Procurement and law firms
Small law firms name cost (25%) and data breach risk (15%) as top barriers, and found technology mostly through colleagues or competitors (76%) (SRA, small firms technology report, June 2025). With no trial, offer the substitutes: a paid scoped pilot, a rolling monthly start, approvals on, Holly at Observe.
Customer content is covered by the data processing agreement, not the privacy policy, which says so itself (clause 2.2). Answer data questions only as "our data processing agreement says", never as your own assurance, and follow up in writing through John (D27).
| They ask | You say | Route to |
|---|---|---|
| "A free pilot?" | "Not at launch. We can talk about a paid pilot at the published price, scoped to a small group, with success criteria agreed in writing. That's Alex or John's call, and I'll set it up." | Alex or John (D17) |
| "We pay on invoice." | "Payment is normally taken at sign-up. If your accounts team needs an invoice, John will confirm how we handle that before you commit." | John (D17) |
| "Send your DPA and policies." | Never send them yourself: "I'll get you our data processing terms and the current position in writing from our team." "Anything beyond those, our legal team will answer in writing." | John, then Karl (D27) |
| "Where is our data held?" | "Our data processing agreement covers your content. It says processing happens in the UK and the regions on our subprocessor list, and that the list, with each subprocessor's location, is available on request. If you need a specific commitment on location, I'll get you a written answer from our legal team." (DPA 3.1, 6.1.) Never "UK hosted". | Karl and Neil |
| "Who are your subprocessors?" | Never name any unprompted or from memory: "We'll send you the current list in writing." | Karl |
| "Does the AI train on our data?" | "Our data processing agreement says we won't let any subprocessor, including the AI model provider, use your content to train their models. If you need that in a form your compliance team can rely on, our legal team will put it in writing." (DPA 2.5.) Asked which model: answer truthfully, never lead with it (D23). | Karl |
| "Complete our security questionnaire." | "We will, accurately and in writing. We don't hold a security certification today, and I'd rather tell you now than have you find it on page four." | Neil and Karl |
| "Certified? Pen tested?" | "No certification today, and I won't imply otherwise." Confirm neither the DPA's penetration testing cadence nor "available third-party attestations". Never "enterprise grade". | Neil and Karl |
| "A renewal cap or most-favoured clause?" | "Everyone in your band pays the same, and your rate holds for as long as you stay subscribed, on the terms I've described, including the move to a twelve-month agreement." | Karl |
| "Our supplier terms?" | "I'll pass them to our legal team." | Karl |
| "Marketplace, Legal SKU, SLA?" | "Not at launch." |
The engagement data question. Only the approved answer:
Say"Publishing runs through LinkedIn's own connection: we don't ask for your password and we don't hold one. On the engagement side, I'll get you a written answer from our legal team rather than paraphrase it, because your compliance people will want it exactly right."
(D1; see the chapter on proof and guardrails.) A loss on a data or legal answer is logged L4.