Working with larger companies
Vendor security questionnaire: working with VBS as a larger company
1,396
Your IT lead, your DPO and your buyer are vetting us. Here is what we deliver, what we agree with you and what we do not have.
A small supplier, vetted like a large one
A vendor security questionnaire is usually the first thing a larger company sends a new supplier. Your IT lead, your DPO and your buyer use it to check whether a supplier can handle your data, your systems and your timeline. Around it come a data processing agreement, a test environment and terms for the handover. This page sets what you ask next to what VBS delivers, so your assessment rests on facts rather than a brochure.
VBS is a small agency in Ghent, Belgium, that builds custom software: management platforms, portals and integrations with the systems you already run. Small means you talk directly to the people who write the code, with no account manager in between. We cover the risk that comes with a small supplier through documentation, code that sits with you and a handover another team can pick up. What we do not have, such as a certificate, is on this page too.
The questionnaire, question by question
The questions cover access, encryption, backups, incidents, hosting and subprocessors. We fill the questionnaire in ourselves, one question at a time, and write no where the answer is no. A list full of yeses that falls apart at the first audit does not move your assessment forward.
What we can show is how we build. Each measure below is in software that is live today, or is a term we put in writing with you per project.
| What a larger company asks | What we do or agree with you |
|---|---|
| A certificate such as ISO 27001 or SOC 2 | We do not have one. We describe each measure that is built and show it in the test environment. |
| Strong login | Two-factor authentication per user and sessions an admin can revoke, as built in the platform for Business Centrum. |
| Encryption of sensitive fields | AES-256-GCM on sensitive fields, as in the same platform. Which fields, we set per project. |
| Backups | A daily backup, at Zuco to S3. Retention and restore tests are agreed with you. |
| Tests before each release | Automated tests in the pipeline: 1,396 on the transport platform, 31 unit tests and 65 abuse tests on the Business Centrum platform. |
| A way back after a fault | Releases with a backup, a snapshot and a way back. On the transport platform the switch takes 2 to 6 seconds. |
| Hosting in the EU or the UK | An AWS region of your choice, or your own AWS account. |
| Personal data | A data processing agreement wherever we process personal data, with the subprocessors listed in advance. |
| Reporting an incident | Without undue delay, as the GDPR asks of a processor. Channel and contacts are set out in the agreement. |
If you are still weighing custom work against a package with a large vendor behind it, read build vs buy software first. That choice decides which questions carry the most weight in your assessment.
The path with a larger company
Supplier questionnaire
- Your questionnaire on security, hosting and access
- We fill it in, including who our subprocessors are
Data processing agreement
- Which data, for which purpose
- Subprocessors, security, deletion or return at the end
Technical agreements
- Hosting in an EU region
- Who has access to what, with which accounts
- Backups and logs
Staging and acceptance
- A separate environment for testing
- Your people test the agreed scenarios
- You sign off before we go live
Go-live
- A moment we choose together
- The previous version stays ready
Way back: if something goes wrong, we put the previous version back
Handover and documentation
- How it is built and how it runs
- Accounts and keys in your name
- A session with your team
If you want one
SLA
Agreements on response time, maintenance and who you call, shaped to what you need
An example of a process. Which stops you need and how heavy each one is depends on your organisation.
Controller and processor: the roles in writing
The GDPR, and the UK GDPR in the same way, gives each party a role. The controller decides why and how personal data is processed: that is you, as the company that uses the software. The processor processes personal data on your behalf: that is us, as soon as we work with personal data in your software, your database or your server.
Article 28 then requires a written contract. The UK regulator, the ICO, lists the same content. It sets out the subject matter and duration, the nature and purpose of the processing, the type of personal data and the categories of people it concerns. It also covers, among other things, that we act only on your documented instructions, that everyone with access is bound to confidentiality, which security measures we take, that we help you answer requests from data subjects, what happens to the data at the end and that you may audit.
We sign a data processing agreement wherever we process personal data for you. It is an agreement between you and us. If your company has its own template, we start from it and propose a change where a clause does not match what we actually do.
