Matt Turley, Continuum. Updated November 5, 2026.
For founders of a young product whose first business customer, pilot or enterprise prospect has sent a spreadsheet of security questions.
Start by answering truthfully from facts you can check, not from what sounds good. List what data you hold and where, who has access, which vendors touch it, how it is protected and what you do on an incident. Mark gaps as planned with a date. Never claim a certification you do not have.
A security questionnaire is a buyer trying to decide whether giving you their data is a risk they can defend internally. It is rarely a test you pass or fail on a single answer. The reviewer looks for honesty, awareness and a plan, and is quick to distrust answers that are all perfect.
Questionnaires usually ask about the same areas: access control, data protection, infrastructure, vendor management, logging and incident response, backups and business continuity, software development practices and compliance. A small product can answer most of them truthfully with a short list of basic controls.
The danger is answering from aspiration. Marking "yes" to multi-factor authentication on all systems, encryption, logging and penetration testing when you have not checked is both a trust problem and, if it goes wrong later, a contractual one.
How to tell They ask who can access production, how access is granted and removed, and whether multi-factor authentication is required. Many early teams share logins or have a departed contractor still in a dashboard.
The fix List everyone with access to hosting, database, source code and payments. Remove what is not needed, turn on two-factor authentication everywhere and keep admin to a minimum.
How to tell They ask what personal data you store, where it is hosted, whether it is encrypted in transit and at rest and how long you keep it.
The fix Write a one-page data inventory. Confirm HTTPS everywhere and what your database and storage providers do by default for encryption at rest, and state it accurately.
How to tell They ask how you prevent and find vulnerabilities, whether you test and how you manage dependencies. AI-generated code is rarely reviewed by anyone.
The fix Get the code read by someone who knows what to look for, fix what matters, turn on dependency vulnerability alerts and keep the evidence.
How to tell They ask which third parties handle their data. An AI-built app often sends data to several without anyone listing them: hosting, database, email, analytics, error tracking and AI model providers.
The fix List every vendor that touches customer data and what it touches. Check that each one's terms fit what you promise, including whether prompts sent to an AI provider are retained or used for training.
How to tell They ask how you would detect a breach, who is responsible and whether backups are tested. A one-person team usually has no written process.
The fix Keep access and error logs, write a half-page incident plan (who decides, who is told, in what order), and take and test a backup restore once.
How to tell They ask whether you have SOC 2, ISO 27001 or similar. Early products almost never do, and some questions assume you do.
The fix Say what you have, honestly. "Not yet; here are the controls we operate, and our plan" is an acceptable answer. Do not imply a certification, and do not describe a vendor's certification as your own.
If the questionnaire is short and your honest answers are mostly "yes, and here is how", fill it in yourself. An independent read becomes valuable when the questions go into application security and you have never had the code reviewed. A Ship Check is not a compliance audit, penetration test or certification, and will not replace one if your customer requires it.
A Ship Check is an independent, written read of the codebase with a security and data section. It gives you evidence to answer from and a list of fixes. It is not a compliance audit or a formal penetration test, and we will tell you if your customer needs one.
Ship Check, $299: A senior engineer reads your codebase and sends a written verdict (fine, fixable or rewrite), what will break first, a security and data read, and a costed plan, within 48 hours of repo access or it is free. It has a 7-day money-back and is credited against a Ship Fix. Or: Book a call.