What should I ask a software vendor about security?

Ask questions whose answers are specific and checkable: where the data is stored, how it is encrypted, how one organization's data is kept from another's, what is logged, who the subprocessors are, how deletion works, and what the vendor commits to when something goes wrong. A vendor with real controls answers each in a sentence. A vendor without them answers with adjectives.

The stakes have moved. The 2024 FTC order against Blackbaud, which requires independent security assessments every two years for twenty years, showed that a vendor's failure becomes the nonprofit's problem in front of donors and regulators. A vendor that has done the work publishes a trust center with the audit status, a subprocessor list, a DPA template, uptime commitments, and an incident-response policy before a sales call. The questions below are what to ask when the trust center is thin.

The twelve questions

1. Where is my data stored, and can that change without notice? A region and a provider is an answer. "The cloud" is not.

2. How is data encrypted at rest and in transit? Expect named standards. Ask separately whether particularly sensitive fields get additional protection beyond disk-level encryption.

3. How is my organization's data isolated from other tenants'? The useful answer describes a mechanism enforced by the database or the platform, not a promise that the application code checks.

4. Is multi-factor authentication available to every user, and can I require it for my whole organization? Follow up: do high-impact actions like billing changes or removing a member require a fresh verification?

5. What is logged, who can see the log, and can I export it? Sign-ins, administrator actions, and changes to sensitive records are the minimum. Export matters when your own auditor asks.

6. Who are your subprocessors, what does each one receive, and do you have data processing agreements with them? The AI model provider belongs on this list with its retention terms stated.

7. What happens to my data when I delete a record, close a user, or leave? Ask for the retention window and how a full deletion is triggered.

8. How are backups taken, how long are they kept, and have you tested a restore?

9. What is your breach notification commitment, in hours or days, and to whom?

10. Do you conduct penetration testing, and can I see a summary under NDA?

11. What is your SOC 2 status, precisely? "In progress" and "Type II report issued" are different things. A vendor in an observation period can say so; one that says "SOC 2 compliant" with no report to show is using the phrase loosely.

12. Is my data used to train AI models, by you or by any provider you send it to? Expect a written commitment, not a verbal one.

How to read the answers

Specific beats reassuring. "AES-256-GCM at rest, TLS 1.3 in transit, US East" tells you more than "bank-grade security" ever will, and "military-grade" is not a standard anyone can audit.

Watch for what is carved out. A vendor whose authentication backbone is a certified subprocessor may honestly cite that provider's certification; the question is what the vendor itself has attested to.

Ask for documents, not descriptions. A subprocessor list, a DPA, a retention policy, a redacted penetration test summary. If the documents exist, the answers are already in them.

What this looks like when a vendor has done the work

For reference, here is how TappHQ answers the same twelve, published on its trust pages. Application data and files are stored with Supabase in the United States (US East). Data is encrypted with AES-256-GCM at rest and TLS 1.3 in transit, with field-level encryption and SHA-256 hashing for sensitive identifiers. Tenant isolation is enforced at the database layer. MFA is available on every plan, organization-wide enforcement is available on Pro and Enterprise, and billing changes, member removal, and administrator actions require step-up verification. Authentication events and administrator actions are logged with timestamp, actor, and target, visible to organization administrators, with export on Enterprise. The subprocessor list, with each vendor's purpose and retention terms, is public, including the model provider's zero-retention agreement. Retention and deletion terms, including a fast-track deletion option, are published. Penetration testing is scheduled with a summary available under NDA. SOC 2 Type II is in an active observation period with a report targeted for Q4 2026; the authentication backbone is independently certified today. Customer data is not used to train models.

Whether or not TappHQ is the vendor in question, that is the shape of a complete answer. Anything vaguer deserves a follow-up.