> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Vendor: Acme Inc

Completed by: [NAME / TITLE]

Date: 2026-03-19

Contact: legal@acme.com

This questionnaire follows the SIG Lite (Standardized Information Gathering) format and has been pre-populated based on automated analysis of the codebase. Review and update all answers before submitting to customers.

> Legend: Answers prefixed with `[AUTO]` were derived from code analysis. Answers prefixed with `[MANUAL]` require human input.

## 1. Company Information

Question | Answer
--- | ---
Company legal name | Acme Inc
Company website | https://acme-saas.com
Primary security contact | legal@acme.com
Data Protection Officer | Jane Mueller (dpo@acme-saas.com)
Company headquarters location | [MANUAL] [LOCATION]
Number of employees | [MANUAL]
Year founded | [MANUAL]
Do you carry cyber liability insurance? | [MANUAL] Yes / No

## 2. Security Governance

Question | Answer
--- | ---
Do you have a dedicated security team? | [MANUAL] Yes / No
Do you have a written information security policy? | [MANUAL] Yes / No
Do you conduct regular security awareness training? | [MANUAL] Yes / No
Do you have an incident response plan? | [AUTO] Yes — generated as part of compliance documentation
Do you conduct regular risk assessments? | [MANUAL] Yes / No
Do you have a business continuity / disaster recovery plan? | [MANUAL] Yes / No

## 3. Certifications & Compliance

Question | Answer
--- | ---
SOC 2 Type I or II certification? | [MANUAL] Yes / No — Type: __
ISO 27001 certified? | [MANUAL] Yes / No
GDPR compliant? | [AUTO] Compliance documentation generated — [MANUAL] confirm operational compliance
PCI DSS compliant? | [AUTO] Payment processing detected (via Stripe/PayPal) — payments are handled by PCI-compliant third party
HIPAA compliant? | [MANUAL] Yes / No / N/A
Do you undergo regular third-party penetration testing? | [MANUAL] Yes / No — Frequency: __
Do you have a bug bounty or vulnerability disclosure program? | [MANUAL] Yes / No

## 4. Access Control

Question | Answer
--- | ---
Do you require authentication for access? | [AUTO] Yes — authentication implemented via @supabase/supabase-js
Do you support multi-factor authentication (MFA)? | [MANUAL] Yes / No
Do you enforce role-based access control (RBAC)? | [MANUAL] Yes / No
Do you enforce least-privilege access? | [MANUAL] Yes / No
How are user sessions managed? | [MANUAL] [DESCRIBE SESSION MANAGEMENT]
Do you support Single Sign-On (SSO)? | [MANUAL] Yes / No — Protocol: SAML / OIDC
Do you log all access events? | [MANUAL] Yes / No

## 5. Data Protection

Question | Answer
--- | ---
Is data encrypted at rest? | [MANUAL] Yes / No — Algorithm: __
Is data encrypted in transit? | [AUTO] Yes — HTTPS/TLS required for all communications
Where is data stored? | [AUTO] Database services detected: prisma — [MANUAL] specify hosting region
Do you use a key management service? | [MANUAL] Yes / No
Do you have a data retention policy? | [AUTO] Yes — generated as part of compliance documentation
Do you have a data classification scheme? | [AUTO] Yes — data classification report generated
Can you delete customer data on request? | [MANUAL] Yes / No — Process: __
Do you have a data backup strategy? | [MANUAL] Yes / No — Frequency: __

## 6. Application Security

Question | Answer
--- | ---
Do you follow a secure software development lifecycle (SDLC)? | [MANUAL] Yes / No
Do you conduct code reviews? | [MANUAL] Yes / No
Do you perform static application security testing (SAST)? | [MANUAL] Yes / No
Do you perform dynamic application security testing (DAST)? | [MANUAL] Yes / No
Do you scan dependencies for known vulnerabilities? | [AUTO] Yes — dependency vulnerability scanning is part of the compliance process
Do you use error monitoring / observability? | [AUTO] Yes — @sentry/node
Do you have a WAF (Web Application Firewall)? | [MANUAL] Yes / No
Do you protect against OWASP Top 10 vulnerabilities? | [MANUAL] Yes / No

## 7. Infrastructure Security

Question | Answer
--- | ---
Where is your application hosted? | [MANUAL] [CLOUD PROVIDER / REGION]
Do you use a CDN? | [MANUAL] Yes / No
Do you use container orchestration? | [MANUAL] Yes / No
Do you have network segmentation? | [MANUAL] Yes / No
Do you use intrusion detection / prevention systems? | [MANUAL] Yes / No
Do you perform regular vulnerability scanning of infrastructure? | [MANUAL] Yes / No — Frequency: __

## 8. Third-Party Risk Management

Question | Answer
--- | ---
How many third-party sub-processors do you use? | [AUTO] 8 sub-processor(s) detected
Do you maintain a sub-processor list? | [AUTO] Yes — generated as part of compliance documentation
Do you have DPAs with all sub-processors? | [MANUAL] Yes / No
Do you assess the security posture of sub-processors? | [MANUAL] Yes / No
Do you notify customers of sub-processor changes? | [MANUAL] Yes / No

## 9. Incident Response

Question | Answer
--- | ---
Do you have a documented incident response plan? | [AUTO] Yes — incident response plan generated
What is your breach notification timeline? | [AUTO] Within 72 hours (GDPR), within 30-60 days (US state laws)
Do you conduct post-incident reviews? | [MANUAL] Yes / No
Do you have a dedicated incident response team? | [MANUAL] Yes / No
Security incident reporting email | legal@acme.com

## 10. AI & Machine Learning

Question | Answer
--- | ---
Does the application use AI/ML services? | [AUTO] Yes — openai
What data is sent to AI services? | [AUTO] user prompts, conversation history, generated content
Is AI-generated content identified to users? | [MANUAL] Yes / No
Do you have safeguards against AI bias? | [MANUAL] Yes / No
Can customers opt out of AI processing? | [MANUAL] Yes / No
Do AI providers use customer data for training? | [MANUAL] Yes / No — [VERIFY WITH EACH PROVIDER]

## 11. Privacy & Data Subject Rights

Question | Answer
--- | ---
Do you have a published privacy policy? | [AUTO] Yes — generated as part of compliance documentation
Do you support data subject access requests (DSAR)? | [AUTO] DSAR handling guide generated
Do you support the right to erasure? | [MANUAL] Yes / No — Process: __
Do you support data portability? | [MANUAL] Yes / No — Format: __
Do you obtain consent for analytics/tracking? | [MANUAL] Yes / No — [AUTO] consent management guide generated
Do you process data of minors (under 16)? | [MANUAL] Yes / No

## Related Documents

- Third-Party Risk Assessment (`THIRDPARTYRISK_ASSESSMENT.md`)
- Supplier Code of Conduct (`SUPPLIERCODEOF_CONDUCT.md`)

This vendor security questionnaire was generated by Codepliant based on an automated scan of the nextjs-saas-example codebase. Answers marked [AUTO] are derived from code analysis and should be verified. Answers marked [MANUAL] require input from your security and compliance teams. This document is not a substitute for a formal security assessment.