Free, ten minutes, no signup
Will your product pass the bank’s security review?
A bank, a hospital or your own lawyers send a vendor security questionnaire. These are the 21 questions behind it, and what a passing answer looks like for each. Ten minutes. Results on screen, no email.
If you have no SOC 2 yet, get that moving first: it is the report most buyers ask for by name. This covers the ground it does not, the AI and data questions a reviewer now asks on top of the certificate, and that a SOC 2 report on its own will not answer for you.
- Where the data lives and moves
- What the model does with it
- Who can touch it
- Can you prove what you shipped
- Can you show your working
- What happens when it breaks
- Can you make it go away
Frequently asked
Questions we get
Who is this for?
A founder or CTO who has built a data or AI product for regulated customers and is now facing the first enterprise security review, their own counsel signing off, or an auditor. The product demos fine. The question is whether it survives scrutiny.
Do I have to give you an email to see the result?
No. The 21 questions, your verdict per area, and what a passing answer looks like for every gap all render on the page without an address. The only thing an email buys you is the free pass on the real questionnaire you have been sent.
Why is there no single score?
Because a number out of 63 tells you nothing you can act on. Seven area verdicts tell you that deletion is where the review stalls and model handling is where you cannot prove what you claim, which is a Monday morning to-do list. The tool reports per area on purpose.
What does "not been asked this" do to my result?
Nothing. It is excluded from that area entirely rather than scored as a zero, and the remaining questions are scaled to the same threshold, so skipping cannot make an area easier or harder to pass. If every question in an area is skipped it shows as "not asked yet" with the questions you will get when they do ask.
What happens to the questionnaire I send you?
Tom reads it and replies the same day with the answers a reviewer will not accept and what would change them. It is a person doing the pass, not a model. The document is stored privately and is not shared, published, or used for anything else.
Is this the same as SOC 2 or ISO 27001?
No, and you should get the SOC 2 moving first if you have not: it is the report most enterprise buyers ask for by name, and there is a whole industry helping you get one. This covers different ground. A SOC 2 report says your controls were audited against a standard; it does not tell a bank which fields you send to a model, whether your provider is contractually barred from training on them, or whether deletion reaches your embedding store. Those are the questions getting answers bounced right now, and a certificate will not answer them for you.
Why ask how much of the code was AI-generated?
Because reviewers have started asking, and it is the question most vendors would rather not answer. The passing answer is not "none". It is an honest number plus the control around it: what agents may add, required coverage, human review before merge.
Can I send the result to someone else?
Yes. The share link puts your answers in the URL, so your CTO or your counsel can open the same result without signing up for anything. Nothing is stored on our side to make that work.
Knowing the gap is the easy half. Closing it is engineering.
Lineage you can show an auditor, a model that runs in your own tenancy, deletion that actually reaches the backups. The work behind a passing answer is the work we do.