Security and rights: ask for documents
Answers on a call are not evidence. For security, request the data processing agreement, the subprocessor list including every model provider and where it processes data, the contractual terms on training and retention, security documentation and any independent assurance reports, penetration test summaries, SSO and SCIM support, audit log samples and incident notification commitments. For rights, request the output licence, any IP indemnity with its cap and exclusions, a description or published summary of training data, and the process for likeness and voice consent. For reference, Synthetic White's positions are that nothing customers upload trains any model, model providers work under zero-retention agreements, and each asset records which model made it.
Brand control and workflow: test, do not watch
Demos use the vendor's best examples. Run a structured trial instead: the same real briefs through each shortlisted tool, with your own guidelines, products and languages loaded, scored blind against a rubric agreed with brand, legal and IT before anyone sees output. Include the unglamorous steps, since that is where tools differ: an approval round with two reviewers, a change request after sign-off, an export to your DAM with metadata, and a look at what the audit trail recorded. Weight the rubric by what the organisation actually produces, so a strong video demo cannot outweigh a weak localisation workflow when localisation is most of the work.
Support, pricing and service levels
Service levels should state an availability target, support response times by severity, service credits when targets are missed, named contacts, and the onboarding and training included. Pricing needs the same precision. Ask what is metered, whether images, seconds of video, characters or credits, how rates differ by model and quality, what happens above the commitment, how model price changes are passed on and whether renewal increases are capped. Then ask for a worked quote based on your last quarter's real volume across media and markets. A vendor that cannot price a known workload in advance will not make your budget predictable later.
Exit and continuity
Negotiate the exit before signing, while you still have bargaining power. You need the right to export all assets with their metadata, your brand rules, approval histories and audit logs in usable formats; a transition period with assistance; deletion of your data with written confirmation, including backups on a stated schedule; and defined notice periods. In the EU, the Data Act, applying since 12 September 2025, gives customers of data processing services switching rights and phases out switching charges by 12 January 2027; check with counsel how it applies to your contract. EU financial entities also need exit strategies under DORA for ICT services that support critical or important functions.
Updated 25 September 2026