A vendor security review killed my deal. The 12-item checklist I now run before the demo
In February I lost a four-month deal to a 64-question security questionnaire. Here's the checklist that came out of that bruise — and the one item that was the actual deal-killer.
In February I lost a deal I'd spent four months building. The work was done. The contract sat on the lawyer's desk. Then the client's security team showed up.
They sent a 64-question vendor security questionnaire. I answered eight of them well, twelve poorly, and forty-four I had to invent answers to in real time, because nobody on our side had asked themselves those questions before.
Three weeks of email tennis later, the deal died. The procurement note said "supplier unable to meet our minimum data-handling standards." Nothing personal. Just true.
I went home, opened the questionnaire, and rewrote the entire stack against it. Here is the checklist that came out of the bruise.
This list is not legal advice. It is the questions an enterprise procurement or security team will actually ask before they sign with you. Most of them have nothing to do with the GDPR text and everything to do with how the software is built.
1. Data flow map. Draw the diagram. Customer enters X. It goes to your server. From your server it goes to A, B, and C — third-party services, the LLM provider, analytics. Every arrow on the diagram. If you can't draw it, no enterprise will buy from you.
2. PII inventory. Across every field of every form: which is personally identifiable, which is sensitive, which is neither. The reviewer will ask for this list. They will check it against the code. Inconsistencies kill deals.
3. LLM data policy. What gets sent to OpenAI / Anthropic / Google, what gets logged, what you can prove with screenshots from the provider's console. "We use the API in private mode" is not an answer — show the setting and the contract.
4. Audit trail. Who did what, when — who logged in, who exported data, who deleted a record. All of it with timestamps and a retention policy you've actually written down. Audit trail without retention is just an archive that grows until it crashes.
5. Access model. Roles, permissions, escalation paths. Where MFA is required. Where it isn't — and why. If your answer is "everyone in the company has admin," you fail the review on this line.
6. Encryption at rest and in transit. TLS in transit, AES-256 at rest, a key rotation policy. Disk encryption on the server. Keys not in the repo. Yes, even in the dev environment.
7. Backup and recovery. Where backups live. How long they're kept. How long it takes to restore. The reviewer wants RPO and RTO numbers, not "we have backups."
8. Incident response. What happens when something leaks. Who calls whom. How fast you notify the customer — the GDPR window is 72 hours, and they will check that you know this. What was the last incident, and what did you do.
9. Subprocessor list. Every third-party your software talks to: name, country, purpose, DPA status. Yes, including the SaaS chat widget on your marketing site. The reviewer's lawyer will find it if you don't.
10. Deletion workflow. Customer asks to be forgotten. What's the path? Database, embeddings, cached prompts, logs, backups. With a documented timeline. "Within 30 days" is fine. "We'll figure it out" is not.
11. Vendor security review history. Have you been through one before? Can you share the result? Most startups haven't. The reviewer respects honesty. "This is our first" is fine. "We passed AWS's SOC 2" when you didn't is fatal.
12. Data residency. Where the customer's data physically lives. EU customer? Probably needs to stay in the EU. US healthcare? Probably needs HIPAA-compatible regions. If your answer is "AWS us-east-1, because that's where I always deploy" — the deal stops there.
Eleven items would have saved my February deal. The twelfth — data residency — was the actual killer. I had no EU region. The client was a German manufacturer. They couldn't sign even if everything else had been perfect.
The lesson wasn't legal. The lesson was that I'd shipped a product that worked beautifully for me but couldn't survive a fifteen-minute conversation with a real security team.
If your AI product is going anywhere near a serious B2B customer in 2026, run this checklist before the demo — not after, not when legal asks, before.
I now build this layer for clients as part of the product, not as a panic sprint two weeks before procurement. Twenty hours of work: architecture review, a pre-filled security questionnaire, and a delivery plan for the gaps. The deal that survives this review is worth more than five demos that don't.