Quick summary: Data security isn’t a checkbox for customer success leaders. It’s key to protecting your customers’ data, earning their trust, and safeguarding your future retention and growth.
About the author
Michael Kipp is Senior Director of Information Security and Technology Operations at ChurnZero. A CISSP with 30+ years of experience, he leads ChurnZero’s IT and infosec strategy and built the company’s security program from scratch—earning SOC 2 Type II, ISO 27001, and independent HIPAA attestation.
***
Your team handles a lot of sensitive customer information. Health scores, contract details, private feedback, support histories, and usage patterns. Protecting your customers’ data comes down to a mix of access controls, encryption, and careful review of the tools and AI features you bring in.
This requires attention to detail, but the ROI of getting it right is significant. You’ll preserve customer trust, stay on the right side of regulations, and ultimately protect the revenue foundation that your company is built on.
This guide walks you through what to look for, what to verify, and what to ask. Use it when evaluating new software, reviewing your current stack, or preparing for a customer’s security questionnaire.
Key takeaways
- Data security protects sensitive customer information, such as health scores and usage data, from unauthorized access.
- Modern CS leaders must understand how to evaluate data security to drive customer success and preserve trust.
- AI features and software integrations significantly expand the organizational data footprint, requiring rigorous security review processes.
- Vendor verification should include SOC 2 Type II reports, ISO 27001 certifications, and transparent subprocessor lists.
- Operational security requires individual user accounts, regular access reviews, and sanctioned AI tools for team members.
Why data security is so critical for customer success leaders.
Data security has long been strategically important in CS, but three recent shifts have raised its importance.
- AI features now potentially route customer data to third-party model providers. Tools that assess content and generate reports and plans that send context to large language models, and it’s easy for an individual CSM to trigger a data transfer without realizing it. Without clear policies, you’re not in control of what leaves your environment.
- Software integrations expand the organizational data footprint. Every connection to Salesforce, Snowflake, Zendesk, SharePoint, or another system adds a path data can travel. Each integration needs its own security review.
- Customers are asking harder questions, and vague answers read as red flags. Procurement, security reviewers, and executive sponsors expect specifics on subprocessors (the third-party providers that process platform data), encryption, and AI data handling.
How to review a customer success platform for essential security features.
A secure customer success platform must provide role-based access control, tenant-level isolation, and single sign-on integration.
It should also include encryption for data at rest and in transit, audit logs for system activity, and AI kill switches that allow administrators to disable AI features at the user or tenant level.
Use this checklist when you review a vendor’s platform. Each item protects a different part of your data footprint, so it’s essential that vendors can check off each one.
Identity and access management (IAM) controls.
These controls govern who on your team can access which data, ensuring people see only the information their role requires.
- Role-based access control (RBAC). RBAC allows administrators to restrict data access based on a user’s specific job functions within the customer success team.
- Tenant-level isolation. Tenant-level isolation ensures that a customer’s data is logically separated from every other organization’s data on the same platform, with no shared access paths.
- Single sign-on (SSO). Single sign-on (SSO) integrates the customer success platform into the corporate identity perimeter, so a single deprovisioning action closes every door.
- Multi-factor authentication (MFA). Enforced for every user, with one-time passcode verification for new browsers or after inactivity.
- IP-based access controls. For internal teams, the ability to restrict access by network location adds a layer of protection against credential theft.
Data protection and encryption standards.
These ensure that customer data can’t be read by unauthorized parties, either during transmission or while stored.
- Encryption in transit and at rest. Applied across the platform without configuration required from your team.
- PII handling in AI features. Natural language processing should identify and remove personally identifiable information (PII) from prompts before they reach a model provider.
- Virus scanning on file uploads. Any document attached to the platform should be scanned before it’s stored.
Security monitoring and compliance oversight.
This creates a traceable record of system activity, enabling you to detect, investigate, and respond to any unauthorized or suspicious actions.
- Audit logs. Audit logs provide a chronological record of system activities, enabling leaders to reconstruct user actions during security investigations or in response to customer requests.
- AI kill switches at three levels. Individual user, profile group, and tenant-wide. You should be able to turn AI off for a single person, a single team, or the entire account.
- Permission groups and profile layouts. Govern who can view and edit specific data, independent of their role.
Securing customer success software integrations.
It’s crucial that every external system connected to your platform uses strong, up-to-date authentication so data can’t leak through those connections.
- OAuth-based authentication for major integrations. Platforms moving Salesforce connections from legacy Connected Apps to External Client Apps with OAuth are a good signal.
- Key-pair authentication for data warehouses. Snowflake is deprecating single-factor password logins, and vendors adopting RSA key-pair authentication ahead of that deadline show they’re tracking the security landscape.
- Documented email integration security. Clear documentation on how email data is handled and protected.
How to verify vendor security compliance with confidence.
Every vendor says their platform is secure. Real verification, however, comes from documentation, certifications, and how transparently a vendor behaves when you press them.
