Supply
A source owner provides the approved document for review.
Security questionnaires + RFPs
Finish your security questionnaire
from sources you approved.
Try the free 5-question gap check, no card
One questionnaire family for USD 850. Cited drafts from your own documents, and a person on your side reviews every answer before it is used.
Send your questionnaire and the documents you already have. A person on your side reviews every answer.
Ready for the full set? One questionnaire family, $850.
Approved sources / Cited drafts / Human review / Private workspace
GOV-01
Does your company operate a documented human approval step before any customer-facing answer or external message is released?
Draft answerAwaiting review
A human reviews every answer before any external use. External actions pause at a human approval gate. [1][2]
[1] Shuttlewright website: home · v1[2] Shuttlewright Terms of Service · v1
Approved sourcesCited draftsHuman reviewPrivate workspace
01 / How it works
From supplied source to reviewer draft.
Nothing is sent outside from this page. Answers leave only after your reviewer approves them.
01
02
Match
Relate a questionnaire item to a relevant source passage.
03
Draft
Prepare a proposed answer only when the supplied evidence supports it.
04
Review
A person checks the source and proposed answer; gaps stay unresolved.
05
Hold
Keep the packet in review. Nothing is sent or exported without your approval.
Packet layoutSource review firstHuman review before use
Real output
Real output from the live engine.
Captured on 16 October 2026 from the free try page. The source text and questions are our own sample, no customer data. Each evidence sentence below appears word for word in the pasted source.
Source text pasted
We are not SOC 2 certified. Customer data is stored in Cloudflare D1 databases in the EU region. Backups are kept for 30 days. We have not run a public bug bounty program.
Q: Are you SOC 2 certified?
Draft: We are not SOC 2 certified. [1]
Evidence: "We are not SOC 2 certified."
Q: Where is customer data stored?
Draft: We store customer data in the EU region. [1]
Evidence: "Customer data is stored in Cloudflare D1 databases in the EU region."
Q: Do you offer a bug bounty?
Draft: We do not offer a bug bounty. [1]
Evidence: "We have not run a public bug bounty program."
Read the last one against its evidence: the draft says "do not offer", which is slightly stronger than "have not run a public bug bounty program". That is why the evidence sits next to every draft for a person to review.
02 / Controls
Review controls and current limits.
Your review checks keep approved sources, answer ownership and evidence together.
01 / Sources
Owner-approved sources
The intended workflow starts with documents a source owner has approved, not open-web search.
02 / Citations
Source-backed drafts
A proposed answer should point to a specific source passage; unsupported answers stay unresolved.
03 / Oversight
Approval gates
Review required before external use.
04 / Audit
Audit visibility
Review the audit chain in the operator console.
05 / Permissions
Deny by default
The intended workflow limits tools and actions to explicit permissions; review any pilot scope before relying on it.
06 / Security review
Security review
Tenant isolation and encryption terms are set in the pilot scope and a security review before any production use.
03 / Who it’s for
For the teams that lose days to questionnaires.
Bring recurring SIG, CAIQ or RFP questions and approved source passages into a review path your team controls.
- Security and GRC leads at B2B SaaS companies
- Sales engineering teams stuck waiting on security reviews
- GRC consultancies answering for many clients
- RevOps partners who want a white-label security desk
02 / Price
USD 850 for one questionnaire family.
The CAIQ v4 alone has 261 questions (Cloud Security Alliance). At 15 minutes a question, that is about 65 hours of someone’s time. The 15 minutes is an example; use your own number.
What happens after you pay
- Pay at Polar checkoutYour private workspace is created right after payment.
- Add your sources and questionnaireYou add the approved documents and the questionnaire family to process.
- Review cited draftsEach draft shows the source sentence it came from. Anything your sources do not answer is marked “needs input”. Your reviewer approves or edits before use.
Try one sourced answer free Ready for the full set? One questionnaire family, $850.
Does a person check the answers?
Yes. Drafts are suggestions. A person at your company reviews them before they are used, and Security Desk sends nothing for you.
What if my sources do not cover a question?
It stays marked “needs input”. We do not make up an answer.
Where does my text go?
Only the sentences that match a question are sent to Cloudflare Workers AI to check the match and word the draft. Each answer shows which model, if any, wrote it.
Are you SOC 2 or ISO 27001 certified?
No. See the trust page for what we do and do not claim.
Can I see it work first?
Yes. Paste your own text and up to 3 questions. No signup, nothing saved.
Start with a free scan
Scan your AI visibility. Ask about a monthly Security Desk plan.
The free AI visibility scan checks your public website’s technical readiness. Security Desk is a separate source-backed questionnaire review workflow.
04 / Contact
Talk to Shuttlewright.
Questions about a scoped pilot? Email the team to discuss the sources, review path and timing.
fuseini.metadata@gmail.com · Founders: fuseini.metadata@gmail.com, alhassanmo365@gmail.com