ScrutoraCode, cloud & consent

Anyone can tick yes. The next question is show me.

A security questionnaire is answerable by anyone with an afternoon and some optimism. What stalls the deal is the follow-up, and the follow-up wants artefacts.

01 · The asymmetry

Two columns. Most teams can only fill the first.

Their questionYour answerWhat backs it
Is personal data encrypted at rest?YesEach store named, with the ones where no encryption is asserted listed by file and line.
Do you log personal data?NoEvery log statement that receives a classified field, with the call site.
Which sub-processors receive customer data?See our listThe recipients found in code, including the ones missing from the list you maintain by hand.
Can you delete a customer's data on request?YesThe fields with a delete path, and the fields without one.
Do you scan dependencies for vulnerabilities?YesThe advisory list, narrowed to the ones reachable from personal data.

The third column is generated. That is the whole difference: you are not writing a better answer, you are attaching the thing that makes the answer checkable.

02 · Before they ask

Run their questionnaire against yourself first.

The worst outcome is not failing a question. It is asserting something, being asked for proof, and discovering in front of the customer that the assertion was wrong. Scanning first turns that into a fix you made quietly last week.

A finding with the data-flow trace, the reason it matters, and the change to make.
Each finding arrives with the path the data took and the specific change, so the gap between discovering and closing it is short.
03 · The artefact

One export, not a folder of screenshots.

THE DATA MAP

What personal data you hold, where it goes, and which third parties receive it. Answers most of the questionnaire on its own.

THE FINDINGS

With severity, the clause each touches, and status. Reviewers care less about zero findings than about a queue somebody is working.

THE DEPENDENCY POSITION

Components, advisories and which ones sit on a path to regulated data.

04 · Try itPUBLIC REPOSITORIES

Scan before they do.

A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.