Before you buy an AI SDR, ask the vendor twelve things in writing: where the prospect data comes from, where it and the AI processing live, who owns the sending mailbox, how opt-outs work, what security controls are in place, and what happens to your data when you leave. The answers separate vendors who can pass EU procurement from those who cannot.
We sell an AI SDR, so each question below is answered for lemonreach as well. This is a buyer’s checklist, not legal advice. Have your own counsel read the contract.
Where does the data come from?
1. Where does the prospect data come from?
Ask for the source in plain terms: a licensed third-party provider, scraped sources, your own uploads, or a mix. A vendor that cannot describe its sources cannot describe its lawful basis either.
lemonreach: contact data comes from a single provider, then runs through a multi-layer validation workflow before it enters a sequence. Verified work emails reach 98% accuracy. Personalization comes from each person’s public LinkedIn activity and recent news at the time a campaign runs.
2. How is each email or phone number verified?
Ask what checks run, how many layers, and what accuracy the vendor claims and measures. Unverified addresses bounce and damage your domain.
lemonreach: every contact passes the validation workflow before it can be used, and verification is a priced action (2 credits per work email, 4 per direct phone number), so you see what it costs.
Where is it stored and processed?
3. Where is my data stored?
Ask for the cloud provider and the region, not just “EU”.
lemonreach: it runs on Amazon Web Services in the EU. The primary infrastructure, including the database and file storage, is in the AWS Frankfurt region.
4. Where does the AI processing happen?
A vendor can host in the EU and still send text to a model endpoint elsewhere. Ask where inference runs and whether your data is used to train models.
lemonreach: AI processing runs in AWS regions within the EU, and your data is not used to train AI models.
5. Does data ever leave the EU?
Ask for the list of countries and the legal basis for each.
lemonreach: prospect data is processed only in the EU or in countries the EU formally recognises as adequate (for example Canada), and never in jurisdictions without that recognition.
6. Who are the sub-processors, and will I be told about changes?
Ask for the list and the notice period for additions.
lemonreach: sub-processors are listed in Annex 2 of the Data Processing Agreement, each is bound by a written data processing agreement, and notice is given before one is added or replaced.
Who controls sending?
7. Whose mailbox does it send from?
Shared sending domains pool reputation across customers. Sending from your own mailbox keeps the reputation, and the replies, with you.
lemonreach: it sends from the inbox you connect. Replies land in your mailbox, and AI tags each reply so you can see which ones need you.
8. Do I see what goes out, and who answers replies?
Ask whether you can preview each message before it sends, and whether the AI replies to prospects on its own. Both are valid designs, but you should choose knowingly.
lemonreach: every AI-written email can be previewed before it sends, and replies are tagged and handed to a person rather than answered automatically. Compare this with a fully hands-off approach in lemonreach vs AiSDR.
9. How do opt-outs and suppression work?
Ask how an unsubscribe is recorded, whether it applies across campaigns, and who is responsible for honouring it.
lemonreach: the Terms require customers to honour opt-out requests promptly and to maintain suppression lists. Ask us for the exact in-product behaviour for your setup before you sign, as you should any vendor.
What security controls are in place?
10. What security controls do you document, and can I read the full policy?
Ask for the written policy and read it. Look for encryption, access control, logging and incident handling.
lemonreach: the security page describes EU hosting, encryption in transit and at rest, application-level encryption (AES-256-GCM) of connected-tool credentials, role-based access, and logged support access. The full information security policy is available on request at [email protected].
11. Is there a standalone DPA, and what does it say about breaches?
A GDPR Article 28 agreement should exist as a document you can read before the sales call, not after it.
lemonreach: yes, at /dpa. It covers a 48-hour breach notification commitment (Section 9) and retention and deletion (Section 11).
12. What happens to my data when I leave?
Ask for the deletion timeline and what is kept.
lemonreach: campaigns are deleted automatically at the end of your plan’s campaign storage period, and customer data is deleted within 90 days of termination.
How should you use the list?
Send the twelve questions to every vendor on your shortlist and ask for written answers. Score each one as answered, partly answered, or avoided. Then run a small pilot on your own list of 50 to 100 contacts and read every message. For the product side of the decision, read What is an AI SDR?.