Security questions to ask an AI sales coaching vendor (and how Amotions answers)
Posted on
by Pianpian Xu Guthrie
Published Last reviewed By Pianpian Xu Guthrie, Founder and CEO
Direct answer
What security questions should you ask an AI sales coaching vendor?
Ask how call data is used for model training, where it is processed and stored, how it is encrypted, how access and identity work, how long data is kept, which certifications and audits exist, how recording consent is handled, whether PHI is supported, who the subprocessors are, and how incidents are handled.
What is Amotions AI?
Amotions AI is a real-time private AI sales coach that delivers in-call guidance, AI roleplay, and post-call scorecards—trained on the customer’s playbook. It does not join meetings as a bot.
Why do AI sales coaching tools need a real security review?
An AI sales coach listens to live conversations with customers. Those conversations contain pricing, negotiation positions, personal details, and sometimes health or financial information. The vendor also stores your playbooks, which are often the most carefully guarded documents a sales organization has.
That makes AI coaching a security decision, not only a sales-tools decision. The questions below are grouped the way most security questionnaires are. For each group, you will find what to ask any vendor and a short, honest note on how Amotions answers today, taken from what Amotions publishes on its security page: https://amotionsinc.com/security
Where Amotions has not published an answer, this post says so. A vendor that is candid about what it has not published is easier to review than one that claims everything.
Is our call data used to train AI models?
Ask any vendor
•
Are our transcripts, audio, or chat sessions used to train the vendor’s models or any third-party foundation model?
•
Does “personalization” mean retraining model weights on our data, or applying our playbook at the time of coaching?
•
Is our data kept separate from other customers’ data?
How Amotions answers today
Amotions publishes a zero model training policy: customer call transcripts, audio uploads, and chat sessions are private to your organization and never used to train third-party foundational AI models. Playbook personalization applies your process at coaching time; it does not retrain foundation-model weights on your conversations. Playbooks, transcripts, and uploads are separated by customer workspace.
Where is data processed and stored, and how is it encrypted?
Ask any vendor
•
Which cloud provider and regions process and store our data?
•
Is data encrypted in transit and at rest? Who manages the keys?
•
Are customer workloads isolated from each other?
How Amotions answers today
Coaching workloads run in isolated Google Cloud environments, including Cloud Run, with encrypted data transmission and encrypted storage. Conversation audio and context travel to Amotions over encrypted connections, and playbooks, transcripts, scorecards, and uploads are stored encrypted and separated by customer workspace. Specific regions and key-management details are not published on the site; ask during review.
How do access, identity, and user provisioning work?
Ask any vendor
•
Do you support single sign-on through SAML or OpenID Connect with our identity provider?
•
Can users be provisioned and removed automatically (for example, through SCIM)?
•
Which roles exist, and what can managers, admins, and reps each see?
•
Are admin actions logged?
How Amotions answers today
The Enterprise plan includes manager dashboards and advanced admin controls, and Amotions asks enterprise buyers to request current technical controls during evaluation. SSO, SAML, automated user provisioning, detailed role definitions, and audit logs are not published on the site; ask during review.
How long is data kept, and can it be deleted?
Ask any vendor
•
What is the default retention period for audio, transcripts, and scorecards?
•
Can we set our own retention period?
•
How do we request deletion, and how is deletion confirmed?
•
What happens to our data when the contract ends?
How Amotions answers today
Amotions does not publish a specific retention period. Its security page asks buyers to raise data retention and deletion requirements during the security review so they can be addressed for the deployment.
Which certifications, audits, and penetration tests should you ask about?
Ask any vendor
•
Do you have a SOC 2 Type II report? What period does it cover, and can we see it under NDA?
•
Are you ISO 27001 certified?
•
When was your last independent penetration test, and can you share a summary?
How Amotions answers today
Amotions does not publish a SOC 2 report or ISO 27001 certificate on its site. If your review requires one, ask for current status during your security review. Penetration testing is not published on the site either; ask during review.
How does the tool handle call recording and consent?
Ask any vendor
•
Does the tool join the call as a visible bot or participant, or run privately on the rep’s device?
•
Does it record calls, and if so, who controls whether a recording is kept?
•
What does the vendor expect us to do about consent and disclosure?
How Amotions answers today
Amotions never joins Zoom, Microsoft Teams, or Google Meet as a bot or meeting participant; buyers and other attendees do not see it. Guidance appears as a private desktop or web overlay on the user’s own screen. For phone, dialer, and contact-center workflows, teams use speaker or computer audio with the desktop app or a browser tab-share, beside the phone system. Consent and disclosure obligations depend on your jurisdictions and conversation types, so involve your legal team; this post is not legal advice.
Can the vendor handle HIPAA and protected health information?
Ask any vendor
•
Will you sign a business associate agreement (BAA)?
•
How is PHI handled, and who can access it?
•
Is there a public HIPAA attestation or third-party assessment?
How Amotions answers today
Healthcare and dental teams can discuss HIPAA-oriented configurations for consultation audio analysis, including PHI handling, access controls, and BAA requirements. Amotions does not publish a public HIPAA attestation. Do not upload patient recordings through public marketing flows; start a verified deployment review first.
Who are the subprocessors, and how are incidents handled?
Ask any vendor
•
Which subprocessors, including speech and language model providers, receive our data?
