An enterprise buyer sends you 120 questions about your security. What they're really checking, how to answer without lying, and the six documents to have ready before anyone asks.
You've won the interest. The demo went well. Then procurement sends a 120-row spreadsheet titled Vendor Security Assessment, and your deal stops dead for six weeks.
That moment kills more B2B deals than people think — not because early-stage companies are insecure, but because they have nothing ready to attach.
A hundred and twenty questions, five concerns.
Where is my data, and who can read it? What happens if you disappear? How will I know there's been an incident? Are your employees a risk? And the last one, the difference between an answer accepted and an answer challenged: can I verify what you're claiming?
An institutional buyer fears your insolvency more than your breach. That's why reversibility — backups, export, continuity — carries more weight than you'd expect.
Never tick “yes” to anything you can't prove the same day.●
An unverifiable yes, discovered during due diligence, costs the deal and often the relationship. A “no, planned for Q4, here's the compensating control in place today” gets through almost every time. Institutional buyers work with imperfect vendors daily; what they don't tolerate is finding out late.
Three acceptable answers.
Yes, with evidence attached. No, with a date and a compensating control. Not applicable, with the reason. Anything else reads as a red flag.
The six documents to have ready before anyone asks.
A two-page security architecture note: data flows, where data sits, who reaches it, how it's encrypted. The list of subprocessors with their hosting region — you inherit your vendors' compliance, so use it. The incident response procedure: who decides, within what window you notify, who writes.
Then the access control policy — least privilege, two-factor, quarterly review, revocation on departure. The restore evidence, meaning the date of the last successful restore test: a backup never restored is not a backup, and an experienced buyer asks exactly that. And a data processing agreement ready to sign, aligned with Law 25 and the GDPR — having it in hand saves two weeks.
What “we're SOC 2 compliant” often means.
We bought a compliance tool and we're mid-audit. SOC 2 Type I attests to a design at a point in time; Type II attests to operation observed over a period, usually three to twelve months. Two very different things, and an informed buyer will ask which, and over what period.
If you have neither, say so. Plenty of vendors are selected without certification when their documentation is clean and their answers verifiable. What is never selected is a vague claim.
The real cost of being unprepared.
Six weeks added to the sales cycle, a founder spending two weeks writing policies instead of selling, and a risk of failure that rises every week — because a deal that drags loses its internal sponsor. Those six documents take a few days when written calmly. Written under deal pressure they take three times as long, and it shows.
What we don't do.
We don't fill in a client's security questionnaire by ticking what the product doesn't do yet. We fix what's fixable in a week and write the rest honestly, with a date. Slower in the first month, and much faster by the third client.