Vendor questionnaire
Questions for a vendor
Please answer each question in writing. Where an answer is in your contract, security documentation or a published page, a reference to it is fine. If a question does not apply, say why.
Data location
In which countries is our data stored, including backups and support copies?
A good answer Named countries or regions, in the contract, with notice before they change.
Which subprocessors (other companies) handle our data, and how will you tell us when that list changes?
A good answer A published list, and advance notice of changes with a way to object or leave.
Data protection
Will you sign a data processing agreement that says you act only on our instructions?
A good answer Yes, a standard agreement you can review before signing, covering security, subprocessors, breach notice and deletion.
Is our data encrypted in transit and at rest, including in backups?
A good answer Yes to all three, described in writing.
Have you handled records like ours before, and will you sign the agreements the law requires for them (for example a business associate agreement under HIPAA in the United States)?
A good answer Experience with your kind of records, and a clear yes to the agreements your law requires.
Will you keep any of our data on your own devices, how is it protected, and how will you delete it at the end?
A good answer As little as possible, on encrypted devices, deleted at the end with written confirmation.
Will anyone else (subcontractors or freelancers) work on our project or see our data?
A good answer A named list, agreed with you in advance.
Access
Which of your staff can see our data, when, and is that access logged?
A good answer Access only for named roles, only when needed, logged, and visible to you on request.
Are single sign-on and multi-factor authentication included in the plan we are buying?
A good answer Yes, in your tier. Security features should not cost extra.
Can we see a log of who viewed or changed our records, including your own staff?
A good answer An audit log you can read or export yourself.
How do your technicians connect to our systems, and is that connection protected with multi-factor authentication and logged?
A good answer A named remote-access tool, multi-factor authentication on every login, and logs you can ask for.
Will each of your staff use their own named account on our systems, removed when they leave your company or our contract?
A good answer Named accounts only, no shared logins, and removal the same day.
Will we always keep our own administrator access and the master passwords to our systems?
A good answer Yes. You own your accounts; they work for you.
Security
How and how often do you apply security updates to our systems, and how will you tell us when you cannot?
A good answer Automatic or scheduled updates, with a report of what was missed and why.
Are you compliant with PCI DSS for card payments, and can you share your attestation of compliance?
A good answer Yes, with a current attestation covering the service you are buying.
How do you check a request to change the bank account our money is paid into?
A good answer A callback or second-factor check before any change, and a notice to you when it happens.
Breach
How quickly will you tell us about a security incident affecting our data, and who will tell us?
A good answer A fixed number of hours or days written into the contract, and a named contact.
Evidence
What independent security evidence can you share: SOC 2 report, ISO/IEC 27001 certificate, recent penetration test summary?
A good answer A current report or certificate whose scope covers the product you are buying.
What insurance do you hold (for example professional indemnity or cyber insurance), and for how much?
A good answer A current certificate you can see.
Ownership
Will our domain name and hosting accounts be registered in our organization’s name, with us as the owner?
A good answer Yes, in your name and account, with the vendor added as a user you can remove.
Accessibility
Do you have an Accessibility Conformance Report (ACR), and which WCAG version and level does it cover?
A good answer A recent report for this product, honest about known gaps and when they will be fixed.
Exit
If we leave, how do we get all of our data back, in what format, and at what cost?
A good answer A complete export in an open, documented format (such as CSV or JSON), at no extra charge.
How long after we leave do you keep our data, and will you confirm deletion in writing?
A good answer A short, stated period, then deletion, confirmed in writing.
Do you back up our website and its form submissions, where are the backups kept, and when were they last restored?
A good answer Regular backups kept separately from the live site, and a date of the last test restore.
How will you tell us about outages, and what happens to our data if your company closes or is sold?
A good answer A status page or notice process, and a contract term that lets you take your data and leave.
Price
Does the contract renew automatically, how much notice must we give to cancel, and how much can the price rise at renewal?
A good answer Renewal reminders, a short notice period, and a cap on increases written into the contract.
If we have a nonprofit or public-sector discount, how long does it last and what happens when it ends?
A good answer A stated term, and the full price you will pay afterwards.
Are there minimum user numbers, implementation fees, support fees or charges for exporting data?
A good answer All one-off and recurring costs listed in the order form.