The questionnaire lands at 16:40 on a Friday: a spreadsheet of a hundred-odd questions, due the following Friday, from a client whose renewal depends on it. The service manager who owns it has answered these before by forwarding sections to whoever seemed to know and collecting the replies over a fortnight. This time she blocks out Monday. The method below is the one we use to answer ours, and the sentences are the ones we give. Take the method even if you do not take the product.
Because it is answered in the wrong unit. Question by question, by people who each know one part, produces a hundred answers in a hundred voices, half of them vague enough to generate a follow-up. A questionnaire is really seven sections asked a hundred ways. Answer the seven sections once, in sentences precise enough to be verified, and the hundred questions become copy and paste.
Hosting and tenancy. Encryption. Identity and access control. Audit and logging. The AI. The agent and the network. What we do not do. Every questionnaire we have seen maps onto those, in roughly that order, whatever it calls them. Write one paragraph of precise sentences for each before you open the spreadsheet.
Two of the seven need evidence rather than sentences, and the evidence should exist before the questionnaire does. For us that is the deployment documentation, the written threat model for total compromise of the management plane, and the network posture guides, all available during evaluation rather than after signature. Whatever your equivalents are, put them in a folder on Monday morning, because a reviewer who can open a document stops asking questions about it.
It names the mechanism and the boundary, and it can be checked. The left column below is the kind of answer that generates a follow-up. The right column is ours.
Hosting and tenancy. Single-tenant per customer; there is no multi-tenant mode. Self-hosted on your servers with OS installers or container images, or hosted by us on infrastructure dedicated to your organisation. Your Suite pairs only with your own product instances and your own secrets.
Encryption. Every connection is TLS, including the agent’s socket, the browser and the relay between them. Credentials, documents, ticket contents and integration secrets use AES-256-GCM at rest. Credentials injected into a remote session are resolved server-side and never reach the browser. Sessions are relayed through the platform: TLS-protected end to end, not end-to-end encrypted in the cryptographic sense.
Identity and access. Single sign-on across every module. Permissions by action rather than by page, assigned through groups, with grants that can carry an expiry date. If a permission check errors, access is denied. Deactivate someone once and every product session ends immediately. A private vault cannot be opened by any administrator, including a super admin, and the attempt is recorded.
Audit. Every sign-in and failure, every ticket change, every credential reveal (who, when, from where, which permission, including overrides) and every suppressed alert with its reason.
The AI. Approve every step, approve the plan once, or unattended; destructive commands stop for a human regardless. Your most sensitive documents are never fed to a model.
The agent. Optional, scoped listeners only where you choose them: a collector, an SNMP trap receiver, loopback screen sharing on macOS and Linux. Three documented network postures, in their own post.
Say it in one sentence, then say what you do instead. The reviewer’s job is to verify claims. A limitation stated plainly is verified in one reading and closed. A vague claim opens a follow-up, and each follow-up is a week. Ours, in the form we give them: we are not SOC 2 certified; a workflow collects SOC 2 control evidence from your Windows and Linux estate, which is a tool for your audit, not a certification of ours. Encryption is not zero-knowledge; shared credentials must be decryptable server-side for injection, break-glass and recovery, and an operator with the master key and database access can decrypt them (the full argument is in we are not zero-knowledge). The audit trail is append-only, not tamper-proof. Our AI service is ours by default; if nothing may leave your network, host the models yourself and point us at them. SAML is not supported.
None of those sentences has ever lost us a questionnaire that we would have won by being vague. Several have shortened one, because the reviewer stopped looking for the catch.
The hard part is the morning. Once the seven paragraphs exist, the afternoon is mechanical, and next quarter’s questionnaire starts at 13:00.
A fortnight of forwarded sections is a fortnight of a service manager’s attention and a week of everyone else’s interruptions, per questionnaire, and vague answers cost everybody a week on top when the follow-ups come. A day is a day. The reconciliation that never happens is the one where the answers you gave in March disagree with the ones you gave in September because different people wrote them.
Our answers to the seven sections, in the order a questionnaire asks, including the limitations, as a PDF you can paste from.