Subprocessors. A processor may only bring in another party with the controller's written authorisation. So we name our subprocessors in advance, with their role and region. For hosting and email that is AWS, which works with its own data processing addendum and its own list of subprocessors. If a project uses another service, such as a payment provider or an AI model, it goes on the same list before you sign.
- Choose a data processing agreement ifwe see, store or process personal data in production, run the server or the database for you, or give support that means looking at real records.
- Choose a record without a processor role ifwe build with test data and your team runs production itself, or we only deliver code that runs in your own environment, with no access to real data.
How that is put in writing is for your DPO to decide. For UK companies, the differences between the two regimes are in UK GDPR vs EU GDPR.
Who holds which role, and who signs
You, the client
Controller
Decides why and how the data is processed, and remains answerable to the people it is about.
Data processing agreementArt. 28(3)- The same obligations, passed onArt. 28(4)We remain fully liable to you
For example AWS in an EU region
Subprocessors
Only with your prior written authorisation. Under a general authorisation we tell you about every change and you can object (Art. 28(2)).
Someone asks for access to their data
1You
The request comes to you. You decide and you answer.
Art. 15
2Us
We help with the technical side: finding and exporting that person's data.
Art. 28(3)(e)
3You
You answer within one month. Extending by two months is possible where needed; you say so within that first month, with the reason.
Art. 12(3)
There is a data breach
1Subprocessor
A subprocessor detects a breach and reports it to us.
Art. 28(4)
2Us
We report it to you without undue delay, with what we know, and help with the investigation and the measures.
Art. 33(2), Art. 28(3)(f)
3You
You notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk.
Art. 33(1)
4You
When the risk is high, you also inform the people affected.
Art. 34
5You
You document every breach, also when you do not have to notify it.
Art. 33(5)
The diagram follows Article 28 of the GDPR; what exactly applies is in the data processing agreement we sign together.
Security in what is already live
Not promises on paper, but what is built into our platforms and runs today.
The Business Centrum management platform
The platform that replaces their Excel, live since 12 July 2026. Two-factor authentication each user switches on, sessions you can revoke, AES-256-GCM encryption of sensitive data, a log and a daily backup. The pipeline runs 31 unit tests and 65 abuse tests. It runs on Lightsail in Paris. More in the case Business Centrum platform.
The DA Logistics transport platform
In daily use: 31 users, around 30 drivers and 34 vehicles. 1,396 tests over 117 files. Every release runs with a backup, a snapshot, a measured switch of 2 to 6 seconds and a way back. Read the case DA Logistics or how we approach transport software.
A server of its own per client at Zuco
The same core as a product for a second transport company. Each client gets its own server, the API is only reachable through CloudFront and a daily backup goes to S3. Domain, certificate, site and API were live in 57 minutes on 14 September 2026. See Zuco Logistics.
Forms for eleven domains
A shared Lambda handles the contact forms of eleven client domains, with a honeypot, an origin check, input sanitisation, a gibberish filter and a brake on the number of requests. It carries 17 tests.
Data in the EU, or in your own AWS account
We host on AWS. Inside the EU you choose the region: Frankfurt, Ireland, Paris, Stockholm, Milan or Spain. For a UK company, London is an option too. The Business Centrum platform runs in Paris. If your data has to stay in one country, we put the whole environment there, backups included.
Many larger companies run their own AWS organisation with their own rules for accounts, logging and costs. Then the environment can sit in your account. We get access by name, with rights your team sets and can revoke. We agree that per project, along with who pays the AWS bill.
More on where data may sit and what a US parent of the cloud provider means is in the guide EU data residency.
NIS2 and your supply chain
The EU NIS2 directive had to be in national law by 17 October 2024. It asks medium-sized and large companies in critical sectors to take cybersecurity risk-management measures, and the security of the supply chain is one of them: who works on your systems, which software you buy and what you ask of those suppliers. In Belgium, the national cybersecurity centre advises suppliers of NIS2 companies to reach at least the CyberFundamentals Basic level, and a NIS2 company can impose a level by contract. In the UK, which is outside NIS2, the NCSC gives similar advice on supply chain security, including setting minimum security requirements for suppliers.
