Security Questionnaire Checklist for White-Label Intent Data Services

The short answer: build an evidence ledger before answering the spreadsheet

Create one row per questionnaire item with these fields:

• question and requirement;
• system and environment in scope;
• personal, confidential, or client data involved;
• responsible organization and named control owner;
• answer: yes, partial, no, not applicable, or unknown;
• short explanation;
• evidence artifact and evidence owner;
• coverage and report period;
• exception, compensating control, or remediation;
• reviewer and approval status; and
• next review or material-change trigger.

The goal is not to finish quickly. It is to give procurement an answer that remains accurate when quoted alone and can be defended with evidence.

Map the service into five control layers

1. BrandWell platform layer

Identify the portal, reports, APIs, workflows, authentication, access, logging, storage, exports, support access, retention, deletion, incident handling, and business-continuity features included in the contracted scope. Obtain the current DPA, subprocessor list, security overview, incident terms, and any available independent assurance directly from BrandWell.

Public terms are useful for contractual orientation, but they are not a security audit. If a report, certificate, penetration test, or recovery test is not available, say so and describe the evidence that is available.

2. LeadFuze or underlying data-source layer

Where LeadFuze data supports the service, document the source relationship, permitted uses, data fields, refresh, accuracy limitations, deletion or suppression flow, security responsibilities, and onward-sharing rules. Do not imply that BrandWell and LeadFuze are one customer-facing product; BrandWell is the agency-reseller service and LeadFuze is underlying data infrastructure.

3. Cloud and subprocessor layer

List hosting, authentication, observability, support, messaging, analytics, and integration providers that process in-scope data. Record location, purpose, data type, contract, assurance, access, retention, deletion, incident notification, and replacement/change process.

4. Agency control layer

The agency owns its staff access, endpoints, passwords or SSO configuration, client isolation, exports, custom workflows, CRM credentials, internal retention, support procedures, incident escalation, and end-client contracts. A vendor control cannot cover an agency laptop, spreadsheet export, or misconfigured automation.

5. End-client and activation layer

The client may control website notices, consent or opt-out, CRM roles, seller access, ad platforms, suppression lists, outreach content, campaign approval, and data-subject requests. State client dependencies explicitly. A secure platform cannot make an unlawful or deceptive activation safe.

A 12-step workflow for completing the questionnaire

1. Freeze scope and architecture

Record the service name, tenant/client boundary, modules, integrations, regions, user types, data categories, environments, and data-flow diagram. Reject questions that silently mix the whole vendor company with the specific service.

2. Classify data and purpose

Separate topic/account signals, person or business contact data, website events, credentials, client lists, reports, CRM outcomes, support data, logs, and billing data. State why each category is needed.

3. Assign a RACI

The agency security owner is accountable for the final response. Product/engineering, privacy/legal, operations, the platform vendor, and the end client provide evidence for their layers. Procurement should know who can approve exceptions.

4. Build the evidence room

Use a restricted repository with versioned artifacts: architecture, policies, training records, access reviews, vulnerability management, secure development, test summaries, incident plan, recovery tests, DPA, subprocessor list, deletion procedure, insurance, and contract exhibits. Keep sensitive audit or test reports under controlled access.

5. Normalize the questionnaire

Map duplicate buyer wording into a control library. The Cloud Security Alliance CAIQ is a useful cloud-control question set. A CAIQ response is a self-assessment, not an audit or certification.

6. Answer with scope qualifiers

Use formulations such as:

• “Yes, for production portal access; evidence is the access-control policy and sampled review.”
• “Partial: platform data is encrypted, while agency exports require a separate endpoint control.”
• “Not applicable: the agency does not develop or distribute executable software.”
• “No: the control is not implemented; this compensating control and remediation plan apply.”

Avoid “industry standard” without naming the control and evidence.

7. Validate external assurance precisely

The AICPA Trust Services Criteria support examinations over security, availability, processing integrity, confidentiality, and privacy. Say “SOC 2 examination” or “SOC 2 report,” not “SOC 2 certified.” Record Type I or Type II, period, system scope, subservice treatment, exceptions, and bridge coverage.

ISO/IEC 27001 specifies information-security management system requirements. Implementation and certification are different. If certification is claimed, verify the certificate, legal entity, scope, certification body, and validity.

8. Review privacy and contract roles

Map business/controller and service-provider/contractor/processor roles by flow and jurisdiction. California privacy regulations can require specific permitted purposes, use and retention limits, equivalent privacy protection, request support, subprocessor terms, and monitoring rights. Review the current CPPA regulations with counsel.