Leaders should review vendor SOC 2 Type II reports, assess AI data handling policies, and verify subprocessor transparency. It is essential to confirm that customer data is excluded from model training and that identity access management controls are in place for all users.
Ask for each of the following:
Security certifications and third-party audits.
- SOC 2 Type II report. Should cover Security, Availability, Confidentiality, and Processing Integrity. Type II matters because it audits controls over a defined period. Note that SOC 2 Privacy category is often excluded because most vendors operate as data processors, with privacy obligations governed through the DPA and regulations like GDPR and CCPA.
- ISO 27001. Demonstrates a structured information security management system.
- GDPR and CCPA compliance. Supported by a current Data Processing Agreement.
- HIPAA compliance. Required if you serve healthcare customers or handle protected health information.
- Hosting specifics. Know which cloud provider hosts the data, where it is located geographically, and whether the vendor supports regulated environments, such as AWS GovCloud, for federal customers.
Vendor transparency and trust indicators.
- Public compliance or trust center. When a vendor publishes certifications, subprocessor lists, incident communications, and security practices at a standing URL, they’re making an ongoing commitment to transparency.
- Subprocessor list. Review who has access to your data downstream and how the vendor manages those relationships.
- Incident history and communication. Look for how the vendor handled past security events. Companies that earned customer trust during breaches suspended affected subprocessors within days, issued public statements, and audited their remaining vendor relationships in view of their customers.
Often, security problems in vendor relationships result from security reviews starting too late, moving too quickly, or not happening at all. Follow this checklist to close the gaps.
- Treat a security review as part of the buying process from the first meeting. Use this sequence to run it well.
- Loop in your security team early. Before the first demo, meet with your IT or security colleagues to understand your organization’s requirements and to build a shared list of questions.
- Request the core documentation. SOC 2 Type II report, penetration test summary, DPA, and any relevant compliance certifications.
- Review the vendor’s trust center. Look for current certifications, the full subprocessor list, and recent incident communications. A standing public presence is a strong signal.
- Ask specific AI questions. Confirm that customer data is excluded from model training under the vendor’s API agreements with providers like OpenAI and Anthropic. Ask how PII is scrubbed from prompts. Ask what levels of AI control you’ll have at your tenant.
- Press on the subprocessors. Ask how often the list is reviewed, how changes are communicated, and what each subprocessor does with your data.
- Validate employee training. Annual security awareness training plus dedicated AI security training, with non-completion triggering system lockout, is a reasonable floor.
- Read the incident history. Every vendor faces something eventually. The ones worth buying from handle events with speed and candor.
- Run a security-focused demo. Ask to see audit logs, access controls, and AI kill switches in action.
How to ensure data security within your own team.
The strongest platform in the world can’t protect you from bad operational habits by team members who bypass its controls, creating risk. Watch for these and address them before they create exposure.
- Shared logins. The moment two people use one account, your audit history loses its value. Assign individual accounts to everyone, including contractors and temporary staff.
- Default-permissive access. Giving every new CSM full visibility into every account expands the reach of any future mistake. Start with minimum access and add permissions as roles require.
- Slow deprovisioning. When someone leaves, their access should disappear the same day. SSO makes this automatic and is one of the fastest ways to close a common exposure point.
- Ungoverned AI tools. Team members often adopt AI assistants on their own. Without guidance, they may paste customer data into tools that are not in agreement with your company. Give your team sanctioned AI tools with documented data handling.
- Customer data in consumer channels. Personal email, messaging apps, and ungoverned spreadsheets still collect sensitive information. Provide sanctioned channels that make the secure path the easy path.
- No regular access review. Permissions drift as people change roles. A quarterly review of who has access to what keeps the system aligned with your current team.
- Treating security as a one-time event. Vendors update their platforms, add integrations, and change subprocessors throughout the year. An annual review of your CS platform’s security posture keeps you current.
Don’t overlook AI data security.
Customer success teams manage AI data security by ensuring that natural language processing identifies and removes personally identifiable information from prompts.
Teams must also use sanctioned AI tools with clear data handling agreements and maintain strict control over which AI features are enabled for specific user profiles or tenant accounts.
This isn’t just a job for your security team. As a CS leader, it’s on you to set expectations, communicate company policies, and know what tools your team is using.
Together, these controls are the foundation of responsible AI adoption in customer success operations. They should be validated with every vendor whose platform touches your customer data.
Want to get your CS team’s data security right? Talk to us.
Data security is part of the experience you deliver to customers, part of how your team operates, and part of how you evaluate the tools you rely on.
When your customers trust you to protect their data, they stay longer, expand faster, and advocate for you more freely.
Start at the compliance and trust center of any vendor you work with, including ours at trust.churnzero.com.
When you’re ready to ask more detailed questions about our AI data handling, subprocessor discipline, and the controls you can exercise at your tenant, we hope you’ll bring them to a conversation with us.
