Free document

Security Questionnaire Response

A security questionnaire answer bank for software startups selling to enterprises: certifications, hosting, encryption, access, incidents, vendors and gaps.

Updated October 7, 2026

security questionnaire
enterprise sales
SOC 2
vendor review

Edit with AI Download (.docx)

Free download · No account needed

Want it written around your situation? Describe it in the Founder Document Studio for Startups.

About this document

A security questionnaire response is a vendor's set of answers to a customer's questions about how it protects data, asked before the customer buys. This version is an answer bank for a software company: certifications, a question table by area, a gap plan and a list of documents you can share.

Use the security questionnaire response as your master copy and paste from it into each customer's own form, whether a spreadsheet or a vendor portal. If the customer also asks you to sign data protection terms, start from the data processing agreement. Answer only what is true today, because a control you claim but do not have can lose the deal or breach the contract later.

How to fill it in

Describe the product and data. Say what the product does, which customer data you handle, and whether it includes personal, health or payment data. Name a security contact.
Record certifications honestly. For SOC 2, ISO 27001 and penetration testing, give the real status and date, and say which reports you share under an NDA.
Answer each area with detail. Fill in hosting, encryption, access, logging, incidents, backups, vendors, deletion, training and AI use. Add the detail a reviewer will check, such as regions and fix times.
List gaps with dates. Put each missing control in the gap plan with a target date, then have your technical lead check every answer before it goes to a customer.

Security Questionnaire Response

[Company] for [Customer] · Prepared by [name, title] · [Date]

Answer only what is true today. "No, planned for Q3" is a fine answer; a control you claim and do not have can end the deal or breach the contract later. Keep this document as your answer bank, and copy from it into each customer's own form.

1. Company and product

Product	[What it does, in one or two sentences]
Customer data we handle	[Types of data, for example: names, work emails, and documents the customer uploads. Say whether it includes personal, health or payment data.]
Security contact	[Name, email]

2. Certifications and reports

Standard	Status	Evidence
SOC 2	[Not started / In progress, expected date / Type I / Type II]	[Report available under NDA]
ISO 27001	[ ]	[ ]
Penetration test	[Last test date, by whom]	[Summary letter available]
[Industry requirement, for example HIPAA]	[ ]	[ ]

3. Answers

Area	Question	Answer	Details
Hosting	Where is customer data stored?	[Provider, region]	[Whether data ever leaves that region]
Encryption	Is data encrypted in transit?	[Yes / No]	[Protocol and version]
Encryption	Is data encrypted at rest?	[Yes / No]	[Method and who manages the keys]
Access	Do you support single sign-on for customers?	[Yes / No / Planned]	[Which providers]
Access	Is two-factor sign-in required for your staff?	[Yes / No]	[Which systems]
Access	Who at your company can see customer data?	[Roles]	[How access is granted, reviewed and removed]
Logging	Do you keep audit logs?	[Yes / No]	[What is logged and for how long]
Vulnerabilities	How do you find and fix security flaws?	[ ]	[Scanning, dependency updates, target fix times]
Incidents	Do you have an incident response plan?	[Yes / No]	[How and how quickly you notify customers]
Backups	How is data backed up and restored?	[ ]	[Frequency, retention, last restore test]
Vendors	Which subprocessors handle customer data?	[List]	[Link to your subprocessor list]
Privacy	Will you sign a data processing agreement?	[Yes / No]	[Your standard version, if any]
Data deletion	What happens to data when a customer leaves?	[ ]	[Export option and deletion timeline]
People	Do staff receive security training?	[Yes / No]	[How often]
AI	Is customer data used to train AI models?	[Yes / No]	[Which providers see it and under what terms]

4. Gaps and plan

Listing gaps with dates builds more trust than leaving blanks.

Gap	Plan	Target date
[For example: no SOC 2 report yet]	[Audit window started with a named auditor]	[date]

5. Documents available on request

[Security overview]
[Penetration test summary]
[Data processing agreement]
[Insurance certificate]

Page 1 of 2407 words

Frequently asked questions

Can a startup sell to enterprises without a SOC 2 report?

Yes, often for early deals. Many buyers accept a completed questionnaire, a penetration test summary and a dated plan to get SOC 2 instead. Larger or regulated buyers may require the report before signing, so ask early what their security review needs.

What is the difference between SOC 2 Type I and Type II?

A SOC 2 Type I report checks whether your security controls are designed properly at one point in time. A Type II report tests whether they actually worked over a period, often three to twelve months. Enterprise buyers usually prefer Type II.

What is a subprocessor?

A subprocessor is another company you use that handles your customers' data, such as a cloud host, an email service or an AI model provider. Customers ask for the list so they know where their data goes, and many contracts require notice before you add one.

Security Questionnaire Response

About this document

How to fill it in