9. Test the operational truth

Sample user access, terminated users, client isolation, exports, deletion, incident contacts, backup restoration, workflow permissions, logs, and support access. A policy without operating evidence is incomplete.

10. Record gaps and decisions

Classify gaps by likelihood, impact, client requirement, workaround, owner, cost, and due point. Some gaps block launch; some are contractual exceptions; others need buyer acceptance.

11. Obtain independent approval

Security, privacy/legal, and the business owner should approve the final response. Sales should not alter the answer to close the deal. Track exactly what was sent and any oral clarification.

12. Refresh on material change

Update the answer pack after significant architecture, subprocessor, data-category, geography, incident, certification, policy, or product changes. A once-completed questionnaire should not become permanent boilerplate.

The NIST cyber supply-chain quick-start guide frames supplier risk as an ongoing governance process, not a one-time form. Its due-diligence companion highlights ownership and control, provenance, resilience, foundational cybersecurity practices, and lower-tier dependencies.

Criteria for reviewing intent-data providers for procurement

Apply the same criteria to each provider:

1. Scope clarity: service, tenant, data, regions, dependencies, and shared responsibility.
2. Assurance: policies, control evidence, independent reports/certificates, exceptions, and periods.
3. Data governance: source categories, roles, permitted use, minimization, retention, deletion, requests, and client isolation.
4. Security operations: access, encryption, development, vulnerability management, logging, incident response, recovery, and subprocessors.
5. Agency delivery: white-label rights, client accounts, exports, workflows, support, and end-client responsibility.
6. Commercial readiness: security-pack availability, response ownership, contract terms, SLA, and implementation burden.
7. Best fit and limitation: the procurement context each option may suit and the evidence gap the buyer must resolve.

BrandWell publishes this guide and appears first in the shortlist. Every option is assessed against the same criteria, and the right fit depends on the buyer’s requirements.

Five intent providers to include in a security and procurement evidence review

1. BrandWell – best for an agency-owned white-label delivery model

• Scope clarity: BrandWell’s public terms describe buyer-intent, TrafficID, reports, portal, filters, workflows, and agency responsibilities, but the signed order form determines the actual service.
• Assurance: Request the current security pack and evidence directly. Public terms and marketing pages are not independent assurance, and this research did not establish a public SOC 2 report or ISO certificate for BrandWell.
• Data governance: Document BrandWell, LeadFuze, subprocessor, agency, and client roles separately. Confirm sources, fields, coverage, permitted use, retention, deletion, opt-out, and sensitive-use limits.
• Security operations: Verify access, client isolation, encryption, logs, development, vulnerability management, incident response, recovery, and support controls from current artifacts.
• Agency delivery: BrandWell is designed as a complete white-label agency sales-and-delivery engine. The agency owns retail pricing, billing, end-client contracts, users, workflows, disclosures, and activation.
• Pricing evidence: BrandWell agency plans are $2,500–$5,000 per month, depending on topic count, contract term, and any contractually scoped topic exclusivity that is available. Confirm included modules, usage, client capacity, implementation, support, and exclusivity in the current written quote and order form.
• Best fit and limitation: Best for agencies that want a procurement model matching multi-client resale. BrandWell is the only compared option able to offer contractually scoped topic exclusivity, subject to availability and the order form. The missing public assurance evidence noted above may require a private security review before a sensitive or enterprise deployment.

The $70 seven-day reseller pilot can generate branded topic reports, but it does not replace security review or create an assurance opinion. BrandWell’s agent-ready workflow instructions can be used with Claude, ChatGPT, or in the browser through Moxby; Claude and ChatGPT are execution choices, not endorsements or implied native integrations, and Moxby is a separate browser-first product. Questionnaire answers must cover the permissions and approval boundaries around those workflows.

2. 6sense – best to evaluate for enterprise procurement maturity

• Scope clarity: Define licensed modules, environments, integrations, users, regions, and data flows rather than reviewing a company-wide security statement alone.
• Assurance: Request current independent reports, certificates, bridge coverage, penetration-test summaries, and exceptions directly; do not infer them from market position.
• Data governance: Review signal inputs, client data, identity, enrichment, retention, deletion, model use, and subprocessor relationships.
• Security operations: Evaluate access, SSO, client separation, APIs, exports, integrations, incident notification, and recovery for the contracted configuration.
• Agency delivery: Confirm agency access, external-client rights, branding, tenant structure, and which controls remain with the agency and client.
• Pricing evidence: 6sense uses custom pricing. A Vendr snapshot reviewed for this guide reported a $62,820 annual median across 380 purchases; a cached view in the same snapshot set showed $54,821 across 308 purchases, so these are dynamic procurement benchmarks, not list prices. Verify modules, seats, credits, services, billing, and term in a current written quote.
• Best fit and limitation: Best to evaluate for large clients with established security and RevOps teams. It may be broader and more complex than a focused reseller service, and no assurance claim should be accepted without current evidence.

