Security Questionnaire Autopilot
Drafts answers to client security questionnaires from your own policies, cites the policy line behind each answer, and never answers yes without proof.
Every draft answer quotes the policy line it relies on
The real screen, on synthetic dataA certificate the agency doesn't hold gets a plain no and its plan, never a yes
The real screen, on synthetic dataWhen a policy changes, every answer that quoted the old version is reopened
The real screen, on synthetic dataApproved answers go back into the client's own file, and nothing else changes
The real screen, on synthetic dataThe whole demo as a video, with captions and chapters
Demo built on synthetic data.
1 of 5: An answer and its policy line
The problem
Every bank or insurer client sends a questionnaire with a few hundred questions, and a senior engineer loses a week to it. Many of the answers already exist in your policies. The risk is the answer someone writes to be helpful that your documents don't support.
What it does
It reads the questionnaire from a spreadsheet, a document or a portal export.
It finds the policy text behind each answer and quotes it.
When you don't have what's asked for, such as a SOC 2 report, it answers no plainly and adds your plan.
It never drafts a yes without a policy line to quote, and writes answers back into the original file only after a person approves them.
Try to break it
On the call we'll trigger these, live:
- A question asks for a certificate you don't hold. The draft says so; it never says yes.
- A policy changes after the draft. Every answer that quoted it is reopened.
- The same question appears on three tabs. It's answered once and linked.
Where it runs
An office computer or your own cloud account. Your policies don't leave it.
Who else does something like this
Loopio automates answers to RFPs and security questionnaires as a hosted service.
The Autopilot runs on your machines and refuses to answer yes without a cited document.
The rules it respects
Every approved answer records who approved it and which document it relied on.
What our tests measured
How we testThese figures come from test runs on Google's Gemini (gemini-3.5-flash-lite), a hosted model, on synthetic data. We'll add runs on a local model.
- Run on 13 October 2026
- Model: gemini:gemini-3.5-flash-lite
- 481 examples
For your engineers
- Engines
- Extractor, Gatekeeper, Proof Console
- Sealed mode
- Test passed: with sealed mode on, it refuses every outbound connection except to the model you've approved.
Data flow