> we have a security page that outlines all of this, and essentially answers the questions that are in most security questionnaires we've seen.

And yet, you still have to fill them in, because the people who ask you for them don't actually care to read them or do the data entry, and generally don't even understand them. It's often clear that they're the people who are supposed to be filing them out, when you get questions like "is the data stored according to our internal "level 3" designation described on this intranet page". I find it so frustrating. They say they have questions. They don't have questions, and they don't care about the answers. They care about whether their spreadsheet automatically highlights and cells in red.

"But hey, you want that sale don't you? So do my homework"