.jpg)
Power Your Growth
hello@propensity.com
How to evaluate data privacy, AI governance, and vendor security—and why Propensity belongs on your shortlist.
Every marketing application makes a promise: better targeting, faster execution, clearer attribution, or more qualified pipeline. Delivering on that promise requires something valuable in return—access to your data.
That data may include CRM records, audience lists, website engagement, campaign performance, and information about the accounts your sales team wants to win. Together, these assets reveal both customer relationships and business strategy.
A marketing technology purchase therefore carries two decisions. You are choosing what a platform can help your team accomplish. You are also choosing a company to trust with the information that makes those accomplishments possible.
Application security belongs in that conversation from the beginning. It affects campaign continuity, the reliability of reporting, customer confidence, and your ability to adopt new capabilities responsibly.
For marketers evaluating platforms such as Propensity, the strongest buying process connects performance with evidence: documented data practices, understandable AI boundaries, meaningful security assurance, and clear responsibilities.
On October 21, 2026, TechCrunch covered newly disclosed PHP security vulnerabilities.
The underlying research illustrates how security risks can emerge in widely deployed software. Wiz’s disclosure briefing describes two critical vulnerabilities enabling unauthenticated remote code execution. OpenAI’s account of the coordinated response explains that PHP’s maintainers led the fixes, supported by researchers and security providers.
Propensity is not affected by this PHP security issue.
For marketing buyers, the broader lesson is about visibility and preparedness. A polished interface tells you little about the software components supporting an application, how those components are maintained, or how quickly a provider can determine whether a newly disclosed vulnerability affects its customers.
When security news breaks, a vendor should be able to answer practical questions: Are we affected? What has been assessed? What action is required? When will customers receive another update?
Build those expectations into vendor selection. Propensity’s unaffected status addresses this particular issue; its published security and data governance resources provide a starting point for the broader evaluation.
Marketing information can look ordinary when viewed one record at a time. A business email address, a page visit, or an account name may seem routine. Combined, those records can become a detailed map of commercial activity.
Consider what a hypothetical export could reveal: which prospects are receiving attention, which accounts appear ready to buy, how audiences are segmented, and where campaign investment is concentrated. An unauthorized change to that information could be damaging even without a public data leak.
Security should therefore protect three things:
Security Objective
What it means for marketing
Confidentiality
Customer records, audience data, and campaign plans remain accessible only to authorized people and systems.
Integrity
Segments, suppression lists, lead scores, and performance reports remain accurate and protected against unauthorized changes.
Availability
Teams can access the platform and information needed to operate campaigns and support sales.
These objectives reflect the confidentiality, integrity, and availability principles described by ISO in its explanation of ISO/IEC 27001.
For a marketer, their value is concrete. An inaccurate suppression list can undermine outreach practices. Altered attribution data can distort budget decisions. An unavailable application can interrupt a launch.
A useful vendor demonstration should therefore include a discussion of how the platform protects the work happening inside it. With Propensity, buyers can begin that discussion alongside the platform’s marketing capabilities and published enterprise security positioning.
Integrations make marketing applications useful. They also create pathways that deserve scrutiny.
Before authorizing a connection, establish which information moves, why it is needed, who can access it, and what happens when the connection ends. A vendor should explain the difference between storing data, processing it for a task, sharing it with another service, and making it available to an AI model.
These activities have different implications. Treating them as one broad category called “data usage” makes meaningful evaluation difficult.
A practical review starts with a representative workflow. For example, ask a vendor to walk through what happens when your team synchronizes a CRM audience and prepares a campaign. Identify the systems involved and the information available at each step.
Propensity offers a useful foundation for this conversation: its AI Data Privacy and Security Overview states that CRM synchronization is isolated from AI processing and that synchronized CRM data does not flow into what the AI processes.
That distinction helps buyers evaluate an increasingly important question: does connecting business data also expose it to a generative AI workflow?
AI features deserve more detailed questions than “Do you use AI?”
Ask what information reaches the model, whether the model can access databases, whether customer information is used for training, and what happens to prompts after a task is complete.
Propensity documents specific boundaries. Its AI overview describes an intermediary processing layer separating the AI from databases and synchronized customer data. It also states that customer data is not used to train or fine-tune the underlying model.
The documentation makes an important distinction: information a user enters directly into chat becomes part of that conversation. It specifies one-year retention for AI interactions, potential internal review to improve agent configuration, and logging whose access is restricted to Propensity’s internal team. Review Propensity’s AI privacy and security details.
For buyers, this level of specificity is useful because it supports operational decisions. Teams can define appropriate prompt practices, assess retention against company policy, and distinguish agent configuration improvements from model training.
A sensible internal practice is to use only the information necessary for a task. For example, a request to draft an industry-specific campaign may require audience characteristics and a value proposition, without requiring a pasted customer list.
Use Propensity’s documented boundaries as the foundation for that training and procurement review. Clear limits make AI easier to evaluate and adopt responsibly.
Strong application security and responsible data collection address different parts of the same relationship.
Security concerns protection against unauthorized access, alteration, or disruption. Privacy also concerns why information is collected, how it is used, and what choices people have.
A marketing buyer needs confidence in both.
