TL;DR
- Security teams look closely at deduplication tools because the tools read and change customer records.
- A security review often starts with where customer data is stored and who can access it.
- Reviewers often ask for certificates, like ISO 27001, that show an independent audit of a vendor.
- Some companies require an NDA or their own vendor questionnaire before approving a tool.
- Dedupely publishes its certifications and subprocessors and works with customers' NDAs and questionnaires.
You've found a deduplication tool that fits, and the team is ready to start. Then someone asks whether security has approved it. For many companies, any tool that touches customer data goes through a review first.
A deduplication tool gets a closer look than many. It connects to the CRM, reads whole objects of customer records and changes them when it merges. Security teams want to know what that means for the data.
In this post, you'll see what security teams ask any vendor, why they ask it, and what a clear answer looks like. You'll also see the questions specific to deduplication, and how to help the review move faster.
Why a deduplication tool gets a closer look
Many apps connected to a CRM read a few fields or write a few activities. A deduplication tool works differently. To find duplicates, it needs the records in the objects you choose, often with names, emails, phone numbers and addresses.
To merge them, it also needs permission to update and remove records. Connecting one often takes admin rights in the CRM.
That combination of personal data and write access is what security teams focus on. Their job is to make sure the vendor protects the data as well as your own company would.
The questions security teams ask any vendor
Every company has its own process, and the depth of the review varies. These questions come up in many reviews, whatever the tool.
Where is the data stored and processed?
Reviewers ask which cloud providers host the data, in which regions, and whether the vendor keeps a copy. Location matters for data protection laws and for internal policies on where customer data can live.
They also ask how long data is kept, and whether you can delete it when you stop using the tool. A clear answer names the providers and regions, and explains retention and deletion in plain words.
Who can access the data?
This covers two sides. On the vendor's side: which employees can see customer data, when, and how that access is controlled.
On your side: which roles the tool offers, and whether it supports two-factor authentication, single sign-on and IP restrictions. Reviewers also ask how the tool connects to the CRM. A token-based connection like OAuth avoids storing CRM passwords.
How does the vendor use the data?
Security teams want to know that customer data is used only to provide the service. They ask whether it's used for marketing, sold or shared, and whether it's sent to outside AI models or used to train them.
If a tool uses AI, reviewers want to know where the processing happens and which providers see the data. See how AI tools compare for CRM deduplication.
Which certifications and audits apply?
Certifications show that an independent auditor checked the vendor's security practices. ISO/IEC 27001 is a common one: it sets requirements for an information security management system.
Reviewers often ask for the certificate itself, its scope and the auditor. Some also ask for penetration test results.
Which subprocessors handle the data?
Subprocessors are the other companies a vendor relies on, such as cloud hosting providers. Security teams ask for the list, where each one is based and what data each one sees.
Under the GDPR, a processor needs the controller's written authorization before engaging another processor. That's one reason reviewers want the list in writing.
What happens in an incident?
Reviewers ask whether the vendor has an incident response plan, how incidents are classified, and how and when affected customers are told. They may also ask how the vendor encrypts data in transit and at rest.
NDAs, contracts and vendor questionnaires
Some reviews need paperwork before the questions start. A company may ask for a mutual NDA before the vendor shares detailed documents, such as policies or test reports.
Companies subject to the GDPR also need a contract with each processor that covers how personal data is handled. Many vendors offer a data processing agreement for this.
Larger companies often send their own vendor questionnaire. It can run to dozens of questions, and it's usually filled in by the vendor's security or support team. Ask early, since questionnaires can take a while to complete.
Questions specific to deduplication tools
A general review checks how the vendor protects data. A deduplication tool also changes your data, so some reviewers go further. These questions are worth answering before they're asked.
Does connecting the tool change anything in the CRM?
Reviewers want to know whether syncing alone edits, merges or deletes records. A clear answer separates reading data from changing it, and says what triggers a change.
Can merges be undone, and is there a record of them?
Merges in many CRMs are permanent. Reviewers ask what's kept from each merged record, whether there's a history of merges and whether it can be exported. That's also why many teams back up the CRM before a large merge.
Who can merge, and what's logged?
Security teams ask whether access can be limited by role, and whether an audit log records merges, logins and changes to settings. They also ask whether the tool has safeguards that hold back risky matches before a bulk merge.
How to help a security review move faster
Reviews take longer when security hears about the tool at the end. Bring them in as soon as the tool looks like a fit, and explain why the team needs it.
Share the vendor's security page and trust center, the list of objects you'll connect and who on your team will use the tool. If leadership needs to approve the project too, the business case for a CRM cleanup can go to them alongside the review.
If your company uses its own questionnaire, send it to the vendor early. Ask who the contact is for security questions, so answers don't get lost in a general inbox.
Summary: what security teams ask and why
| Question | Why they ask | What a clear answer includes |
|---|---|---|
| Where is the data stored? | Data protection laws and internal policies | Providers, regions, retention and deletion |
| Who can access it? | Limit exposure of customer data | Vendor staff access, roles, 2FA, how the CRM connects |
| How is the data used? | Prevent use beyond the service | No marketing use, no sharing, AI processing explained |
| Which certifications apply? | Independent proof of security practices | Certificates, scope, auditor, test results |
| Which subprocessors are used? | Know every company that handles the data | Names, locations and what each one does |
| What happens in an incident? | Know how and when you'd be told | Incident response plan and notification steps |
| Can merges be undone or traced? | Merges change customer records | Merge history, export, audit log, safeguards |
How Dedupely answers a security review
Use Dedupely's security page and Trust Center to start the review. Ask for current certificate scope and validity, processing locations, subprocessors, retention terms and the policy on AI processing. Review that evidence for the actual CRM objects and fields you plan to connect, and agree on any required vendor documents before access.
A good review protects the data and the project
Security teams ask any vendor where the data lives, who can see it and how it's used. They also ask who audits it and who else handles it. A deduplication tool adds a few more, because it changes customer records as well as reading them.
A review goes smoothly when those answers are published, specific and easy to share. Bring security in early, limit the review to the objects you need, and expect the paperwork. The result is a tool your security team trusts with the data your whole company depends on.
References: Dedupely security; Dedupely Trust Center.
Frequently asked questions
What do security teams ask before approving a SaaS tool?
They often ask where data is stored and processed, who can access it, and how the vendor uses it. They also ask which certifications and audits apply, which subprocessors handle the data and what happens in an incident. Many companies also require an NDA, a data processing agreement or their own questionnaire.
Is it safe to connect a deduplication tool to my CRM?
It can be, once your security team has checked the vendor. Look for published certifications, clear hosting regions, a token-based CRM connection like OAuth, and a subprocessor list. Ask whether syncing alone changes records, and whether merges are recorded in a history you can export.
What is a vendor security questionnaire?
A vendor security questionnaire is a list of questions a company sends a vendor during a security review. It covers topics like data storage, access control, encryption, certifications, subprocessors and incident response. Large companies often use their own, and the vendor's security or support team fills it in.
What is a subprocessor?
A subprocessor is a company a vendor relies on to process customer data, such as a cloud hosting provider. Security teams ask for the list, where each one is based and what data each one sees. Under the GDPR, adding one needs the customer's written authorization, given specifically or in general.
Why does ISO 27001 matter in a security review?
ISO/IEC 27001 sets requirements for an information security management system, and certification means an independent auditor checked the vendor against them. Reviewers often ask for the certificate, its scope and the auditor. It doesn't answer every question, so reviews still cover hosting, access and subprocessors.
Or sign up with Google
Salesforce AppExchange 
