A data room security questionnaire is a written set of questions you send a vendor before uploading deal files. Cover nine areas: certifications and report scope, hosting and data residency, encryption, identity, access controls, logging, incident response, subprocessors and end-of-deal deletion. Ask for evidence, such as a SOC 2 Type II report, not adjectives.
The question set below is built for buyers of a secure data room: sellers, advisors, funds and in-house teams who need confidence before confidential documents leave their own systems. It is proportionate, so a lower-mid-market sale does not need a 300-line enterprise questionnaire. For background on what SOC 2 and ISO 27001 each certify, read our SOC 2 vs ISO 27001 guide first; this page focuses on the questions and how to read the answers.
Best overall: Read the Papermark review
Papermark is best for teams that want a vendor review to go quickly: it holds SOC 2 Type II and ISO 27001 certification, is GDPR compliant and offers EU hosting, with NDA gating and audit logs built in. The Data Rooms plan is $99/month on annual billing.
How to run a secure data room vendor review
Start before you need the room. A vendor review squeezed into the week before launch tends to end with a signature and a promise to read the SOC 2 report later. Two to three weeks ahead is comfortable for most mid-market processes.
Much of what you need is published or available on request. Well-run vendors keep a trust center or security page, share the SOC 2 Type II report under NDA, publish their ISO 27001 certificate or point you to the certification body, and offer a data processing agreement (DPA) and subprocessor list. Collect those first, then send only the questions they do not already answer.
Involve the right reviewers. IT or security should read the SOC 2 report and the technical answers. Counsel should read the DPA, the subprocessor terms and the deletion commitments. The deal lead should confirm the controls match how the room will actually be run.
- Request the SOC 2 Type II report, the ISO 27001 certificate and, if available, the Statement of Applicability
- Request the DPA and the current subprocessor list
- Request a summary of the most recent independent penetration test
- Request a security overview covering encryption and identity
- Then send the remaining questions from the tables below
Certifications, hosting and data residency questions
| Question | Why it matters | Good answer |
|---|---|---|
| Which certifications and attestations do you hold, and can we see the reports? | Badges are claims; reports are evidence | SOC 2 Type II report shared under NDA, ISO 27001 certificate verifiable with the issuing body |
| Does the SOC 2 and ISO 27001 scope cover the data room product we will use? | A certificate can cover a different product or legal entity | Yes, with the product named in the system description and the certificate scope |
| What period does the latest SOC 2 Type II report cover? | An old report says little about current controls | A recent period, with a bridge letter covering any gap to today |
| Where are documents, backups and logs stored? | Counterparties and privacy law may require specific regions | Named regions for each, with an EU option if EU personal data is involved |
| Can data leave the chosen region, for support or processing? | Residency claims often stop at primary storage | A clear statement of any transfers and the safeguards used |
Encryption, identity and access control questions
These questions test the controls that protect documents day to day. Our data room encryption explainer covers what good encryption answers look like in more depth.
| Question | Why it matters | Good answer |
|---|---|---|
| How are files encrypted at rest and in transit? | Baseline protection for stored and moving data | AES-256 or equivalent at rest including backups, TLS 1.2 or higher in transit |
| How are encryption keys managed? | Key access controls decryption | A managed key service or HSM, restricted and logged access, defined rotation |
| Is two-factor authentication (2FA) available for admins and reviewers? | Stolen passwords are a common route into accounts | Yes, and admins can require it |
| Do you support single sign-on (SSO), and on which plans? | Lets your identity provider enforce your policies for internal users | A clear answer, including any plan requirement |
| Can permissions be set per folder and per file, by group? | Bidder isolation depends on granular access | Yes, with view-only, download and print controls per group |
| Can access be revoked immediately and set to expire? | A withdrawn bidder must lose access at once | Instant revocation plus expiry dates for users or links |
| How is vendor staff access to customer data controlled? | The platform can decrypt files for previews and search | Least privilege, approval before access, every access logged and audited |
Logging, incident response and subprocessor questions
| Question | Why it matters | Good answer |
|---|---|---|
| Which events does the audit log record, and can it be exported? | The log is your disclosure and investigation record | Views, downloads, permission changes, invitations and failed access, exportable to CSV or PDF |
| Can anyone, including your staff, edit or delete log entries? | An editable log has little evidential value | No, logs are append-only |
| How do you detect and respond to security incidents? | Response speed limits damage | A documented, regularly tested incident response plan inside the audit scope |
| How quickly will you notify us of an incident affecting our data? | You may have your own notification duties, for example under GDPR | A notification commitment in the DPA, without undue delay |
| Who are your subprocessors, and how are we told about changes? | Your data flows to every subprocessor | A published list with locations and purposes, and advance notice of changes |
| Are subprocessors covered by your SOC 2 report? | Carved-out subprocessors sit outside the auditor's testing | A clear statement of carve-outs and how the vendor monitors them |
End-of-deal deletion and data return questions
Deal rooms are temporary. The vendor relationship around them should end cleanly, with your data returned to you and then destroyed on a timetable you know in advance.
| Question | Why it matters | Good answer |
|---|---|---|
| Can we export all documents, the index, Q&A and audit logs before closing the room? | You need a complete archive for the closing record | Yes, self-service, in standard formats |
| What is deleted when we close a room or end the subscription, and when? | Lingering copies create risk with no benefit | A stated timeline for live data, then for backups |
| How long do backups keep deleted data? | Backups often outlive primary deletion | A defined backup retention window, after which data is unrecoverable |
| Can you confirm deletion in writing? | Some counterparties and regulators expect evidence | Yes, on request |
How to read a SOC 2 Type II report's scope
A SOC 2 Type II report is an independent auditor's opinion on whether a service organization's controls were suitably designed and operated effectively over a period, commonly between three and twelve months. It is built on the AICPA Trust Services Criteria. Security is always included; availability, processing integrity, confidentiality and privacy are optional. The value is in the detail, so read these parts rather than stopping at the opinion letter.
