Security question explainer

MeansWhether stored data and data moving over networks are encrypted, so it's unreadable if intercepted or a disk is stolen.

AnswerName the standards (e.g. AES-256 at rest, TLS 1.2+ in transit), where they apply, and who manages the keys. Reference the relevant policy.

MeansWhether an independent auditor has certified your security controls against a recognised framework.

AnswerState which report/certificate, the type (SOC 2 Type II vs Type I), the scope and the date, and offer it under NDA. If in progress, give the expected date.

MeansWhether logins require a second factor beyond a password, for staff and ideally for customer accounts.

AnswerConfirm MFA is enforced for all staff and admin access, name the method (e.g. TOTP, hardware keys, SSO), and note customer-facing MFA options.

MeansData residency: the physical/legal location of the data, which matters for GDPR and other regulations.

AnswerName the provider and region(s), whether data ever leaves them, and any residency options. Be exact; this answer becomes part of the contract record.

MeansThe third parties that process customer data on your behalf (hosting, email, analytics, support tooling).

AnswerLink to a current subprocessor list, state how customers are notified of changes, and confirm data-processing terms are in place with each.

MeansHow long you keep data and how it's deleted when a customer leaves or requests removal.

AnswerGive retention periods by data type, the deletion process and timeframe (including backups), and how you confirm deletion on request.

MeansWhether independent testers actively try to break your systems to find vulnerabilities.

AnswerState frequency (at least annually and on major change), that it's third-party, and that findings are remediated. Offer a summary/attestation letter.

MeansHow you detect, contain, investigate and communicate a security incident or breach.

AnswerSummarise the plan (detect → triage → contain → eradicate → recover → review), who owns it, and your customer-notification commitment and timeframe.

MeansRecovery Point Objective (how much data you could lose) and Recovery Time Objective (how fast you restore service) after an outage.

AnswerGive concrete targets (e.g. RPO 1 hour, RTO 4 hours), how backups support them, and how often recovery is tested.

MeansWhether access follows least privilege and role-based controls, and how it's reviewed.

AnswerDescribe RBAC, least-privilege defaults, approval for access, periodic access reviews, and logging of who accessed what.

MeansHow you find, prioritise and patch security vulnerabilities on an ongoing basis.

AnswerCover scanning frequency, dependency monitoring, and remediation SLAs by severity (e.g. critical within X days).

MeansTenant isolation: how one customer's data is kept from another's in a shared platform.

AnswerExplain the isolation model (logical separation with tenant IDs, or dedicated instances), and the controls that enforce it.

MeansWhether you can keep operating, and restore service, through a major disruption.

AnswerConfirm a documented BC/DR plan, its key objectives (linked to RPO/RTO), and that it's tested at least annually.

MeansWhether security-relevant events are recorded, retained and available for review or investigation.

AnswerState what's logged, retention period, tamper-resistance, and whether customers can access logs for their own tenant.

MeansPre-employment vetting for people who can access customer data or systems.

AnswerState the checks (identity, right-to-work, references, criminal where lawful), whether they cover all staff or privileged roles, and that contractors are included.

MeansWhether staff are regularly trained to spot phishing and handle data safely.

AnswerConfirm training at onboarding and at least annually, phishing simulations, and that completion is tracked and enforced.

MeansSingle sign-on and automated provisioning/deprovisioning from the customer's identity provider.

AnswerName the protocols (SAML 2.0, OIDC), which plans include SSO, and whether SCIM auto-provisioning is available.

MeansHow API keys, passwords and encryption keys are stored, accessed and rotated.

AnswerCover a secrets manager or KMS, no secrets in source code, least-privilege access, and a rotation policy.

MeansYour commitment to tell affected customers when their data is caught up in an incident.

AnswerGive a concrete timeframe. Many vendors commit to "without undue delay", mirroring GDPR's 72-hour regulator deadline; US state laws vary, so state your own target and the channel.

MeansA contract governing how you process personal data on the customer's behalf.

AnswerConfirm a standard DPA that lists subprocessors and security measures, and that cross-border transfers use SCCs (EU) or the IDTA / UK Addendum (UK).

MeansFinancial cover for security incidents and related liability.

AnswerConfirm cover is in force, give the limits, and offer a certificate of insurance on request.

MeansWhether real customer data is isolated from test and development systems.

AnswerConfirm environments are segregated, that production data isn't used in dev/test, and that production access is restricted and logged.

MeansWhether security is built into how you design, build and ship code.

AnswerCover peer code review, automated dependency/SAST/DAST scanning, change approval, and separation of duties between who writes code and who deploys it.

MeansThe service level you guarantee, and how it's measured and evidenced.

AnswerGive the SLA figure (e.g. 99.9%), how it's measured and credited, and link a public status page with incident history.

MeansYour standing under the major privacy regimes, and who owns data protection.

AnswerConfirm which regimes apply (UK/EU GDPR, CCPA/CPRA), your lawful basis, how you handle data-subject requests, and name your DPO or privacy contact.

MeansHow the customer gets assurance beyond your own self-assessment.

AnswerOffer your SOC 2 Type II / ISO 27001 certificate and latest pen-test summary under NDA, a bridge letter between audit cycles, and note any right-to-audit terms.