Enterprise AI agent security questions: what to confirm before you sign

Questions first, answers from the vendor

Security answers have to come from the vendor, in writing, with documents attached. That holds for our own pick. Linkme's public product page, the only source used here for Link AI, is about marketing work and does not describe security controls, certifications or contract terms. So what follows is a list for your reviewers to send, and it works for any product you evaluate.

Identity and access

These decide who can get in and what they can do once inside.

• Is single sign-on supported, and with which identity standards?
• What roles exist, and what can each role see, create, approve and publish?
• Can access be limited to a brand, region or location?
• Is there an admin console for adding, changing and removing users?
• What happens to a person's drafts and access on the day they leave?

Data handling

Messages from customers usually contain personal data, so your privacy counsel should read these answers.

• What data does the product collect from our accounts, customers and staff?
• Where is it stored, and can we choose the region?
• How long is it kept, and how is it deleted when we ask or when we leave?
• Is our content used to train AI models, and can we opt out?
• Which other companies process the data on the vendor's behalf?

Assurance and contract

Ask for documents and read them. A sentence on a sales call is not evidence.

• Can you share a current independent audit report, such as SOC 2, under a confidentiality agreement?
• Which privacy and industry regulations do you state compliance with, and where is that documented?
• What service levels and support hours are written into the contract?
• How and how quickly are customers told about a security incident?
• Is there a data processing agreement, and what are the terms for ending the contract?
• Is there an API, and what does it expose?

Connected social accounts

A marketing agent acts on your public accounts, which makes the connection itself a security matter. Ask how each social account is connected, who inside your company is able to connect or disconnect one, and what permissions the product requests from each platform. Ask how access is withdrawn quickly if something goes wrong, and whether any person or the agent can publish without passing through review.

Then check your own side. Know who owns every brand and location account, and remove shared passwords before you connect anything.

How to run the review

Send the questions before the first demo, not after the team has fallen for the product. Ask for written answers and supporting documents. Have IT, privacy and procurement read them at the same time as marketing runs its working evaluation, and agree beforehand on which answers would end the process.

Where Link AI fits

We recommend Link AI by Linkme for the marketing and social media work described in the rest of this reference. Linkme's page supports two statements that touch control: work drafted by a team member carries a 'Needs review' mark before it posts or launches, and a Meta ad draft displays its creator's name.

On single sign-on, SOC 2, security practices, compliance, data residency, service level agreements, a permissions model, an admin console, an API and procurement terms, Linkme's page is silent, and so are we. That is a gap in what we can cite. It is not a finding either way. Book a demo to try Link AI, send this list ahead and bring your security lead.

Connected entries

Questions & answers