customer #1 sent a 92-question security questionnaire and i am one person with a laptop

Answer honestly, and answer in the language of the control rather than the question.

For the staff questions, "sole proprietor, no employees, therefore no background check programme; access to production is limited to one named individual with hardware backed two factor" is a complete and truthful answer. For the data centre ones, you name your hosting provider and point at their compliance page, because that is literally the control. Their auditor is used to that answer, it is how every small vendor answers it.

Write four things once and reuse them forever: a one page security overview, a subprocessor list with what data each one sees, your data retention and deletion behaviour, and how someone reports a vulnerability to you. That pack answers most of the spreadsheet.

Then email their security contact and ask which items are blocking versus informational. On mine it was six.

Time cost, since that is the thing nobody prices in. My first one took about seven hours spread over two evenings. The second took forty minutes because I answered from the document I had already written. The third took twenty.

The other number people will bring up is a formal audit. Ballpark for a small shop is well into five figures once you count the auditor and the compliance tooling, plus an observation window measured in months, not weeks. That is not a 79 a month decision. What I would do is ask them plainly what deal size would justify it on their side, and put a note in your file. If three prospects in a row give the same answer, you have a real number to work with instead of anxiety.

Did my first one in March and the one pager is genuinely all I use now, so here is what is in mine in case it saves you an evening.

Who runs it and how many people have production access. Where data lives, which country, which provider. What is encrypted and where. Backup frequency and the last time I tested a restore, with the date. Subprocessors listed in a table with what each one receives. Retention and what happens on cancellation. How to report a security problem and how fast I promise to reply.

It is a page and a half. Two prospects have now accepted it in place of most of their spreadsheet, and one asked for exactly three follow up questions.

A forty person company sending 92 rows for a 79 a month tool is running a process designed for a six figure contract because it is the only process they have.

Before you spend three weekends on it, qualify. Is there approved budget. Who signs. What happens if the answers come back fine, do they buy this month or does it go to a committee in the autumn. If the answers are vague, the questionnaire is not a buying signal, it is an activity.

I have done the diligence marathon twice for accounts that churned inside three months. Both times the signals were there in week one and I ignored them because I wanted the logo.

Answer in a document you own, not in their portal. Portals want an account, an SSO handshake and a Tuesday afternoon, and you cannot reuse anything you type into one.