Notes for owners · Sales management
Security and data questions buyers ask a vendor, and how to answer them ahead
The security and data questions a buyer's IT or procurement team sends a technology vendor, with a plain-language page that answers them in advance so reviews move without a long email chain.
The GullySales team · Updated 17 Oct 2026 · 6 min read
On this page
A long security questionnaire lands in your inbox on the day you thought the deal was closed. Buyers send the same security and data questions again and again, so you can answer most of them ahead with one plain-language page and a master answer sheet. The questions cover where data sits, who can see it, what happens when something goes wrong, how it is backed up and what leaves with the buyer at the end. State only what is true today, and name one person who owns the answers.
What do buyers actually ask?
The wording changes by buyer, but the themes hold steady. A larger company's IT team sends a spreadsheet; a smaller company's owner asks the same things in one phone call.
| Theme | The question in plain words | What a good answer includes |
|---|---|---|
| Location | Where is our data stored? | The country and the kind of hosting, named plainly |
| Access | Who at your firm can see it? | Roles, not names; how access is added and removed |
| Protection | How is it protected? | Login controls, encryption in general terms, how staff devices are handled |
| Backup | If it is lost, can you restore it? | What is backed up, how it is tested, who does it |
| Incidents | What happens if there is a breach or outage? | Who tells the buyer, in what form, who investigates |
| Subcontractors | Does anyone else touch our data? | A list of the third parties and what each does |
| Exit | What happens to our data if we leave? | How it is returned and how it is deleted |
Rules about personal data, sector-specific obligations and what counts as adequate differ by state and body and change, so check with your own adviser or the regulator before stating anything as a legal position. Your page should describe what you do, not what the law demands.
Why does a plain page save time?
A procurement review can stall for weeks because the same questions arrive by email in a different format each time, and each answer is written fresh by whoever is free. Meanwhile the owner who wanted your product may start talking to a rival.
A page that answers the common questions lets the buyer's reviewer tick many boxes before writing to you. It also shows a firm that has thought about this.
How do you build the master answer sheet?
Gather every questionnaire you have received, including the ones you answered badly. Copy each question into one sheet, group them by the themes above, and write one approved answer to each.
Then run three checks on each answer.
- Is it true today? Not planned. Not copied from a template. Ask the person who does the work, such as whoever manages backups.
- Can you prove it if asked? If you say backups are tested, you should be able to show the last test record.
- Would a non-technical reader follow it? The buyer's procurement officer may not be an engineer.
Flag every question where you cannot truthfully say yes. Beside each, write what you do instead and what you plan to change. An honest gap with a plan may read better to a reviewer than a column of blanket yeses.
Here is how one row of the sheet can read when the honest answer is a gap, with an invented firm:
| Question | Answer as of the review date | Gap and plan |
|---|---|---|
| Is a restore from backup tested? | Backups run on a set schedule. A restore test has been done on one customer's data. | Restore tests are not yet routine. The technical lead will set a schedule and record each test. |
A reviewer can read that row as a firm that knows its own position.
Version the sheet, with a date and a name against each change. When a practice changes, the sheet changes the same day.
Case: a payroll software firm in Bhopal
Imagine an invented payroll software firm in Bhopal that answers each questionnaire from scratch. One buyer asks whether data is encrypted, and the salesperson types "yes" from memory. Weeks later another buyer's reviewer asks for the details. The technical lead reads the earlier answer and says it was broader than the truth. The deal stalls while the firm checks.
Someone who did not own the facts gave a confident answer. Now the technical lead owns a master sheet. Every answer carries a date, and anything the lead cannot confirm is marked as such with the plan beside it. The firm also publishes a one-page "How we handle your data" with the hosting location, access roles, backup practice, incident route and exit terms. When the next questionnaire arrives, the salesperson sends the page first and fills the rest from the sheet. The lead reviews it before it goes.
Much of the email chain goes, and only the unusual questions need fresh work. Not all of it: one bank-linked buyer still sends a forty-page questionnaire that the page does not cover, and the technical lead spends two days on it.
What should the public page say and not say?
Say what you do, in short sentences, with a date of last review. Name the hosting region. Describe access by role. Explain your incident route in one paragraph: who the buyer hears from and in what form. State plainly what happens to data when the contract ends.
Do not name certifications you do not hold, quote rules as if they are settled, or promise that nothing will go wrong. Do not publish detail that would help an attacker, such as internal tool names or network layouts. Keep that for the buyer who has signed a confidentiality agreement and asked.
Where a buyer's questionnaire is part of a formal tender, the same sheet feeds the response. Our note on vendor registration packs lists the other documents a purchase team asks for.
How much is enough for your buyers?
If you sell small, low-risk tools to buyers who never ask, a short page and a sheet in a drawer are enough. If you handle sensitive data or sell to banks, hospitals or government, you need more than a page, and an adviser to review your answers before they go out.
Turn three questionnaires into one sheet
Collect the last three questionnaires you received and merge them into a single sheet. Questionnaires inside a formal tender are handled differently, as in RFP and tender management, and other work for software and IT firms is under technology. When you want help setting up the page and the sheet, tell us what you need.
