Free tool · no signup
Vendor questionnaire builder
Most vendor questionnaires fail because they are too long: 200 questions sent to a cleaning contractor and a payroll provider alike. Describe the vendor below and you get a questionnaire sized to its risk. It asks only what applies to that kind of vendor, adds GDPR or NIS2 questions when you need them, and skips what a certificate you already hold has answered.
Your questionnaire: 15 questions
1.Is multi-factor authentication (MFA) enforced for all workforce accounts?
Yes / No
2.Are you certified to ISO 27001 or an equivalent security standard?
Yes / No / In progress
3.Will you process or store any personal or sensitive customer data?
Yes / No
4.Is data encrypted in transit and at rest?
Yes / No
5.Do you have a documented incident response plan?
Yes / No
6.List any subprocessors or third parties that will access our data.
Free text · optional
7.How often do you conduct independent security audits?
Annually / Bi-annually / Quarterly / Never
8.Have you experienced a security breach in the last 24 months? If yes, briefly describe.
Free text
9.Have you signed a Data Processing Agreement (DPA) with us, or are you willing to sign one?
Yes / No
10.Please list all sub-processors (third-party platforms) that will handle our data on your behalf.
Free text · optional
11.Within how many hours would you notify us if our data was involved in a breach?
Within 24 hours / Within 48 hours / Within 72 hours / More than 72 hours / No defined process
12.Where is our data stored geographically?
UK only / EEA only / UK and EEA / USA / Other — please specify in comments
13.Do you have a documented process to return or delete all our data on contract termination?
Yes / No
14.Do you have a documented Business Continuity Plan (BCP)?
Yes / No
15.When did you last conduct a formal security risk assessment?
Within the last 6 months / Within the last 12 months / More than 12 months ago / Never
How the builder picks questions
The builder runs the same rules VendorAuditly uses inside the product, with no AI and no guesswork. The same answers always give the same questionnaire, so you can explain to an auditor why a vendor got the questions it did.
Risk sets the length. A critical vendor gets up to 25 questions, an important one up to 15, a standard one 8. Long questionnaires sent to low-risk vendors come back late or not at all, and the answers you need get lost in the ones you don’t.
The vendor type sets the topics. A SaaS provider is asked about encryption, sub-processors and recovery times. A logistics firm is asked about goods-in-transit cover and operator licences. A contractor on your premises is asked about health and safety accreditation.
Regulation adds what the law expects. GDPR adds the questions behind an Article 28 processor check: DPA, sub-processors, data location, deletion. NIS2 adds supply chain security: incident notification, business continuity, risk assessments, staff offboarding.
Evidence you hold removes questions. If you already have the vendor’s ISO 27001 certificate or a signed DPA, the builder drops the questions those documents answer. Asking a vendor to re-state what its certificate proves is the fastest way to lose its goodwill.
Questions people ask
What is a vendor questionnaire builder?
A vendor questionnaire builder is a tool that lets you create, send, and track security questionnaires to your vendors. Instead of emailing Word documents and chasing responses manually, a questionnaire builder automates delivery, sends reminders to non-responders, and collects all answers in one place for review and export.
What questionnaire templates does VendorAuditly include?
VendorAuditly includes pre-built questionnaire templates aligned to DORA Article 28 ICT due diligence, ISO 27001 Annex A.15 supplier security, SOC2 vendor management, GDPR data processor assessment, and general security due diligence. Templates can be sent as-is or customised with additional questions.
Do vendors need to create an account to complete a questionnaire?
No. Vendors receive a unique link and can complete the questionnaire without creating an account. This removes friction and significantly improves response rates. VendorAuditly automatically tracks who has responded, who is overdue, and sends configurable reminder emails to non-responders.
How does VendorAuditly track questionnaire responses?
VendorAuditly shows the status of every questionnaire — sent, in progress, completed, or overdue — in a central dashboard. Responses are stored with timestamps, creating an audit trail of when each vendor was assessed and what they said. Completed responses update the vendor's risk score automatically.
Can questionnaire responses be exported for audits?
Yes. VendorAuditly exports questionnaire responses as part of the vendor evidence pack — including the questions asked, vendor responses, completion date, and vendor name. This creates the dated due diligence record that ISO 27001 auditors and DORA inspectors expect to see.
Related: framework questionnaire templates · what to ask in a vendor security questionnaire · vendor risk score calculator