• Local First
  • Human Approved
  • Air-Gapped Capable
  • Private Alpha

Never answer the same security questionnaire twice.

Import the spreadsheet. RepliSec finds approved, sourced answers across your platform, organisation and customer knowledge. Review them, approve them and export the completed response.

Use AI to draft answers, use it only to find approved wording, or operate without AI.

Request Alpha Access See How It Works

Local first. Private alpha. Commercial model in validation.

Questionnaires · Vendor Security Assessment 2026
RepliSec working through an imported questionnaire. Question 12 of 23, 'Where is customer data stored geographically?', is selected. RepliSec proposes an answer with the source it came from and a 62 per cent match, alongside Approve, Edit, Promote to library and Regenerate actions.
Dashboard
The RepliSec dashboard, showing 18 approved answers in the library, three questionnaires in progress, 78 knowledge base entries, and how confident the proposed answers are, split into high, medium and low.
The problem

The security questionnaire arrives when the deal is waiting.

Customer security questionnaires often arrive as complex spreadsheets containing hundreds of inconsistently worded questions. They are passed between security, engineering, legal and sales, frequently under pressure to return them quickly.

Teams search previous questionnaires, copy old answers and write whatever will get the response out. The result may contain inconsistent claims, outdated evidence or commitments nobody intended to make.

  • 300-row spreadsheet
  • Friday afternoon
  • Enterprise deal waiting
  • Answers scattered across documents and people

RepliSec turns that improvised process into a governed response workflow.

How it works

Import. Match. Review. Export.

The same four steps whether you are answering your first questionnaire or your fiftieth.

  1. 01

    Import

    Import the customer's spreadsheet or document. RepliSec separates the questions into a structured working list.

  2. 02

    Match

    Search approved answers and eligible supporting knowledge. Every candidate retains its source and scope.

  3. 03

    Review

    A person reviews the proposed response, checks its evidence and approves or changes it.

  4. 04

    Export and reuse

    Return the completed document in the customer's format. Approved answers remain available for future questionnaires.

Questionnaires · Vendor Security Assessment 2026
The questionnaire workspace in RepliSec: the imported question list on the left, and on the right the proposed answer for the selected question with its source, match score and Approve, Edit, Promote to library and Regenerate actions.
  1. 01

    Import. The customer's spreadsheet becomes a numbered working list, so you can see what is answered and what is not.

  2. 02

    Match. Each proposed answer shows where it came from and how closely it matched the question.

  3. 03

    Review. Nothing is final until a person approves it. Edit the wording, or search again.

  4. 04

    Reuse. Promote an approved answer to the library and the next questionnaire starts from it.

Knowledge model

Every answer has a source and a scope.

RepliSec keeps three kinds of knowledge apart: what you inherit from the platforms you rely on, how your own organisation operates, and what you have committed to individual customers.

Every tier is searched at once. Results merge using confidence thresholds and tier precedence, so the more specific knowledge wins. Approved answers are returned exactly as approved, while answers drawn from the knowledge base may combine information across tiers where appropriate.

  1. Tier 1

    Platform and supplier knowledge

    Controls and evidence supplied by platforms on which the organisation relies, such as Azure certifications, service documentation and independently audited infrastructure controls.

    Cloud-provider trust centresCertifications and assurance reportsService documentationSupplier security documentation

    Technical name: Foundation knowledge.

  2. Tier 2

    Organisation knowledge

    The organisation's own policies, configurations, architecture, procedures, controls and approved positions.

    Approved security answersPolicies and proceduresArchitecture and configurationInternal controlsApproved positions
  3. Tier 3

    Customer-specific knowledge

    Contractual commitments, exceptions, configurations and operating details that apply to one customer or engagement.

    Contractual commitmentsAgreed exceptionsCustomer-specific configurationPrevious responses to that customer

Supplier controls do not automatically become your controls.

RepliSec records how your organisation relies on each supplier and distinguishes inherited platform capabilities from controls that your organisation actually configures and operates.

Cloud providerSubprocessorTechnology supplierReference material

Supplier material with no declared relationship is excluded from answers, so another organisation's controls are never presented as your own by accident.

Worked example

"Do you encrypt customer data at rest?"

  1. Platform

    Microsoft Azure infrastructure controls are independently audited under ISO 27001 and SOC 2.

