Vendor Security Questionnaire (Template)
Twenty questions to ask any software vendor before they handle your students' data — covering hosting, access, encryption, incidents and compliance.
Use these questions when evaluating any platform that will store or process institutional or personal data. Ask for evidence, not just "yes".
Company and hosting
- Where is our data hosted (country, provider)? Can it be kept in India?
- Who at your company can access our data, and how is that access logged?
- Is the service multi-tenant? How is our data isolated from other customers?
Security controls
- Is data encrypted in transit (TLS 1.2+) and at rest?
- Do you support MFA and single sign-on for our users?
- How are passwords stored?
- When was your last independent penetration test, and were findings fixed?
- How quickly are critical vulnerabilities patched?
Data lifecycle
- What data do you collect beyond what the service needs?
- How long is data retained, and how is it deleted when we leave?
- Can we export all our data in a standard format?
- Are backups encrypted and tested?
Incidents and continuity
- What is your incident response process, and how quickly will you notify us of a breach?
- What uptime do you commit to, and what happened during your last outage?
Compliance and legal
- Which laws and standards do you comply with (e.g. DPDP Act, ISO 27001, SOC 2)?
- Will you sign a data processing agreement?
- Do you use sub-processors? Provide the list.
Development practices
- Do you review code for security before release?
- Do you have a vulnerability disclosure policy?
- Who is our named security contact?
> Score each answer 0–2 and set a minimum before contracting.