Who can access the information?
Ask how user roles are defined, who can export records, how administrator access is granted and how access is removed. Discuss authentication, account recovery, service-team access and the records available when an administrative action needs investigation.
Where does the information go?
Confirm hosting locations and the service providers involved. For each integration, identify what is shared and why. Ask how information is protected in transit and at rest, who can access relevant keys and which functions can read the content. Transport encryption and end-to-end encryption describe different arrangements; ask for the arrangement that applies to your use case.
What can you verify?
Request the current evidence relevant to your service, including the scope and date of any assessment or certification offered. Ask what audit events are retained, who can review them and how missing or delayed events are handled. A product feature label is not evidence of a regulatory approval or a complete control environment.
What happens when something changes?
Agree incident contacts, retention and deletion arrangements, exports on exit and recovery responsibilities. For recovery requirements, define the acceptable loss of recent work and the acceptable interruption, then ask what the proposed service can commit to. Record unanswered questions before approving sensitive workflows.