• Fair Source · FSL
  • Source Available
  • Local First
  • Invite-only Alpha

Never answer the same security questionnaire twice.

Build a private library of trusted security responses and retrieve the best answer in seconds.

Use AI where it helps. Disable it where it doesn't. Remain in complete control of your knowledge.

Join the Alpha Explore How It Works

The public source release will follow the alpha programme. We're inviting experienced security professionals to help shape it.

Questionnaires · Vendor Security Assessment 2026
RepliSec answering a questionnaire. Question 12, 'Where is customer data stored geographically?', is selected from a list of 23. RepliSec shows an AI draft with the source it came from and a 62 per cent match, alongside Approve, Edit, Promote to library and Regenerate actions.
Dashboard
The RepliSec dashboard, showing 18 approved answers, three questionnaires in progress, 78 knowledge base entries, and a breakdown of AI draft confidence across high, medium and low.
Two sides

Every security questionnaire has two sides.

Someone sends it. Someone answers it. Only one of them has tools.

There are dozens of platforms that help vendors answer security questionnaires faster. Nobody built anything for the person on the other end, the buyer who receives a 300-row spreadsheet back and has to decide whether the answers are credible, complete, and consistent.

Which side are you on?

Vendor side

I answer questionnaires

You are the one filling in the spreadsheet to win the deal.

Keep reading Buyer side

I review questionnaires

You are the one who gets the answers back and has to judge them.

See RepliSec Review

Free. Source Available. Local First.

RepliSec is a Fair Source security questionnaire platform, released under the Functional Source License (FSL-1.1-ALv2), that runs on your own infrastructure. Free to use, free to modify, free to self-host.

Early access is limited while the platform is stabilised. The public source release will follow the alpha programme.

The problem

Most organisations answer the same security questions hundreds of times.

Each one means searching old documents, rewriting an answer that already exists, and getting it approved again. That is hours of expert time spent on work that has already been done.

Today
Previous questionnaires Word documents Spreadsheets Security policies Trust centres Email threads People's memory
Search Copy Paste Repeat
With RepliSec
One trusted knowledge base
  • Customer knowledge
  • Organisation knowledge
  • Foundation knowledge
Retrieve Review Respond

The knowledge already exists. The problem is retrieving the right answer consistently, quickly and with confidence.

How it works

Import. Retrieve. Review. Reuse.

The same four steps whether you are answering your first questionnaire or your fiftieth.

  1. 01

    Import the questionnaire

    Bring in a spreadsheet, document or form. Questions are parsed into a structured list you can work through.

  2. 02

    Retrieve from your knowledge

    RepliSec searches foundation, organisation and customer-specific knowledge at once, returning candidates with confidence scores and cited sources.

  3. 03

    Review and approve

    You remain the author of record. Accept, edit or search again, with the compliance mode for that engagement deciding how much AI is involved.

  4. 04

    Reuse next time

    Approved answers return to your library, so the next questionnaire starts from what you have already agreed rather than a blank page.

Knowledge model

Answers grounded in the right knowledge.

RepliSec separates reusable organisational knowledge from supplier evidence and the commitments you have made to individual customers.

Each questionnaire can draw from all relevant knowledge tiers while preserving the source, scope and context of the information used.

All three tiers are available in RepliSec, and every tier is searched at once. Results merge using confidence thresholds and tier precedence. Approved answers stay deterministic, while knowledge-base responses may combine information across tiers where appropriate.

  1. Tier 1

    Foundation knowledge

    Trusted information inherited from technology suppliers and service providers.

    Cloud-provider trust centresSupplier security documentationCertifications and assurance reportsProduct documentationStandard platform controls
  2. Tier 2

    Organisation knowledge

    Information that describes how your own organisation operates.

    Approved security answersPolicies and proceduresArchitecture and implementation detailsInternal controlsEvidence and supporting documentsStandard organisational positions

    In RepliSec Teams, this tier becomes a shared organisational knowledge base available to authorised users.

  3. Tier 3

    Customer-specific knowledge

    Information relevant to a particular customer, engagement or contractual context.

    Customer-specific questionnaire historyContractual commitmentsCustomer terminologyAgreed exceptionsPrevious responsesEngagement-specific evidence

    Already supported in the single-user RepliSec product. It does not require RepliSec Teams.

Foundation knowledge never automatically becomes your answer.

Before inherited controls can be used, the organisation explicitly defines its relationship with the supplier.

Cloud providerSubprocessorTechnology supplierReference material

This prevents another organisation's controls from accidentally being presented as your own.