  2. Organisation

    Application data sits in Azure SQL Database with Transparent Data Encryption; keys are held in Azure Key Vault with annual rotation.

  3. Customer

    Under clause 9.2 of the Acme MSA we committed to customer-managed keys and 30 days' notice of any change to the encryption standard.

Composed answer

All customer data is encrypted at rest using AES-256. The underlying platform is Microsoft Azure, whose infrastructure controls are independently audited under ISO 27001 and SOC 2. Application data is held in Azure SQL Database with Transparent Data Encryption enabled, and encryption keys are managed in Azure Key Vault with annual rotation and separation of duties. For Acme, those keys are customer-managed in a dedicated vault, and we will give 30 days' notice before any change to the encryption standard, as set out in clause 9.2 of the MSA.

Every part of the final answer remains linked to the knowledge and scope that support it.

AI and control

How answers are produced.

Some organisations want AI to draft. Some allow it only to find wording a person has already approved. Some cannot use it at all. RepliSec supports all three.

  1. AI-assisted workflow

    AI may draft wording or provide reference material. A person reviews and approves every answer before use. In Human Authored mode, a person writes the final response and remains the author of record.

    AI used for matching, drafting or reference

  2. Approved answers only

    RepliSec finds an existing human-approved answer and returns it without changing its wording. Semantic matching may be used to locate it.

    No generative drafting. AI may be used for matching.

  3. No AI

    RepliSec uses deterministic lexical matching. No LLM, embeddings or neural model is loaded.

    No AI used

The selected policy applies to the engagement, so every answer in a questionnaire follows the customer's contractual and governance requirements.

What those terms mean
LLM
A large language model such as Claude, GPT, Gemini or a local equivalent. It drafts wording from retrieved knowledge.
Semantic matching
Finds matches by meaning, using embeddings: numerical vectors produced by a small neural model that runs locally. A question about "multi-factor authentication" will find your approved answer about "MFA". It is AI, but it does not write anything.
Lexical matching
Finds matches by the words themselves, like Ctrl-F indexed across your whole answer library. Fast, deterministic, no AI involved.
Under the hood
These three policies are implemented as five compliance modes. The Technical FAQ maps each mode to the policy it belongs to.
Deployment

Keep assurance knowledge under your control.

Local or self-hosted

Questionnaires, documents, approved answers and indexes remain on infrastructure controlled by the user.

Local AI

Use a locally operated model where AI assistance is permitted but information cannot be sent to an external provider.

Air-gapped

Operate without a network connection. Lexical mode requires no model. Semantic or local-model deployments require the necessary models to be installed before the environment is isolated.

Two separate controls.

Air-gapped describes where the data and computation remain. No AI describes how answers are found and produced. RepliSec supports both independently.

Single Docker container
One data directory
Embeddings computed locally
Ollama and OpenAI-compatible local models

Cloud models are optional. If you configure one, the only outbound call RepliSec makes is to that provider, using your own key, and only under the AI-assisted workflow policy. No telemetry. For the detail, read the Technical FAQ.

Why RepliSec

Why RepliSec is different.

Governed inheritance

Platform capabilities, organisational controls and customer commitments remain distinct.

Approved wording

Existing human-approved answers can be returned verbatim.

Traceable sources

The reviewer can see the evidence and scope supporting an answer.

Enforced operating modes

AI restrictions are enforced in the application architecture rather than presented only as a user preference.

Every claim on this page describes what RepliSec does today, not what it is planned to do. For the detail behind them, read the Technical FAQ.

About

Built from a problem seen from the inside.

The Impact CTO

RepliSec was created by Michael Doody after more than 25 years leading technology organisations across FTSE 100, private-equity-backed and global software businesses.

The product grew from a recurring enterprise problem: complex security questionnaires arriving late in a commercial process, with senior technical teams expected to assemble defensible answers under pressure.

RepliSec is now in private alpha, being tested with practitioners against the questionnaires they actually receive.

Private alpha

Test RepliSec against a real questionnaire.

We are inviting a small number of security leaders, CTOs, consultants and assurance professionals to test RepliSec with the questionnaires they already receive.

  • Run it on your own infrastructure
  • Test it with a questionnaire you already have
  • Tell us where it falls short
  • Help decide what gets built next

No spam. Used only to contact you about the alpha.