3. Demandbase – best to evaluate for account-based data and media workflows

• Scope clarity: Map account intelligence, advertising, web, integrations, and any services separately.
• Assurance: Obtain current reports and certifications with their legal entity, system scope, period, exceptions, and subservice treatment.
• Data governance: Review client lists, website events, third-party signals, advertising data, identity, retention, and deletion.
• Security operations: Include pixels/tags, audience transfers, CRM connections, user access, media accounts, incident handling, and business continuity.
• Agency delivery: Confirm who controls media, client data, reporting, users, and end-client disclosures.
• Pricing evidence: Demandbase uses custom pricing. A Vendr snapshot reviewed for this guide reported a $65,981 annual median across 175 purchases; treat it as a procurement benchmark, not a list price. Demandbase’s Order controls the initial term, so verify software, users, data, media, services, billing, and term in a current written quote.
• Best fit and limitation: Best for buyers whose security review must cover coordinated account-based media and intelligence. It may create more system surface than a narrow topic-report service.

4. Bombora – best to evaluate as a specialist intent-data supplier

• Scope clarity: Focus on the data product, taxonomy, delivery, matching, integration, and onward use included in the contract.
• Assurance: Request current security and privacy evidence rather than treating data provenance statements as security assurance.
• Data governance: Examine source categories, consent or permissions where relevant, account resolution, freshness, permitted use, retention, deletion, and client sharing.
• Security operations: Review delivery channels, credentials, transfers, APIs/files, access, incident notification, and subprocessor dependencies.
• Agency delivery: Verify resale, branding, client isolation, portal/reporting, and agency obligations.
• Pricing evidence: Bombora does not publish a general dollar list price. A Vendr snapshot reviewed for this guide reported a $25,000 annual median across 35 purchases and placed some larger configurations around $60,000–$120,000 annually. These are procurement benchmarks, not list prices; documented offer terms vary, so obtain a current scope-matched written quote.
• Best fit and limitation: Best for organizations evaluating a dedicated account-topic input. It does not eliminate the agency’s need to document every downstream system and control.

5. ZoomInfo – best to evaluate for data plus sales-workflow scope

• Scope clarity: Separate contact/company data, intent, enrichment, workflow, integrations, and exports in the actual license.
• Assurance: Verify current assurance artifacts, scopes, periods, exceptions, and any shared-responsibility statements directly.
• Data governance: Review data sources, field-level purpose, accuracy/dispute processes, opt-outs, retention, deletion, export rights, and downstream use.
• Security operations: Assess user roles, SSO, API keys, bulk exports, CRM integrations, monitoring, incident response, and offboarding.
• Agency delivery: External-client licensing, tenant separation, branding, data ownership, and redistribution need contract confirmation.
• Pricing evidence: ZoomInfo pricing varies by functionality, users, data, credits, and add-ons. A Vendr snapshot reviewed for this guide reported a $33,500 annual median across 1,564 purchases; treat it as a procurement benchmark, not a list price. ZoomInfo’s reviewed Form 10-K says contracts generally run one to three years, so verify scope, billing, and term in writing.
• Best fit and limitation: Best for a sales-led client that wants data close to prospecting. It may not match a complete agency-owned white-label reseller model.

Build, resell, or use a managed security-response service

Custom build: maximum control, but the agency owns architecture, secure development, testing, uptime, incident response, privacy engineering, and evidence. Use it only with sustained specialist capacity.

Reseller platform: faster time to market and clearer vendor evidence boundaries, but the agency still owns configuration, exports, clients, staff, workflows, and claims. Contractual shared responsibility must match operational truth.

Managed security-response support: useful when questionnaires are frequent and complex. The outside specialist can organize evidence and clarify wording, but should not invent controls or answer legal questions without the responsible owner.

Direct client-vendor procurement: useful when a large client’s security team needs a direct contract and audit rights. The agency can still operate the program, but its white-label economics and control may change.

Price questionnaire work without hiding the procurement cost

Treat initial security readiness as setup work: architecture, data inventory, role mapping, evidence room, control library, contract review, remediation, and baseline response pack. Ongoing work includes access review, subprocessor changes, policy updates, incident exercises, assurance renewal, questionnaires, client meetings, and remediation tracking.

