Free guide

Security one-pager template for startups

When a buyer asks for security information before sending the full portal, send a short current-state security one-pager instead of improvising broad compliance claims.

What the one-pager should cover

Current security contact or monitored intake route.
Authentication, access control, and account-review summary.
Data hosting, encryption, backup, and retention overview.
Subprocessor or vendor list status.
AI-use and restricted-data boundaries if the product or team uses AI tools.
SOC 2 status wording that separates current certification from planned readiness work.
Evidence owner, last-reviewed date, and review-needed flag for each section.

Do not send from memory

A buyer-facing security packet should match the team's actual practices. If the team cannot point to an owner, evidence source, or review date, mark that section as review-needed before sending it externally.

Use narrow wording: current, planned, not applicable, or under review. Do not invent certifications, customer logos, insurance coverage, DPA acceptance, incident-response timelines, or buyer approval.

Starter outline

Section	Safe buyer-facing note	Internal check
Security overview	Summarize current practices in plain language.	Confirm owner, evidence source, and last-reviewed date.
SOC 2 status	State whether a report exists today and what can be shared instead.	Do not say SOC 2 certified unless the report exists and is shareable.
Subprocessors	Explain whether a current vendor or subprocessor list is maintained.	Confirm whether the buyer needs a public page, contract exhibit, or portal answer.
AI-use boundaries	Describe approved AI use cases and restricted-data rules.	Confirm human review and customer-data rules before sharing.
Evidence packet	List what can be attached now and what requires review.	Separate current evidence from planned controls.

Need the broader buyer packet?

The Growth Procurement Stack includes a security overview, security questionnaire answer bank, evidence tracker, subprocessor register, AI-use disclosure, and first-buyer reply playbook for a fuller buyer review.

See Growth Stack Open evidence tracker guide

Scope limit

This guide and the related templates are documentation starters. They are not legal advice, privacy advice, cybersecurity advice, procurement advice, compliance advice, SOC 2 certification, audit readiness, cyber insurance advice, DPA advice, or a guarantee of buyer approval.