{"page":"/tools/dsp-rfp-template","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Item","Question","Why it matters","Red-flag answer"],"rows":[["49 (pass/fail)","Provide current SOC 2 Type II or ISO 27001 reports under NDA, with audit dates and scope.","Enterprise minimum; see PCI, HIPAA and SOC 2 for ad tech.","None, expired, or scope excludes the bidding platform."],["50 (pass/fail)","Provide your GDPR Article 28 data processing agreement, subprocessor list and international transfer mechanism.","Without a DPA you are the controller with no processor terms.","No subprocessor list."],["51","How do you handle sector-restricted data (health, financial, children's) and which controls apply?","HIPAA, GLBA and state health-privacy laws reach ad tech; the compliance hub tracks them.","\"We do not process sensitive data\" with no controls."],["52","What are your incident-response SLA and breach-notification time to us?","GDPR's 72-hour regulator clock starts with your awareness, which depends on theirs.","More than 72 hours, or undefined."],["53","Describe access controls: SSO, role-based permissions, audit logs for every change to campaigns and settings.","Shared logins defeat question 36.","Shared logins; no audit log."],["54","What is your penetration-test cadence and vulnerability-disclosure process?","A bidder is an internet-facing system taking millions of requests a second.","None, or undisclosed."]],"sourceUrls":[[],[],[],[],[],[]]}