Sales reps may say what is on an approved claims sheet and nothing beyond it. The sheet lists each claim in exact wording, the evidence behind it, its owner and its review date, plus a short list of questions to hand to security. It prevents the most common overclaims before they reach a customer.
Why reps overclaim
Reps are not careless. They are asked questions in live calls, they want to help, and the nearest answer is often a marketing line they half remember. A single "yes, we are fully compliant" in an email can end up quoted back in a contract review.
What the sheet contains
| Column | Example content |
|---|---|
| Topic | Encryption, access control, testing, incident handling |
| Approved wording | The exact sentence to use |
| Evidence | Where the proof lives |
| Last reviewed | Date and reviewer |
| Do not say | Phrases that overstate the claim |
| Hand off when | The follow up question that goes to security |
Build it in five steps
- Collect every security claim in your website, decks and past questionnaires.
- For each, find the evidence. No evidence means the claim comes off the list.
- Rewrite each claim in plain, bounded wording with a date or scope where needed.
- Add the hand off triggers: questions about audits, certifications, incidents, custom contracts and named frameworks.
- Get one named approver to sign off and set a quarterly review.
Example of a bounded claim
Instead of "our data is fully encrypted", write what you can prove: which data, in which state, and by what mechanism, per your encryption page. The sheet should say who verified it and when. If the scope differs between products, list each.
Things reps must never state
- That any certification exists, unless the sheet lists it with scope and the issuing body.
- That an audit is complete when it is in progress.
- Anything about a named customer.
- Prices or contract terms in security conversations.
- Absolute words such as always, never, all and guaranteed.
Put the do not say list at the top of the sheet. It is the most used part.
Make it usable
A sheet nobody opens fails. Keep it to two pages, host it where reps already work, and add a one line Slack or email route to security with a target for first reply. Run a ten minute briefing each quarter on what changed. Use real customer questions from the last quarter as examples.
Also track exceptions. When a rep gets a question the sheet cannot answer, record it. After a few weeks you will know which claims to add and which evidence to produce.
Keeping it consistent
The sheet should match your questionnaire answer library and your trust page. When any of those change, update all three on the same day. One named owner prevents the three drifting apart.
Where Safeguard fits
Safeguard's compliance and evidence automation can keep the evidence and review dates for each claim current, so the sheet reflects what you can show. The free scan is available at https://gold.safeguard.sh/scan.
Quick check
How long should the sheet be?
Two pages is a good target. If it is longer, reps will not use it.
What if a rep gets a question that is not on the sheet?
They hand it to security, record the question, and the owner decides whether to add a claim.
Last reviewed: 19 October 2026.
