How to answer a vendor security questionnaire when you do not have SOC 2

What the questionnaire is really asking

A vendor security questionnaire is a long spreadsheet with a short job. Someone has to decide whether customer data can leave their company and sit in yours.

The rows look different on every form. They ask the same things: who else can see the data, what you do to protect it, whether agreements exist, and what happens when that set of companies changes.

You can answer without an audit report. The answers have to match the product this week.

Say you do not have a SOC 2 report

Use this when it is true.

We do not have a SOC 2 report. We do not claim a certification we have not completed.

If they also ask about ISO 27001 or HIPAA, answer those the same way. Missing is a fine answer. A badge you do not hold is not.

Then describe the controls you actually run. Who can reach production, how one customer's data stays separate from another's, encryption, logging, backups, and what you do when something goes wrong. If a control is a plan and not a habit, say so.

A vendor's audit belongs to that vendor. Do not attach it as your report.

Do not write that the report is on the way, or that a tool will close the gap. The reviewer compares the spreadsheet with the page you send. Those two have to say the same thing.

What to write when the form asks about a penetration test you have not had is in the penetration test guide.

What to write for how soon you tell the customer when something goes wrong is in the incident notification guide.

What to write when they ask how someone reports a vulnerability, including the address and whether you run a bounty, is in the vulnerability reporting guide.

What to write when they ask if customer data is encrypted is in the encryption guide.

What to write for who can still open customer data, how often that access is reviewed, and what happens when someone leaves, is in the access review guide.

What to write when they ask if you have restored a backup, including how backups work and a recovery time, is in the backup restore guide.

What to write when they ask if you support single sign-on, including the plan and the identity providers, is in the single sign-on guide.

What to write when they ask how one customer's data stays out of another's, including the mechanism, is in the customer data isolation guide.

What to write when they ask if customer data trains a model, including a direct no and a redaction miss, is in the customer data training guide.

What to write when the customer leaves and wants their data out, including a file another tool can open and how soon you delete, is in the customer data export guide.

The short packet to send

Send the form with three things. Leave out anything you cannot stand behind today.

• The no-report lineThe sentence above, in the certification row and in the note you attach.
• A security overviewOne page in your own words. Access, how customers stay separate, encryption, logging, backups, and what you do when something goes wrong. Only what is true.
• The current listEvery company that stores, moves, or can read customer data. What it does, where the data is processed when you know the place, and a link to that company's public agreement.

You add the agreement link. Trust Prep does not write, negotiate, or sign the agreement.

Use the same list in the spreadsheet and on any page you send. If the two disagree, the reviewer will ask which one is current.

The agreement and the privacy policy should name the same companies as that list. When a brand, a legal name, or an old name shows up in a different place, how to write the row is in the company names guide.

A table you can copy, with example rows, is in the subprocessor list template.

What happens when a subprocessor changes

This row asks whether the customer gets a real say. Writing that you will update the page, and nothing else, is an intention. That answer comes back.

Describe the mechanism you already have.

• You update the list when a company is added or removed, and each row shows the date you last checked it.
• You follow the notice clause already in the customer agreement. You name that agreement. You write a number of days only when the contract has one.
• You mention a right to object only when the agreement gives one, and you say what you do if you cannot resolve the objection.

Updating the page is part of the answer. It is not the whole answer. A public page can hold the current list, the dates, a dated change history, and a short How we notify you note that says what you do. The note is text you write. Trust Prep does not email customers, and it does not send the notice for you. If the contract requires an email, you send that email.

The longer note on the vendor list, the agreement, and change notice is in the security review guide.

What to put in the email, and where the number of days comes from, is in the subprocessor change notice.

Keep the answers so the next form is shorter

The next vendor security questionnaire is mostly the same questions. Keep the approved answers in a document you control: the security overview, the vendor list, and the change answer.

Next time, copy, paste, and check. Change a line when the product changed. Leave it when it did not.

That document stays with you. Trust Prep does not store those answers, fill the form, or keep an evidence folder.

If you want the longer notes

Why reviewers ask for the list, and what a public page is for, is in the vendor list guide.

How to answer the vendor list, the agreement, and the change notice is in the security review guide.

A table you can copy, with example rows, is in the subprocessor list template.

What to do when a vendor will only share a DPA on a higher plan is in the vendor DPA guide.

How long you keep customer data, and what to write when a vendor will not name a period, is in the data retention guide.