AI-native security questionnaire and RFP automation
Security reviews answered in hours, every answer cited.
Connect your policies, SOC 2 summary, and past questionnaires once. Attestloom drafts every answer from your own evidence, cites the exact passage, scores its confidence, and sends what it cannot support to an owner.
Every answer citedGaps never guessedYour data never trains models
Drafting queue
4 of 214Q-112Do you encrypt data at rest?
CitedPolicy Set › Cryptography96%Q-120Is MFA enforced for production access?
CitedPolicy Set › Access Control94%Q-138Annual third-party penetration test?
Needs reviewPolicy Set › Vulnerability71%Q-174Do you hold a FedRAMP authorization?
Needs ownerNo supporting sourceRouted to owner
Confidence
96%
Q-112 · evidence covers algorithm and key management
Sample workspace totals
- Questions answered
- 12,480
- Hours saved
- 1,716
Illustrative figures from a sample workspace, not audited customer data.
Live demo · no login
Try it on a real questionnaire.
Pick a fictional vendor's evidence pack and run a 15-question security review, or paste up to 10 of your own questions. Watch answers arrive with citations you can open, confidence you can read, and gaps left for a human.
No login. Rate-limited per IP. Questions and answers are processed in memory and never stored.
3 · Review
Pick a pack and run the sample. Rows fill as each answer is drafted.
Every answer will show its sources.
Open a citation chip to see the exact passage highlighted. Two questions in the sample have no supporting evidence on purpose: watch them come back as Needs owner instead of a guess.
How it works
Three steps from spreadsheet to signed-off answers.
Step 01
Connect your evidence
Upload policies, your SOC 2 summary, past questionnaires, and architecture notes once. Each source gets an owner and a review date.
- Security Policy Set v4.2.pdf38 chunks · Leah C.
- SOC 2 Type II summary.docx11 chunks · Leah C.
- 2026 SIG Lite (approved).xlsx212 Q/A · Daniel O.
Step 02
Drop in the questionnaire
XLSX, CSV, or pasted questions. Attestloom finds the question and answer columns, keeps your customer's layout, and drafts every row.
acme-vendor-assessment.xlsx
- Questions
- 214 in column B
- Answers to
- column D
- IDs
- column A
Step 03
Review and export
Approve, edit, or assign. Export into the original file with an audit log of who approved what, and when.
- 10:42L. Castellanos approved Q-112
- 10:44D. Okafor edited Q-138, approved
- 10:51Q-174 assigned to legal, due Nov 3
- 11:06Exported acme-vendor-assessment.xlsx
Product
Everything a security review needs, and nothing it cannot back up.
Cited answers with source highlights
Every drafted sentence points at a passage in your own documents. Reviewers see the highlight, not a claim to take on trust.
Q-131How quickly are customers notified of a breach?
We notify affected customers without undue delay, and in any case within 72 hours, after confirming a security incident that affects their data.
Policy Set v4.2 › 4. Incident Response
Security events are monitored around the clock by an on-call security engineer. Corvane notifies affected customers without undue delay, and in any case within 72 hours, after confirming a security incident that affects their data. Notices describe the nature of the incident.Confidence on every answer
Scored from evidence coverage, not model mood. Under 0.80 needs a reviewer before export.
- Encryption at rest97%
- Third-party pen test64%
- Data residency88%
Gaps routed to owners
Unsupported questions are never guessed. They go to a named owner with a due date and a thread.
Original-format export
Answers go back into the customer's own file, in the column they asked for.
Reviewed answer library
Approved answers flow back, with their sources and a last-reviewed date, so the next review starts ahead.
- MFA for productionreviewed 12d ago
- Backup and DRreviewed 31d ago
RFP mode
Long-form narrative sections drafted paragraph by paragraph, each paragraph cited.
4.2 Security program overview
3 citationsAudit trail
Who drafted, edited, approved, and exported each answer, exported with every file.
Model-agnostic
A thin routing layer sends drafting to the configured provider and falls back cleanly. Your evidence and rules stay the same whichever model runs.
Outcomes
Faster reviews without lowering the bar.
6 hrs
median time to a reviewed 250-question SIG Lite, down from 3.5 working days
78%
of drafted answers approved without edits after the second questionnaire
0
answers exported without a citation or a named human approver
2.4×
more security reviews handled per sales engineer each quarter
Illustrative sample customer results, not audited and not a guarantee. Your results depend on the evidence you connect.
Built AI-native
Mapping hundreds of differently worded questions to the right evidence is a language problem.
Keyword templates break on the first rephrased question. Attestloom was designed around retrieval and language models from the first commit, with guardrails that make every output checkable.
