NOTE: To use this checklist, copy the content using the “Copy page” button above, then fill in each line before you submit for security review. Read the companion guide on connector security reviews for the full context behind each section.

AI connector & plugin security review checklist

A free template for getting a Claude connector or ChatGPT plugin approved. Fill in each line before you submit for security review.

0. Which scenario?

• Scenario 1: connector into a system you’ve already approved (e.g. NetSuite, HubSpot, Xero). Complete Part A.
• Scenario 2: plugin with its own backend from a vendor you haven’t approved. Complete Part A and Part B.

Part A: Connector review (every connector)

A1. Ownership

• Decision owner named:
• Reviewers: information security, DPO, system owner, enterprise architecture (+ procurement/third-party risk for scenario 2)
• Business owner and one-sentence use case:

A2. Questions for your implementer

• Scopes required, each justified; unused scopes removed
• Records read
• Records written (if any)
• Roles that get the connector
• Connected account’s permissions inside the system of record
• Authentication model: individual OAuth / managed via identity provider
• Joiner, leaver and revocation process
• Post-go-live support owner

A3. Questions for the AI platform vendor

• Processing regions
• Training on customer data (yes/no, evidence link)
• Default retention and configurability
• Audit events and compliance exports available
• DPA and trust centre links

A4. Data protection

• Data flow diagram, personal and special category data marked
• Lawful basis
• DPIA screening done; full DPIA if required
• Subject access request handling
• Retention on AI platform aligned to policy

A5. Logging and audit

• AI platform audit logs: where, who reviews, how often
• Source system logs
• Actions traceable to a named user

A6. Pilot

• Read-only scopes only
• Pilot group limited by role
• Duration:
• Exit criteria (usage, accuracy, incidents, log review)
• Write-back submitted as a separate change with pilot evidence

Part B: Vendor and backend review (scenario 2 only)

B1. Data and hosting

• What data the plugin’s backend stores
• Where it is hosted (region)
• Retention period and deletion on request
• Separation from other customers’ data
• Sub-processors list

B2. Assurance

• Current security evidence (and its date)
• Model training on your data (vendor’s or any third party’s)
• Incident notification and support contacts

B3. Contract and supplier onboarding

• Data processing agreement
• International transfer mechanism (if data leaves the UK)
• DPIA covers the vendor’s processing
• Exit and data return/deletion terms
• Added to supplier register

Implementation notes

Before you start

Name the decision owner first. Without one named owner (typically a CISO’s deputy or enterprise architecture lead), each reviewer waits for the others. Get their agreement to own the decision before you write anything else.

Know which scenario you’re in. If the connector reaches into a system your organisation already contracted and approved (NetSuite, HubSpot, Xero, your own M365 tenant), that’s scenario 1. If the plugin brings its own backend on its own hosting with its own sub-processors, that’s scenario 2. Scenario-2 plugins are arriving through ChatGPT’s and Claude’s plugin directories, and they need a full vendor review.

Drawing the data flow diagram

Use arrows to show user → AI platform → connector → source system. Mark which flows carry personal data and which carry special category data. This diagram is the artefact your DPO needs for DPIA screening, and security teams approve diagrams faster than prose.

Justifying scopes

List every permission the connector requests. Explain which part of the workflow needs each one. Remove anything unused. Both Claude and ChatGPT let admins restrict scopes centrally now, so “it asks for everything” is not acceptable. Also check the connected account’s permissions inside the system of record, because the connector acts with those permissions.

Piloting read-only

Start every connector read-only. Reading a HubSpot deal is a different risk from updating it. Run the pilot with one team (using role-based access to limit who gets the connector), set a duration (typically four weeks), and define exit criteria: usage threshold, accuracy checks, no incidents, and a clean log review. Then submit write actions as a separate, smaller review with the phase-one evidence attached.

Vendor review for scenario 2

Treat the plugin provider like any new SaaS supplier: data processing agreement, international transfer mechanism if data leaves the UK, a DPIA that covers the vendor’s processing, exit and data deletion terms, and a place on your supplier register. Don’t let the plugin directory’s install button skip procurement steps that a normal SaaS contract would never skip.

When to split the reviews

Don’t batch a scenario-1 connector with a scenario-2 plugin. Scenario 2’s vendor checks will hold up scenario 1’s faster approval. Split them and move the simpler one first.

Template by Kowalah, UK Anthropic Implementation Specialist. kowalah.com