When a Client Sends You a Security Questionnaire
- A security questionnaire usually means the client is serious and has a process, not that they distrust you. Most questionnaires are written for large software companies, so many questions will not apply to a solo builder or small team. That is normal.
- Use the Profit Room's Honest Answers Pass: sort every question into yes, no, not applicable, or 'here is what we do instead', answer only what is true today, and write a short summary of how you handle their data: where it lives, who can access it, how you use AI tools on it, and what happens to it when the project ends.
- Never claim a certification, policy, or control you do not have. A clear 'no, and here is how we handle it' beats a 'yes' you cannot back up. If the client needs things only a large vendor can provide, say so early and suggest a smaller first project or a different setup.
The Short Answer
When a client sends you a security questionnaire, thank them, ask when they need it back, and ask who you can contact with questions. Then fill it out honestly. Do not leave it sitting because it looks intimidating, and do not tick 'yes' on everything to get through it. The person reviewing it is looking for two things: that you understand how their data will be handled, and that what you tell them is true.
That is the Honest Answers Pass. Many questions will ask about things a small team does not have, like a dedicated security officer or a formal audit report. 'Not applicable' or 'No, here is what we do instead' are acceptable answers. A wrong 'yes' is the one answer that can come back to hurt you, because answers like these can end up referenced in the contract you sign. This is general guidance from how we run our own projects, not legal or compliance advice.
Why Clients Send Security Questionnaires
Usually it is policy. Businesses that handle customer, health, or financial information often have to check every vendor that touches their systems or data, and the questionnaire is how they do it. The same form goes to a giant software company and to you. That is why so much of it will not fit.
For AI builds there is a second reason: clients want to know where their data goes when an AI tool is involved. Expect questions about which AI services you use, whether their data is used to train models, and where it is stored. The honest way to answer is from the current data and privacy terms of the exact plan and tools you use, which you should read yourself rather than repeat from memory. If you already told the client you build with AI, as [should you tell clients you use AI](/blog/should-you-tell-clients-you-use-ai) recommends, these questions will not come as a surprise to either of you.
Run the Honest Answers Pass
Read the whole questionnaire once before answering anything, then sort every question into one of four buckets.
- Yes: you do this today, and you could show how if asked. Answer plainly.
- No, here is what we do instead: you do not have the formal version, but you do have a real practice. For example, no written incident response policy, but a commitment to tell the client within an agreed time if something goes wrong.
- Not applicable: the question does not fit how you work, such as questions about data centers you do not run or office badge access when you work remotely. Add one line explaining why.
- Needs a decision: something you could start doing, such as turning on two-step login everywhere or using a password manager for client logins. Decide whether you will commit to it before the project starts, and only answer yes once it is true.
Then write a one-page data handling summary to send with the questionnaire. Reviewers often read this first, and it answers half the form in plain words. Cover five things.
| Topic | What the client wants to know | What to write |
|---|---|---|
| Access | Who can get into our systems and data | Named people only, using accounts the client creates and can remove |
| Location | Where our data ends up | Which tools and services touch it, and that it stays in the client's own systems where possible |
| AI tools | Whether our data goes into AI services | Which AI tools you use, on which data, under which plan's terms |
| Incidents | What happens if something goes wrong | How quickly you will tell them and who you will contact |
| Offboarding | What happens to our data when the project ends | What you delete or hand back, and that their access to you is removed |
The Honest Answers Pass: what your data handling summary should cover
Claude Code can help with the paperwork. In the desktop app, you can ask it to group the questions by topic and draft plain-language answers from notes you give it about how you actually work, then check every answer yourself before it goes out. Do not let it fill in answers about practices you have not described, because a confident draft is not the same as a true one. If the questionnaire itself is marked confidential, treat it the way [is it safe to use Claude Code with client data](/blog/is-it-safe-to-use-claude-code-with-client-data) describes.
How to Send It Back
Send the completed questionnaire, the data handling summary, and a short note offering a call. A short call with their reviewer often settles questions that would otherwise go back and forth by email for weeks.
Many of the practices that make a questionnaire easier are worth having anyway. Ask the client to create accounts for you instead of sharing their logins, which also helps when [a client will not give you access to their accounts](/blog/client-wont-give-you-access-to-their-accounts). Keep a short written list of which tools touch client data. Run a [security review on your own code](/blog/claude-code-security-review-for-client-work) before handoff, and have a clear [offboarding routine](/blog/how-to-offboard-a-claude-code-client) for removing your access and their data at the end. Each one turns a future 'no' into an honest 'yes'.
When the Questionnaire Means Not Yet
Sometimes the questionnaire makes it clear the client needs things a small team cannot honestly provide, such as a formal third-party audit report or a specific certification written into the contract as a requirement. Do not try to bluff through. Say it early, explain what you can offer, and suggest a different shape for the work: a smaller first project that does not touch their sensitive data, a build that runs entirely inside their own accounts, or working alongside their internal team. If none of those fit, [turning down the project politely](/blog/how-to-turn-down-a-client-project) keeps the door open for later.
Then make the next one easier. Ask about security reviews in your [expectations conversation](/blog/set-client-expectations-before-a-claude-code-build) before anything is signed: 'Will your team need me to complete a vendor or security review?' Finding out early means the questionnaire does not delay the start date, and it pairs well with checking whether they will [send their own contract](/blog/client-sends-you-their-own-contract) or [an NDA](/blog/client-wants-you-to-sign-an-nda).
Short, practical drops on offers, outreach, pricing, and closing clients with Claude Code. No spam, unsubscribe anytime.
Frequently asked
Do I have to fill out a client's security questionnaire?
If you want the project, usually yes. Many businesses cannot work with a vendor until the review is done. It is fine to ask questions about it and to mark questions that do not apply to you.
What if I do not have most of what the questionnaire asks for?
Answer honestly. Mark questions that do not fit how you work as not applicable, and for the rest explain what you do instead. A clear, honest 'no' with a real alternative is better than a 'yes' you cannot back up.
How do I answer questions about AI tools and client data?
Say which AI tools you use, on which data, and under which plan. Answer questions about training and storage from the current data and privacy terms of that exact plan, which you should read yourself before you answer.
Can Claude Code fill out a security questionnaire for me?
It can group questions and draft plain answers from notes you give it about how you really work. Check every answer yourself, and never let it describe practices you do not actually follow.
What if the client requires a certification I do not have?
Tell them early. Offer a different shape for the work, such as a smaller project that avoids their sensitive data or a build that runs inside their own accounts. If none of that fits, decline politely and keep the relationship.
Last reviewed November 7, 2026.
Co-founder of the Claude Code Profit Room. Built and sold AI services to real clients; writes about offers, pricing, outreach, and closing with receipts.
More from Duncan Rogoff →
