Security questionnaires

Someone sent you a security questionnaire. Rowpa drafts the rows it can prove.

Upload the spreadsheet they sent. Rowpa drafts every row it can evidence from three places you already keep: your GDPR record, your security profile, and the certificates you have uploaded. The rest are marked as yours.

Upload one free See a review in the demo

Free to upload and read the drafts. £79 once to draft the rest and export, or included from Starter.

// Security questionnaires

The honest number

In a general vendor security assessment, the data protection rows, sub-processors, transfers, retention, breach handling, rights, are a small part of the sheet: about a tenth in the ones we have worked through. The rest is MFA, backups, patching, access control, screening and penetration tests. Rowpa answers the first group from your GDPR record, the second from your security posture profile, thirty-six statements about your IT and forty-one if you build software, answered once as yes, partly, no or not sure. A no is drafted as a no. The rows that ask for proof are answered from the certificates you have uploaded, which travel with the pack.

What is left is what no record holds: a narrative about your own arrangements, a reference, a figure you have never written down. Those rows are marked as yours, and you can send several of them at once to the person who does know, on one link, without giving them an account. Their answers come back as drafts for you to approve, and everything you approve joins your answer library, so the next questionnaire starts further ahead.

What happens to the file

It reads their layout, and checks with you

xlsx, xlsm or csv, or paste the questions. Rowpa finds the question column, the answer column, any evidence or comments column, and any yes/no column, on every sheet, and shows you what it thinks before anything runs. Nothing is drafted until you confirm.

It drafts only what it can evidence

Each answer comes from a named place in your record: an activity, a vendor, a transfer, a procedure, or an item in your security posture profile. The source is shown beside the draft. Where the record is silent, the row is left blank and marked as yours.

Thirty-six questions about your IT, answered once

MFA, device encryption, backups, patching, endpoint protection, access reviews, training, insurance, certifications with expiry. Yes, partly, no or not sure, with a note where the specifics matter. Every questionnaire draws on it, and your pack prints it.

It explains what they are asking

Buyer questions are written by security teams for security teams. Each row carries a plain-English note on what the question is really after, so the person answering does not need to be a privacy expert.

Review at the speed of a keyboard

J and K to move between rows, A to approve. Edit any draft. Mark a row as not sure. A 150-row review is designed to take minutes, not an afternoon.

Send one row to the person who knows

The penetration test date is with your developer; the insurance limit is with your accountant. Send them one question by link. They answer without an account, and it lands in the right cell.

It writes back into their file

Approved answers are patched into the workbook they sent: their columns, their formulas, their formatting, their other sheets, untouched. You return the file the way they wanted it, not a Rowpa export.

It remembers

Every approved answer goes into your answer library. The next questionnaire draws on it, so the security rows you answered by hand are drafted next time.

It asks whether it worked

After export, one question: did this get you through? The answer shapes what Rowpa drafts better next time, and it is the only metric that matters.

A sample review, ten rows

Do you maintain a record of processing activities under Article 30?

Yes. Maintained in Rowpa, last reviewed 21 August 2026, 19 activities.

Your record: review status

List all sub-processors that will handle our data, with hosting location.

Draft from the vendor record. Confirm each processor's current location, agreement and transfer safeguard before sending the pack.

Your record: vendors

Is personal data transferred outside the UK or EEA? On what basis?

Yes, to Stripe Inc. (US) under the EU-US Data Privacy Framework with UK Extension, for payment processing only.

Your record: transfers

What is your data breach notification commitment to customers?

Confirmed incidents affecting your data are notified within 48 hours of confirmation, per our breach procedure.

Your record: breach procedure

Do any of your tools process our data using AI? Is it used for training?

Anthropic API is listed for document drafting. Confirm the applicable account agreement, training terms, retention settings and processing locations before approving this answer.

Your record: AI tools

Is multi-factor authentication enforced for all staff accounts?

Yes. Enforced on email and on the main business systems (Google Workspace, Xero, HubSpot).

Your security posture: MFA

When was your last external penetration test? Please attach the summary.

No external test has been carried out. Dependency scanning runs on every build, and code review is required before merge.

Your security posture: penetration test

Describe your backup and restore testing frequency.

Daily backups to a separate service. Restore has been tested in part: files restored once, no full drill yet.

Your security posture: backups

What is your cyber insurance cover limit?

Yes, cover is in place. The certificate travels with the pack, valid to 31 March 2027.

Your documents: cyber insurance certificate

Provide two customer references we may contact.

Left blank. Rowpa does not record this and will not guess it.

Only you can answer this

Ten rows of a sample, drafted from a fictional company's record, its security profile and the certificates it has uploaded. The blank row is the point.

Which questionnaires

Any spreadsheet a buyer sends: their own template, SIG Lite, a Cyber Essentials style self-assessment, a public-sector data protection questionnaire, a Google Sheets export. Recognised standard forms get their layout read automatically; anything else gets the confirmation step. Portals that require typing into a web form are not supported; copy the questions out, paste them in, and copy the answers back.

What a review looks like

The sample review above is ten rows. Nine carry a source in teal: an entry in the record, an item in the security profile, or a certificate you uploaded. The tenth is marked as yours and left blank on purpose. Rowpa does not hold it, so it will not invent it, and you can send that row to whoever does know.

Pricing

Free to upload, confirm the layout and read every draft. £79 once (a Questionnaire Pass) to draft one questionnaire of up to 300 questions and write it back into their file; no card kept on file, nothing to cancel, credited against your first subscription payment if you subscribe within 30 days. Starter £34/mo includes three questionnaires a year, Business £79/mo twelve a year, Business Plus £159/mo thirty-six a year. All prices ex VAT.

Start free See all plans

Common questions

Will it answer the whole questionnaire?

Not every row, and it will say so. It drafts the data protection rows from your record and the common security rows from your posture profile, and marks the rest as yours: the specifics a buyer wants attached, such as a penetration test summary, and anything your profile does not cover. Your own answers to those rows are saved and drafted next time.

What stops it inventing a control we do not have?

Every draft has to cite a place in your record. If there is no source, there is no draft. That is enforced in the code, not in a prompt, and the source is shown beside each answer so you can check.

Does it keep the buyer's formulas and formatting?

Yes. The export patches the cells you approved and leaves everything else in the workbook as it was, including other sheets, formulas and macros in an xlsm file.

What if the questionnaire is in German, Polish or French?

Rowpa reads and drafts in English, Polish, German and French, and the colleague link carries the question in the language the buyer used.

Can I try it on a real questionnaire before paying?

Yes. Upload it, confirm the layout, and read every draft Rowpa produces. Paying is only for drafting the rest and exporting into their file.