We are a small supplier in your chain. We hold no CyberFundamentals label, no Cyber Essentials certificate and no other certificate. If your contract requires one, we say so before you get a quote. What we do: answer your questions measure by measure, with the test environment at hand, and help you work out what to ask of all your software suppliers. A company under NIS2 often knows what it must do itself, but less well how to test that at a small agency or a SaaS package.
What NIS2 is exactly, see NIS2. The next dates for Belgian companies are in our piece on the NIS2 deadline of April 2027.
Documents per phase
What you get in each phase and what you sign or approve. The content of each document is agreed per project.
| Phase | What we deliver | What you sign or approve |
|---|---|---|
| Assessment | The completed questionnaire, the list of subprocessors, a sketch of the architecture | A non-disclosure agreement if you want one |
| Contract | A quote with a fixed price per project, the data processing agreement | The order and the data processing agreement |
| Build | A test environment with test data, technical documentation that grows with the software | Feedback on each delivery |
| Acceptance | The acceptance list and the test results | Your approval to go live |
| Go-live | A release with a backup and a way back, access in your name | The go-live itself |
| Handover | The code in your repository or transferable, the documentation, accounts in your name | Receipt of the handover |
| After go-live, as an option | An SLA with response times and maintenance | The SLA |
Staging and acceptance before go-live
We agree that nothing goes to production without your approval. You get a test environment, separate from production and filled with test data, where your team can check each delivery. Acceptance is set per project:
- we agree up front what has to be done and how you test it;
- we put the version on the test environment and report what changed;
- your team tests and reports what is wrong;
- only after your approval does the version go live, with a backup and a way back.
That rhythm already runs on the transport platform, where a release switches over in 2 to 6 seconds and can roll back if something goes wrong. It works the same for a web application or a client portal for your own customers.
A handover without lock-in
The biggest risk with a small supplier is that everything lives in one head. So we agree per project that the code sits in your repository or can be transferred at any moment, that the technical documentation grows with the software, and that domains, cloud accounts and keys are in your name. If you stop working with us, another team takes over with what is there.
We write tests alongside the code and keep it readable, so as little technical debt as possible is left that only we can pay off. The same goes for links to your ERP or finance system: API integration services mean a documented integration with us. If you run Microsoft Dynamics, read how a Business Central integration works.
An SLA as an option
After go-live you can take out an SLA: response times per type of issue, maintenance and updates, and who you call when it is urgent. The terms are agreed per client, based on what your software does and when your team works. We do not put standard figures on it that we cannot meet.
Questions from procurement and the DPO
Do you have ISO 27001 or SOC 2?
No. We answer your questionnaire measure by measure and show what is built in a test environment. If a certificate is a hard requirement, we say so up front.
Will you sign our data processing agreement?
We read your template and sign what matches what we actually do. If a clause does not fit, we propose a change and explain why.
Which subprocessors do you use?
AWS for hosting and email. Whatever else a project uses, we name in advance, with role and region, and it only comes into use after your written authorisation.
Where is our data stored?
In the AWS region you choose, backups included. If we agree it, in your own AWS account.
What if VBS stops, or we want to switch?
The code sits in your repository or can be transferred, the documentation grows with the software and the accounts are in your name. Another team can carry on with what is there.
May we run a penetration test?
Yes, if we agree it in advance. You run it on the test environment, through a party you choose. We go through the findings together and plan the fixes.
How do you report a data breach?
Without undue delay, as the GDPR asks of a processor. As controller you have 72 hours to notify the regulator yourself, so channel and contacts are set in the data processing agreement up front.
What does a project cost?
After a conversation you get a fixed price per project. An SLA after go-live is priced separately, on what you need.
Custom software
How VBS helps you with this
We build the platform your business runs on every day: your spreadsheets, emails and paperwork in one system that does what you do.
- Your workflow mapped first, then a fixed price
- Screens for the office, the client and the road
- Hosting, backups and security managed by us on AWS
How we approach it is on our page about Custom software.
Is your questionnaire ready?
Send us your questionnaire or your data processing agreement template through the contact form. After a conversation you know what we fill in, what we do not have and what the project costs.
Rather get in touch right away?