Worked example

"Do you encrypt customer data at rest?"

  1. Foundation

    Microsoft Azure infrastructure controls are independently audited under ISO 27001 and SOC 2.

  2. Organisation

    Application data sits in Azure SQL Database with Transparent Data Encryption; keys are held in Azure Key Vault with annual rotation.

  3. Customer

    Under clause 9.2 of the Acme MSA we committed to customer-managed keys and 30 days' notice of any change to the encryption standard.

Composed answer

All customer data is encrypted at rest using AES-256. The underlying platform is Microsoft Azure, whose infrastructure controls are independently audited under ISO 27001 and SOC 2. Application data is held in Azure SQL Database with Transparent Data Encryption enabled, and encryption keys are managed in Azure Key Vault with annual rotation and separation of duties. For Acme, those keys are customer-managed in a dedicated vault, and we will give 30 days' notice before any change to the encryption standard, as set out in clause 9.2 of the MSA.

Every sentence keeps its source. Inherited platform controls stay distinguishable from what your organisation operates, and from what you have committed to this customer.

Why RepliSec is different

AI on your terms.

Most AI products assume every organisation wants AI everywhere. RepliSec doesn't.

Every organisation has different governance requirements. Some embrace AI. Some require disclosure. Some prohibit AI entirely. RepliSec adapts to your governance model rather than forcing one.

AI-assisted No AI
  1. 01 Standard

    AI-assisted drafting using trusted knowledge.

    LLMEmbeddings
  2. 02 Disclosure

    AI assistance with automatic disclosure in exported responses.

    LLMEmbeddingsExport disclosure
  3. 03 Human Authored

    Knowledge retrieval is permitted. Final responses must be written by a human.

    No AI draftingEmbeddings
  4. 04 Library Only (Semantic)

    Responses come only from approved knowledge using semantic matching. No AI-generated wording.

    No LLMEmbeddings
  5. 05 Library Only (Lexical)

    Deterministic lexical matching only. No semantic models. No LLMs. Designed for environments where AI is contractually or organisationally prohibited.

    No LLMNo embeddings
What those terms mean
LLM
A large language model such as Claude, GPT, Gemini or a local equivalent. It drafts wording from retrieved knowledge.
Embeddings
Numerical vectors that capture the meaning of text, generated by a small neural model. Required for semantic search.
Semantic matching
Finds matches by meaning. A question about "multi-factor authentication" will find your approved answer that talks about "MFA".
Lexical matching
Finds matches by exact words, like Ctrl-F indexed across your whole answer library. Fast, deterministic, no AI involved.
Engineering

Built for regulated environments.

FSL licence
Docker
SQLite
FastAPI
Air-gapped deployment
Bring your own API key
OpenAI-compatible providers
Local-first architecture
Converts to Apache 2.0

Every claim on this page describes what RepliSec does today, not what it is planned to do. For the detail behind them, read the Technical FAQ.

Why Fair Source?

Your infra. Your data. Your rules.

Your security knowledge should belong to you. Security questionnaire responses often contain highly sensitive operational knowledge. RepliSec's source is open to read, run, modify and self-host, because you should be able to verify exactly what happens to your data.

RepliSec uses the Functional Source License rather than a permissive licence like MIT. The difference is one restriction: you cannot take RepliSec and sell it as a competing hosted service. Everything else, including commercial internal use, is free. And each release automatically becomes Apache 2.0, a true open source licence, two years after publication. We think that is an honest trade: the code is open to everyone who uses it, and the ability to commercialise it funds its development.

Run locallyRun in DockerUse local modelsUse cloud modelsOr operate without AI
  • Your data
  • Your deployment
  • Your AI provider
  • Your infrastructure
  • Your roadmap
Planned

Need to collaborate across a team?

RepliSec Teams will extend RepliSec with collaborative knowledge management, organisational identity integration and governed workflows for security teams.

Learn about RepliSec Teams
Early Access

Help shape RepliSec.

Rather than launching in isolation, we're working with experienced security professionals to refine RepliSec before public release.

  • Receive preview builds
  • Follow development
  • Provide feedback
  • Help shape the roadmap

No spam. We'll only use this to send Early Access details.

About

Created by The Impact CTO.

The Impact CTO

RepliSec was created by Michael Doody after more than twenty-five years leading technology organisations across FTSE 100, PE-backed and global software businesses.

The project demonstrates a practical approach to grounded AI, where governance, explainability and privacy are considered from the beginning rather than added afterwards.

It is intended to become both a practical, source-available tool and a reference implementation for applying AI safely within regulated environments.