- The opinion: an unqualified opinion is clean. A qualified opinion means the auditor found a problem significant enough to call out.
- The report period: confirm the dates, and ask for a bridge letter if the period ended some months ago.
- The system description: check that the product you will use, its infrastructure and its support processes are inside the boundary.
- The criteria in scope: for a data room, security is the minimum; confidentiality and availability are worth having.
- Subservice organizations: under the carve-out method, a hosting provider's controls are excluded and the vendor relies on that provider's own report. Under the inclusive method they are tested. Know which applies.
- Complementary user entity controls: things the auditor assumes you will do, such as managing your own users. They are your side of the bargain.
- Exceptions in the testing section: individual test failures. A few minor exceptions with sensible management responses are normal; repeated exceptions in access control or change management deserve questions.
A hypothetical scenario: Pinecrest Health Partners vets a data room vendor
Pinecrest Health Partners is a hypothetical group of physical therapy clinics preparing for a recapitalization. Its CFO shortlists two data room vendors and sends each the question set in this guide. The likely investors include a European fund, so data residency is a live issue.
One vendor replies within a day with a trust center link, a SOC 2 Type II report under NDA, an ISO 27001 certificate and a DPA. Pinecrest's IT manager reads the report and finds an unqualified opinion, a period that ended four months earlier with a bridge letter, the data room product inside the system description, and hosting carved out to a major cloud provider with its own report. Two minor exceptions relate to a late quarterly access review, each with a documented fix.
The second vendor sends a two-page security summary and declines to share its SOC 2 report until after contract signature. Its deletion answer says data is removed 'in line with our policies', with no timeline. Asked about subprocessors, it promises a list on request but never sends one.
The CFO picks the first vendor. The deciding factor is not that the second vendor is necessarily insecure, but that Pinecrest cannot verify anything it says. Pinecrest files the questionnaire, the report and the DPA with its deal records, ready for its own investors' questions about the room.
Red flags in a data room security questionnaire
- Certifications claimed on the website but no report or certificate available, even under NDA.
- A SOC 2 Type I offered in place of a Type II, or a report whose period ended more than a year ago with no bridge letter.
- A system description that covers a different product, entity or region from the one you will use.
- Answers in adjectives, such as 'military-grade' or 'bank-level', with no versions, regions or timelines.
- No published or available subprocessor list.
- Audit logs that cannot be exported, or that administrators can edit.
- No written deletion timeline for data and backups after the room closes.
- Claims of 'GDPR certification' rather than GDPR compliance backed by a DPA.
Common secure data room vendor vetting mistakes
- Sending a generic enterprise questionnaire that the vendor answers with links, then reading none of them.
- Reading the SOC 2 opinion letter but not the system description, exceptions or user entity controls.
- Checking certifications but not where documents, backups and logs physically sit.
- Ignoring end-of-deal deletion until the room is already closed.
- Leaving counsel out of the DPA and subprocessor review.
- Failing to keep the questionnaire and evidence on file, so the same questions come back from your own buyers.
More on data room security
Part of the What is a secure data room? cluster.
Next steps
What is a secure data room?
The security hub for the controls a secure data room should provide.
Secure data room features checklist
Pair the security review with a feature fit check.
SOC 2 vs ISO 27001 for secure data rooms
What each certification measures and how to verify it.
Data room encryption explained
What good answers to the encryption questions look like.
Editorial policy
How this site evaluates data room vendors.
FAQ
What is a data room security questionnaire?
It is a structured list of security questions sent to a data room vendor before you upload confidential documents. It covers certifications, hosting, encryption, identity, access control, logging, incident response, subprocessors and deletion. A good questionnaire asks for evidence rather than descriptions.
Which certifications should a secure data room vendor have?
SOC 2 Type II and ISO 27001 are the two most commonly requested, and each must cover the product you will use. For EU personal data, also look for GDPR compliance backed by a data processing agreement and, where needed, EU hosting.
How do I read the scope of a SOC 2 Type II report?
Check the report period, the system description, the trust services criteria in scope, how subservice organizations are treated and the complementary user entity controls. Then read the testing section for exceptions. The opinion letter alone does not tell you whether the product you will use was tested.
What is a SOC 2 bridge letter?
A bridge letter, sometimes called a gap letter, is a statement from the vendor's management covering the time between the end of the last SOC 2 report period and today. It confirms there have been no material changes to controls. It is a management assertion, not an audit opinion, so it carries less weight than the report.
How long does a data room vendor review take?
With a vendor that keeps a well-maintained trust center, a proportionate review often fits within one to two weeks. It takes longer if the vendor is slow to share reports or counsel negotiates the DPA. Start before you need the room.
What is the biggest red flag when vetting a data room vendor?
A refusal to share evidence. A vendor that claims SOC 2 or ISO 27001 but will not share the report under NDA, or cannot name its subprocessors, leaves you unable to verify anything. Treat that as a reason to move on.