Investors and acquirers usually ask about access control, data handling, how you ship code, incidents, and what customers have asked of you. They rarely expect perfection. They look for honest answers, a visible owner and a trend toward better. Prepare short, evidence backed answers before the request arrives.
What diligence is really testing
A reviewer wants to know whether security risk could hurt the value of the company: a breach that stalls sales, a missing control that blocks an enterprise deal, or a liability hidden in code and data. They also read how you answer. Vague claims raise more concern than a plain admission of a gap with a plan.
Questions differ by deal and reviewer, so treat this list as a typical pattern, not a standard.
Questions that come up often
- Who is responsible for security, and how much of their time goes to it?
- How do employees authenticate, and is MFA enforced everywhere it can be?
- How is production access granted, reviewed and logged?
- How is customer data stored, encrypted and deleted?
- How do you review code, manage dependencies and handle vulnerabilities?
- Have you had an incident, and what did you change?
- Do you have written policies, and does anyone follow them?
- Which customer security reviews have you passed, and what commitments did you make in contracts?
- What third parties touch your data?
- What are your open source licences and where do your dependencies come from?
How to prepare
Write a half page answer to each, with a link to evidence. Evidence can be a screenshot of an identity provider setting, an access review record, a branch protection rule, a dependency report, a backup restore log, or a contract clause.
Keep a data room folder for security, with policies, the incident log, the vendor list and your latest scan summary.
Where a bill of materials helps
Acquirers increasingly ask for a software bill of materials and licence information. Generating one is quick, and it shows you know what is in your product. Safeguard can produce SBOMs and scan dependencies, and a free scan at gold.safeguard.sh/scan gives you a first look.
Gaps that are cheap to close first
Enforce MFA, turn on disk encryption, enable branch protection and secret scanning, write the one page incident plan, and run a restore test. Each takes hours, not weeks, and each answers a standard question.
Do not overclaim
State only what is true today. Do not describe an audit in progress as completed, and do not say certified where the right word is attested or aligned. Contradictions found later damage trust more than an honest gap.
Common pitfalls.
A final tip: assign one person to own the diligence response and keep a single source of truth. Different founders giving different answers to the same question is a red flag in itself. Keep answers short, link evidence, and date them. After the deal, turn the gaps you found into a short roadmap and share progress, because follow through is one of the best signals you can give.
Quick check
Do we need SOC 2 before a seed round?
Usually not. Investors tend to ask about your plan and basics. Customers, not investors, are more often the reason to start it.
Last reviewed: 19 October 2026.