Propensity’s GDPR resource describes a privacy-by-design approach and explains its intent-data co-op model. It outlines consent handling through participating properties’ consent management platforms, including appropriate consent signals where applicable.
That gives buyers concrete practices to discuss when assessing the origin and permitted use of marketing signals.
The next step is to connect the vendor’s practices to your own implementation. Which audiences will you activate? Which regions will you target? What disclosures and consent settings apply to the technologies on your website?
The European Commission explains that personal data can include cookie identifiers and IP addresses, and that pseudonymized information remains personal data when a person can be reidentified. Buyers should therefore assess the actual information and processing involved rather than assume that business-focused targeting or hashing removes privacy obligations.
Propensity’s published materials provide a useful basis for a review with your privacy team. The goal is a clear understanding of how your intended campaigns fit the applicable requirements.
A productive vendor relationship makes responsibilities visible.
Propensity’s Data Governance FAQ distinguishes account website tracking from contact website tracking, including their different use of cookies. It also explains that customers remain responsible for their website consent management and recommends reviewing privacy notices, consent processes, and permissions for uploaded information before launching campaigns.
That clarity has practical value. Your website, CRM, advertising accounts, and marketing application form one operating environment. A well-planned implementation considers how they work together.
Before launch, bring marketing operations, website owners, and privacy stakeholders into the same conversation. Confirm that notices describe the planned activity, tracking is configured appropriately, and uploaded records can be used for the intended purposes.
Propensity’s documentation helps teams prepare those discussions early, when adjustments are easier to make and less likely to disrupt a campaign.
Propensity’s homepage displays AICPA SOC, GDPR, and ISO 27001 badges in its enterprise security section. These are useful starting points for due diligence, with each addressing a different aspect of trust. View Propensity’s enterprise security section.
A SOC 2 Type II examination addresses the design and operating effectiveness of controls within a defined scope over a specified period. The resulting report helps a buyer understand what was examined and what the testing found. See AICPA guidance on SOC 2 reporting.
For procurement, request the current report and have your security team review the covered services, examination period, relevant findings, and customer responsibilities.
Propensity’s AICPA SOC badge provides a natural entry point for requesting that supporting evidence.
ISO/IEC 27001 defines requirements for an information security management system. It emphasizes identifying risks, applying appropriate controls, and continually improving how information security is managed. Read ISO’s overview.
When evaluating a vendor’s ISO 27001 assurance, request the current certificate and its scope. Confirm that the services relevant to your purchase are covered.
Propensity’s ISO 27001 badge makes this a clear topic for the security review accompanying your evaluation.
GDPR is a regulation. Buyers should examine the contractual terms, processing activities, consent practices, and allocation of responsibilities relevant to their use case.
Propensity supports that discussion with a dedicated GDPR explanation, giving your team more substance to assess alongside the homepage badge.
Together, the badges and documentation create a useful path from an initial trust signal to a detailed purchasing decision.
The most useful time to involve security and privacy stakeholders is while requirements are being defined.
Start with the workflows that matter: audience creation, CRM synchronization, website tracking, AI-assisted campaign development, and reporting. Then ask your reviewers to identify the evidence required to approve those workflows.
Include access management, encryption, application testing, vulnerability remediation, incident notification, backup recovery, subprocessors, retention, and deletion in the review. Confirm applicable commitments in the vendor’s documentation and agreement.
For Propensity, this process can begin with its public resources and continue through a focused discussion with the team. Request evidence for the controls your organization requires and clarify any details that are not covered publicly.
Assess ongoing operations, too. Establish who owns integrations, who reviews access when employees change roles, and who receives security communications. Include offboarding: what happens to data and credentials when a connection or contract ends?
These questions make a purchasing decision more durable. They help ensure that the platform remains manageable as your team, campaigns, and data needs grow.
Use this checklist to bring performance, privacy, and security into the same purchasing conversation.
Evaluate
Ask the vendor
Where to begin with Propensity
Data flows
What information moves between our systems, your application, and other providers?
Review the Data Governance FAQ, then walk through your intended integrations.
AI governance
What can the AI access, and is our information used for model training?
Start with the AI privacy and security overview.
Retention and review
How long are interactions retained, and who can review them?
Compare the published AI interaction policy with your organization’s requirements.
Data sourcing and consent
Where do signals originate, and how are permissions handled?
Examine Propensity’s GDPR resource.
Security assurance
Can we review current assurance documents and their scope?
Use the homepage security badges to open the evidence review.
Operational protection
How do access controls, testing, patching, and recovery support our use case?
Include these requirements in your Propensity security discussion.
Incident readiness
How will you assess exposure and communicate when a major vulnerability appears?
Establish notification expectations during procurement.
Implementation and exit
What must we configure, and how are data and access handled when usage ends?
Build on Propensity’s documented customer responsibilities and confirm contractual details.
The right marketing application should help you generate pipeline while giving your organization a clear basis for trusting how data is handled.
Propensity deserves consideration on both fronts. Its enterprise security positioning, published privacy practices, and documented AI boundaries give buyers concrete material to evaluate alongside marketing performance.
Make security part of your next platform conversation. Explore Propensity and ask the team to walk through your data flows, AI requirements, and security review before your first campaign launches.
%201.svg){kind=icon}