A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A security questionnaire is a structured set of questions an enterprise buyer sends a vendor to assess the vendor's security and compliance posture before purchasing. It covers areas like access control, encryption, incident response, and certifications. Completing it is a standard gate in the B2B sales and procurement process.
Common formats include the SIG (Standardized Information Gathering) questionnaire and CAIQ. They arrive late in the deal and can stall it for weeks if a vendor scrambles to answer from scratch.
A current SOC 2 report or ISO 27001 certificate short-circuits much of the questionnaire, since buyers accept the attestation in place of many individual answers. A maintained answer library and a named security owner turn a multi-week fire drill into a same-week turnaround.
traztech delivers security questionnaire response and vendor reviews for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Questionnaires arrive at the worst point in a sales cycle: after the buyer is interested and before they will sign. Answering one badly costs weeks; answering forty of them badly costs a quarter.
The efficient pattern is to answer once, properly, and reuse it. A public trust page removes a large share of the questions before anybody sends the form, and a current SOC 2 or ISO 27001 report answers many more with independent evidence.
Publish the answers. A trust page covering certifications, data handling, subprocessors and a security contact answers most of what a reviewer needs and narrows what they ask for.
You can offer your SOC 2 report or ISO certificate instead, and many buyers accept that. Regulated buyers usually still send their own form.