Security reviews and DPAs, signed with the order
Your hosting, encryption, audit and sub-processor statements and your data processing terms as locked blocks, with the customer's questionnaire attached.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
QuoteCloud lets a software vendor keep its security statements and data processing terms as content library blocks, locked on the Business plan so sales can't change the wording, and attach the customer's completed questionnaire and policies as files. The customer signs the schedule with the order form; the signed copy carries a certificate of authenticity.
Last reviewed by the QuoteCloud team
Three pages of a sample security and data protection schedule from a fictional software vendor, Plinthwork, to Tidemark Property Services, fanned out and taking turns at the front: the cover with a padlock on a keyboard; the security summary as a locked company block covering hosting in a region the customer chooses, encryption in transit and at rest, a yearly independent audit with the report under NDA, single sign-on and an audit log, a yearly penetration test and the sub-processor list in Schedule B; and the acceptance page, signed by Lena Albright with a summary: region chosen at set-up, signed with order form PW-2340, 62 questionnaire answers attached.
Security answers written once, locked for every deal
Amara, Plinthwork's security lead, and its lawyers approved the wording once. Every rep builds the schedule from the same library blocks; the locked ones go out exactly as approved.
- Security summaryHosting, encryption, audit, access Locked
- Data processing termsRoles, incidents, return and deletion Locked
- Sub-processor listSchedule B · PDF
- Support and service levelsHours and response times
- Standard questionnaire answersPDF, reviewed each quarter
- Company profileText and photos
- 1CoverTidemark Property Services
- 2About Plinthwork From library
- 3Security summary Locked block
- 4Data processing terms Locked block
- 5Sub-processors From library
- 6Support From library
- 7Tidemark's questionnaire62 answers, attached as a PDF
- 8Accept the scheduleSigned with order form PW-2340
Write it once
Save your security statements, data terms and policies as Company content library blocks and files.
Content library: Essentials and up
Lock the wording
Locked blocks can be added to any document but not edited; only permitted roles unlock them.
Content locking: Business
Attach the evidence
The customer's completed questionnaire, your sub-processor list and policies go in as files.
Attachments: Essentials and up
The review answered inside the document
Tidemark's IT team sent 62 questions. Plinthwork answered them once, attached the answers as a PDF, and sent the schedule with its locked security summary on top.
When Ravi, Tidemark's IT lead, wanted to check one answer, he commented on it in the document. Amara replied in the same thread, so the question and answer stay with the schedule instead of in someone's inbox.
- The same security summary in every deal
- Questionnaire, sub-processor list and agreement attached
- Comments and replies on the document
- Opens tracked, so you know procurement has read it
Security summary Plinthwork's own statements
Locked company block- HostingYour choice of two regionsChosen at set-up; data stays in that region
- EncryptionIn transit and at restKeys rotated every 90 days
- Independent auditReport under NDAAgainst the applicable standard, yearly
- AccessSingle sign-on, roles, audit logIncluded with SSO & audit log
- Penetration testYearly, by a third partySummary letter on request
- Sub-processorsListed in Schedule B30 days' notice of changes
Sample statements for a fictional vendor. QuoteCloud sends and signs the schedule; it doesn't audit or verify it.
Attached
- Security questionnaire, Tidemark's 62 questions answered (PDF)
- Sub-processor list, Schedule B (PDF)
- Data processing agreement, version 3.2 (PDF)
Ravi MehtaQuestion 41: are backups in the same region as production?
Amara, PlinthworkYes: backups stay in the region you choose, in a separate zone.
What to lock, and what to leave open
A pattern many vendors use. Your own legal and security teams decide; QuoteCloud doesn't give legal advice or check your wording.
Lock: security statements
Hosting, encryption, audit and access answers, as approved by your security lead.
Lock: data processing terms
Roles, incident notice, return and deletion: the clauses legal signed off.
Lock: sub-processor notice
How and when customers hear about a new sub-processor, with the current list attached.
Open: the customer's details
Name, contacts, region and the order form it goes with, filled in for each deal.
Open: their questionnaire
Each customer's own questions and your answers, attached as a file for that deal.
Open: questions and replies
Comments on the schedule, answered by your security lead in the document.
Stop pasting security answers from old emails
Free for 14 days, no credit card required. Bring your security summary and data terms; content locking is on the Business plan.
