Credit Unions: Top 6 Questions to Ask Your GenAI Vendors

Credit unions have either adopted tools like Microsoft Co-Pilot and ChatGPT Enterprise or are still considering GenAI from the sidelines.

For both cases, the critical question to consider is whether one can safeguard member information from potentially leaking into harmful AI systems.

In our latest discussions, credit union executives are actively choosing to forgo Co-Pilot, and many have banned ChatGPT entirely. A ton are looking for DLP layers that can get the job done, but with zero click-vulnerabilities and numerous ChatGPT breaches, traditional DLP does more harm than good. The number of false positives and negatives make it an outdated solution for highly advanced threat vectors.

To make the right choice, ask these 6 standard questions to all your GenAI vendors:

1. Where does your GenAI product run, and who controls the environment?

This question gets to the core of infrastructure risk. Many vendors rely on shared public cloud deployments or process prompts through APIs they do not own or control.

Look for vendors that offer secure deployment models such as private cloud, isolated virtual networks, or air-gapped setups. These architectures give you greater control over where data is processed and reduce the risk of unauthorized access. Additionally, ensure the AI product is not granted unnecessary access to other tools like email, calendars, or messaging systems by default. Default access to connected tools such as Microsoft 365 or Gmail can increase your attack surface and reduce your control. Control over the environment means control over the risk.

Copilot: Runs on Azure OpenAI infrastructure with shared cloud environments. Enterprises can configure some privacy settings, but runtime isolation is limited. May access Microsoft 365 data (e.g., Outlook, Teams) by default unless explicitly restricted.

ChatGPT Enterprise: Prompts run on OpenAI infrastructure. No support for private deployments or customer-controlled runtime environments. Not integrated with broader enterprise tools like email unless via API.

Gemini: Google’s GenAI products run on Google Cloud infrastructure. No support for air-gapped or isolated deployments. Integrated with Gmail, Docs, and other Google Workspace tools unless disabled.

Copilot, Gemini, ChatGPT Alternative:

Wald.ai runs on a dedicated, single-tenant VPC managed by Wald. Processing is fully isolated and never leaves your logical environment. Wald does not request or retain access to connected tools like email or calendars.

2. How do you protect our prompts from leaking into training data or third-party models?

Some vendors fine-tune their models using customer prompts, while others rely on LLM providers that retain prompt data in ways that are not always disclosed.

Your AI partner should provide clear guarantees that data will not be stored, reused, or shared. Expect end-to-end encryption, data isolation, and architectural safeguards that ensure no prompt ever becomes part of a model.

Copilot: Prompts are stored for up to 30 days by default. Fine-tuning and retention policies depend on tenant-level settings.

ChatGPT Enterprise: Does not use prompts for training. However, prompts are stored for 30 days temporarily and traverse shared infrastructure.

Gemini: Prompts logged for minimum 30 days.

Copilot, Gemini, ChatGPT Alternative:

Wald.ai provides zero data retention, encryption, and never stores or reuses your data.

3. How does your system handle PII, PCI, or other sensitive member data in prompts and outputs?

Generic AI platforms are not built to understand financial compliance risks. Most rely on basic keyword filters that miss context, especially when it comes to nuanced member data.

Choose a solution with built-in context-aware redaction and domain-specific DLP. It should identify and protect sensitive data automatically, without requiring manual reviews or configuration.

Copilot: Offers some redaction via Microsoft Purview, but financial data detection and redaction must be manually configured.

ChatGPT Enterprise: No native context-aware redaction.

Gemini: Limited built-in DLP capabilities. Redaction and PII handling require integration with other Google Cloud services.

Wald.ai: Includes real-time prompt scanning and context-aware redaction. No rule-building or manual tagging needed.

4. What certifications or third-party attestations back your claims of security and governance?

Many vendors describe their product as secure or compliant, but those claims often go unverified.

Look for SOC 2 Type II, ISO 27001, third-party red teaming, and documented governance policies. These certifications provide assurance that the vendor’s controls have been independently tested.

