Jared Smith Founder & Engineering Leader
Book a call

Kit · Answer bank

A buyer sends a security questionnaire. Your answers have to be true.

The AI Startup Security Questionnaire Kit has your coding agent interview you once about the security program you actually run. Then it writes an answer bank: what is in place, what proves it, who owns it, and where the gaps are. You paste from the bank every time a buyer asks.

Get the kit $19+ · pay what you want See the 10 themes

$29 suggested. One license covers one organization. 7-day refund.

120
questions
10
themes
29
on AI and LLM use
5
files written

Guess, or paste the nicest answer

Your first enterprise buyer sends a security questionnaire. Many of the questions repeat from one buyer to the next. You either guess at the answers, or you paste the nicest one you can write. The security team on the other side finds out which one you did when they ask for the evidence.

I wrote about why in Why Auto-Filled Security Questionnaires Kill AI Deals. This kit is the first step of that advice, in files.

120 questions in 10 themes

  1. Access and identity
  2. Data handling and encryption
  3. AI and LLM use The largest theme, with 29 questions: what your model providers can do with customer data, how long prompts and outputs are kept, what your agents are allowed to call, and whether you log those calls.
  4. Vendors and subprocessors
  5. Incident response
  6. SDLC and change management
  7. Infrastructure and logging
  8. Business continuity
  9. Policies and people
  10. Compliance status

The AI questions are the ones enterprise reviewers have learned to ask AI vendors, and the part a SOC 2 report does not cover. The questions are written for this kit. It never copies SIG or CAIQ text.

One interview, five files

  1. Unzip the kit, open Claude Code, Codex or another agent that reads files and runs shell commands in the folder, and say: read the README and set this up.
  2. The agent walks you through the questions. For each one you say whether the control is in place, partial, not in place or not applicable, and what proves it. It saves after every theme, so you can stop and come back.
  3. It shows a plan, waits for your yes, and writes the bank into a folder you name.
answer-bank.md
Every question with your answer, status, evidence and owner.
answer-bank.csv
The same bank, one row per question, for pasting into a portal or a spreadsheet.
gaps.md
Every partial or not-in-place answer, with what you do meanwhile and when the gap closes (or that you accept it), plus everything still open.
evidence-index.md
Your evidence, listed by document.
handoff.md
What was written, counts per status, open items, and how to update.

Your answers live in a sixth file, notes.md. It is the one file you edit. To update the bank, edit it, run sh render.sh, then sh check.sh. The render backs up the old files first.

The answer rules

A script checks the bank and prints PASS, FAIL or SKIP for each check.

  • Every question has a status.
  • Every "in place" answer names evidence.
  • Every gap has a closing date or is marked accepted, and every missing control says what you do meanwhile.
  • Vague words such as "regularly" or "planned" need a cadence or a date.
  • The CSV matches the bank, and gaps.md lists every gap.
  • No secret-shaped value is in the notes.

The kit would rather write "not in place" than a nicer answer. A gap with an interim step and a date reads better to a security team than a claim they find out is false. Setup never upgrades a status you did not confirm.

What it does not do

  • It does not fill in a questionnaire file you drop in. You copy from the bank.
  • It does not rank your gaps by deal risk, and it does not prepare you for a buyer's follow-up call.
  • It does not copy, open or quote SIG, CAIQ or any other licensed questionnaire.
  • It is not an audit, a pen test or a policy library.
  • It does not promise that a buyer will accept your answers or that a deal closes.

Known limits

  • check.sh cannot read documents outside your repo. Whether your evidence says what you claim is your call.
  • Linux is tested with Claude Code. Codex, macOS and Windows are in beta.
  • The kit makes no network calls. The scripts need POSIX sh and awk. The CSV check also needs python3 and prints SKIP without it.

A live questionnaire under deadline is a separate consulting engagement.

Built by Jared Smith

13+ years shipping production systems. I was CISO at Lavender, where I built the security program from zero through SOC 2 Type II and shipped production AI features for 100,000+ users. Before that: backend and identity at BlockFi, telemetry ingestion at AAMP Global, and co-founder of PopSocial.

Today I'm a founding engineer at an early-stage startup, where most of the code is typed by coding agents and every line is mine to answer for. This kit grows from my post Why Auto-Filled Security Questionnaires Kill AI Deals.

Questions

Who is the Security Questionnaire Kit for?

Founders and CTOs at AI startups who just got their first security questionnaire, and the engineer who was handed it. If you want something that fills in the buyer's spreadsheet for you, this isn't it.

What do I need to run it?

An agent that reads files and runs shell commands, such as Claude Code or Codex, and sh and awk. The CSV check also needs python3 and prints SKIP without it. The kit needs no API keys and no account, and makes no network calls.

Does it use SIG or CAIQ questions?

No. The 120 questions are written for this kit. They cover most of the same public areas that common questionnaires cover. The kit never copies, opens or quotes SIG, CAIQ or any other licensed questionnaire.

Will it fill in the questionnaire my buyer sent?

No. It writes an answer bank, and you copy from the bank into the buyer's file or portal. The CSV has one row per question for pasting.

What if a control is not in place?

The answer says so, says what you do instead, and says when the gap closes or that you accept it. Setup never upgrades a status you did not confirm.

Can I use it for a client?

One license covers one organization. Don't resell or redistribute the kit, and don't hand the kit files themselves to a client. The answer bank the kit writes from your answers is yours, and you may send it to your customers.

How much does it cost?

Pay what you want: $19 minimum, $29 suggested.

Refunds?

7 days, no questions. Email jared@sublimecoding.com.

Controls on Claude Code and Codex themselves are covered by the Coding Agent SOC 2 Kit. The bundle has both kits.

Get the kit

A zip of Markdown steps, templates and shell scripts, delivered via Gumroad. No app, no account, no API keys.

Get the kit $19+ · pay what you want

$29 suggested. 7-day refund, no questions.