Ask five things before you buy. Where is the data hosted? Who are the sub-processors? What does the data processing agreement say? How long is data kept? How are people told they talk to an AI? Ask for the answers in writing.
This post gives you the checklist. At the end it says what Bill & Ben states today and what is still a draft. It is not legal advice.
Where is the data hosted, and where does it travel?
Ask for the hosting region and for every place data goes. A good answer names a region for each service. It should also cover the AI model vendors.
Ask for this in writing, not on a call.
Who are the sub-processors?
A sub-processor is another company that can handle your data on behalf of the vendor. Ask for the full list. Ask how much notice you get before the list changes, and whether you can object.
Check that the list says where each one processes data.
What should the data processing agreement cover?
A data processing agreement, or DPA, sets the rules for how the vendor handles your data. Ask for the real text, not a summary. Look for these points:
- What the vendor may do, and only on your instructions.
- Security measures.
- Sub-processors and notice of changes.
- Transfers outside your country or region.
- Help with requests from the people the data is about.
- Deletion or return of data at the end.
Ask who has reviewed it. Have your own lawyer read it before you sign.
How long is data kept, and can you export or delete it?
Ask how long each kind of data is kept, and whether you can change it. Ask how you get a copy of your data, how fast, and how deletion works.
Also ask what happens if you stop paying.
How are people told they are talking to an AI?
Ask how and when the assistant says it is an AI. Ask the same for meetings: does the assistant say that the meeting is transcribed?
Look at the wording, and ask the vendor to list the gaps.
Who can see what inside your company?
Ask how permissions work. Can each person only reach what they may reach? Can an admin see a log of who asked for what? Can you limit which AI model vendors are used?
What does Bill & Ben state today, and what is still a draft?
We list facts and documents here. We do not say Bill & Ben is compliant with anything. You and your own advisers make that call.
What we state today
- Every company has its own space. A request from one company cannot read another's.
- Nobody is in by default.
- If the check cannot be made, the answer is no.
- You set how long each kind of data is kept.
- You can export or delete a person's data on request.
- Exports are delivered within 72 hours.
- Nothing is deleted when a payment fails.
- Admins see who asked for what, and what happened, in the audit log. Export it on Business.
- Both agents tell people they are AI assistants before they first answer.
- In meetings, they announce that the meeting is transcribed.
- You can restrict which model vendors may be used for your company.
What is still a draft or not stated
- We do not state a hosting region on this page. The sub-processors draft says Not stated for most vendors. Ask us in writing before you decide.
- The DPA is a draft template. It needs a lawyer's review. It is not ready to sign.
- The AI transparency notice and the meetings impact assessment are drafts too.
- The sub-processors list is a draft.
- We make no SOC 2 claim today.
The drafts are in the public docs: the sub-processors list, the DPA template, the AI transparency notice and the meetings impact assessment, and each says at the top that it is a draft. Read them, then write to us with your questions. See the FAQ and the pricing page for the rest.