Worklyflow
Menu
Get your questionnaire reviewed

For B2B SaaS and software companies

Security questionnaire completion for B2B SaaS Send us the questionnaire. Get back an evidence-backed draft.

Send us your DDQ, SIG, CAIQ or customer security questionnaire together with your existing security documentation. We return an evidence-backed draft and clearly flag anything that needs your confirmation or has no supporting evidence.

We complete vendor and customer security questionnaires, enterprise security assessments and the security sections of RFPs and procurement forms. Every response is grounded in the information you provide, and you approve the final answers.

Get your questionnaire reviewed How the completion service works
  • No new platform to implement.
  • No production access required.
  • No invented compliance claims.
Security review Illustrative example

287 questions

  • 241 Supported
  • 31 Review required
  • 15 Missing evidence
  1. Supported

    Is customer data encrypted at rest?

    Yes. Production customer data is encrypted at rest in accordance with the supplied Data Security Policy.

    Evidence Data Security Policy · §4.2

  2. Review required

    Are backups restoration-tested every 90 days?

    Documentation confirms backups are performed but does not establish a 90-day restoration-testing schedule.

    Needed Confirmation from you

  3. Missing evidence

    Is an independent penetration test performed annually?

    No penetration-test report or policy reference was supplied, so this cannot be substantiated.

    Needed Evidence or your answer

Illustrative example only. Figures and wording are not client data.

The problem

A questionnaire lands. Someone has to answer it.

A prospect sends a security questionnaire with hundreds of questions. Someone inside your company then works through it, usually alongside their real job.

  1. Searching policies for the paragraph that answers the question
  2. Looking up how a similar question was answered last time
  3. Checking technical details with the people who know
  4. Chasing evidence, and whoever holds it
  5. Answering the same topics again, in slightly different words

That work sits between your team and a closed deal.

What you send, what you get

Send the material you already have. Get back something you can review.

You send

  • The questionnaireExcel, Word, a portal export or similar
  • Security policies
  • Certifications and reportsWhere you hold them
  • Technical and security documentation
  • Previously approved responsesWhere available

You get

  • Completed draft responses
  • Evidence mappingEach supported answer points to its source
  • Unsupported questions flaggedMarked, not filled in with a guess
  • Items needing your approval
  • Reusable answer materialApproved answers, kept with their evidence

Evidence first

Never guess. Every answer is either supported or flagged.

Answers are drafted only from what you supply. When the evidence isn’t there, the question comes back to you marked for review.

Supported
Question
Is production access protected by MFA?
Answer
Yes. Privileged production access requires MFA according to the supplied Access Control Policy.
Evidence
Access Control Policy · §4.2
Review required
Question
Are employees required to complete security awareness training every year?
Finding
The Information Security Policy requires training but does not state how often it must be completed.
Required
Customer confirmation
Supported
The supplied material answers the question, and the answer cites where.
Review required
The material is partial or ambiguous, or the answer needs your judgement.
Missing evidence
Nothing supplied supports an answer. You provide evidence, or answer it yourself.

Examples are illustrative and are not drawn from client work.

Formats

Built for the questionnaires buyers actually send.

We’re set up to handle these formats. This is not a record of past engagements.

Reuse

Answer it once. Reuse it next time.

Most questionnaires ask variations on the same topics. Once an answer has been reviewed and approved, it can be kept alongside its evidence and used again.

  • Encryption
  • Identity and access
  • MFA
  • Backups
  • Incident response
  • Vulnerability management
  • Data retention
  • Subprocessors
  • Business continuity

First questionnaire

  1. Question
  2. Evidence
  3. Draft
  4. Review
  5. Approved answer

Future questionnaires

  1. New question
  2. Match approved knowledge
  3. Verify evidence
  4. Review exceptions

How it works

Send the questionnaire. Provide the evidence. Review the exceptions.

  1. Send the questionnaire

    Tell us what has arrived, its format and your deadline.

  2. We review the scope

    We check the scope and agree what we need from you before any sensitive material is exchanged.

  3. We prepare evidence-backed responses

    Answers are drafted from your material, each tied to its source. Anything unsupported is flagged.

  4. You review exceptions

    You confirm, correct or supply evidence for flagged items, and approve what goes to your customer.

  5. Receive the completed draft

    The completed draft, plus reusable approved-answer material for next time.

Boundaries

What we won’t do.

A questionnaire is a set of representations your company makes to a customer. They have to be true, and they have to be yours.

  • Invent controls that aren’t in your documentation
  • Claim certifications you don’t hold
  • Manufacture evidence
  • Present assumptions as verified facts
  • Make legal attestations on your behalf
  • Require production credentials to complete a questionnaire

You remain responsible for approving every final representation.

Request a questionnaire review

Have a questionnaire waiting?

Tell us what you’ve received. We’ll review the scope and let you know what we need to complete it.

  • No production access required.
  • Please don’t include sensitive documents or credentials in this form.
Questionnaire format

We’ll use these details only to respond to your enquiry.

FAQ

Questions we expect.

Do you need access to our production environment?

No. We work from the documents you send and won’t ask for credentials or access to production systems. If a question can only be answered by inspecting a live system, we flag it for you to answer.

What happens if our documentation doesn’t answer a question?

We don’t fill the gap with a guess. The question is marked review required or missing evidence, with a note on what is unclear. You then supply evidence, confirm the position, or answer it yourself.

Can you use previous questionnaires?

Yes. Previously approved responses you provide can be used as source material. We check them against your current documentation and flag anything that looks out of date or inconsistent.

Do you provide SOC 2 or ISO 27001 certification?

No. We don’t audit, certify or attest. We help you answer questionnaires from the evidence you already hold, including any certifications or reports issued to you. Certification comes from the relevant auditors and certification bodies.

Can you handle recurring questionnaires?

Yes, that is part of the idea. Answers you have reviewed and approved can be kept with their evidence and reused on later questionnaires. Mention it in your enquiry and we can discuss what an ongoing arrangement would look like.

How do you handle our information?

Confidential material is handled under arrangements we agree with you before you send anything sensitive, including how documents are transferred and how long they are kept. Until then, send only the enquiry form.