Question 1

What is MVSP and why does it matter for UK startups?

Accepted Answer

MVSP (Minimum Viable Secure Product) is a vendor-neutral security baseline published at mvsp.dev and maintained by a working group with contributors from Google, Salesforce, Okta, Slack, Netflix and CISA. It has 25 controls across four categories — business, application design, application implementation and operational — and it exists because those companies were all sending near-identical questionnaires to their own suppliers. Completing MVSP shows you take security seriously without needing an expensive third-party audit, which matters when you're competing against larger vendors.

Question 2

Do I really need SOC 2, or is MVSP enough?

Accepted Answer

For early-stage UK startups, MVSP is usually enough to satisfy most enterprise procurement questionnaires. SOC 2 costs £15k–£30k and takes 3–6 months. MVSP is free, takes an afternoon, and covers what most small enterprise buyers actually ask about. Note the trade-off honestly: MVSP is self-attested, so it carries less weight than an audited standard. If a customer specifically requires SOC 2 you can add it later—many don't.

Question 3

How does VendorDeck help with security questionnaires?

Accepted Answer

VendorDeck creates a professional, hosted trust centre that answers most security questionnaire items upfront. Rather than filling in form after form, you share one link. Enterprise procurement teams can review your MVSP compliance, policies, and security posture instantly—dramatically reducing back-and-forth email.

Question 4

What's the difference between VendorDeck Free and Verified?

Accepted Answer

Free is a real, public Trust Centre — not a preview. You get all 25 MVSP controls, auto-generated policies, lead capture, a live URL at vendordeck.org/trust/your-company, and the machine-readable procurement API, with a "Powered by VendorDeck" footer. Verified (£49/month) adds custom document uploads (pen-test reports, SOC 2, Cyber Essentials certificates), full lead history with CSV export, manual approval workflow for access requests, and removes our branding. Most startups stay on Free until a buyer asks for a document they need to upload themselves.

Question 5

Can I use VendorDeck if I only have Cyber Essentials?

Accepted Answer

Yes. Cyber Essentials is a simpler UK government security standard. You can upload your Cyber Essentials certificate alongside the MVSP checklist in your trust centre. This combination is often enough for early-stage enterprise deals—many UK firms default to Cyber Essentials before requiring SOC 2.

Question 6

How long does it take to set up a Trust Centre?

Accepted Answer

An afternoon. Sign up, answer 25 plain-English MVSP questions, and your trust centre goes live at vendordeck.org/trust/your-company. You can upload additional docs (pen-test, Cyber Essentials cert, etc.) immediately, and refine answers anytime. No waiting for approvals or audits. You don't need to answer 'yes' to everything to publish — you need to answer everything honestly.

Question 7

How does the lead capture feature work?

Accepted Answer

When an enterprise prospect reviews your trust centre and requests access to a document, you get an email notification with their company name, contact details, and exactly which documents they reviewed. This turns compliance into a sales signal—you know exactly who's vetting you, and can follow up at the right moment.

Question 8

Is VendorDeck suitable for agencies and consultancies?

Accepted Answer

Yes, especially if you're a marketing, security, or technology agency selling to enterprises. A professional trust centre makes you look enterprise-ready and signals that you care about client security. You can add your own logo and brand colour on any plan, including Free, so it fits into your sales process rather than looking bolted on.

Stop Losing Enterprise Deals to Security Questionnaires

Your Company Ltd

How It Works

Create Your Trust Centre

Complete MVSP Checklist

Share & Capture Leads

Procurement Bot Ready

Features

MVSP Checklist

Auto-Generated Policies

Public Trust Centre (Free)

Lead Capture

Procurement Bot API

Evidence-Backed Controls

VendorDeck Review (Verified)

Frequently asked questions