FillTrust
Create account

The worked example

The same questionnaire, answered from three different filing cabinets.

One company has a SOC 2 and a written policy set. One has good engineering notes and no audit. One has a paragraph. They get eight answers, four, and one — because the product only writes what the documents behind it support. Every answer below is real output, captured from a real run.

Try it against three different companies.

Same questionnaire, very different documentation. One has a SOC 2 and a written policy set, one has good engineering notes and no audit, and one has a paragraph. Watch what happens to the third: the boxes stay empty, because nothing in its documents supports an answer and making one up is the failure this product exists to avoid.

Questionnaire
CAIQ_v4_Northwind.xlsx

8 answered · 0 need you

Pick a question · 8

Drafted answer

All customer data is encrypted in transit using TLS 1.2 or above and at rest using AES-256.

Drawn from

Information Security Policy s.3
“All customer data is encrypted in transit using TLS 1.2 or above and at rest using AES-256.”

8 of 8 answered from Northwind Systems’s own documents. Every one is backed by a passage you can go and read. Reading: Information Security Policy s.3 · Information Security Policy s.4 · Information Security Policy s.5 · +9 more

Real output, captured from a real run. Precomputed rather than live, because answering costs model time and a button anybody can press is a bill with no revenue against it.

Sample data. The questions are real, taken verbatim from a CAIQ v4 workbook. The three companies are invented, and so are their documents. The answers are not: they are what the product actually returned when it read those documents. Publishing a real customer’s security posture on a public page would be a strange thing for us to do.

Step through it

Drop it in, and watch it read your evidence.

Play it, pause it, or jump to a step. The three phases are the whole product: the file arrives, your own documents are read, and the sheet comes back with a grade and a citation on every row.

The three answers worth clicking

“Do you hold ISO 27001?” on Northwind comes back a confident no, not a gap. Their certifications register says they do not hold it and have no timeline. “No” is a real answer and shipping it is faster for everybody than leaving a box for a human to fill in with the same word.

The same question on Meridian is left blank. Their documents are good engineering notes that simply never mention certification. Same question, same product, different evidence, different answer — which is the whole behaviour.

Brightside’s encryption answer is blank too, and it is the one that matters. “We take security seriously” is in their notes. A plausible sentence about AES-256 would have been easy to write and impossible for a reviewer to catch. Saying “I don't know” is the harder behaviour and the only useful one.

Run this against your own documents

Create your account

Nothing is processed until you subscribe. See pricing before your first questionnaire.