Security questionnaires, answered from your own documentation
Upload your policies and audit reports once. When a customer sends a questionnaire, Quenaire drafts every answer from those documents, cites the passage it relied on, and leaves the decision to your reviewers.
Free to start. No card required.
Questionnaires
Northbridge vendor assessment
In reviewDue 21 Nov| Question | Draft answer | Confidence | Status |
|---|---|---|---|
| Do you maintain an information security policy approved by management? | Yes. The Information Security Policy is approved by the CEO and reviewed annually. | 91 | Approved |
| Is customer data encrypted at rest? What algorithm is used? | Yes. Databases, object storage and backups use AES-256, with keys held in AWS KMS. | 78 | Needs review |
| Is data encrypted in transit over public networks? | Yes. All external traffic is served over TLS 1.2 or higher. | 88 | Approved |
| Are background checks performed on new employees? | Not covered by your documents | – | No source |
| Is MFA enforced for access to production systems? | Yes. MFA is required for all production and administrative access. | 86 | Approved |
| How often are user access rights reviewed? | Access to production systems is reviewed quarterly by each system owner. | 72 | Needs review |
| Do you have an incident response plan, and is it tested? | Yes. The Incident Response Plan is exercised in an annual tabletop test. | 81 | Approved |
Reads the files you already have
- Word
- Excel
- CSV
- Plain text
Every draft shows its source. Every gap is marked as a gap.
Quenaire writes only from what your documents say. When they do not cover a question, it tells you so instead of inventing an answer for a customer to rely on.
Drafts written from your documents
Quenaire searches your policies, audit reports and past answers for the passages that bear on each question, then drafts a response from those passages alone, in the plain register a security reviewer expects.
Cited
Every draft names the document and section it relied on.
Honest about gaps
Questions your documents do not cover are flagged, not guessed.
Is customer data encrypted at rest? What algorithm is used?
Yes. All customer data stored in production databases, object storage and backups is encrypted at rest using AES-256, with keys managed in AWS KMS and rotated annually1.
1Data Protection Policy, section 4.1
“All customer data stored in production databases, object storage and backups is encrypted at rest using AES-256 with keys managed in AWS KMS.”
An answer library that grows with every questionnaire
Approved answers are kept. The next questionnaire that asks the same thing, in whatever words, starts from what your team has already signed off, so the work gets lighter each time.
Answer library
Is customer data encrypted at rest?
Yes. Databases, object storage and backups use AES-256 with keys in AWS KMS.
Approved 12 Oct
Which encryption standard protects backups?
Backups are encrypted with AES-256 before they leave the production network.
Approved 3 Sep
Are encryption keys rotated?
Keys managed in AWS KMS are rotated automatically every year.
Approved 28 Aug
Questionnaires in, in their format back out
Customers send spreadsheets laid out every way imaginable. Upload the file as you received it; Quenaire finds the questions and remembers where each answer goes. When you are done, export the original workbook with the answers filled in.
| Control | Question | Vendor response |
|---|---|---|
| AC-01 | Is MFA enforced for remote access? | Yes. MFA is required for all remote and admin access. |
| AC-02 | How often are access rights reviewed? | Quarterly, by each system owner. |
| DP-04 | Is data encrypted at rest? | Yes. AES-256, with keys in AWS KMS. |
| IR-01 | Do you have an incident response plan? | Yes. It is tested in an annual tabletop. |
A review queue for the questions that need a person
Drafts with thin evidence and questions with none wait in one place. Reviewers approve, edit, reject or ask for a fresh draft, and nothing reaches the customer without a person deciding it should.
Review queue
19 waitingHow often are user access rights reviewed?
72Needs reviewRedraftEditApproveAre background checks performed on new employees?
–No sourceRedraftEditApproveIs customer data encrypted at rest?
78Needs reviewRedraftEditApprove
Everything a reviewer works with
Start free1Access Control Policy, 3.2
“Multi-factor authentication is required for all production access.”
Citations you can check
Each answer names the document and passage it came from, so a reviewer can verify it in seconds.
Confidence, stated plainly
Well-supported answers say so. Thin or missing evidence is flagged for a person to decide.
Intake link for Northbridge
Single use, with an expiry date.
Intake links
Send a customer a single-use link to upload their questionnaire straight into your workspace.
Access is reviewed periodically.
Access to production systems is reviewed quarterly by each system owner.
Fresh draftFresh drafts on request
Not happy with a draft? Ask for another, written again from your current documents.
Executive summary
92
Questions
64
Approved
9
Gaps
Executive summaries
Hand leadership a one-page view of what was asked, what was approved and where the gaps are.
Lumen Labs
Lumen EU
Separate workspaces
Each workspace keeps its own documents, answers and reviewers, with nothing shared between them.
How a questionnaire moves through Quenaire
The same four steps every time, whether it is a forty-line spreadsheet or a full vendor assessment. Quenaire does the first pass; your team makes the calls.
- 1PDFDOCXXLSXTXT
Upload your documents
- Policies, audit reports and procedures
- PDF, Word, spreadsheets or plain text
- Every passage indexed so it can be found again
- 212Is MFA enforced?13Is data encrypted at rest?14Is there an IR plan?
Add the questionnaire
- Upload the customer's spreadsheet as received, or let them send it through an intake link
- Questions are found automatically
- Each answer keeps track of the cell it belongs in
- 3
Is MFA enforced?
Yes. MFA is required for all production access1.
91ApprovedReview the drafts
- A draft for every question, written only from your documents
- Sources and a confidence score on each
- Questions your documents do not cover are marked, not guessed
- 4vendor-assessment.xlsxExport
Send it back
- Export the completed workbook in the customer's own layout
- Or a formatted copy, an executive summary or a PDF
- Approved answers join your library for next time
Your documents stay yours
A tool for answering security questions has to hold up to them.
Read the security overviewWorkspaces kept apart
Every request is checked against the workspace it belongs to.
Encrypted throughout
Your documents are encrypted in transit and at rest.
Never used for training
Your documents are not used to train AI models.
Start free, upgrade later
Starter is free with no time limit. Growth is month to month, with no per-seat surprises and no overage fees.
Start freeCompare all plansStarter
$0Free, with no time limit
- 5 questionnaires a month
- Up to 3 users and 1 GB of documents
- Drafts with citations and confidence scores
- Answer library of up to 200 entries
- XLSX and CSV export
Growth
$299per month
Everything in Starter, plus
- Unlimited questionnaires
- Up to 20 users and 25 GB of documents
- Unlimited answer library
- PDF export
- Priority email support
Start with your next questionnaire
Create a workspace, upload a few documents and read the drafts before you commit to anything.