The failure this prevents is the demo. A demo shows a product working under conditions the vendor chose. Six weeks into diligence, a bidder's counsel asks whether the assistant could have surfaced the compensation schedule their team was fenced out of, and the answer turns out to be that the filter ran in the prompt. Nobody asked, because the demo was impressive and the question is awkward. The questions below are the awkward ones.
Three rules make the checklist work. Ask in writing. Get the answers that matter into the contract rather than an email from an account executive who may not be there in November. And treat “we can look into that” as a no, because on the day it matters, it will be.
Group one: AI and retrieval
The first question in this group does more work than the other twenty-one combined. If the permission filter runs anywhere other than the retrieval query, the model was handed text the participant should never have seen and was asked not to use it. That is a hope. It is not a control, and it fails in the direction of disclosure.
| Criterion | What a good answer sounds like | Sifrsys |
|---|---|---|
| Where does the AI permission filter run?The single highest-signal question on this page. | Inside the retrieval query, as a clause the database enforces. Anything applied after retrieval means the model already received text the participant should never have seen. | In the query. Retrieval filters on tenant and a per-participant document access check inside the SQL WHERE clause, not after retrieval and not as a prompt instruction. The exclusion is structural: CI reads the deployed function out of pg_proc.prosrc and fails if either predicate is missing, and a denial suite counts only SQLSTATE 42501 as a pass. |
| Can the AI answer from a document I cannot open?A yes means your permission model has a second, invisible copy. | No, under every configuration, and they can show you the code path or the test. | No. The retrieval filter requires view permission or higher, so a name-only document is excluded from answers as well as from the viewer. A separate per-document switch can also remove a viewable document from AI scope. |
| Does every answer carry a citation that opens the source?An uncited answer cannot be checked, and an unchecked answer is a rumour. | Yes, to a page or a cell range, and clicking it opens the document at that location. | Yes. Absolute 1-based sheet rows plus column ranges, rendered as Q3_Model.xlsx · Revenue!B14:F34. Tapping a citation opens the workbook at that sheet and washes those cells. |
| Is AI a paid add-on, and on which tier?Price the tier that has the feature, not the tier in the brochure. | A straight answer, with the tier named and its price published. | Included in every paid tier, never an add-on. |
| What happens to my documents and chat history at the model provider?Ask for retention and training terms in the contract, not in an email. | Named subprocessors, named retention terms, and a contractual position you can point a security reviewer at. | Chat is persisted in your room, so plan what goes into it. Our subprocessor list and current AI data-handling position are published in the Trust Center, though that page carries no revision date yet. Get the terms into the contract rather than taking any vendor's page as the commitment. |
Group two: documents, watermarks and capture
Two of these are designed to be uncomfortable. Where the watermark is generated decides whether a leaked page names anybody. Whether the vendor claims to block screenshots decides whether you can trust the rest of their answers, since the honest answer is no and there is no browser in which it is anything else.
| Criterion | What a good answer sounds like | Sifrsys |
|---|---|---|
| Are watermarks burned into the pixels or drawn in the browser?The second uncomfortable question. Test it yourself with developer tools open. | Burned server-side before encoding, and they will let you try to strip it during the trial. | Burned server-side into the page image before encoding, tiled, carrying name, email, IP and timestamp. Delete every overlay element in DevTools and the identity stays in the pixels. Worst of 64 sampled 25% crops kept 11.7% watermark ink with all four fields legible. Survives JPEG quality 50 and a 50% downscale. Two participants viewing the same page receive different bytes. |
| What happens if the watermark cannot be generated?Failing open here produces an untraceable copy, silently. | The request fails and the page is not served. A degraded mode that serves a clean page is a defect, not a fallback. | Fails closed. The worker raises rather than writing clean pages for a room that requires a mark. |
| Can you block screenshots?This answer tells you whether the vendor is being straight with you. | No, not in a browser. Any other answer means a native application you must install, or a claim that will not survive a test. | No, and nobody can. We would rather lose this row than win it dishonestly. |
| Do you offer fence view?Establish which control they mean: the striped overlay, or a metadata-only permission level. | A screen share showing the control running, rather than the phrase. | Not the striped overlay. We use the word for a permission level at which a participant sees a file name and nothing else. If your policy names fence view specifically, we do not have it. |
| Are view, download and print separate permissions?A control on reading is decoration if the same person can keep the file. | Yes, configurable independently, and inherited predictably from folder to document. | Yes. Five levels resolved most-specific-first, with download and print as separate switches from the view level. |
| Will you render my actual files, not your demo set?Every viewer looks perfect on a file the vendor chose. | Yes, during the trial, on your worst workbook. | Yes. Fidelity is measured against LibreOffice ground truth in real Chromium across four producer dialects: display strings, font styles, alignment, merged cells and KSA number formats at 100%, fills at 99.7% on the 4 August 2026 run against a committed 99.3% floor that fails the build on regression. But there are no charts and no pivot tables yet, and legacy .xls loses conditional formatting beyond simple cell rules. |
Group three: audit and evidence
This group is the one you will care about long after the deal closes, and the one nobody tests during an evaluation because it produces nothing visible on day one. Run it anyway. The properties behind these five questions are covered in more detail in what a defensible audit trail records.