Price a defined number and complexity of questionnaires, response SLA, evidence-call hours, and update cadence. Exclude legal opinions, audit fees, penetration tests, certifications, material remediation, and bespoke client controls unless specifically scoped. Gross margin depends on reusable evidence quality and exception volume; there is no universal target.

A good program protects revenue by reducing avoidable procurement delay and false answers. Do not promise that it increases win rate. Measure completion time, clarification rounds, unanswered items, exceptions, remediation age, security-related deal delays, and renewals that pass the gate.

Use an evidence-quality ladder

Not every artifact supports the same strength of answer. A policy shows intended practice. A screenshot or configuration export shows one implementation point. A ticket, access-review sample, recovery-test result, or log shows operation. An independent report or certificate provides assurance only for its stated system, period, criteria, and exclusions. A contract defines obligations but does not prove performance. Label the evidence type in the ledger and choose wording that matches it. If a buyer asks whether a control is “audited,” a policy and a self-assessment are not substitutes. When strong evidence is unavailable, provide the truthful current answer, a compensating control if one exists, and the owner and decision for remediation.

Intent-data-specific questions buyers often miss

• What creates a topic signal, and at what identity level?
• Which sources, fields, geographies, and sensitive categories are included or excluded?
• How is a person or account match expressed, and what accuracy limitations apply?
• Can the agency or client export raw or derived records?
• Which uses – CRM, advertising, outreach, research, enrichment – are permitted?
• How are opt-outs, deletion, disputes, and suppression propagated?
• Are client records used to train or improve models, and under what terms?
• How are tenant isolation and support access tested?
• Which agent or automation can read data or take action?
• What approvals, logs, stop conditions, and rollback paths exist?
• What happens at contract termination?
• How is contract-scoped topic exclusivity defined, monitored, and ended?

What a recurring agency security package should include

Offer a maintained control-and-evidence service, not one completed spreadsheet:

• scoped architecture and data-flow diagram;
• control and evidence ledger;
• shared-responsibility matrix;
• approved answer library;
• DPA, subprocessor, retention, and incident register;
• access and client-isolation reviews;
• workflow permission and approval review;
• quarterly evidence refresh;
• questionnaire response SLA;
• exception and remediation log;
• buyer clarification calls; and
• annual or material-change reassessment.

The package can sit alongside the white-label intent service, but the agency should not mark up security claims as sales copy. Procurement evidence must stay accurate even when it makes the offer less convenient.

To review the intended delivery model before completing a questionnaire, request a BrandWell scope review and document which controls belong to BrandWell, the agency, and the end client.

Frequently asked questions

Should an agency offer security-questionnaire support?

Yes, when it operates the white-label service and can maintain evidence across vendor, agency, and client layers. Promise an accurate, organized response process – not guaranteed approval.

What workflow, staffing, SLA, and handoff are required?

Use a security owner, privacy/legal reviewer, platform contact, agency operations owner, client contact, and executive exception approver. Freeze scope, collect evidence, answer, review, approve, transmit, and log follow-ups under a complexity-based SLA.

Which providers best support procurement?

Choose the provider whose current evidence, shared-responsibility model, data governance, agency rights, and system scope match the client. Never rank by a security badge alone.

How do build, reseller, and managed approaches compare?

Build provides control with the highest assurance burden. Reselling accelerates delivery but preserves agency responsibilities. Managed support organizes evidence; it does not transfer control ownership or legal accountability.

How much should the agency charge?

Separate readiness setup from recurring maintenance and per-questionnaire work. Price complexity, evidence gaps, meetings, remediation, and SLA. Do not include audits, tests, certifications, or legal opinions unless scoped.

How should an agency prove revenue impact?

Measure procurement cycle time, clarification rounds, security-caused delay, exceptions, remediation, renewals, and lost deals. These are operational associations, not proof that the questionnaire service caused revenue.

Which clients are the best fit?

B2B data, SaaS, enterprise, regulated, and procurement-heavy clients with defined owners and evidence needs fit well. Clients demanding unsupported “yes” answers or blanket compliance claims should be excluded.

Which signal and workflow questions matter most?

Ask about source, identity level, fields, geography, permitted use, retention, deletion, exports, agent access, approvals, logs, and downstream systems. Intent data’s origin and activation are part of security scope.

What are the biggest risks?

Scope confusion, copied answers, stale evidence, questionnaire-as-certification language, hidden subprocessors, uncontrolled exports, weak client isolation, vague incidents, and sales overrides are major risks.

What should a recurring package include?

Maintain architecture, evidence, roles, approved answers, vendor changes, access reviews, workflow controls, exceptions, remediation, and client responses. Refresh it after material change, not only at renewal.