IN SHORT
- The questions are about passwords, payments, backups, exports, access, incidents and gaps. None of them require you to be technical.
- What you are listening for is specificity. "We take security very seriously" is not an answer to any of the seven.
- The seventh is the one that tells you the most: ask what they do not have. A supplier with no answer has not looked.
- Our own answers are below, including the list of things we do not have.
Why questions beat certificates for a small business
A certificate tells you a supplier passed an audit on a particular day. Seven specific questions tell you whether the people answering them understand their own system, which is what protects you between audits.
Certificates are genuinely useful and larger buyers are right to require them. But for a business buying its first internal system, a supplier who answers precisely and admits gaps is a better signal than one who forwards a PDF and stops talking.
The test throughout is specificity. Every one of the seven has an answer that is checkable, and an evasive version that sounds reassuring and means nothing.
One to three: passwords, payments, backups
How are passwords stored, who holds the card data, and how often are backups taken. Three questions with concrete answers that a supplier either has or does not.
On the first, the wrong answers are audible even to a non-technical ear: "encrypted" is wrong, because passwords should not be decryptable at all, and "we do not store them in plain text" is a statement about what they avoided rather than what they did.
| Ask | A good answer sounds like | Our answer |
|---|---|---|
| How are passwords stored? | A named slow hash with a per-user salt | scrypt with a salt per user, compared in constant time |
| Who holds card data? | A named payment provider, not the supplier | Stripe. Card data never touches our database |
| How are backups taken? | Continuously, with a stated retention | Continuously, in Frankfurt, alongside the database |
Four and five: getting your data out, and who can get in
Can you export everything without a negotiation, and exactly which people at the supplier can reach your data. Both answers should be short, and the second should include the uncomfortable part.
On export, a good answer is a procedure, not a permission. Ours is that records export as files and the database exports as a full dump, both on request, with no leaving fee. Test it early rather than at the point you need it.
On access, listen for whether the support door is mentioned before you ask about it. Support can open a customer's studio in order to help; we state that on the security page. Every hosted supplier has an equivalent, and the ones who do not mention it have not stopped having it.
Six: what happens when something goes wrong
How quickly would you be told, and by what route. The GDPR sets 72 hours from awareness for a personal data breach, so a supplier who cannot say that number has not thought about the question.
The part worth pressing on is the caveat. We say 72 hours from becoming aware, and we say plainly that a breach at an upstream provider reaches us on their timetable and not ours. A supplier who promises an unconditional window is promising something they do not control.
Ask also who you would call, and whether anyone is on duty at three in the morning. Our answer to the second is no - there is no 24/7 on-call - which is a real limitation for a business that runs overnight and irrelevant for one that does not.
Seven: what do you not have
The question that tells you the most, because it cannot be answered from a brochure. A supplier who has genuinely looked at their own security can list their gaps in under a minute.
That is our list, maintained on the security page rather than in this article, because a gap list that goes stale is worse than none. When one of those items changes, the page changes.
- No ISO 27001 or SOC 2 certificate of our own
- No two-factor authentication yet
- No 24/7 on-call rota
- No published penetration test
- No tamper-resistant audit log of operator actions
- Backups taken continuously but never rehearsed as a full restore
- No data protection officer, and we are not a NIS2 entity
The honest limit of all seven
These questions test whether a supplier has thought about security. They do not test whether the supplier is secure, and nothing you can ask in a meeting does.
A determined attacker is not defeated by a good answer about password hashing. What the seven do is filter out the suppliers who have never considered the question, and that filter removes most of the risk most small businesses actually face, which is not a targeted attack but an unattended weakness.
The other half of the job is on your side and no supplier can do it for you: who has a login, who still has one after they left, and whether anyone has looked at that list this year.
QUESTIONS
Do you offer two-factor authentication?
Not yet. It is on the list of things we do not have, which is published rather than implied. Sessions are signed and the admin panel has a shorter session than the rest of the platform.
Do you have ISO 27001?
No certificate of our own. The infrastructure underneath is certified, which is not the same claim and we will not make the stronger one.
Can I run my own security review?
Yes. Ask, and we will answer specific questions in writing. We do not have a penetration test report to hand you, because we do not have one.
Is a system I build with AI less secure than one an agency writes?
Not inherently. The same platform handles logins, sessions and access control in both cases. The difference in practice is who reviewed the roles you configured, which is worth doing deliberately either way.
RELATED
Security - the full answers, kept current
Where your data lives - Frankfurt, the exception and the export
The AI Act for a small business - the duties that are yours rather than ours
Privacy - what is processed and by whom