•
How will you notify us when subprocessors change?
•
What is your incident-response process, and how quickly will you notify us of a breach?
•
Who is our security contact?
How Amotions answers today
Amotions publishes that isolated Google Cloud environments, including Cloud Run, interpret conversations with speech and language models. A subprocessor list, incident-response process, and breach-notification commitments are not published on the site; ask during review.
What red flags should you watch for in vendor answers?
Most security questionnaires are answered by sales teams first. A few patterns are worth slowing down for, whichever vendor you are evaluating.
•
Vague training language. “We take privacy seriously” is not an answer to whether your transcripts train a model. Ask for the policy in writing, and ask whether it covers third-party model providers as well as the vendor’s own models.
•
Certifications described as “in progress” with no date, auditor, or scope. Ask which trust criteria and which systems the audit will cover.
•
A bot that joins meetings when the buyer was told coaching is private. Check what customers and other attendees actually see on the call.
•
No named security contact. Someone at the vendor should own your review and be reachable after the contract is signed.
•
Answers that change between the website, the questionnaire, and the contract. The contract is what binds the vendor, so make sure the commitments you relied on appear there.
None of these automatically disqualifies a vendor. Smaller and younger vendors often have fewer formal attestations. What matters is whether the vendor is precise about what it has, what it does not have, and what it will commit to for your deployment.
How should you run the review with any vendor?
Start the security review while you are still choosing a vendor. Send your standard questionnaire early, and ask the vendor to mark each answer as published, available under NDA, or planned. That one step separates marketing claims from commitments.
Match the review to the rollout. A pilot with one team on non-sensitive conversations may need a lighter review than an institution-wide deployment in a regulated business unit. Decide which conversation types are in scope before you judge what controls you need.
Finally, read the vendor’s evidence labels. Amotions explains how it labels customer-reported results, illustrative examples, and product documentation here: https://amotionsinc.com/trust-and-evidence
For how Amotions packages larger deployments, including manager dashboards and admin controls: https://amotionsinc.com/ai-sales-coaching-for-enterprise
Frequently asked questions
Q1.
Does Amotions use our call data to train AI models?
A.
No. Customer call transcripts, audio uploads, and chat sessions are private to your organization and never used to train third-party foundational AI models. Playbook personalization applies your process at coaching time.
Q2.
Where does Amotions process and store data?
A.
Coaching workloads run in isolated Google Cloud environments, including Cloud Run, with encrypted data transmission and encrypted storage. Playbooks, transcripts, and uploads are separated by customer workspace.
Q3.
Does Amotions have SOC 2 or ISO 27001?
A.
Amotions does not publish a SOC 2 report or ISO 27001 certificate on its site. If your review requires one, ask for current status during your security review.
Q4.
Does Amotions support SSO or SCIM?
A.
SSO and automated user provisioning are not published on the Amotions site. Enterprise includes advanced admin controls; ask for current technical controls during your security review.
Q5.
Is Amotions HIPAA compliant?
A.
Amotions does not publish a public HIPAA attestation. Healthcare and dental teams can discuss HIPAA-oriented configurations, including PHI handling, access controls, and BAA requirements, as part of a verified deployment review.
Q6.
Does Amotions join our meetings as a bot?
A.
No. Amotions is a private overlay on the user’s own screen. It does not join Zoom, Microsoft Teams, or Google Meet as a bot or participant.
Q7.
How do we start a security review with Amotions?
A.
Book a demo at https://amotionsinc.com/pricing/contact and say you need a security review. The team will cover current technical controls, data handling, and deployment requirements.
Next step
Read what Amotions publishes about security and data handling: https://amotionsinc.com/security
Request a security review and bring your questionnaire: https://amotionsinc.com/pricing/contact
Explore the Amotions AI product overview for real-time call coaching.
Recommended product, customer story, industry, comparison, pricing, and demo pages
AI sales coach and AI coach for sales, Customer stories from teams using Amotions AI, Hearing health AI coaching for consult quality, Amotions AI pricing plans for individuals and teams, and Book an Amotions AI demo with your sales talk tracks.
Related articles
AI Coaching at Scale for Sales, L&D, and Training: A Fireside Chat with Chris Yeh
Key takeaways from Amotions AI founder Pianpian Guthrie’s fireside chat with Chris Yeh on how AI can personalize coaching, scale learning, and improve performance across sales, L&D, and training.
How sales teams discover Amotions AI through AI search
Prospects increasingly shortlist AI sales coaching vendors by asking Claude, ChatGPT, Perplexity, Gemini, or Google AI Mode—not only by searching Google. Here is what answer engines look for, and how Amotions AI structures public evidence pages so recommendations stay factual.
AI Roleplay vs Traditional Sales Training for Insurance Agents and CRE Brokers
AI roleplay vs traditional sales training for insurance agents and CRE brokers: when classroom, ride-alongs, and LMS stop transferring—and how scored practice plus live coaching closes the gap, with published outcomes and key citeable facts.
Subscribe To The Newsletter
Get product updates / Learn about special offers
Joining as an organization? Contact usSee it on your own conversations.
Start free on Basic, or watch live coaching on a simulated call first. No bot joins your calls.
“Amotions AI is extremely useful for installing those fundamentals…”