Sales engineering
How to answer “list your sub-processors” on a security questionnaire
Customer security reviews stall on sub-processors, AI use, and DPAs. Here is how to keep paste-ready answers — SIG-Lite and CAIQ style — without rebuilding them for every deal.
Published 2026-08-24
The questions that delay SMB deals are repetitive: list sub-processors, describe AI use, attach your DPA, prove you have a DSAR process. Teams lose days because the answers live in a founder’s head. The fix is an exportable register, not a more eloquent email.
The questions that always come back
- Provide your current sub-processor list with locations.
- Do you use generative AI on customer data? Which providers? Do they train on inputs?
- How do you assess vendor risk?
- How do you handle data-subject requests?
- Where is data hosted, and are there international transfers?
Honesty is faster than theatre
Do not claim SOC 2 you do not hold. Do not say “no AI” if the team uses Copilot. Customers’ security teams have seen every evasion. A current list with residual-risk notes and a public trust page (jurisdiction, sub-processors, DPA) closes more deals than a glossy PDF with yesterday’s vendors.
What PrivyLedger exports
From one workspace you can export a trust pack, an AI evidence pack, SIG-Lite-style and CAIQ-style answer banks, CSV, and JSON. Each file is a starting point for review — not a substitute for counsel. Growth plans unlock the questionnaire and evidence packs; the register itself starts on the free tier.
If a customer requires a full GRC platform attestation, PrivyLedger is the wrong tool. See the compare page for that boundary.
Questions
What is SIG-Lite vs CAIQ?
SIG (Standardized Information Gathering) and CAIQ (Consensus Assessment Initiative Questionnaire) are common enterprise questionnaires. “Lite” and “style” exports are structured answers you paste or attach — not a claim that you are SIG-certified.
Should I send my full vendor register to a customer?
Usually no. Send the sub-processor cut: processors of their or your customer data, with purpose and location. Internal tooling that never touches their data can stay off the attachment.
How often should I refresh the pack?
Whenever you add a processor or a DPA status changes. If that is weekly, generate from the register instead of editing a stale PDF.