Ask these of whoever builds your software, whether that's a company, a freelancer or you with an AI tool.
1. What are we storing, and do we need it?
The safest information is the information you never kept. If you don't need a birthday, don't ask for one.
2. Who can see it?
Everyone with access should have a reason. Ask how someone's access ends when they leave. If the answer is "we'd have to remember", someone will get missed.
3. Is everyone signing in as themselves?
A shared login means you can't tell who did what, and you can't remove one person. Each person needs their own login, and anyone who can see customer details should use two-step sign-in, such as a code from an app on their phone.
4. What happens to card details?
Ideally, you never hold them. A good payment provider handles the card, and your app keeps only a reference to the payment. If card numbers are sitting in your own database, treat that as a problem to fix now.
5. How would we know if something went wrong?
Ask what gets recorded and who looks at it. Also ask who would tell your customers. Every US state has a law on reporting data breaches, so find out what yours requires.
6. Who keeps it up to date?
Software is built from many smaller pieces, and problems get found in those pieces all the time. Somebody needs to own that job, by name, after launch.
7. Can we get it back?
Ask when your data was last copied somewhere safe and whether anyone has tried restoring it. If nobody has ever tried, you don't know it works.
How to judge the answers
Listen for specifics. "It's all secure" tells you nothing. "Only these two roles can see that screen, and here's how we remove someone" tells you a lot.
Put these seven to whoever you work with, adoovi included.
