Every vendor assessment starts the same way: a spreadsheet or PDF lands in your inbox with fifty to two hundred questions, and you begin the hunt. You search your shared drive for the last answer to the same question, ask a colleague what control addresses that requirement, double-check the policy document, and paste it all together hoping nothing slipped. The work is not writing — it is chasing. Compass flips that: the agent reads the workspace you already keep and drafts cited answers from your own evidence, marking every gap it cannot support instead of filling it with a guess.
Import the Questionnaire
Most questionnaires arrive as a spreadsheet, a PDF, or a link to a vendor portal. Compass accepts the file formats you are already working with — PDF, Markdown, TXT, XLSX, CSV — and reads the questionnaire into a structured answer library grid. Each question becomes a row with fields for your answer, the source evidence that supports it, and the owner who will approve it.
No re-typing, no format conversion, no manual setup. The agent knows what a questionnaire is the same way it knows what a control is — it understands the shape of the work, so you do not have to explain it.
Answer From Workspace Evidence Only
Once the questionnaire is loaded, the agent scans your existing workspace: policies you have written, risk registers you maintain, evidence you collected for past audits, control mappings from frameworks you already cover. It reads every document fresh each session — there is nothing to train, no database to configure.
The search is grounded in your actual files, not a language model's training data. If your access control policy states that reviews happen quarterly and the question asks how frequently you review access, the agent finds that clause, reads it, and prepares an answer that quotes it. If your evidence tracker shows the last three review dates, those become part of the response too.
What this means in practice: a question that used to take ten minutes of digging now takes the agent a few seconds to locate and draft. The context is already in your workspace — Compass connects the dots you already drew.
Cite Each Answer; Mark Unsupported as "Not Provided"
Every answer the agent proposes carries a visible citation — the document, control ID, or evidence record it came from. The reviewer opening the answer library grid sees not just what the answer says, but where it came from and who last worked on it.
This is the critical difference from a general AI chatbot. When a chatbot cannot find supporting evidence, it invents something plausible — a control ID that looks right, a policy clause that sounds correct, a date that fits the narrative. Compass does the opposite: when it cannot trace an answer to a source in your workspace, it marks the field "Not Provided / no source found."
| Dimension | Manual copy-paste | General AI chatbot | Compass |
|---|---|---|---|
| Source of answers | Your inbox and shared drives | Model training data | Your evidence files |
| Citation enforcement | Inconsistent — relies on the writer | None — outputs plausible text | Every answer cites a workspace source |
| Gap handling | You notice or the auditor finds it | Invented to look complete | Marked "Not Provided" |
| Review burden | You re-read every answer for accuracy | You must fact-check every claim | You verify citations, not content |
| Reusability per cycle | Start from scratch | No memory of your workspace | Same evidence, next cycle, instant |
| Data location | Your devices and cloud drives | Vendor cloud | Local desktop, telemetry off |
The gap is not hidden — it is surfaced. That changes the review conversation from "did they make this up?" to "what evidence do we need to close this gap?"
Review, Edit, Export
The agent proposes each answer as a pending change — nothing lands in the final output without approval. The answer library grid displays every proposed answer with its citation and source. You work through the grid, accepting answers that are correct, editing those that need adjustment, and leaving "Not Provided" entries as flags for evidence you still need to gather.
This review pass is faster than writing from scratch because you are verifying rather than creating. The citations give you a shortcut: you check whether the source says what the answer claims, rather than re-researching the question.
When review is complete, export to whatever format your customer or auditor expects: PDF, DOCX, HTML, CSV, Markdown, or XLSX. The answer library grid travels with the export — question, answer, source, and owner are all present in the delivered file.
Can I Use This for SIG or CAIQ?
Yes. The Common Security Assessment (CSA) and Standardized Information Gathering (SIG) questionnaires follow the same structure as any other vendor assessment — a list of controls and questions mapped to frameworks. Compass handles them the same way: import, evidence grounding, citation, review, export. If you process multiple questionnaire formats across the year, the workspace remembers your evidence base, so each new assessment starts from the same connected record rather than a fresh blank page.
What If My Evidence Is Incomplete?
Every compliance program has gaps — controls that have been designed but not tested, policies drafted but not approved, evidence collected but not reviewed. The "Not Provided" marker makes these gaps explicit rather than hidden. You see exactly which answers lack support, prioritise closing them (or accept the risk of leaving them open), and proceed. The agent does not paper over uncertainty, which means your customer receives an honest picture of your security posture — not a polished surface hiding unfinished work.
Can My Auditor See the Gaps?
Only the answers you approve leave the workspace. The "Not Provided" markers are visible during your internal review; when you export the final response, you control which answers ship. If you choose, you can include the notations as evidence of your review process (some auditors find the honest-gap trail more trustworthy than a perfectly filled form), but the default is that only approved answers reach the customer.
What About Data Privacy?
The questionnaire, your evidence files, and the drafted answers stay on your machine. Compass is a local desktop app — SQLite workspace, no cloud upload, telemetry off by default. You bring your own API key for the language model (or run a local model with zero network egress), so your data never touches a vendor server during processing.
What Does This Cost?
Compass uses a flat monthly seat fee. You bring your own model key — the same OpenAI, Anthropic, or DeepSeek key you may already use. Because you supply the key (or run a local model with zero API cost), the per-assessment expense is limited to whatever the model provider charges for the tokens consumed — typically very modest for a questionnaire cycle. There is no per-questionnaire fee, no per-answer charge, and no markup on the model provider.
The Answer Library Grid
In Compass by Truvara, every drafted questionnaire becomes an answer library grid — question, answer, source, and owner in one view. The agent reads your workspace, cites each answer to its source, and marks what it cannot support. It does not decide which answers ship: you review each one, accept or edit, and export only when you are satisfied. The same grid feeds the next questionnaire cycle without rework. Join the preview cohort to try it.