| Criterion | What a good answer sounds like | Sifrsys |
|---|---|---|
| Are viewed and downloaded distinct events?A view ends when you revoke access. A download does not. | Yes, as separate event types, visible in the interface without a support request. | Yes, plus print and metadata access as their own events. |
| What is logged when the browser cannot render a file and the original is handed over?Every product has this path. It is the one least likely to be logged correctly. | Its own event, distinct from a view, recording the link and how long it stays live. | Its own event, recording the expiry window of the signed link and whether a watermark was required. It used to be recorded as a view, which meant a silent handover looked like someone glancing at page one. That was a defect and we fixed it. |
| Can an administrator delete or edit a log entry?If yes, the log is a report, not evidence. | No, and they will let you try during the trial. | No. A trigger on update or delete raises an exception, so no application path edits a row in place. |
| Is the log tamper-evident, and is that evidence independent of you?Prevention is a policy. Detection is a property. Independence is a third thing again. | Hash-chained at minimum. Anchored outside the vendor's own infrastructure if your dispute needs evidence independent of them. | Hash-chained with SHA-256 per organisation, so removing a row stops every later hash reconciling. Not anchored anywhere outside our database, so it proves internal consistency and is not third-party notarisation. |
| Can I export the trail, with hashes, during the trial?A log you cannot export is a log you lose when the subscription ends. | Yes, as CSV or JSON, without a support ticket. | Yes, as CSV or JSON, capped at 10,000 rows per export and limited to an owner or admin. Test it on the trial rather than taking this row on trust, here or anywhere else. |
Group four: the company behind the product
Product questions are answerable in a trial. These are not, and they are the ones that decide whether a security reviewer signs off.
| Criterion | What a good answer sounds like | Sifrsys |
|---|---|---|
| Do you hold SOC 2, or any certification?Readiness is not certification. Ask which one they are describing. | A yes with a report you can request under NDA, or a no. Not a sentence containing the word journey. | No. No SOC 2 of any type, no ISO 27001, no certification, and no signed audit engagement. If your counterparty's security review requires certification from the host, we fail that requirement today. |
| Do you publish a statement of what you have and have not certified?A vendor that publishes its gaps is easier to verify than one that publishes only strengths. | A public page listing subprocessors and what is not in place, carrying a revision date. | Yes, in the Trust Center, including the items marked as not yet in place. It carries no revision date yet, which is a gap on our side. |
| Who owns you?Ownership decides whose infrastructure your documents sit on, and who your vendor competes with. | A straight answer including parent companies and investors with control. | Independent. Not a subsidiary of Datasite, unlike Firmex and Ansarada, based on publicly available information. |
| Can I see your pricing without a call?Unpublished pricing is not automatically worse. It is automatically slower. | A published number for the plan you would buy, and a named billable unit for anything metered. | Yes. Free, Teams at $399 a month and Pro at $999 a month are published, with no per-page fee and no charge per extra seat, though each plan includes a set number of seats. Enterprise is a custom quote, which is one row where we stop publishing a number too. |
| Do you publish an uptime figure or offer a contractual SLA?Ask before signature. Nobody negotiates this well in week six. | A published figure, or an honest no with a willingness to discuss terms. | We publish neither. If you need a contractual uptime commitment, raise it before you sign. |
| Can you give me reference customers?For an early vendor the honest answer costs them the row. Take the honest answer. | Named references, or a clear no. | We publish no customer names, counts or testimonials. We would rather you ran the product on your own documents during the 14-day trial than took a logo wall on trust. |
How to weight the answers
Not all twenty-two carry the same load. Two of them are close to dispositive, because both have a right answer that costs real engineering and a wrong answer that is invisible in a demo: where the AI filter runs, and where the watermark is generated. A vendor who gets both right has built for the failure case. A vendor who gets either wrong has built for the demo, and the rest of their answers should be read in that light.
Weight the honest no above the confident yes. A vendor who tells you they cannot block screenshots is telling you something true about a hard problem, and that is better evidence of how they will behave in an incident than any row they pass. On the specific controls above, the reasoning behind fence view and its limits is worth reading before you score group two, and how metered pricing behaves in diligence matters before you score group four. Our plans, the price-lock terms and the trial are on the pricing page.