Questionnaires
Security questionnaire automation
Answer inbound security questionnaires with AI grounded in your own controls (included on every paid plan), and send auto-scored ones to your vendors.
Security questionnaires eat days on both sides of a deal. Keel automates both: when a prospect sends you one, it drafts honest answers grounded in your own controls and policies; when you need to assess a vendor, it assembles a structured, auto-scored questionnaire from a library of 100+ questions. Upload the file you were sent and review a queue of drafts, citations included where a draft has them, instead of typing into a spreadsheet.
The problem
A questionnaire is a day of copy-paste, twice
Answering a prospect’s 200-row spreadsheet from memory and old docs is a day gone. Building one to send a vendor, then hand-grading the replies, is another. Both are repetitive work that should be grounded in what you already have.
Capabilities
What Security questionnaire automation does
Answer inbound questionnaires (sell-side)
Paste a prospect’s questions and Keel drafts answers from your own frameworks, controls, and policies: honest, grounded, and flagged where you should confirm internally rather than guess.
Grounded, not guessed
Every answer runs retrieve → draft from your own material → faithfulness check → abstain. If nothing relevant is retrieved, no model is called at all. If the draft cites a source that was not retrieved, or says more than that source supports, it is held for review instead of sent.
It tells you when it does not know
A question your evidence cannot answer comes back marked “needs review”, not filled in confidently. That behaviour is enforced by tests, not by a prompt: no answer can ship without at least one citation, and a near-match from your answer bank is only ever suggested, never auto-filled.
A status and a confidence level on every answer
Each draft is marked answered, reused from your library, or needs review, and carries a high, medium or low confidence level. Confidence is set by rules about how well the retrieved sources match the question. The model does not grade its own work. Where a draft cites your material, the quoted passage sits under the answer, so a reviewer can check it before approving.
Warnings when answers contradict each other
Keel compares the drafts in a run with each other and with the answers you have already approved. If one answer says yes and a related one says no, or a new draft disagrees with your library, the run shows a warning so you can settle it before the questionnaire goes back. The check flags the pair and leaves both answers as they were.
The uploaded file is read as questions, never as instructions
A questionnaire arrives from outside your company. Keel scans it for text written to steer an AI, such as “ignore previous instructions”, and warns the reviewer when it finds any. Whatever the scan finds, the file is handled as questions to answer, and the answers still come only from your own material.
Upload the file you were sent
Upload a .docx, .xlsx, .csv, .txt, .md or PDF questionnaire up to 5 MB, or paste the questions. One run drafts up to 50 questions, so a long questionnaire goes in several runs. For an .xlsx workbook, Keel writes the answers it could verify back into the original file for download, and leaves anything flagged for review in the app.
An answer library that reuses your approved wording
Accept a good answer and it goes into your answer library. When a later questionnaire asks the same question in close to the same words, Keel reuses the wording you approved and refunds that question’s share of the run’s credits. You can search the library and edit or delete an entry when your program changes.
Build and send assessments (buy-side)
Assemble a structured vendor questionnaire from a curated library of 100+ questions, describe the vendor and your concerns, and send it, consistent and on-brand.
Templates, and one draft per vendor
Built-in templates run from a short security review to a comprehensive one, with versions for privacy, SOC 2 or ISO 27001 attestation, cloud and SaaS providers, AI vendors and ISO 9001 suppliers. An owner or admin picks one of these and a set of vendors, Keel creates a draft for each, and each draft is checked and sent on its own, with an optional due date. Each vendor gets its own copy of the questions, so later changes never reach an assessment already in progress.
Auto-scoring
Vendor responses are auto-scored so you get a consistent risk read without grading every answer by hand. Each scored question carries a weight, and the risk score is the share of that weight, from 0 to 100, whose answers came back risky or blank. A response your reviewer flags counts as risky too. The score lands in a low, medium, high or critical band.
Collaborative portal
Vendors answer in a portal and can invite colleagues to help, so responses aren’t bottlenecked on a single contact. They can save part-way and come back, and upload a file wherever a question asks for evidence, such as a SOC 2 report or a certificate.
Outcomes
Why it matters
- Turn a day of questionnaire copy-paste into minutes of review
- Answer prospects from your real posture, not your memory
- Send consistent, auto-scored questionnaires to vendors
- No fixed annual questionnaire cap: AI answering is metered by credits and included on every paid plan
- Keep humans in the loop: every AI draft is reviewed before it’s sent
Get audit-ready, and prove it
Security questionnaire automation is one module of a full GRC platform: controls crosswalked across every framework, so you collect evidence once and comply everywhere. Start free, no credit card, no sales call.
Frequently asked questions
Will the AI make up answers?
No. It drafts from your own controls and policies and flags anything uncertain to confirm internally. You review and approve every answer before it’s sent.
How far can I automate security questionnaires?
Up to the review step. Keel finds the questions in the file, drafts answers from your controls and policies, reuses wording you have approved, and flags conflicts and unsupported answers. A person on your team still approves each answer before it goes to the prospect, because a buyer can hold you to what the questionnaire says.
Does this handle both answering and sending questionnaires?
Yes. Sell-side (answer prospects’ questionnaires) and buy-side (build, send, and auto-score vendor questionnaires) are both covered.
Is there a limit on how many questionnaires I can answer?
There’s no fixed annual questionnaire quota. AI answering is included on every paid plan and metered by AI credits (1,500 a month on Starter, 5,000 on Pro, 15,000 on Enterprise), and you can top up any time, so a heavy quarter isn’t rationed against a yearly limit.
How many questions can one run answer?
Up to 50. A run is charged one flat amount up front, whatever its length, and questions answered from your answer library are refunded afterwards. Split a long questionnaire across several runs.
Is AI questionnaire answering on the Free plan?
Drafting answers uses AI credits, which come with Starter, Pro and Enterprise and with the Pro trial every new workspace starts on. The Free plan has no AI credits. Building a vendor questionnaire from the library, sending it and auto-scoring the replies works on every plan; having AI pick the questions uses credits.
Can buyers get our documents without sending a questionnaire?
Often, yes. Your trust center shows approved policies automatically, and documents such as an audit report or a penetration test summary are uploaded to it separately, optionally behind an NDA.
Where do the vendor questions come from?
From a curated library of 100+ questions you assemble into a structured, auto-scored assessment.
Related features: Vendor risk management · Trust center · AI tools
Works with: SOC 2 · ISO/IEC 27001
Software guides: Security questionnaire software
In the docs: Questionnaire assist