What do you hand over when a client asks how you manage information?

Summary: Prepare the vendor’s public security report, its data processing agreement and evidence of your account’s data location. Then match them to the client’s actual questions. These documents describe the supplier; they do not show who in your company can access customer records or how you remove access when someone leaves.

Start with the question, then choose the evidence

A request to explain information management can mean an ordinary supplier review, a demand for a particular audit report, or a contractual requirement to keep data in Japan. Ask for the questionnaire or the written requirement before changing a subscription. A public report may answer a general question about the service’s security, but it cannot change where an account stores data.

This is an editorial checklist, not a certification standard. SOC reports concern an organization’s controls. SOC 2 Type II examines their operation over a reporting period; check that period in the report rather than assuming it always covers a full year.

Where to get the reports

HubSpot’s Trust Center, monday.com’s Compliance Hub and Asana’s Trust page list SOC reports. Shopify’s report guide identifies SOC 3 as freely shareable and also lists SOC 2 Type 2 and a bridge letter covering the gap after the report period.

If the client explicitly asks for SOC 2, confirm how it can obtain the report and whether you may forward your copy. Do not treat a download button as permission to redistribute a restricted document. Keep the report version and the date you checked it alongside your answer.

The DPA is a separate document: HubSpot, monday.com, Asana and Shopify publish one. Record the version that applies to your contract. A DPA’s existence alone does not establish that every use of the service meets your client’s requirements.

For a Japanese business, data location needs its own review

Japan’s Personal Information Protection Commission distinguishes storing data abroad from providing it to a foreign third party. Q12-3 describes a case where the cloud provider does not handle the personal data, with contractual terms and appropriate access controls. Whether your service and use fall within that case needs a review of the actual arrangement.

Q10-25 explains that this case still requires security measures informed by the foreign environment, and information about them that the individual can obtain. Distinguish the provider’s country from the server’s country. If the server country cannot be identified, the Q&A addresses explaining that fact, the reason and useful reference information. A country name alone is therefore not the whole answer.

Use these official Q&As and your data flow when reviewing Japanese legal obligations with the person responsible for legal compliance. A client questionnaire and a legal review serve different purposes; completing one does not automatically complete the other.

When the requirement changes the product choice

If the client needs an explanation, assemble the relevant evidence and describe your own controls. If it requires domestic storage, define the scope: customer records, backups, logs, support access and processing may need separate answers. Compare that scope with the vendor’s commitments before paying for another plan. The related data location article introduces the services, but your account and contract are the evidence for the reply.

A document checklist alone is not enough for a project with mandatory sector requirements or a specific certification. Nor does a small contact list remove the need to review applicable obligations. The useful next step is a list of unanswered requirements, each with an owner and the document or setting needed to resolve it.

Sources

Checked 10 October 2026: the linked Trust Centers, Asana Trust and Shopify report guide (report availability and types), and PPC Q12-3 and Q10-25 (cloud use and security measures). DPA links are provided for contract review; this article does not determine their applicability to your account.

← Back to the comparison