Copilot: Backed by Microsoft’s certifications including SOC 2 and ISO 27001. Varies by product tier and integration.

ChatGPT Enterprise: SOC 2 Type II certified. No public red team disclosures.

Gemini: Backed by Google Cloud certifications. Certifications apply at the infrastructure level, not always at the application level.

Wald.ai: SOC 2 Type II certified, independently tested by third parties. Documentation available on request.

5. What admin controls and audit trails will we have from day one?

Even when AI works as intended, internal misuse can lead to unintended consequences. Staff might share sensitive data, generate inaccurate summaries, or expose information in ways that violate internal policy.

Ensure your vendor supports prompt logging, user-specific monitoring, and role-based access controls. These features should be available immediately and not as part of a long-term roadmap.

Copilot: Admin logging available but prompt-level audit trails are limited.

ChatGPT Enterprise: Usage analytics and logging available. Prompt-specific tracking requires API-level integration.

Gemini: Workspace activity logs are available. Prompt transparency is limited.

Wald.ai: Provides full prompt-level logging and role-based controls.

6. How quickly can your platform adapt to emerging compliance guidance?

Regulations around GenAI are evolving quickly. Credit unions will be expected to comply without delay.

Your vendor should offer flexible policy management, versioned audit trails, and configuration options that help you adapt to new requirements. Just as important, the vendor’s team should understand frameworks like NCUA, FFIEC, and other industry-specific standards.

Copilot: Microsoft’s roadmap includes compliance updates, but change cycles are long and not specific to credit unions.

ChatGPT Enterprise: Compliance policies must be configured externally. No specific alignment to financial regulations.

Gemini: Adapts via Google Cloud policy tools. Requires customer-side implementation for compliance controls.

Wald.ai: Helps regulated companies stay compliant by eliminating prompt leaks and isolating sensitive data. Purpose-built for financial and other regulated institutions.

Where Do You Stand? A Checklist for Credit Unions

Before choosing a vendor, know exactly where you are on the GenAI adoption curve. These questions will help you quickly access your internal systems:

Not Yet Using GenAI?

• Have you evaluated internal risks and readiness?

• Do you know what member data might show up in prompts?

• Do you have a clear procurement or pilot plan in place?

• Who will be accountable for responsible use?

• How will you prevent shadow use of free GenAI tools?

Already Using Copilot, ChatGPT Enterprise, or Gemini?

• Are your users aware of prompt-level data risks?

• Are prompt logs and user activity being monitored?

• Have you restricted default access to other enterprise tools?

• Are you redacting sensitive data before it enters the model?

• Do you know where your data is processed and stored?

Looking to Add a DLP Layer to GenAI Use?

• Can your DLP detect context-specific financial data?

• Is redaction automated or reliant on manual rules?

• Does it support audit trails for every prompt?

• Is the DLP designed for member trust and compliance?

• Will it scale across teams and tools?

Moving Away from Copilot or Other Tools?

• What gaps were exposed in your current setup?

• Are you looking for better data isolation?

• How important is vendor independence to your board?

• What lessons have you learned about AI risk so far?

• Who needs to approve the change internally?

Planning Your Next GenAI Move?

• Have you mapped vendor capabilities to credit union priorities?

• Are your compliance officers involved in evaluations?

• How fast can you pivot if regulations change?

• Is your member trust strategy influencing the tech roadmap?

• Do you need a partner or just another product?

Innovation Without Oversight Is Not a Strategy

AI can help credit unions write policies faster, improve board reporting, and educate members more efficiently. But these benefits mean little if your vendor cannot meet the governance and security standards your institution is built on.

Use these six questions and the checklist to guide your evaluation process. The right vendor will not hesitate to answer them in full and their product will reflect those answers in practice.

Along with being a technological decision, it is also a commitment to protecting the people and systems that make your credit union what it is.

Talk to our team today, let’s get your team the best of GenAI with in-built security and zero data retention.