Solutions / Questionnaires and RFPs
B2B software and services
Security questionnaires and RFPs answered from your own evidence
A 300-question questionnaire drafted in an afternoon, every answer cited to your own policy or report, with the risky ones routed to the person who owns them.
Representative blueprint. The targets below are design targets we scope and measure against in a Loop Audit. They are not results from a named client.
The deal is waiting on a spreadsheet
- Every enterprise buyer sends their own questionnaire, and the questions repeat with different words.
- The right answer lives in a SOC 2 report, a policy PDF, an architecture doc and one engineer’s head.
- Old answers drift out of date and then get pasted into new contracts.
- Security, legal and sales trade the document in Slack for a week.
- A wrong claim about encryption or data residency is a contractual problem.
How the loop runs.
7 stages, from the moment work arrives to the moment it is proven done. Each one is observable, testable and can be paused.
Ingest
Accepts the buyer’s file, portal export or web form and structures every question and answer field.
Retrieve evidence
Searches your approved knowledge base: policies, reports, architecture and past answers, each tagged with an owner and a review date.
Draft with citations
Writes each answer using only retrieved evidence and cites the source passage.
Score confidence
Marks each answer as ready, needs review or needs an owner, based on evidence quality and how sensitive the claim is.
Route to owners
Sends the uncertain items to the right person in Slack or Teams with the question, the draft and the evidence.
Export
Fills the original document or portal exactly as the buyer expects and keeps a copy of what was sent.
Learn
Adds approved answers to the library and flags answers that become stale when a policy changes.
The hard parts, and how we handle them.
A fluent wrong answer is the worst outcome
The system may only answer from approved evidence. No evidence means no answer, only a routed question. Absolute claims such as "always" and "never" require a human sign-off.
Freshness
Each source has an owner and an expiry. When a policy changes or a certificate expires, every answer that depended on it is flagged for review.
Format fidelity
Buyers send Excel with merged cells, Word with tables, and portals with dropdowns. We write back into the original so you never retype.
Consistency across deals
The same question gets the same answer everywhere, with a visible history of every variation we have ever sent.
What a person always decides
- Answers may only use documents marked approved
- Sensitive claim categories always require a named owner approval
- Complete log of what was sent, to whom and when
- Nothing leaves without a human pressing send
- Source documents never used to train shared models
Connects to
- Google Drive
- SharePoint
- Confluence
- Notion
- Slack
- Microsoft Teams
- Salesforce
- Vanta and Drata
- OneTrust and Whistic portals
Built with
- Document ingestion with versioning
- Retrieval with citation-level grounding
- Owner and expiry registry
- Slack and Teams workflows
- Excel, Word and portal writers
A realistic timeline.
Shadow mode first. Nothing acts on its own until its accuracy has been measured against your team’s own work.
- Week 1Collect your policies, reports and last five questionnaires. Assign owners.
- Weeks 2 to 3Build the approved evidence library and first drafts on past questionnaires.
- Week 4Routing, review workflow and export live on a real deal.
- Week 5 onwardFreshness tracking and portal automation.
What we design for.
Modeled targets, confirmed or corrected with your own data in a Loop Audit.
- Evidence trail ready for your own audits
- Nothing sent without a named approver