Security questionnaire template: answer every row with a source

Download the template (CSV, 39 questions). It opens in Excel or Google Sheets, and it has the column most answer libraries leave out: the sentence, copied word for word from your own documents, that makes each answer true.

Here is a row from it, filled in from our own security page:

Question	Answer	Source sentence	Source	Status
Do you retain security event logs for at least six months, and do you monitor them regularly?	No. We keep them 90 days. Monitoring: not stated publicly.	"Security and authentication logs are normally retained 90 days."	accountmade.com/legal/security, section 6, effective August 25, 2026	Sourced

That's a complete answer, and it's a No.

The rule behind the template fits on one line. Never send a Yes you can't quote.

We tried the rule on ourselves. On October 17, 2026 we answered 31 questions from Google's Vendor Security Assessment Questionnaire (VSAQ) using only AccountMade's public pages. Two were about running physical data centers, which we don't. Of the other 29, our pages answered 12, and only 6 of those answers were a plain Yes. The other 17 need a document we haven't published.

The misses bunch up. Data location and hosting went 3 for 3, because a subprocessor list already says which provider runs what and where. Personnel went 0 for 4: background checks, removing a leaver's access, contractor training, laptop disk encryption. On vulnerability management we could source a bug-report address and a once-a-year promise of security information, and no patch schedule, scan results or penetration tests.

Closing those 17 rows takes 17 different documents, from a restore-test record to a pen-test report to a device-management export. Each one is a request to a person. Those requests set how fast the questionnaire goes back, not the typing.

This guide is for whoever gets the spreadsheet at a small SaaS company with no security team: a founder, a sales lead, a solutions engineer. The six steps below carry one question all the way through.

How we did this. 31 questions from Google VSAQ (Apache-2.0), answered from our security page, privacy policy, DPA, terms, subprocessor list and pricing page as saved on October 17, 2026, with AI help, every quote machine-checked against the saved page. One pre-launch company on one day: a worked example, not a benchmark.

The six steps

The running example is VSAQ's dc_provider: "Who is your data center provider?" Each step shows a wrong cell and a right one. The wrong ones are illustrations we wrote, not quotes from anyone.

1. List the documents you can quote

Write down every document that could back an answer, with the date it last changed. Ours:

Document	Date on the page
Security overview	Effective August 25, 2026
Privacy policy	Effective September 7, 2026; last updated October 12, 2026
DPA	Effective August 25, 2026
Terms	Effective September 7, 2026
Subprocessor list	Last updated October 12, 2026
Pricing	Undated; record the day you read it

Slack threads, old decks and last year's questionnaire stay off the list. They're copies, and copies drift from the thing they copied.

• Wrong source for dc_provider: last year's questionnaire, hosting tab.
• Right source: the subprocessor list, last updated October 12, 2026.

2. Triage every row before you answer any

Sort each question by where its answer lives:

Question type	Where the answer lives	Who signs
Hosting, data location, subprocessors, retention, AI use	Public pages (subprocessor list, privacy policy, DPA)	Whoever owns the page
Encryption at rest and in transit	Public page, if it names the provider controls	Infrastructure owner
Patching, scanning, pen tests, admin-access audits	Internal: patch policy, scan output, pen-test report	Infrastructure owner
Background checks, leavers, training, laptops	Internal: HR process, offboarding checklist, device policy	Whoever runs people ops
Physical data-center controls	Your hosting provider's own report	Not you: cite the provider

The internal pile is the slow one. Send those requests on day one, then answer the public rows while you wait.

• Wrong: start at row 1 and work down in the buyer's order.
• Right: tag dc_provider "public page" and move on. The 17 internal rows go out as requests before you answer anything.

3. Find the sentence and paste it

Copy the exact sentence into the source column. A link is not a source. It points at a whole policy and lets you skip the reading, which is where the unsupported answers hide.

• Wrong source cell: accountmade.com/legal/subprocessors
• Right source cell: Vercel Inc., "Application hosting, serverless functions, scheduled jobs, edge delivery and CDN". Supabase Inc., "Database, authentication, object storage", located "United States (AWS us-east-1)".

If the sentence doesn't turn up in five minutes, the row moves to the internal pile.

4. Write the answer to the sentence, not to the question

Say exactly what the sentence says. Answer values: Yes, No, Partial, Not stated publicly, or N/A. Silence is not a No. Mark it "Not stated publicly" and name the document that would settle it.

• Wrong answer to dc_provider: "AWS."
• Right answer: "Application hosting: Vercel, functions in the US East region. Database, authentication and object storage: Supabase, on AWS us-east-1."

"AWS" isn't false. It leaves out the provider that runs the application. Three more rows from our set:

Question	Wrong	Right
Where is data stored? (dc_countries)	"All customer data stays in the United States."	Partial. Application, database and storage are hosted in the U.S.; delivery runs over a global edge network; the company operates from Korea, so data may be processed outside the U.S. (privacy policy, section 9; subprocessor list)
Is customer data used to train AI models?	"No, never."	Partial. The page says AccountMade "does not use Customer Content to train general-purpose models", and the answer keeps the qualifier.
Do independent testers run pen tests? (testing_pentests)	"Yes, annually."	Not stated publicly. Evidence that would settle it: a pen-test report or engagement letter, or a written statement that none has been done.

The first wrong answer is the dangerous kind: almost true, and easy to send. The third right answer is a gap stated honestly, and it costs one request to whoever would hold the report. "Yes, annually" costs nothing until the buyer asks for the report.

5. Have someone who could produce the evidence approve it

The approver for "yes, we have X" is someone who could hand over X.

• Wrong approver cell for dc_provider: "Sales".
• Right: the named person who runs the hosting account and could show the provider contracts.

At a company our size that's often the same person for every row. Write the name anyway.

6. Save the exact file you sent, with the date

Keep the file that went to each buyer, not just the latest version of your answers.

• Wrong: security-answers-latest.xlsx
• Right: 2026-10-17 BuyerName VSAQ.csv, kept unchanged after sending.

Here's why, on the same row:

On October 11, 2026, our application hosting moved to Vercel and Anthropic became the AI provider. On October 12, OpenAI was added as a backup, used only when Anthropic returns an error. A dc_provider answer written on October 10 would have named a different host, and nothing in it would look wrong today without the date beside it. (Both changes came before launch, with no customer DPAs in force.)

When a source changes, the dated copies tell you which buyers have the old answer. The buyer keeps their copy either way.

Before you send it

• Every Yes has a sentence in the source column, and the source has a date.
• Every No has a sentence too. Our No on log retention is quoted, and so is SAML SSO: "Features we don't offer yet, such as SAML SSO and SCIM, aren't included."
• No row says No where the page is silent. Those say "Not stated publicly" and name the evidence.
• MFA, pen tests, background checks and patching are answered from documents, not memory.
• Each source has been checked against its change log since you last answered.
• Every row has an approver's name.
• A dated copy of the file is saved under the buyer's name.

Disclosure: AccountMade is built by The Plain Works. It drafts security briefs and other buyer documents from sourced claims. AI agents researched and drafted this piece. Nothing in it needs the product: the template works in any spreadsheet.

The template's 31 VSAQ questions are Google's, under the Apache 2.0 licence, and the question_source column says so; keep it if you share the file. The other 8, marked AM-01 to AM-08, cover topics VSAQ predates (MFA, AI training, subprocessor notice) and were written by us. Three rows are filled in from our pages; the other 36 are blank.

Download the template (CSV), open your own security page, and fill in dc_provider first. It's the row you can source in five minutes.