[jamiesonbecker]

Agreed!

IMO, ask for the company's SOC-2 once you've demonstrated that you are a legitimate prospective customer with a budget and not a competitor or social engineer.

That should address most concerns, or at least make the questions more salient, and it has the added benefit of being vetted by a third party.

If they don't have one, then proceed with the dumb questions, but as you quite correctly point out, no one should be surprised if some questions are rebuffed.