AI questionnaires & Ask

Answers grounded in what you have proven

Import a questionnaire and every question is drafted from your approved answers, your published policies and the live health of the controls behind them, with the sources cited. When a control is failing, the answer says so.

Frameworks Monitoring Integrations People & devices Policies Vendors & risk Access reviews Audits SOC 1 Trust Center AI questionnaires Consultancies

Questionnaires

Import, draft, review, export

Upload a CSV or Excel file; InsightAssure finds the question column (and a section column when there is one). Answer with AI drafts every unanswered question, each with a confidence and the sources it used. Reviewers edit and approve; an approved answer can be saved to the answer library so the next questionnaire starts from it. Export to CSV or Excel.

Retrieval ranks the organization’s own sources: 83 standard answers to start (edited to match you), published policies section by section, and controls with their live health.

Questionnaire ‘Contoso vendor security assessment’ for Contoso Health: 10 questions, all answered by AI with confidence and cited sources, such as ‘Do you encrypt customer data at rest?’ and ‘Is MFA enforced for all employees?’, whose answers say a gap found by continuous monitoring is being remediated. — Answers drafted from your approved answers, published policies and live control health, each with its sources. Where a monitor is failing, the answer says so; it does not claim “for all” while the MFA check fails for two people.

Honest by construction

A failing control is never described as in place

Every source carries the controls it relates to: an answer-library entry names its controls, a policy is linked to the controls that cite it. The live status of those controls is always given to the model with the question, with the reasons when they fail. The model is instructed to state what is in place and that a gap is being remediated, never an unqualified “yes” or “for all”, and never to repeat names from failure reasons.

Without a model, the rule path applies the same guard mechanically: a matched answer whose controls are failing gets a note that the automated check is failing and being remediated.

Knowledge base: 83 approved answers with tags, such as ‘Are code changes peer reviewed?’, ‘Are you GDPR compliant?’ and ‘Do you back up customer data?’. — The answer library questionnaires draw on: 83 answers to start, and every answer you approve can be saved back.

Ask Assure

Questions about your own program, from every screen

A side panel on every console screen answers questions about your controls, people, vendors and audits from the same sources and the program’s current numbers, citing what it used. The same engine explains a control (what it requires, why it is in its state, what to do next), drafts a policy and drafts a SOC system description.

Ask Assure side panel answering ‘Which monitors are failing for people and access, and what should we fix first?’ with a table of five failing monitors and a numbered fix priority starting with MFA in the identity provider. — Ask about your own program in plain words. The answer is built from your monitors, policies and controls; here it ranks five people-and-access failures and cites the 3-business-day offboarding SLA from your policy.

Models

Your model, or none

Setting	What happens
Bedrock, Azure OpenAI, Vertex AI, OCI or an OpenAI-compatible endpoint	The model writes from the retrieved sources, in batches of twelve questions, and returns the source ids it used
No model, or `ASSURE_AI=false`	Every feature answers by rule from the same retrieval, with a lower confidence and the same sources
A model that fails	The failure is remembered for five minutes and the rule path answers meanwhile

How it works

A questionnaire answer, from sources to approval

If the sources do not answer a question, the draft is left empty for a person, not invented.

Questions it answers

What you can find out

Each one is answered on a screen you can open, and most can be typed into Ask Assure as they are.

Do we encrypt customer data at rest?A drafted answer citing the cryptography policy, with any gap stated

Which monitors are failing for people and access?Ask Assure: the failing monitors and a fix order

Why is IAM-02 failing?Explain control: requirement, reasons, next steps

Draft an AI acceptable use policyA policy draft from the template and your instructions

Which answers are low confidence?The questionnaire’s Low confidence filter

Export for the customerCSV or Excel with every approved answer

Outcomes

What teams do with it

Questionnaires in hours

Every question drafted with sources; people review instead of writing.

No answer you would retract

Failing controls are disclosed, not glossed.

An answer library that grows

Every approved answer makes the next one faster.

Where it stops. Answers are drafts for a person to approve. There is no browser extension or portal autofill for customer questionnaire sites yet: import the file, answer here, export it back.

Trust Center Policies Security: AI boundaries Blog: questionnaires you can audit