HECVAT help for SaaS vendors

HECVAT help for SaaS vendors is the fastest way to unblock a stalled deal with a college or university: NorthSight Technologies completes your HECVAT questionnaire and fixes the code behind the answers so they are actually true. We are senior Canadian engineers — not a form-filling service — so when a campus security team checks your answers, they hold up. Start with a free introductory call.

What is the HECVAT?

The HECVAT — the Higher Education Community Vendor Assessment Toolkit — is a standardized security questionnaire that colleges and universities send to software and cloud vendors before they buy. It is stewarded by EDUCAUSE (which holds the copyright) together with its Higher Education Information Security Council (HEISC), Internet2 and REN-ISAC, and its purpose is simple: let a vendor answer one consistent set of security, privacy and data-handling questions instead of a different custom questionnaire for every campus. For an institution, it is a shared, trusted way to assess risk before signing; for a vendor, a completed HECVAT is increasingly the ticket that lets a contract move forward at all.

The current generation, HECVAT 4 (released February 2025), is a single modular workbook of roughly 320 questions across seven sections — company and product information, data handling, access control, application security, infrastructure, incident response and a dedicated privacy section — with conditional logic that now also covers AI governance where a product uses AI. The depth of questions you actually answer scales with the risk of the engagement.

If a campus procurement or information-security office has sent you a spreadsheet of security questions before they will sign, that document is almost certainly a HECVAT or a close equivalent.

Who has to complete a HECVAT?

Any vendor selling a software product, SaaS application or cloud service into a post-secondary institution is typically asked to complete one — and the ask gets sharper the moment your product touches student, staff, research or health data. In practice that means almost every modern SaaS vendor selling into higher education: learning tools, student-services platforms, health-and-wellness apps, research software, analytics, scheduling, payments. If you are selling to a college and a security review is standing between you and signature, the HECVAT is the review.

In Canada this increasingly arrives alongside privacy obligations the buyer is bound by — PIPEDA federally, PHIPA for health data in Ontario, and Quebec's Law 25 — so a Canadian post-secondary deal often means satisfying the HECVAT and showing your data-handling lines up with the applicable privacy law. A Canadian firm answering a Canadian buyer's residency question with evidence is a real advantage here.

HECVAT Full vs Lite vs On-Premise — and what changed in version 4

For years the toolkit shipped as separate documents, and buyers still use the names:

• HECVAT Full — the detailed assessment, used for higher-risk or data-heavy products.
• HECVAT Lite — a shorter version for lower-risk purchases.
• HECVAT On-Premise — for software installed on the institution's own hardware rather than hosted by the vendor.

HECVAT version 4, released in 2025, consolidated these into a single, modular assessment where the depth of questions scales with the risk of the engagement, rather than three distinct files. The practical effect for vendors: there is one current toolkit to work against, but many buyers still speak in the old "Full / Lite" terms, so you should expect to hear both. Whichever framing your buyer uses, the underlying questions — data handling, access control, application security, infrastructure, incident response and privacy — are the same ones your software has to be able to answer honestly.

How do you complete a HECVAT questionnaire?

Mechanically, you work through each section and answer honestly, attaching evidence where the question asks for it:

• Company & product information — what you are, what the product does, how it is hosted.
• Data handling & privacy — what personal data you collect, where it is stored, who can see it, and how it crosses borders.
• Access control & authentication — how users prove who they are and what they are allowed to do.
• Application security — how the software itself is protected against the common classes of attack.
• Infrastructure & operations — hosting, encryption, backups, monitoring.
• Incident response — what happens, and who you tell, when something goes wrong.

Filling in the document is not the hard part. The hard part is that a meaningful number of answers are only "yes" if the software actually behaves that way — data is encrypted at rest, access control is enforced on the server, logs exist, data stays in Canada. Where the honest answer is "no," the fix is an engineering change, not better wording. Writing a confident answer you can't back up is the fastest way to fail the follow-up, because a buyer's security team checks.

Why vendors get stuck — and where code review comes in

The pattern we see constantly: the questionnaire itself gets completed in a day, then the deal stalls for weeks because two or three answers can't honestly be "yes" yet. Access control leaks between tenants. Secrets are hard-coded. There's no encryption at rest. Data residency can't be proven. These aren't paperwork problems — they're in the code. This is the moment a secure code review stops being optional: the only way to make the HECVAT answers true is to find the gaps in the application and close them. That is exactly the work we do, and it is why bringing in engineers — rather than a compliance form service — is what actually unblocks the sale.

How NorthSight helps you pass

We take you through the whole thing end to end:

• Review the application against what the HECVAT actually probes — authentication, access control, secrets handling, dependencies and data residency — so we know exactly which answers are currently true.
• Close the real gaps. The same senior engineers who find a finding build the fix and re-test it, so "yes" becomes an evidence-backed yes.
• Complete the questionnaire with you, so the language is accurate, consistent and defensible when the buyer's security team follows up.
• Document data handling and residency — a Canadian firm answering a Canadian buyer's residency requirement with evidence, not a guess.

This is the exact situation we are built for. In one representative engagement, a health-and-education SaaS vendor had a signed-in-principle deal with Canadian colleges waiting on a HECVAT and the code review behind it — the kind of blocker where the paperwork was ready but two answers couldn't honestly be "yes" until the software changed. Senior engineers who both find the issues and fix them are what turn that standstill back into a signature.

What does HECVAT help cost, and how long does it take?

It depends on how close your software already is to what the questionnaire requires. If the answers are genuinely "yes" and you just need help completing and evidencing the document, that is a short engagement. If two or three answers need the code to change first, the timeline and cost are driven by those findings — codebase size, language and access. Your first 20-minute call is free: we use it to see which questionnaire and deadline you're facing and outline the fastest honest path through it.

Frequently asked questions