Product
One workspace for every security review your company answers.
Attestloom keeps your evidence, your questionnaires, and your approved answers together, so each review is drafted from what is true today and reviewed by the people accountable for it.
Review table · acme-vendor-assessment.xlsx
Q-101Documented security policy, reviewed annually?
97%ApprovedQ-113Encryption in transit and TLS versions
79%Needs reviewQ-150Hosting location and data residency
91%CitedQ-183Cyber liability insurance limit
Finance · due Nov 3Needs owner
Sources with owners
Security Policy Set v4.2
Leah C.Review Jan 2027
Architecture notes
Daniel O.Review Mar 2027
2025 CAIQ responses
Leah C.Review overdue
Stale evidence is flagged before it is cited, not after a customer notices.
Capabilities
Each feature holds one promise: the answer can be checked.
Cited answers with source highlights
Every drafted sentence points at a passage in your own documents. Reviewers see the highlight, not a claim to take on trust.
Q-131How quickly are customers notified of a breach?
We notify affected customers without undue delay, and in any case within 72 hours, after confirming a security incident that affects their data.
Policy Set v4.2 › 4. Incident Response
Security events are monitored around the clock by an on-call security engineer. Corvane notifies affected customers without undue delay, and in any case within 72 hours, after confirming a security incident that affects their data. Notices describe the nature of the incident.Confidence on every answer
Scored from evidence coverage, not model mood. Under 0.80 needs a reviewer before export.
- Encryption at rest97%
- Third-party pen test64%
- Data residency88%
Gaps routed to owners
Unsupported questions are never guessed. They go to a named owner with a due date and a thread.
Original-format export
Answers go back into the customer's own file, in the column they asked for.
Reviewed answer library
Approved answers flow back, with their sources and a last-reviewed date, so the next review starts ahead.
- MFA for productionreviewed 12d ago
- Backup and DRreviewed 31d ago
RFP mode
Long-form narrative sections drafted paragraph by paragraph, each paragraph cited.
4.2 Security program overview
3 citationsAudit trail
Who drafted, edited, approved, and exported each answer, exported with every file.
Model-agnostic
A thin routing layer sends drafting to the configured provider and falls back cleanly. Your evidence and rules stay the same whichever model runs.
Where it fits
Two teams, one source of truth.
Security and GRC
Own the evidence, approve the answers.
Keep policies current with owners and review dates, see exactly which passages support each claim, and sign off with a recorded approval instead of rewriting the same answers every week.
Security reviewsSales engineering and proposals
Answer while the deal is warm.
Import the customer's file the day it arrives, return it in their format, and use RFP mode for narrative sections, without pulling security engineers off their roadmap for routine questions.
RFPsTrust
Guardrails are part of the product, not a policy page.
Never invents controls
No source, no answer. Unsupported questions are marked Needs owner with the reason.
Every answer cited
Citations are checked to be verbatim spans of your documents before anyone sees them.
Your data never trains models
Model API requests are sent with storage off, and provider terms exclude training on API data.
Tenant isolation
Every row carries a workspace ID enforced on every query. Originals are sealed with per-workspace keys.
Read how documents are encrypted, isolated, retained, and deleted, and which subprocessors touch them. Attestloom does not yet hold its own SOC 2 report; a Type I examination is on the roadmap and labeled as such.
Visit the Trust page