When a robotics company moves from Series A to Series B and starts selling enterprise, the data partner conversation changes. The engineering questions don’t go away, but a new layer appears: procurement.
We’ve been on the receiving end of enterprise procurement reviews from healthcare, defense, automotive, and finance — the four sectors where robotics is moving fastest. Here’s what they actually ask, in order of how often it shows up. Procurement’s questions are not the same questions ML leads ask. Both matter.
1. Where physically is the data captured and stored?
Data residency is the dominant question across enterprise procurement. The answer needs to be specific: not “we have global delivery,” but “capture happens in Austin and Manila, storage on AWS us-east-2, with EU-region replication available on request.”
For healthcare buyers, HIPAA compliance requires US-only capture and storage (or EU-only, depending on the data subject). For defense buyers, ITAR may restrict to US persons on US soil. For automotive in Europe, GDPR shapes where personal data in operator footage can live.
If a data partner can’t answer this with specifics, procurement stops the evaluation.
2. What’s the right to audit?
Enterprise buyers want the contractual right to send their security or compliance team to inspect data handling at the supplier site. The typical clause:
- Annual audit right (some buyers want quarterly)
- 30 days notice required
- Audit at customer’s cost
- Findings shared with the supplier for remediation
- Material non-compliance is a contract termination event
The friction point is usually around “can we audit at any time” vs “with reasonable notice.” Most enterprise contracts end at 30 days notice with no-notice rights reserved for specific incidents.
3. Who has access to the data, and what’s the logging?
Procurement increasingly asks for named-operator access logs. Not “X people had access,” but “these specific 47 operators worked on this program, and here’s the per-operator activity log.”
This is partly compliance (audit trail for HIPAA, ITAR, GDPR) and partly forensics (if data leaked, can we trace it). Partners without per-operator audit trails get filtered out before the engineering review even starts.
4. What’s the sub-processor list?
Most data partners use sub-processors — cloud storage, payroll providers, recruiting tools, communication platforms. Enterprise procurement wants the full list, kept current, with notification requirements when it changes.
The typical clause: “Supplier maintains a sub-processor list; Customer is notified 30 days before adding new sub-processors; Customer can object to additions.” Material objections trigger contract renegotiation.
5. What’s the deletion timeline?
When the contract ends, what happens to the data? Procurement wants specifics:
- Active production data: returned to customer within 30 days, deleted from supplier systems within 60 days
- Backups: deleted within 90 days (or whatever the backup retention policy is)
- Audit logs: retained for the customer’s required period, then deleted
- Operator training material derived from customer data: deleted on contract end
“What about model weights trained on the data?” is becoming a question too. The answer needs to be unambiguous: customer owns model weights derived from customer data; supplier doesn’t retain a copy.
6. What’s the indemnity?
If your data partner causes a breach, who pays for the consequences? Standard indemnity for robotics data deals is typically the higher of (a) 1–2 years of fees or (b) a fixed cap of $5M–$25M depending on customer size.
Buyers occasionally ask for unlimited indemnity. This is a sign of either inexperienced procurement or specific high-stakes context (medical, defense). Most data partners decline unlimited indemnity in writing; if you accept it without thinking, your D&O insurance probably becomes invalid.
7. What’s the SLA, and what’s the penalty for missing it?
SLAs for data programs are less standardized than for SaaS. Typical components: trajectory delivery cadence, acceptance rate target, response time for QA escalations. Penalties are usually fee credits, not refunds.
The mistake I see new buyers make: focusing on the penalty math instead of the SLA itself. A 5% fee credit when delivery slips doesn’t fix your training pipeline. The right structure is tight SLA, modest penalty, and an explicit escalation path that gets the supplier’s leadership involved when the SLA misses.
What this means for your data partner choice
If you’re a robotics startup that’s going to sell into enterprise within the next 12–18 months, the data partner conversation isn’t just about engineering quality. Procurement will eventually evaluate the supply chain behind your product. Picking a data partner who can survive that evaluation — named-operator audit trails, sub-processor discipline, deletion timelines that hold up in contract — saves a lot of friction later.
If you’re already at the procurement-evaluation stage and your current data partner can’t answer the seven questions above, that’s a sign. Talk to us — we answer all seven before contract.
\n\n
\n
