What a large client asks before signing
You have won the commercial conversation. Next comes a file with forty security questions, from someone you have never met, due in three days. It is not bureaucracy: your client answers for their suppliers, and you are now one. This is what they ask, what the questions mean, and why a fast, precise „no” helps you more than a vague „yes”.
1. Why this is happening now
When a client sends you data about their people or their customers, they remain responsible for it. In GDPR terms they are the controller, you are the processor, and the relationship has to sit in a contract. So the questions are not a test of you — they are questions that will be put to them if something happens at your end.
2. The seven questions that almost always appear
| The question | What it is really asking |
|---|---|
| Where is the data hosted? | Whether it leaves the EU, and on what basis. |
| Which sub-processors do you use? | Who else touches the data. They want a list, not a reassurance. |
| Who at your company has access? | How many people, with what access, and what happens when one leaves. |
| Is 2FA mandatory? | The best effort-to-effect ratio in the whole list. „It can be enabled” is not a yes. |
| What do you do in an incident? | How fast you tell them. The controller has 72 hours; they want to know they will hear from you in time. |
| How do we get our data back? | Meaning: what if you disappear, or we fall out. |
| Do you have ISO 27001 or SOC 2? | The dreaded one. See below. |
3. What to do when the answer is „no”
A five-person company does not have ISO 27001. The answer that works has three parts, in this order: no, we do not — said plainly, at the start; here is what we have instead — concrete and checkable; here is what we can do for you — a signed data processing agreement, the list of sub-processors, an hour with the engineer who wrote the software rather than a salesperson.
4. The mistake that loses the contract
It is not „we have no certification”. It is the vague answer. „Data is stored securely in state-of-the-art data centres” says nothing, and the person reading it knows — they have read that sentence a hundred times.
| Does not help | Helps |
|---|---|
| „We use bank-grade encryption” | „National ID numbers and connector credentials are encrypted in the database; the encryption keys are themselves encrypted with a certificate that is not in the database” |
| „We back up regularly” | „Hourly. Restoration has been rehearsed, not merely configured” |
| „We separate clients” | „The company filter is applied by construction, and writing into another company must be declared explicitly in code or a guard throws — with tests on every change” |
The right-hand column does not require a certification. It only requires knowing what you built.
5. What to prepare before anyone asks
- A public page answering the seven questions.
- A data processing agreement ready to sign.
- The list of sub-processors.
- The export procedure, written down.
- The „what we do not have” chapter — written by you, calmly, before they find it.
The last one surprises people: an honest list of gaps reads as confidence, not weakness.
Example Our own security page Where the data lives, what is encrypted at rest, how companies are separated — and the „what we do NOT have” chapter. Use it as a model for yours.Sources
GDPR article 28 (controller / processor relationship) and article 33 (72-hour breach notification by the controller). The rest is practical experience rather than legal basis. For actual contract wording, ask a lawyer.