Prepared for your buyer’s reviewer
Your buyer sent 187 questions.
Answer them this afternoon.
We write every answer against the stack you actually run, and return it in your buyer’s own file. One purchase, $349, no annual contract. Where something needs a real audit, we say so in writing.
The Triage is free, takes about 4 minutes, and needs no account and no card. You see how much of your file we can answer before you decide anything.
142of 187
questions answered from your Profile
Coverage 76%read in 41 seconds · 9 sections
- 142
- answered, each with its source
- 33
- gaps, one decision each
- 12
- honestly require an audit
Example of the free Triage result. No account, no card.
- 10 minutes
- of intake, 10 questions
- $349
- one time, then $99 per file
- 0
- sales calls, ever
- 1
- afternoon, not 6 months
The largest deal in your history is frozen behind a spreadsheet.
You closed your first enterprise buyer. Then their vendor-risk team asked for a 200-question questionnaire, a SOC 2 report, a DPA, an information security policy and a public security page. You have none of it, and the deal waits on you.
Buy a monitoring program
Entry plans start near $10,000 a year, plus $10,000 to $50,000 for the audit, on a timeline of months. Sized for companies that already have a security team.
Paste in free templates
The policy set visibly does not describe your stack. A reviewer reads that as a red flag, not as reassurance.
Stall
You hope the champion on the other side fights for you, while your nights disappear into copy-paste.
What the deal actually needs is not a certification. It is a credible, stack-specific answer packet this week, and one honest sentence about where you are on the road to an audit.
It starts with a number, not a purchase.
Upload the questionnaire that is blocking the deal. The Triage is free, and it tells you how much of that file we can answer before you decide anything.
- Step 1
Upload the buyer's file
An .xlsx, .csv, .docx or .pdf, or paste the questions as text. No account, no password, no email.
- Step 2
Confirm what we read
“187 questions, 9 sections. Is that right?” One click, so the packet is never built against a misread file.
- Step 3
Answer 10 questions
Cloud, auth, where customer data lives, MFA, production access, backups, subprocessors, laptops, offboarding, pen test. Each one preselected and skippable.
- Step 4
Read your Coverage
Answered, gaps that need one decision each, and the questions that honestly require an audit. Three real answers appear in full.
Target: 6 minutes to the number, 12 minutes to a delivered Trust Packet.
This is what one answer looks like.
Not a template with your company name dropped in. Your cloud, your identity provider, your data region, drawn from one stored Profile, with a source line a reviewer can follow.
Are personnel required to use multi-factor authentication to access production systems?
Yes. Production access is granted only through Google Workspace single sign-on, with multi-factor authentication enforced at the identity provider for every account. Hardware security keys are required for the 3 engineers who hold AWS console access; everyone else uses time-based one-time codes. Access is granted by role, reviewed quarterly, and removed the same day a person leaves.
Source: your intake, 24 August 2026 — auth provider, production access, offboarding
How often is your disaster recovery plan tested?
You take automated daily backups and you have never run a restore drill. Pick a date this quarter and we write the answer around it.
Provide your most recent SOC 2 Type II report.
“We do not hold a SOC 2 report today. Our controls are documented and operating, our audit window opens in January 2027, and we will share the report when it is issued.”
Written the way a vendor-risk reviewer expects to read it. We never claim a report you do not have.
Example rows. A real Triage quotes your buyer’s own question IDs, verbatim.
What $349 puts in your hands.
One purchase, delivered in about 12 minutes. Everything is drawn from one stored Profile, so answer 40 never contradicts answer 3.
- 01
Your questionnaire, filled
The buyer's own file: same sheet, same columns, same order, your answers in the answer column. Nothing to copy and paste.
- 02
The policy set
Information security, access control, incident response, vendor management and business continuity, written against the stack you described.
- 03
A hosted Security Page
A public page you can link from a sales email: your stack, your practices, your subprocessors, your dated gaps.
- 04
DPA and subprocessor list
The data processing agreement, and the named subprocessors a reviewer will ask you to disclose.
- 05
Evidence Checklist
Exactly what an auditor will ask for later, so your next step is a list rather than a mystery.
- 06
The honest sentences
For every question that needs an audit, the plain wording to send your buyer instead of silence.
The price, and what it does not buy.
We will not hide this behind a call. Here is what the alternatives cost, and here is exactly what you do not get from us.
| Option | Cost | Time to an answer |
|---|---|---|
| Continuous monitoring program, entry plan | $10,000 / year, plus $10,000–$50,000 audit | Months |
| Questionnaire response service | $12,000–$25,000 / year | Annual contract first |
| Readiness consultant | $2,000–$10,000 | About 2 weeks |
| Free templates | $0 | Fails the review |
| Trust Packet | $349, once | An afternoon |
What $349 does not buy
- A SOC 2 report. We are not an auditor and we do not issue one.
- A certificate, a badge or a seal for your website.
- Continuous monitoring of your cloud accounts.
- A person on a call. Everything here is written, not presented.
- Any claim to your buyer that is not true today.
When the next buyer asks
Answer Pass
$99Any additional questionnaire, answered from the Profile you already built.
Refresh Pass
$149The whole packet regenerated after a stack change, with a dated change summary.
One-time payments. No subscription, no seat count, no renewal to remember to cancel.
The line we will not cross
We do not issue SOC 2 reports and we are not an auditor. We write what is true today, we name what needs an audit, and we put a date on it.
That is not modesty. It is the reason a packet survives a real vendor review. A reviewer who catches one overstated answer stops trusting the other 186.
If your Triage shows the questionnaire genuinely needs an audit, we hide the checkout button and send a free letter for your buyer instead. That costs us the sale, and it is the right call.
Bring the file that is blocking the deal.
The Triage is free and the first thing you see is a number, not a price: how many of those questions we can answer from your stack.