Security overview one-pager template for SaaS customers
Updated
A free, short security overview (a one-pager) for a SaaS company, built from the facts you tick: where you host, how data is encrypted and backed up, how people sign in, how you handle incidents, which subprocessors touch customer data and who to contact. It downloads as a Word file or Markdown, and it states only what you tick or type. Whatever you leave blank stays a [Fill in: ...] line.
Build your security overview
Tick only what is true today. A statement appears only for what you tick or type; everything else stays a highlighted [Fill in: ...] line for you to complete or delete. Built in your browser: nothing is uploaded and there is no signup.
Opens in Word, Pages or Google Docs. The Word file is kept short: one or two pages.
Preview
[Fill in: company name] security overview
[Fill in: product name]
Assurance
- [Fill in: SOC 2 status and any other framework you can document, or delete this section]
Hosting and data location
- [Fill in: hosting provider and data region, or delete this section]
Data protection
- [Fill in: how data is protected in transit and at rest, and how it is backed up, or delete this section]
Access control and logging
- [Fill in: how employees and customers sign in, or delete this section]
Security practices
- [Fill in: the security practices you can describe, or delete this section]
Incident response
- [Fill in: how you handle and report security incidents, or delete this section]
Subprocessors
- [Fill in: your subprocessors, or delete this section]
Contact and document control
- Security contact: [Fill in: security contact email]
- Document owner: [Fill in: owner role or name]
- Last reviewed: [Fill in: date of last review]
This overview summarizes our practices as of the review date above. It is not a SOC 2 report.
Review every line before you send it, and replace or delete each highlighted placeholder. For a public version of the same facts, use the trust page generator.
What buyers want on one page
Cortance's guide to a security one-pager for sales and customers lists the items to include: the data hosting region, encryption in transit and at rest, access controls, MFA and SSO plans, logging and monitoring, incident response basics, backup strategies, and a vendor or subprocessor list. It also says not to make the page overly technical. That is a list of topics rather than a filled-in document.
Procurize, in its article on the compliance documents a SaaS company needs, calls a security and compliance overview an "executive-friendly entry point" to the longer documentation. Treat the one-pager that way: it answers the first round of questions and points to the documents behind it.
One-pager, whitepaper or trust page: which to send when
- One-pager. A page you attach to a first reply, a sales thread or a questionnaire. Single-sentence facts, a subprocessor table, a contact. Most of the value is that it is short enough to read.
- Whitepaper. Several pages that explain how the program works. Visme's SaaS security whitepaper template is an 8-page US Letter design to customize. It is a layout, so the words are still yours to write and to prove.
- Trust page. A public page on your own site with the same facts. Build it with the trust page generator, which uses the same fields as this template.
- Questionnaire answers. When the buyer sends their own questions, draft the first pass with the security questionnaire answers tool and keep the questionnaire library in step with the one-pager.
The template: sections with one factual sentence each
The Word file has 8 short sections of single-sentence bullets, kept short on purpose: a sparse overview fits on one US Letter page, and a fuller one (more answers, or up to 12 subprocessors) runs to a second page. Each sentence maps to one field in the form above.
| Section | What it can state | Comes from |
|---|---|---|
| Assurance | Your SOC 2 status, with the date or period for a Type I or Type II report, and whether the report is shared under NDA. Other frameworks, if you name them. | SOC 2 status, report date or period, NDA tick, other frameworks |
| Hosting and data location | The cloud providers you host on and the region where customer data is hosted. | Hosting providers, data hosting region |
| Data protection | Encryption in transit (TLS 1.2 or higher), encryption at rest, and a one-line description of your backups. | Two ticks and a backups line |
| Access control and logging | The identity provider, MFA for employees, SSO for customers, and logging of sign-ins and administrative actions. | Identity provider and three ticks |
| Security practices | A yearly third-party penetration test, vulnerability scanning, and employee security training. | Three ticks |
| Incident response | A written incident response plan, a notification commitment you type, and a way to report a suspected vulnerability. | Two ticks and a commitment line |
| Subprocessors | Up to 12 vendors with purpose and location, as a table. | Name, purpose and location per vendor |
| Contact and document control | The security contact, the document owner and the date of the last review. | Contact email, owner, review date |
Logging is covered, monitoring is not: a tick can say that sign-ins and administrative actions are logged, but how you watch them and who responds is a description only you can write. Here is what the file contains when nothing is ticked. No section makes a statement; each one asks you for the fact or tells you to delete it:
# [Fill in: company name] security overview
[Fill in: product name]
## Assurance
- [Fill in: SOC 2 status and any other framework you can document, or delete this section]
## Hosting and data location
- [Fill in: hosting provider and data region, or delete this section]
## Data protection
- [Fill in: how data is protected in transit and at rest, and how it is backed up, or delete this section]
## Access control and logging
- [Fill in: how employees and customers sign in, or delete this section]
## Security practices
- [Fill in: the security practices you can describe, or delete this section]
## Incident response
- [Fill in: how you handle and report security incidents, or delete this section]
## Subprocessors
- [Fill in: your subprocessors, or delete this section]
## Contact and document control
- Security contact: [Fill in: security contact email]
- Document owner: [Fill in: owner role or name]
- Last reviewed: [Fill in: date of last review]
*This overview summarizes our practices as of the review date above. It is not a SOC 2 report.*
What to leave out
- Anything you cannot show if the buyer asks. Every line should have a setting, a screenshot or a document behind it.
