When you sell software to a large organisation, there is a moment where the conversation stops being about features and starts being about risk. A security questionnaire arrives, or a call gets booked with someone whose job is to find reasons to say no. The teams that handle this well are not the ones with the most certifications. They are the ones who answered the real questions clearly, and did not pretend.
Here are the questions that come up again and again, and what a straight answer looks like.
Where does our data live, and who can touch it?
They want to know the hosting region, whether data is encrypted in transit and at rest, and which of your staff can access production. "Encrypted and access-controlled" is not an answer. Naming the region, the encryption, and the fact that production access is limited and logged is.
How is our data separated from other customers'?
For any multi-tenant product, this is the question under the question. Be specific about your isolation model and where the boundary is enforced. If a large customer can be moved to their own database, say so — it is often the thing that unblocks the deal.
What happens when something goes wrong?
Incident response, backups, and recovery. They are not asking whether you will ever have an incident — everyone does. They are asking whether you will notice, contain it, tell them, and recover. A short, real description of that process beats a promise that nothing will happen.
Who else can see our data?
Subprocessors. Every third-party service that touches customer data — hosting, email, analytics, a model provider — is part of your security posture, and mature buyers want the list. Keep it current and be ready to share it.
What certifications do you have?
This is where honesty matters most. If you hold SOC 2 or ISO 27001, provide the report. If you do not, say that plainly and describe the practices you build against instead. Claiming a certification you do not have is the fastest way to lose trust — and it is the one thing a good security reviewer will actually check.
You will not lose a serious enterprise deal for not having a certificate yet. You will lose it for being evasive about not having one.
Answer the questionnaire before they send it
The practical move is to write these answers down before anyone asks — a short security overview you can hand over on request. It shortens the sales cycle, and it signals that you have thought about this seriously, which is exactly what the person on the other side is trying to find out.