Data terms accepted with the order, not a round later
Lena accepted the schedule in the same sitting as the order form, so procurement had nothing left to chase. The signed copy carries a certificate of authenticity and an audit trail.
Need the customer's security contact or preferred hosting region? Add a Forms block to the schedule and they fill it in before signing, inside the document.
- Several signers, no account needed to sign
- Optional one-time passcode by email
- A Forms block for the details you need (Essentials and up)
- Version history shows what changed between versions (Business)
Data processing terms
- RolesTidemark is the controller of its data; Plinthwork processes it only to provide the service.
- Your obligationsEach party meets the data protection obligations that apply to it where it operates.
- IncidentsPlinthwork tells Tidemark's security contact within 48 hours of confirming an incident.
- At the endYour data is returned on request within 30 days, then deleted from every copy.
A security review in five steps
How Plinthwork runs procurement's review alongside the order form.
NDA first
Send a mutual NDA from the Non-Disclosure Agreement template before sharing any audit report.
Build the schedule
Drop the locked security summary, data terms and sub-processor list in from the content library.
Attach their answers
Attach the customer's completed questionnaire and any policies they asked for.
Answer in the document
Follow-up questions arrive as comments; your security lead replies in the thread.
Sign with the order
The customer accepts the schedule and signs the order form; both are signed online.
Security review and DPA questions
Can we include our data processing agreement in the order form?
Yes. Keep your data processing terms as a content library block and add it to the order form, or send a separate schedule signed alongside it, with the full agreement attached as a PDF. The customer signs online and the signed copy carries a certificate of authenticity. QuoteCloud doesn't give legal advice: the wording is yours.
How do we stop sales editing security or legal wording?
On the Business plan, lock the blocks in your Company content library. Locked blocks can be dragged into any document but not edited there, and only people with the right permissions can unlock them. Version history, also on Business, keeps earlier versions of each document.
Can we attach the customer's security questionnaire?
Yes. Attach the completed questionnaire, your sub-processor list, policies or a summary letter as files in the document, on Essentials and up. If procurement has a follow-up question, they can comment on the document and your security lead replies in the same thread.
Does QuoteCloud check or certify our security statements?
No. Your security statements, audit details and data terms are your own content: QuoteCloud sends them, collects signatures and keeps an audit trail, but it doesn't audit, verify or certify anything you write. Keep the wording approved by your security and legal teams, and lock it so it stays that way.
Can the customer's legal and IT teams both sign?
Yes. Add as many signers as you need, such as the customer's operations lead, IT lead and finance director. Each signs online without an account, optionally with a one-time passcode sent by email, and every signature is recorded in the audit trail and the certificate of authenticity.
The rest of the deal
The order form this schedule is signed with, and the documents around it.
-
Seat-based order formsSeats, plan and term the customer can adjust on the price lines before signing, with the totals following.Explore
-
Discount approvals & deal deskDiscounts over your limit and large deals wait In Review for the right approver before the customer sees them.Explore
-
Software & SaaS templatesReal QuoteCloud templates for SaaS proposals, software quotes, SLAs and acceptance forms.Explore
- Plan tiers & add-onsStarter, Growth or Scale as a single choice in the order form, with add-ons the customer ticks.
- Ramp, usage & ROI calculatorsSeats × tier price × term, ramped by year, in a spreadsheet block whose cells set the price lines.
- Implementation statements of workDiscovery, migration, set-up and training as milestones, a plan on a Gantt chart and a deposit on signing.
- Renewal quotes from usage dataSeats used against seats licensed, turned into a renewal order form before the agreement's expiry date.
- QBR reports with expansion quotesUsage, adoption and recommendations in one report, with the expansion lines the customer can tick and sign.
- Renewals & QBRs drafted by your AI assistantAn assistant connected through QuoteCloud's MCP service drafts from your CRM and usage data; your account executive reviews and sends.
- CRM, billing & data integrationsHubSpot, Salesforce, Pipedrive, Xero, QuickBooks and your own systems, connected the way each one really connects.
- QuoteCloud implementation for software vendorsYour price book, order form and renewal templates, approval rules and integrations set up with your team.
- FAQAnswers to the questions software vendors, account executives and customer success teams ask most.
Security and data terms, signed with the order
Free for 14 days. No credit card required.