A security exhibit is a short attachment to the contract that states the vendor's security commitments as obligations instead of marketing. For a tool that reads your code or data, ask for access control, encryption, logging, vulnerability handling, breach notice, audit evidence and notice of material changes. Keep it short enough that both sides will actually read it.
Why bother
Trust center pages and questionnaire answers describe what a vendor does today. Without a contract term, the vendor can change them without telling you. An exhibit makes the key commitments enforceable and gives your auditors a document to cite.
Clauses worth asking for
Access control. Role based access for vendor staff, least privilege, multi factor authentication for administrative access, and prompt removal when staff leave.
Encryption. Encryption in transit and at rest, with a statement of how keys are managed. Ask what you can check, not only what is promised.
Segregation. How your data is separated from other customers' data.
Logging. What the vendor logs, how long it keeps logs, and whether you can get access logs for your tenant.
Vulnerability handling. How the vendor finds and fixes weaknesses in its own product, and a target time for critical ones. State it as a commitment to a process, not a guarantee of no flaws.
Breach notice. Notification without undue delay after the vendor becomes aware, with a stated outer limit in hours or days. For personal data, GDPR Article 33(2) already requires a processor to notify the controller without undue delay. See the notice clause guide.
Audit evidence. Delivery of an independent audit report or equivalent each year, and a right to ask reasonable questions. Article 28(3)(h) expects a processor to provide information needed to demonstrate compliance and to allow audits for personal data processing.
Subprocessors. A current list and notice of changes.
Material change notice. Advance notice if the vendor makes a change that weakens a commitment, such as moving hosting to a new region.
Business continuity. Backups and recovery objectives, stated plainly.
What to leave out
Do not turn the exhibit into a copy of your own security policy. Vendors serving many customers will not accept 40 pages of custom terms, and a clause nobody will track is worse than no clause. Choose the eight or ten that matter for this tool.
How to check it is true
Compare each clause to the evidence: the audit report, the trust center, the questionnaire answers. Where they differ, ask. See how to read a vendor SOC 2 report for the evidence side.
Sources
Try it yourself
Look at how controls map to frameworks, and compare that evidence view with the clauses you would ask a vendor to commit to.
Click through it at your own pace, or open it full screen.
Quick check
Is an exhibit the same as a SOC 2 report?
No. A report is an auditor's assessment. An exhibit is a contract term between you and the vendor.
How long should an exhibit be?
A page or two is usually enough. If nobody will read it, nobody will enforce it.
Last reviewed: 19 October 2026.
