Describe the intended workflow, users, decisions and prohibited uses before comparing providers. Identify every data class submitted or retrieved, including catalogs, fitment records, quotations, supplier documents, warranty files and personal information. Clarify retention, training use, subprocessors, location, access, security, incident notice and deletion evidence with qualified legal, privacy and security owners. Require enough service and version information to evaluate the actual configuration, plus notice and re-test rights for material changes. Define ownership and export of prompts, outputs, evaluation records and corrections; then test suspension, export, termination, deletion and manual fallback before dependency becomes difficult to unwind.