Answer your first SaaS security questionnaire without bluffing

Capture the buyer request exactly as sent
30 min
There is no EU-wide security questionnaire form or statutory deadline. Every enterprise review is buyer-defined due diligence, not a GDPR filing — the request email or portal is the specification. Treat it as the source of truth and copy it verbatim before you interpret or answer anything.
Create a single page at the front of your answer register called Buyer request record and paste the exact fields as received. Do not normalise, summarise or translate at this stage.
Copy these fields character-for-character:

questionnaire file name and version or date shown in the header

evidence list the buyer asks for (policies, reports, certificates, attestations)

portal name and URL, account or invitation details, submission format and naming rules

buyer contact name, role and email for clarifications

deadline with date, time and timezone (e.g., 12 May 2026, 17:00 CET) and any staged dates

submission instructions: upload button, email, or portal section

Save the original email as PDF and the portal invite screenshot alongside. If any item is missing — no timezone, no portal access, no version, no evidence list — ask the buyer in writing now and paste their reply into the same record. Never assume a standard EU deadline or form.
- Save buyer email and questionnaire file as received (PDF) in a versioned folder
- Create Buyer request record at top of register with all 6 fields above
- Record deadline with date, time and explicit timezone from the buyer text
- Paste portal URL, login or invite detail and file-format or naming rules
- Send one written clarification for any missing item and file the reply verbatim

0/4 done

Contents