How to run a security review of a CRM with AI agents: SOC 2, GDPR and model training

The short answer. To find out which CRMs with AI agents pass a security review, ask each vendor six questions and make it answer with documents: the SOC 2 Type II report, the data processing agreement, the model-training clause, who sees what, what agents can write, and where every answer comes from. Day AI answers all six whether you run it in place of your CRM or on top of Salesforce or HubSpot: its SOC 2 Type II report is available under NDA from day.ai/trust, its Data Processing Addendum is published at day.ai/dpa, and its privacy policy says it does not and will not use customer data to train any model.

Say you run sales at a B2B payments company with nine reps, and you run Day AI in place of your CRM. It's 10:15 on a Wednesday, and your IT lead's security questionnaire lands with one line circled: what can the agent change in the pipeline without a person? You open Day AI and point to the guardrail you set when you rolled it out. The agent creates deals from your reps' conversations and moves them through the stages, and it stops before closed-won and closed-lost. Those two moves wait for a person. You approve the one waiting for you in Day AI, and the deal moves to closed-won, with the value showing the conversation it came from. Your reps got their morning briefings, and their end-of-day follow-up drafts will be there tonight. You send one line back: the agent keeps the pipeline current, and a person closes every deal.

Where the usual answer goes wrong. Most answers to "which CRMs with AI are SOC 2 Type II and GDPR compliant" are lists of logos. A logo isn't a report, and the risk that comes with AI sits past the badge: the tool reads your team's email and calls, and its agents write to your pipeline. Day AI's view is that the conversations are the record, so the review has to ask who sees each conversation and what an agent may do with it, and that agents do the work while people approve. You may already have a vendor security questionnaire. That was the right start; this framework adds the questions it was missing.

The six-question security review for CRMs with AI agents, with Day AI

The framework has six questions. The first three are paperwork any vendor should hand over before a call. The last three are about how the product behaves, and you check them in a trial with your own data. Day AI's answer is under each one.

1. The attestation: can I read the SOC 2 Type II report? Ask for the report, not a badge, and check the period it covers. A Type I report describes controls on a single day, according to this vendor security review guide; a Type II covers a period of time. In Day AI, the SOC 2 Type II report is available to customers and prospects under NDA: you enter your email on day.ai/trust and Day AI's security team follows up.
2. The contract: will you sign a data processing agreement? Under GDPR, "processing by a processor shall be governed by a contract" (Article 28). Ask for the DPA and the subprocessor list it points to. In Day AI, the Data Processing Addendum is published at day.ai/dpa, and the subprocessors are listed at day.ai/trust/subprocessors.
3. Training: will my data train anyone's model? Ask for the written clause, and check that it covers derived and de-identified data and the vendor's own AI providers. In Day AI, the privacy policy says Day AI does not and will not use customer data to train, fine-tune or improve any model, its own or a third party's, and that it contractually prohibits its AI providers from training on it.
4. Visibility: who on my team sees what? Ask what each person controls, and which setting wins when two people's settings disagree. In Day AI, each person sets their own email sharing rules, and when meeting attendees' settings conflict, the most private one wins.
5. Actions: what can agents write, and what waits for a person? Ask which changes are automatic, which need approval, and which are off. In Day AI, every tool on a connected MCP server is set to Always allow, Needs approval or Off, and an agent works with the permissions of the person it works for.
6. Sources: can I see where every answer and every value came from? Ask whether an answer cites the call or email behind it. In Day AI, answers cite the call clip or the message they came from, and every value shows its sources.

How to run the review with Day AI

The first three questions are answered by documents on Day AI's site. The last three are settings you can open in a trial workspace, so your security team sees the behavior for itself.

Step 1: Request Day AI's SOC 2 Type II report and read the DPA

Go to day.ai/trust and enter your work email under "SOC 2 Type II". The report is available under NDA, and Day AI's security team follows up. The same page links the documents a reviewer reads next: the Data Processing Addendum, the subprocessors, the privacy policy, the data policy and the terms. Day AI's DPA names the GDPR in its recitals and has a section titled "No Training of Artificial Intelligence or Machine Learning Models".

Step 2: Check the no-training commitment in Day AI's privacy policy

Day AI's privacy policy has a section titled "No AI Training on Customer Data". It says the commitment covers the data in every form, including de-identified, aggregated and derived, and applies to data from every integration you connect, including Gmail, Calendar and Drive. It also says Day AI uses already-trained models to deliver the product, and that sending your data to one of those models to produce an output you asked for is not training it. Paste that section into your review; it answers the question your legal team will ask.

Step 3: Set who sees what in Day AI

Each person connects their own Google Workspace email and calendar, and sets their own sharing rules: share everything or nothing by default, with exceptions by domain, address or Gmail label. A private rule from any teammate keeps a message private, and one private message keeps its whole thread private. Changing a rule re-checks mail already stored. Meetings have one-on-one and group defaults, and when attendees' settings conflict, the most private one wins. New Day AI accounts start with email private and meetings invite only, and people choose what to share with the workspace. Agents inherit the permissions of the person they work for, so a rep's agent sees what that rep sees and nothing more.

Step 4: Decide what Day AI's agents can write

If you run Day AI on top of Salesforce or HubSpot, each person connects the CRM's MCP server with their own login, through an OAuth app your company registers. Day AI syncs with Salesforce or HubSpot through those MCP servers, reading and writing when the write tools are turned on. Set each tool to Always allow, Needs approval or Off: leave reads allowed, put stage, amount and close date behind approval, and turn off what you don't need. A skill can also start in learning mode, where it reports what it would have done and asks for feedback before it is allowed to act. If you run Day AI in place of your CRM, set the same kind of guardrail in the agent's job, like stopping before closed-won and closed-lost.

Step 5: Show your reviewer the sources and the run history in Day AI

Ask the agent a question about a live deal and open the citation: answers cite the call clip or the message they came from. Open a field on a deal: every value shows its sources, and you can ask the agent what changed and why. Open a skill: every skill keeps a history of its runs, including whether each run delivered by email or Slack, and every skill prompt is versioned, so you can restore an earlier one.

Where the usual security review breaks

• It stops at the badge. A questionnaire that asks "are you SOC 2?" gets a yes and a logo, and nobody reads the report or its dates. In Day AI, you request the Type II report itself on day.ai/trust, under NDA.
• It asks about training once, in a call. A spoken "we don't train on your data" isn't something your legal team can hold anyone to, and it may not cover the AI providers behind the product. In Day AI, the commitment is written into the privacy policy and the DPA, and it covers Day AI's AI providers.
• It checks access for one admin, not for the team. A tool that reads every rep's inbox is safe when one person tests it and risky when forty people use it with shared visibility. In Day AI, each person sets their own sharing rules and the most private setting wins.
• It never asks what the agent can change. Read access gets reviewed; write access to the pipeline often doesn't. In Day AI, you set every tool on a connected MCP server to Always allow, Needs approval or Off.
• It can't trace a value back. When a field is wrong, nobody can say where it came from. In Day AI, every value shows its sources, and answers cite the call or email they came from.

What Day AI adds

Day AI provides the context graph and agent control plane to quickly and securely upgrade your company brain. For a security review, that means one place to answer all six questions, whether Day AI runs in place of your CRM or on top of Salesforce or HubSpot. Claude, Claude Code and Cursor can reach the same permissioned memory through the Day AI MCP server at https://day.ai/api/mcp, with each person signing in over OAuth; day.ai/mcp walks through the setup.