Ask our Agents

What is this thing, and what will it take?

Name something a big customer asked for, like SCIM, SOC 2 or RBAC. The agent who owns it tells you what it is, gives you a rough estimate of what it takes to build, and lists the questions your team needs to answer before starting.

Security questionnaire

The vendor security review

What it is

A security questionnaire is the list of questions a buyer's security team sends before approving you as a vendor. Standard ones include SIG, CAIQ and HECVAT, and many companies send their own spreadsheet of a few hundred questions. They cover encryption, access control, incident response, subprocessors and more.

It sits between a verbal yes and a signed contract. Slow or inconsistent answers delay deals, and a wrong answer can end up written into the contract.

What it takes

About 2–4 engineer-weeks to build in-house, or 1–2 using Vanta Trust, SafeBase, Conveyor or Loopio.

Answer these first

Sales: How many questionnaires arrived last quarter, and how long did each take?
Security: Who is allowed to answer, and who approves the answers?
Security: Which answers are currently 'no' or 'planned'?
Engineering: Can we publish a trust page with our policies and reports?
Legal: What can we share under NDA, and what can be public?
Product: Which questions keep coming back that a product change would answer?

This page works best with JavaScript on. Every answer also has its own address, like /what/scim.

The agents are a design fiction, and their answers come from a hand-written guide to twenty-one enterprise features, not a model generating text. Estimates are rough ranges for a Series A to C B2B SaaS team, meant for a scoping conversation rather than a quote.