Security questionnaire drafting

Before you start

Discuss setup and account eligibility with the founding team. This manifest is not an executable or purchasable template.

• A customer questionnaire
• Approved current policies and control evidence
• A security reviewer and permitted export destination

How the workflow should run

• Match each question to the relevant approved documents.
• Draft an answer with a source reference and document date.
• Flag missing, expired or contradictory evidence rather than filling gaps.
• Submit the draft and open questions for review before any customer export.

Human review and limits

The security owner signs off on every answer and export. An agent cannot attest a certification or control on the company's behalf.

• This is document assistance, not certification or an audit opinion. Never upload customer or regulated data without an approved data-handling agreement.

Synthetic example input

This is a small illustration of the expected contract. It is not a customer record, live execution result or performance benchmark.

{
  "synthetic": true,
  "questionId": "SEC-DEMO-01",
  "question": "Is the company SOC 2 certified?",
  "approvedEvidence": []
}

Expected review output

{
  "synthetic": true,
  "questionId": "SEC-DEMO-01",
  "answer": null,
  "state": "evidence_required",
  "reason": "No certification evidence supplied",
  "exported": false
}

What to verify before deployment

• Every affirmative control claim has current supporting evidence.
• Missing evidence remains explicitly unanswered.
• Conflicting document versions are escalated.
• Only the reviewed version can be exported to an authorized destination.