For an Indian B2B SaaS company, the first large enterprise deal often stalls at the same point. The buyer's security team sends a spreadsheet with dozens or hundreds of questions, and nobody on your side owns it. The sales cycle waits while engineers guess at answers between releases.
This post explains what enterprise security questionnaires usually ask, what evidence buyers expect for each area, how to show tenant isolation in a multi-tenant product and how to build a reusable answer pack, so the next questionnaire is faster to answer and easier to defend.
Quick answer: Prepare for a SaaS security questionnaire by building an answer pack before you need it: a short security overview, your policies, an architecture diagram, a recent independent penetration test with retest results, evidence of tenant isolation, access control and backups, an incident response summary and your data handling terms. Answer every question honestly and explain gaps with a dated plan.
What enterprise questionnaires usually cover
Formats vary. Some buyers use their own spreadsheet. Others use standard formats such as the Cloud Security Alliance CAIQ or the Shared Assessments SIG questionnaire. The topics are broadly similar.
| Area | Typical questions | Evidence to keep ready |
|---|---|---|
| Governance | Who owns security? Do you have policies? Are staff trained? | Policy set, named security owner, training records |
| Access control | Is MFA enforced for staff? How are admin rights granted and removed? | MFA settings, access review records, offboarding checklist |
| Tenant isolation | How do you keep one customer's data separate from another's? | Architecture note, pentest results covering cross-tenant tests |
| Application security | Do you test before release? How do you handle vulnerabilities? | Secure development practice, latest pentest and retest report |
| Data protection | Is data encrypted in transit and at rest? Where is it hosted? | Hosting region, encryption settings, key management note |
| Resilience | How often are backups taken and tested? | Backup schedule, record of the last restore test |
| Incident response | How and when will you tell us about a breach? | Incident response plan summary, notification commitment |
| Vendors | Which sub-processors handle our data? | Sub-processor list with locations and purposes |
| Compliance | Do you hold ISO 27001 or a SOC 2 report? How do you approach the DPDP Act? | Certificate or report if you have one, otherwise a roadmap |
Proving tenant isolation
In a multi-tenant product, the buyer's main fear is simple: can another customer see our data? Answers such as "we use a secure cloud provider" do not address it. Explain the actual mechanism.
- Tenant identity: set on the server from the authenticated session, never from a parameter the client can change.
- Query scoping: every database query filtered by tenant and enforced centrally, for example through ORM global scopes or row-level security, not left to each developer.
- Files and caches: storage paths, signed URLs and cache keys that include the tenant.
- Background work: jobs, exports, reports and webhooks that carry tenant context correctly.
- Testing: an independent test where testers log in as one tenant and try to reach another tenant's objects.
The usual failure is broken object level authorisation, the first item in the OWASP API Security Top 10: an API returns an object because the ID exists, without checking that it belongs to the caller's tenant. Cross-tenant testing of this kind is the core of our SaaS security testing.
Build a reusable answer pack
- Write a two-page security overview covering architecture, hosting region, encryption, access control, testing and incident response. Some buyers accept it as a first response, and it gives sales something to send at once.
- Keep a master answer library: every question you have answered, the approved answer and a link to the evidence. Give it an owner and review it every quarter.
- Get an independent penetration test of the product, including multi-tenant and API tests, and keep the retest that shows fixes.
- Prepare your sub-processor list and a standard data processing agreement.
- Offer a short call with the buyer's security team. A conversation often settles questions that would take weeks of email.
What to put in the security overview
- Architecture: a simple diagram of the application, database, storage and third-party services, with the hosting region.
- Access: how staff sign in, how admin access is approved and how access is removed when people leave.
- Data: what customer data you store, how it is encrypted and how long you keep it after a contract ends.
- Testing: when the product was last tested independently and how findings are tracked to closure.
- Incidents: how you detect problems and how quickly you commit to telling customers.
- Contact: a named person and a monitored mailbox for security questions.
How to answer when you have a gap
Every growing SaaS company has gaps, and experienced buyers know it. What damages trust is an answer that turns out to be false during a later audit or incident.
- Answer "No" or "Partially" when that is the truth, and add a sentence on compensating controls.
- Give a dated plan for material gaps, such as "SSO for customer admins planned for next quarter".
- Do not claim certifications you are still working towards. Say "ISO 27001 readiness in progress" instead.
- Do not copy answers from a template or another company's questionnaire. They will not match your architecture.
- Keep a record of what you told each customer, because contracts often turn those answers into commitments.
Mistakes that stall deals
- Leaving it to sales: engineers and founders must review technical answers.
- Sharing a report with open critical findings: fix and retest first, then share a summary.
- Contradictions: hosting or backup locations in your answers that differ from your privacy policy or contracts.
- No named contact: follow-up questions from the buyer go unanswered for days.
How EthicsComputer can help
Our SaaS application security testing checks tenant isolation, IDOR, role-based access, subscription limits and webhooks, and includes a retest and an enterprise-ready security summary you can share with buyers. For the APIs behind your product, our API security testing goes deeper, and if buyers ask for certification, our ISO 27001 readiness service helps you prepare for the audit.
Is an enterprise security questionnaire holding up a deal?
Tell us about your product and the buyer requirements, and we will suggest what to test and prepare first.
About the author
Vinay Grover founded EthicsComputer in Rohtak, Haryana in 2018 and leads its cybersecurity, software and AI work for clients across India and abroad. EthicsComputer is ISO 9001, ISO/IEC 27001 and ISO 20000-1 certified.
