Identify which systems connect, which records are collected, where they are processed and who can see the results. Ask whether message bodies, transcripts or other content are included rather than assuming all relationship tools use metadata only.
Check least-privilege permissions, authentication, access restrictions, encryption, audit records and incident handling. Review subprocessors, permitted use, international transfers and whether any customer data can be used for model training or shared analysis.
A vendor-hosted service can be secure without running in your own tenant. Evaluate the architecture and contractual safeguards rather than using tenant location as a single pass/fail test.
Request relevant assurance reports and understand their scope and date. Certifications support due diligence; they are not a guarantee against every incident.
Agree retention, deletion, exports and access revocation before launch. Confirm how former employees and discontinued integrations are handled.
For Orbb, request the current materials through the trust centre and verify the applicable configuration. Avoid publishing specific certification types, residency or permission claims unless the documentation supports them.