Security questionnaires

Before signing, a customer often sends a list of questions about how you protect data: where it is hosted, whether it is encrypted, who your subprocessors are, whether you had a breach. The Questionnaires page answers them from what you already recorded in Privacyboard. It is part of the Business plan.

#How it works

1. Import the file. On Questionnaires, choose the Excel (.xlsx) or PDF file the customer sent, up to 4 MB. You can add the customer's name.
2. Check where the questions are (Excel). Privacyboard finds the sheet, the question column and the answer column. If it guessed wrong, or found nothing, choose them yourself.
3. Suggest answers. Click Suggest answers. Each answer is written from your records: company profile and security practices, vendors, processing register, incidents, impact assessments, documents and cookie banner, and from the answers you approved in earlier questionnaires or wrote under Customer question / Reviewed answer. Questions are answered 25 at a time: a progress bar shows how many are done, what is being done and the time left, and each answer appears as soon as it is written. Keep the page open until it finishes.
4. Read and approve. Every suggestion is marked to read, with where it comes from (your records, or an approved answer). An answer already in the customer's file is marked Already in the file, to approve, and one you wrote Written by you, to approve. Use the To review, To answer and Approved filters to work through the list, and Suggest again on a question to get a new suggestion. Correct it if needed, then Approve it. A question your records do not cover is marked Not in your records: to answer: write that answer yourself.
5. Download. For an Excel file, you get the customer's own workbook with the approved answers written in the answer column. An answer that was in their file but that you removed or did not approve is left empty. Everything else in the file stays as they sent it. For a PDF, you get an Excel file with each question and its answer. Once sent, choose Mark as sent to the customer.

#What the suggestions are based on

Answers come only from your records and your approved answers. Nothing is invented: a certification, a test or a policy you did not record is never claimed. When a question goes beyond your records (an ISO 27001 certificate, a penetration test, business continuity), you write the answer.

Keep your company profile and security practices complete: the more you record, the more questions are answered for you.

#Your answer library

Approved answers are kept with the questionnaire. When the next one asks the same thing, your approved answer is reused, adapted to the wording. If your records changed since, the records win. Changing an approved answer makes it to approve again, so nothing is exported or reused before someone approves it.

#From your AI assistant

With the AI assistant connector, Claude, ChatGPT or another assistant can read your questionnaires and the answers you approved, to answer a customer's questions in your own words, for example in an email or a form outside Privacyboard. It reads only: answers are approved and the customer's file is filled in here. The imported files never leave Privacyboard.

#Your data

To suggest answers, the questions and your records are sent to Anthropic, Privacyboard's AI provider, which does not use them to train its models. Requesters' names and messages, and the details of your incidents, are never sent. A PDF is read by the same provider to find its questions. The number of AI requests per person each day is limited.

The customer's file is kept so you can download it filled in again later. It is removed 12 months after the questionnaire last changed; the questions and your answers stay, and a later download comes as a new Excel file. Removing a questionnaire removes its file and its answers at once.

The questions come from a third party, so their text is treated as questions only, never as instructions to the AI. Suggestions share only what a company normally tells a customer: never the details of individual people or of incidents, nor the content of your impact assessments. Suggestions that may share sensitive details are marked Check before approving and must be approved one by one, not with Approve all.

Viewers can read questionnaires and download them; editors, admins and owners can import, answer and approve.

#FAQ

#Which files work best?

Excel files, because you get the customer's own file back filled in. Older .xls files need to be saved as .xlsx first. A PDF must contain text: a scanned PDF cannot be read. Very large workbooks (over about 60 MB once opened) are refused: keep only the questionnaire sheets.

#Can I download before everything is approved?

Yes. Download includes approved answers only. Download with unapproved answers includes the others too, for an internal review.

#Does the customer see Privacyboard?

No. You send the file yourself; nothing in it mentions Privacyboard.