SaaS founders & security leads · private browser tool · free
Answer the customer's security questionnaire from answers you already wrote
Paste the questionnaire and your answer library. Every question is matched to your closest past answer with a confidence level, matches that could be wrong (a different number of hours, a flipped yes/no) are flagged, and the questions you have never answered are listed so you know what to write. Download the filled sheet as CSV.
Nothing is uploaded. Matching runs on this device.
Matched questionnaire
| ID | Question | Match | Suggested answer | Flags |
|---|
Answers to write next
Questions with no close saved answer, grouped by topic. Write these once and they are reusable next time.
Read this first
What it does, and what it leaves to you
- Finds: the closest saved answer for each question, using weighted term similarity after folding synonyms (MFA, 2FA and multi-factor are one control). Marks each as strong, review or no match, tags the topic and whether it expects yes/no, a list or a description, and spots repeated questions.
- Flags: figures that differ from the saved answer (24 hours against 72), negated questions, and answers with no figure when one is asked for.
- Not decided: whether a saved answer is still true, whether it is complete for this customer, or what you may promise. Even a strong match is a suggestion. Every exported row is marked Review. It writes no new answers and makes no compliance claim for you.
Prefer the command line? node cli.mjs questions.csv --library answers.csv > filled.csv runs the same code on your own machine (see the README in the repository).
Common questions
What is a security questionnaire?
A security questionnaire is a spreadsheet or portal form a customer's security or procurement team sends before buying software. It asks, often in hundreds of rows, how the vendor handles encryption, access control, incident response, backups, subprocessors and compliance. Common formats include SIG, CAIQ and customer-written lists. Most rows repeat across customers, which is why a saved answer library saves so much time.
How does the matcher choose an answer?
It compares each incoming question with the questions in your own answer library using term weighting (TF-IDF cosine similarity) after folding common synonyms, so multi-factor, 2FA and MFA count as one control. A strong match is a close paraphrase, a review match is related but not certain, and no match means you write a new answer.
Why does it flag some strong matches?
A text match can be the wrong answer. If the new question asks for 24 hours and the saved answer says 72, or one question is negated and the other is not, the row is downgraded to review and the reason is written in the Flags column.
Is my answer library uploaded?
No. Matching runs in your browser. The library stays in the page unless you press Save library on this device, which stores it in your browser's local storage; you can clear it any time. There is also a command-line version that runs on your own machine.
Does it write answers for me?
No. It reuses answers you have already written and approved, and lists the questions that have none. Every answer in the export is marked Review, because you remain responsible for what you tell a customer.
How to answer a customer security questionnaire faster · SOC 2 readiness checker · Security headers check · RFP compliance matrix generator