Can you outline the security compliance questions I should ask software vendors before buying their generative AI automation platform