the US, and a connected AI assistant may process data outside your region.

"We don't train on your data" answers one of three questions. You also need to know how long each model provider keeps your data and where it processes it.

Provider defaults matter. OpenAI does not train on API data by default but keeps abuse monitoring logs for up to 30 days unless a customer is approved for Zero Data Retention (OpenAI). So ask each vendor which providers it uses, whether it has zero data retention with each, and where calls run. Then ask two more:

• Is redaction applied before storage or only at display? Display-only masking hides names on screen, but the raw data stays stored and can still reach a model.
• What can a connected AI assistant do? Through MCP, an assistant acts as the signed-in user. Look for an admin off switch, a choice of which roles can connect, read and write tools labeled separately, and a list of who has connected. For setup patterns, see how to connect customer feedback to Claude or ChatGPT.

Ask for the report, not the badge. A SOC 2 Type II report tests whether controls worked over a period of months, while a Type I checks their design on a single date (AICPA). If the period ended more than 12 months ago, ask for a bridge letter.

Read two parts closely. The exceptions section shows which controls failed testing, and the complementary user entity controls section lists what the vendor expects you to do, such as offboarding your own users. That list becomes your homework.

For ISO 27001, check that the certificate's scope covers the product you're buying. Then collect a recent penetration test summary, the subprocessor list, and a DPA with standard contractual clauses if you hold EU data.

Trust pages answer the easy questions; these expose the gaps. Paste them into your first email and compare how specific each vendor gets.

1. Which OAuth scopes does each integration request? Which systems can you write to?
2. Where are integration tokens stored, and what happens to them when we disconnect?
3. When we deprovision a user in our identity provider, which of their API keys, OAuth tokens, and AI assistant connections stop working, and how fast?
4. Which data leaves our chosen hosting region? List model providers, sign-in, analytics, AI chat history, logs, and backups.
5. Which model providers process our data? Do you have zero data retention with each? Where are calls processed?
6. Is PII redacted before storage, or only when it is displayed? Which fields?
7. What can an AI assistant connected to your product read and change, and can admins turn that off?
8. When we delete data or cancel, what is deleted, how fast, and does that include insights, summaries, embeddings, clips, and backups?
9. Can we see your latest SOC 2 Type II report or ISO 27001 certificate? If not, what is your timeline?
10. How do you notify us of new subprocessors, and how much notice do we get?

Three answers are red flags: a link back to the trust page, "AI data is handled by our provider" with no retention detail, and deletion terms that skip derived data. Each one hands the vendor's homework back to you.

This is what each vendor's public pages list. "Not listed" means we didn't find it on the cited page, not that the feature is missing.

Checked November 2, 2026, from Deck pricing, Enterpret, Productboard pricing, Productboard subprocessors, Productboard security, Dovetail pricing, and Canny pricing.

For research teams handling health data, note that Dovetail lists redaction, auto-deletion of original videos, and a paid HIPAA add-on on Enterprise (Dovetail pricing).

This example is illustrative, not real data. A 120-person B2B SaaS company earns about a third of its ARR from EU customers, and its DPA requires 30 days' notice of new subprocessors.

1. Obligations, 20 minutes. Legal confirms the tool would be a subprocessor. Must-haves: EU hosting, a DPA with SCCs, and enforced SAML SSO. SOC 2 Type II is preferred, but a pen test summary and a dated plan are acceptable for a one-year contract.
2. Public pages, 40 minutes. Vendor A hosts only in the US, so it's out.
3. Vendor questions, 30 minutes to send and review. Vendor B hosts in the EU but sends model calls to the US; legal accepts that under SCCs and adds it to the customer notice. Vendor C has no SOC 2 report but gives specific answers, a pen test summary, and a dated plan, so security accepts it with a six-month review.
4. Offboarding test, 30 minutes during the trial. Vendor C revokes API keys on deprovisioning. Vendor B doesn't, so the team records a manual offboarding step.

The move that saves the most time is sending the subprocessor notice on day one. The 30-day window then runs during the trial instead of after it.

Deck is strongest on sign-in, regional hosting, and database isolation, and has real gaps in SCIM, audit logs, and assurance reports. These facts come from Deck's security page, docs, and privacy policy.

Sources: Deck security, Deck pricing, security docs, privacy docs, MCP docs, and the privacy policy.

If your contracts require SOC 2 Type II, ISO certifications, or audit logs today, Deck won't pass yet; Enterpret lists those certifications. If you need regional hosting and a dedicated database without an enterprise contract, Deck is worth a look, and you can limit MCP server connections to Admins from day one. For a wider shortlist, see the best customer intelligence platforms for AI-first startups. When you're ready to try it, compare Deck's plans.