Most vendor sustainability questionnaires can be passed without the supplier changing anything, because they ask for commitments instead of figures. Five questions with specific answers tell you more than a forty-item form — and the most useful one is not about energy at all. It is how long the vendor keeps your data, and how many copies it makes.
This is written for whoever has to fill in or score one of these forms. It works for any software vendor; file transfer and storage are the running example.
Why the standard questionnaire fails
The usual form asks: do you have a net-zero commitment, an environmental policy, an offsetting programme, reporting under a recognised framework?
A supplier can answer yes to all four without changing how it operates. A commitment is a statement about the future. A policy is a document. Offsets are a payment. None of them measures what the service does today.
Worse, the style favours large suppliers with compliance teams to write the documents over small ones that may be more efficient but have nobody to write the policy.
The five questions
Each one has a specific answer. A vendor that cannot give it is telling you it does not measure.
1. How long do you keep our data by default, and how many copies do you hold?
The most valuable question, and almost never asked. Storage is a continuous energy cost and copies multiply it: a vendor holding three regional copies indefinitely has a much larger footprint per gigabyte than one holding a single copy for thirty days.
It is also a security and compliance question, which earns it a place on the form regardless. Retention is a data protection obligation, not only a cost.
2. Which data centres, in which countries, and who supplies the electricity?
A named facility, country and supplier. Grid carbon intensity varies a lot across Europe, so the country is a real variable.
Then the follow-up that separates the claims: is the renewable supply direct, matched hourly, matched yearly, or offset? Four different things, routinely described with one word. The distinctions, explained.
3. What is the PUE of those facilities — and is it yours or your host's?
Power usage effectiveness. Efficient modern facilities sit near 1.1 to 1.2.
The second half matters. A vendor renting capacity should say the figure is its host's, not present it as its own. A supplier that draws that line unprompted is being careful — itself a useful signal.
4. What is in scope of any carbon claim?
If a vendor says carbon neutral, ask across what. Direct emissions and purchased energy only, or also the supply chain and the hardware — which is usually where most of it sits. Leaving that out quietly is standard practice, and it is the difference between a meaningful claim and a marketing one.
5. What have you actually changed in the last two years, with a figure?
The question no template can answer. A real answer sounds like "we moved from four regions to two and cut stored volume by a third with default expiry". A non-answer sounds like "sustainability is core to our values".
Scoring the answers
Weight by real effect, which is close to the reverse of how vendors present them:
- Retention and copies. Largest effect, rarely volunteered.
- Energy source. Direct supply beats hourly matching beats yearly matching beats offsets.
- Grid location. Real, second-order.
- PUE. Real, smaller.
- Certificates, neutrality claims, tree planting. The weakest evidence — not worthless, not a substitute for the four above.
Two questions worth adding
What happens to our data when the contract ends? The deletion timeline, backups included. It matters for carbon and compliance at once.
Where are backups held, and by whom? Primary storage in one place and backups in another is a common gap on both the carbon sheet and the jurisdiction sheet. Jurisdiction is its own question, and it usually matters more than the energy one.
What I would submit for Yungle
Since I am proposing the form, here are my answers — unflattering parts included. You should ask me question one just as hard as anyone else.
- Retention and copies: one primary copy, not three regional replicas. Nightly backups go to a second Hetzner data centre, in Finland. Free transfers expire after 7 days; paid collections last until you delete them or set a date, which is worse on this measure and is a feature customers want.
- Where and whose power: servers at Hetzner in Germany, on hydropower. I rent capacity; the supply arrangement is Hetzner's.
- PUE: 1.13 — Hetzner's figure for the data centre, not mine. The ISO 27001 and EMAS certificates are Hetzner's too.
- Carbon claims: none. I do not claim carbon neutrality and buy no offsets to support one.
- What changed: the service was built small from the start — one server, one primary copy, expiry by default on free transfers.
A tenth of profit goes to Rainforest Trust, which is a donation and not evidence about electricity. The security side of the form — encryption, hosting, the data processing agreement — is answered on the security page, and the environmental one on the sustainability page.
That is the shape of an answer you can check. Expect it from anyone worth buying from.