How the AI works- 01Ingest and chunk
- 02Retrieve evidence
- 03Draft with citations
- 04Score confidence
- 05Route gaps
- 06Learn from approvals
Trust
Built for the people who sign the answers.
Attestloom is a tool for telling the truth about your security program faster. It is not a tool for saying more than your evidence supports.
Never invents controls
No source, no answer. Unsupported questions are marked Needs owner with the reason.
Every answer cited
Citations are checked to be verbatim spans of your documents before anyone sees them.
Your data never trains models
Model API requests are sent with storage off, and provider terms exclude training on API data.
Tenant isolation
Every row carries a workspace ID enforced on every query. Originals are sealed with per-workspace keys.
Read how documents are encrypted, isolated, retained, and deleted, and which subprocessors touch them. Attestloom does not yet hold its own SOC 2 report; a Type I examination is on the roadmap and labeled as such.
Visit the Trust pageFrom the field
What security and sales engineering teams notice first.
“The first thing I checked was whether it would make up a control we do not have. It would not. Anything without a source came back to my team with the reason, and everything else showed me the paragraph it came from.”
“We used to lose two or three days per questionnaire chasing answers across old spreadsheets. Now the draft is waiting with citations before the kickoff call, and my team spends its time on the questions that need judgment.”
Illustrative, anonymized quotes representing design-partner feedback.
Pricing
Start with one questionnaire. Scale when it proves itself.
All prices in USD. Taxes calculated at checkout.
Free
Prove it on a real review.
$0forever
- 1 questionnaire a month, up to 50 questions
- Cited answers with confidence scores
- Needs-owner routing for unsupported questions
- XLSX and CSV export with audit log
- 2 seats, 10 sources
Team
Most teams start hereFor teams answering reviews every week.
$249per month
or $208/mo billed yearly
- Unlimited questionnaires
- Reviewed answer library
- All export formats: XLSX, CSV, Word, portal copy
- Gap assignment with due dates and comments
- 5 seats, unlimited sources
Business
For security and sales engineering at scale.
$699per month
or $583/mo billed yearly
- Everything in Team
- RFP mode for long-form narrative sections
- SSO (SAML) set up with our team
- Workspace-wide audit exports
- 20 seats, priority drafting and support
Enterprise. Over 20 seats, custom DPA terms, procurement review, or a dedicated region. Talk to sales@attestloom.com.
Contact salesFAQ
Questions procurement will ask.
What happens to the documents we upload?
Sources are parsed into passages and embedded for retrieval inside your workspace. The original file is sealed with AES-256-GCM under a key derived for your workspace, and the database runs on encrypted storage. Nothing is shared across workspaces, and you can delete any source, or the entire workspace, at any time from Settings. Deletion is immediate in the application and backups age out within 30 days.
Is our data used to train AI models?
No. Attestloom does not train models on customer data, and model providers receive only the question and the retrieved passages needed for that request, through API terms that exclude training. OpenAI requests are sent with storage disabled.
Which model providers do you use?
Attestloom is model-agnostic. A thin routing layer sends drafting and embeddings to the configured provider, OpenAI by default, with Anthropic supported as an alternate. Every provider in use is listed as a subprocessor on the Trust page, and Enterprise customers can restrict routing to one provider.
How accurate are the answers?
Accuracy is bounded by your evidence, by design. Every answer must cite a verbatim passage from your sources, and confidence is capped by how much of the question that evidence covers. Answers under 0.80 confidence must be approved by a reviewer before export, and questions with no supporting source are left as Needs owner with the reason instead of being guessed.
Which questionnaire formats are supported?
Import XLSX and CSV files from any template (SIG, SIG Lite, CAIQ, or custom spreadsheets), or paste questions from a portal. Attestloom detects the question, answer, and ID columns and lets you correct them. Export writes answers back into the original file and format, or to CSV, Word, or a portal copy view, with an audit log.
Do you support SSO and roles?
Every workspace has owner, reviewer, and contributor roles enforced on the server. Google sign-in is available on all plans. SAML single sign-on is included in Business and set up with our team during onboarding.
Can we sign a DPA or custom contract?
Yes. Our standard DPA covers processing on your instructions, subprocessors, security measures, and deletion; a summary is public. Business and Enterprise customers can negotiate terms, and we answer your security questionnaire about Attestloom itself, with citations.
Does Attestloom have its own SOC 2 report?
Not yet. We are a Pre-Seed company and will not claim a certification we do not hold. A SOC 2 Type I examination is on our roadmap. Today we share our security overview, subprocessor list, and data handling practices on the Trust page.
More in the docs and on the Trust page.