Your payment processor, CRM, and AI tools all process something valuable. “They seem big” is not a control.
Lightweight diligence
- Read where data is stored and whether it’s used to train models
- Check MFA/SSO support
- Ask how access is revoked and how breaches are disclosed
- Prefer vendors who let you export and delete data
Contracts and reality
You may not renegotiate AWS, but for smaller tools you can ask for a DPA, clarify subprocessors, and limit data shared to what’s necessary.
Ongoing hygiene
Keep a vendor list. When you stop using a tool, delete the tenant—not just the bookmark.