Vendor security reviews are evidence problems wearing questionnaire clothes. Buyers ask for answers; they follow up for proof. If your proof is a Slack search and a half-updated Confluence page, every deal reopens the same archaeology.
What belongs in the vault
- Policies and standards (versioned, with owners).
- Architecture / data-flow summaries safe to share externally.
- SOC 2 report excerpts, bridge letters, and control narratives you actually stand behind.
- Runbooks that map to common asks: key rotation, access reviews, IR, restore drills.
- Past questionnaire exports — as reference, not as the live source of truth.
- Screenshots / configs with redaction notes (what must never ship to a portal).
Minimum metadata per artifact
Identity
Stable evidence ID, title, type (policy / diagram / log extract / attestation), and classification.
Trust
Owner, last-verified date, next review date, and “do not claim” exceptions.
Linkage
Control themes or CCM/SIG tags so questionnaire drafts can find the right row fast.
How the vault feeds a review
- Intake the sheet. SIG, CAIQ, Excel, or portal — extract questions into a working list.
- Draft from evidence, not memory. Each answer cites an evidence ID. No citation → UNVERIFIED + owner.
- Human approve. Especially for access, encryption, and subprocessors — where stale claims kill trust.
- Export and archive. Keep the submitted pack linked to the evidence versions used, so follow-ups don’t restart from zero.
Common vault failure modes
- Two libraries: audit folder vs sales SharePoint that diverge within a quarter.
- Screenshots without dates — buyers ask “is this current?” and you can’t say.
- Over-sharing: full SOC PDFs with customer names in carve-outs.
- AI drafts that sound finished but cite nothing.
Where Trustfill fits
Trustfill is an evidence vault plus cited questionnaire drafts — you approve, then export. Try it at gettrustfill.com. Start smaller if you need to: one spreadsheet with evidence IDs already beats six unmarked PDFs.
Next: SIG Lite / CAIQ answer bank · automation with citations.