Every vendor now says its AI is "secure" and "enterprise-grade". Firms bound by confidentiality need more than adjectives. These are the ten warning signs we'd look for, whoever you buy from, including us.
1. "We Don't Train on Your Data"… but Only Verbally
If the no-training promise isn't in the contract or the published terms, and doesn't cover every model provider the tool uses, it isn't a promise. Ask which providers sit behind the product and get each one's terms in writing.
2. Compliance Badges Without Paperwork
"HIPAA compliant" and "SOC 2" are claims you can check. Ask for the SOC 2 report under NDA, the date of the audit and its scope. Ask whether they'll sign a Business Associate Agreement. A vendor who can't answer is telling you something.
3. Answers with No Sources
If you can't click from an answer to the document, page or ledger entry it came from, every answer has to be checked from scratch. That's slower than doing the work yourself, and riskier.
4. It Acts on Its Own
Tools that email clients, post entries or submit forms without a human approving them move liability onto you. Look for drafts that wait for approval, and a clear "needs review" state.
5. One Login for the Whole Firm
Shared accounts mean shared access: everyone sees every client. Per-person connections keep one partner's inbox from becoming the firm's inbox, and make audit trails meaningful.
6. "Just Upload Your Files"
Bulk uploads copy client data into yet another place. Connections through each app's own sign-in (OAuth) read data where it lives, with access you can revoke.
7. Passwords Requested
No modern tool should ask for your QuickBooks, Google or Microsoft password. If it does, stop there.
8. No Clear Exit
Ask what happens when you leave: are tokens revoked, is data deleted, and on what timeline? "We'll handle it" is not an answer.
9. Pricing You Can't Predict
Usage-based AI pricing is normal, but you should be able to see your usage and know what happens at the limit, especially before busy season.
10. It's Built for Everyone
General tools are great for general work. For tax prep, matter summaries or prior auths, look for workflows that understand your documents, your systems and your review process.
Turn This into a Checklist
We've expanded these into 25 questions, with what a good answer sounds like, in the free AI Vendor Due-Diligence Checklist. And for the record, here is how MetaWurks answers them, including what we don't claim yet.