Supplier attestation
Each supplier lists relevant AI tools and declares where buyer information is processed, stored and retained. This is the supplier’s claim, not evidence by itself.
DataPathby Trust Boundary
Evidence on supplier AI use, inside your tender.
Suppliers can use AI anywhere in their business, whether or not AI is part of what you’re buying. DataPath asks which tools may handle your information and what their settings mean, then presents relevant evidence for your panel to consider.
Join the pilotThree steps, one record per supplier.
Evidence record
Trust Boundary relates each claim to provider terms, sub-processor information, regional documentation and third-party evidence where available. Support, gaps, scope, configuration and evidence dates stay visible.
Panel consideration
Your evaluation panel weighs the record and unresolved questions alongside the wider risk assessment. The decision stays with the panel.
Clear responsibilities, useful records.
What suppliers provide
- AI tools and features used to deliver the service
- Where each tool processes and stores information
- Retention or monitoring settings they have changed
- Supporting documents, where available
What your panel receives
- One record per supplier, in plain English
- A status for each claim and its evidence scope
- Links to sources used
- Suggested follow-up questions
What a DataPath record looks like
A shortened example of a supplier evidence record.
| Supplier’s claim | What the evidence shows | Status |
|---|---|---|
| The writing assistant’s at-rest storage region is set to Australia. | Account-specific configuration evidence shows Australia selected for the writing assistant’s at-rest storage. This supports the configured storage setting, not processing locations or monitoring copies. | Supported |
| Client data is processed in Australia. | The account uses an APAC-zone option. This permits processing across a broader region but does not identify where this account’s prompts and outputs are processed. Australian-only processing is not established. | Not evidenced |
| The AI provider keeps no client data. | The provider reference note describes possible abuse-monitoring retention unless an exemption applies. No account-specific exemption evidence is included. | Not evidenced |
| Meeting transcripts stay in Australia. | No account-specific evidence identifies where meeting transcripts are processed or stored. Australian-only handling has not been established. | Not evidenced |
Common questions
Join the DataPath pilot
Tell us about a procurement you have coming up and we’ll talk through whether the pilot may suit it.