- Absolute claims about the past, uptime or coverage. The next section has examples.
- Internal detail: account IDs, network layouts, tool versions, names of individuals. A security contact is a mailbox, not a person.
- Commitments with a clock on them that you are not staffed to keep, such as a response time in minutes.
- Plans stated as facts. If MFA is on for some people, do not tick it for all employees.
Wording that does not overclaim, and how to describe a SOC 2 report you do not hold yet
The status field has 4 choices besides leaving it out: no SOC 2 report yet; an audit in progress with a CPA firm; a SOC 2 Type I report as of a date; or a SOC 2 Type II report covering a period. Each one writes a sentence that is true if you picked it correctly, and none describes SOC 2 as a certificate, because it is a report issued by a CPA firm. The SOC 2 certification guide explains the difference. If a customer has asked for a report you do not have yet, read what to do when a customer asks for SOC 2 and how to answer a security questionnaire without it.
The same discipline applies to every other sentence. Some phrases to replace:
| Avoid | Do this instead |
|---|---|
| All of our data is encrypted. | Say which: encryption in transit, encryption at rest, or both. One log, export or backup that is not encrypted makes a blanket statement false. |
| We monitor everything 24/7. | Name what you actually run and who gets the alert. If nobody is on call at night, do not imply it. |
| We have never had an incident. | A statement about the past is easy to disprove with one ticket. Describe how incidents are handled instead. |
| Zero downtime. | Link your status page or your service level terms, if you have them, rather than quoting a figure in a sales document. |
| Industry-leading security. | Replace it with a fact a reviewer can check, or delete the sentence. |
To check a draft you have already written, paste it into the policy checker. It flags the same kinds of phrases: blanket encryption claims, always and never statements, real-time monitoring and zero-incident claims, and certificate language for SOC 2.
Keeping it accurate: an owner, a review date, one source of truth
A one-pager goes stale quietly. Hosting moves, a vendor is added, MFA gets an exception, and the page sent last month still says the old thing. The file has a document owner and a last-reviewed date for that reason. Pick a person, not a team alias, and set the review rhythm yourself: the template does not decide how often.
- Keep one list of facts and copy it into all three documents that state them: this page, the trust page and your questionnaire answers.
- Review it when you change hosting, add a subprocessor or change how people sign in, not only on a calendar.
- Keep the policies in step. The free generator writes the 22 policies the page describes, and the system description template covers the longer description a SOC 2 report contains.
- Reviewing a vendor yourself? The vendor security questionnaire template has the questions to ask.
The Audit Kit ($59, one time) includes the policies tailored to the tools you named, so the overview and the documents behind it describe the same stack.
Frequently asked questions
- What goes in a security overview one pager?
- Cortance lists eight things: the data hosting region, encryption in transit and at rest, access controls, MFA and SSO plans, logging and monitoring, incident response basics, backups, and a vendor or subprocessor list. This template has a section for each except monitoring, which it leaves for you to describe in your own words, and it adds a contact and a document owner with a review date. Each sentence appears only when you tick or type the fact behind it.
- Is there a free security whitepaper template for SaaS?
- A whitepaper runs to several pages and explains how your security program works. Visme, for example, lists an 8-page US Letter whitepaper design that you customize with your own text. This page covers the shorter document that usually goes out with a questionnaire or in a first security call: one page of single-sentence facts. If a buyer asks for more detail, send the policies or the questionnaire answers instead of stretching the one-pager.
- Can I say we have SOC 2 on the one-pager?
- Say what exists. The status field offers only accurate choices: no SOC 2 report yet, an audit in progress with a CPA firm, a Type I report as of a date, or a Type II report covering a period. SOC 2 is a report from a CPA firm, not a certificate, so the file has no option that describes it as one. The report sentence appears only for the status you pick, and a Type I or Type II sentence needs the date or period from the report itself.
- What if I leave a field blank?
- Nothing is claimed for it. A section with nothing ticked shows a highlighted [Fill in: ...] line in the preview and in the file, so you either complete it or delete the section before you send the page. The subprocessor table, the security contact, the owner and the review date work the same way.
- How is this different from the trust page generator?
- They share the same fields and the same wording, so the two documents say the same thing. The trust page is a public HTML page for your website. The one-pager is a Word file for a sales thread or a questionnaire reply, with a document owner and a review date, and it fits on one page. If you already used the trust page generator, your saved answers pre-fill this form.
- Should I send it as a PDF?
- Edit it in Word or Google Docs first, replace or delete every [Fill in: ...] line, then export a PDF if you do not want the buyer to edit it. This page produces the Word and Markdown versions only, and the review date in the file is the one you type.
- Is anything uploaded?
- No. The Word and Markdown files are built in your browser. If you used the Policyseed generator before, its saved answers are read from your browser's local storage to pre-fill a few fields, and they stay on your device.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.