Answering Vendor Security Questionnaires About PDF Tools

Question 47: "Describe encryption at rest for customer-uploaded documents." The honest answer for our browser merge tool: N/A — no upload. Procurement read that as "they didn't understand the question" and flagged us yellow.

Vendor security questionnaires (VSQs) assume SaaS uploads. Browser-based and offline tools break the template — unless you translate architecture into their language.

Common questionnaire sections

• Data classification handled
• Storage location and residency (EU, US)
• Encryption in transit and at rest
• Retention and deletion
• Access controls and MFA for admin
• Incident response and breach notification SLAs
• Subprocessors and fourth parties
• Pen testing and vulnerability management
• Compliance certs (SOC 2, ISO 27001)

PDF-specific add-ons:

• Malware scanning on uploads (if applicable)
• JavaScript execution in PDF engine
• Logging of document metadata

Browser-only processing answers

| Question | Sample honest answer | | --- | --- | | Where is data stored? | User device RAM during session; not written to our databases | | Retention period? | Zero for file content; server logs 30 days | | Encryption at rest? | Not applicable to file content; TLS 1.2+ for site delivery | | DPA available? | Yes, with subprocessor list |

Align with GDPR Browser Processing and Browser PDF Privacy.

Server-upload tools — harder path

If tool uploads files:

• State retention (auto-delete 1 hour?)
• Encryption at rest (AES-256)
• Region pinning
• AV scan policy
• Whether humans access files (ideally never)

Offline vs Online PDF Tools — help customers choose tier.

Red flags procurement watches

• Vague "we take security seriously"
• No subprocessors listed but Google Analytics runs
• Claims "military encryption" without specifics
• Free tool with no privacy policy
• Data sold to third parties

Phishing PDF Attachments — train employees parallel to tool approval.

Preparing a VSQ packet

Maintain security page + PDF one-pager:

1. Architecture diagram (browser vs server)
2. Subprocessor table with purposes
3. Certifications or roadmap
4. Contact security@ email
5. Pen test summary date (if available)

Update when adding analytics or error tracking — Cookie Notices.

When you can't pass

Confidential M&A docs — enterprise may mandate desktop Adobe or air-gapped tools regardless of your VSQ. Know your lane.

Employees using consumer tools

IT policy template:

• Public marketing PDFs → approved browser tools OK
• PII/PHI/financial → approved list only
• No unknown upload converters

Troubleshooting

What is a vendor security questionnaire? A standardized form (SIG, CAIQ, custom Excel) asking about your security controls — encryption, access, incident response, subprocessors. Enterprise procurement requires it before approving tool use.

Do browser-based PDF tools need SOC 2? Not always for adoption, but enterprise buyers often request SOC 2 Type II or equivalent. Client-side tools with no file upload have simpler answers but still need accurate policies on analytics and infrastructure.

How do I answer where customer data is stored for local browser tools? State files are processed in user browser memory, not persisted on your servers, with caveats for error logs, support uploads, and CDN delivery of JavaScript. Accuracy matters — audits compare claims to architecture.

Limitations

When not to use this approach

Common mistakes

Real-world examples

When to use this approach

Conclusion

Answer questionnaires literally and architecturally — "no upload" is a valid encryption-at-rest answer when true.

Maintain subprocessor list, match privacy policy, explain browser processing in procurement's vocabulary. Yellow flags become green when answers map to real design.

SIG Lite vs full SIG

Enterprise procurement may send 800-question SIG — allocate security owner half day for first response, then maintain answers in repository for reuse. Browser-only tool answers shrink questionnaire vs full SaaS with data storage.

Insurance and liability

Cyber insurance applications overlap VSQ questions — consistent answers across insurance form and customer SIG prevent underwriting disputes.

Pen test report sharing

Redact executive summary shareable under NDA; full report with exploit details restricted. Customers ask "last pen test date" — annual cadence minimum for enterprise sales.