Step 1
You send three things.
The questionnaire exactly as your customer sent it, your latest SOC 2 report, and whatever policies you have. No forms to fill, no question mapping.
Step 2
Every answer is a quote.
Each response is backed by the exact sentence from your documents and the page it's on. We check the quote really exists before it goes in the file.
Step 3
Exceptions are disclosed.
If your auditor found a problem, the answer says so and cites the exception. Your customer finds out from you, in your words, not later from the report.
Step 4
Gaps stay blank.
Where nothing in your evidence supports an answer, the cell is left empty with a note on what's missing. A reviewer checks every flagged answer before you get the file.
| # | Question | Answer | Evidence |
|---|---|---|---|
| 4.1 | Is customer data encrypted at rest using AES-256 or stronger? | Yes | SOC 2 Type II, CC6.1, p.3: “Customer data at rest is encrypted using AES-256 via AWS KMS.” ✓ Quote verified |
| 6.3 | Is access revoked within 24 hours of termination? | Partial | Auditor exception, CC6.3, p.4: “For 2 of 25 sampled terminations, access was revoked after 48 hours.” Exception disclosed |
| 7.4 | In which countries is customer data stored? | blank | No document states where data is hosted. Add a data-residency statement. Left blank |
A sample. The company and report are fictional; the format is what you receive.