Security questionnaire software built for compliance consultancies

Each client gets its own workspace. On the Growth and Agency plans a workspace switcher moves you between them without signing out, and the separation is not just a filter in the interface: tenant isolation is enforced by PostgreSQL row-level security, so one client's evidence cannot be read in another client's workspace even by a faulty query. Sign-in is SSO only (Google or Microsoft), so removing a consultant ends their access immediately.

1. 1

   Drop in the questionnaire, whatever format it came in

   Excel, CSV, PDF or Word. The questions are parsed in your browser and triaged deterministically: already answered for this client before, answerable from evidence, or needing a human decision.

2. 2

   Collect evidence inside the client's estate

   The open-source collector runs on the client's machines, makes zero network calls, and reads exports from their identity provider (Microsoft Entra, Okta, Google Workspace, PingOne, JumpCloud) and vulnerability scanner (Trivy). Secrets, IP addresses and personal data are scrubbed before anything leaves.

3. 3

   Verdicts by code, narrative by AI

   Pass/fail against ISO/IEC 27001:2022 and Cyber Essentials v3.3 is computed by deterministic rules — the 14-day patching window, MFA scope and the rest. The AI only drafts the written answer around a verdict that is already decided, and cites the evidence behind it.

4. 4

   You review and sign off

   Anything the system is not certain about lands in a review queue. You edit before approving, and every approval is audit-trailed: who signed off what, and when.

5. 5

   Hand back the buyer's own workbook, or a proof pack they can verify

   The buyer's .xlsx comes back with the response cells filled in and its formatting intact. Or send a content-hashed proof pack the buyer checks at a public link, without an account.

A question the evidence cannot support is never guessed. It is traced to its cause — telemetry not connected, coverage not extended, evidence gone stale, a control genuinely failing, or a question only a human can answer — and grouped into work orders ranked by how many answers each fix would unblock. Securevoo puts no hours or prices on that list; it gives you the scope, and you price the remediation work.

You already bill clients £500–£2,500 for a questionnaire or assessment. On Securevoo that job is one answer-run, costing you £12–£15 on top of a monthly base: Boutique £249 (3 client workspaces, 10 runs), Growth £649 (10 workspaces, 40 runs) or Agency £1,299 (25 workspaces, fair-use runs). Runs are metered across all your client workspaces together and hard-capped at your allowance, so there is never a surprise bill. Invoiced, prices exclude VAT. Full pricing · work out what questionnaires cost you today.

• Not an ISMS builder. It answers questionnaires from evidence; it does not write your client's policies or run their certification project.
• Not a trust portal. Buyers receive their own workbook or a verifiable proof pack, not a login to another vendor's site.
• Not a certification body. Cyber Essentials v3.3 is built in as a framework; Securevoo does not issue the certificate.
• UK frameworks first. ISO/IEC 27001:2022 and Cyber Essentials v3.3 are built in, and you can import your own or your client's policies to be cited alongside them. If your book is mostly SOC 2, it is not the right tool yet.

The Agency plan includes onboarding for your delivery team and priority support. Before a client's security team lets you run anything in their estate they will ask how we handle their data — the answer is one page, and it is written to be forwarded.