Securevoo
COMPLIANCE TELEMETRY ENGINE

Answer security questionnaires with evidence, not prose.

The engine that answers your clients' supplier security questionnaires and ISO/IEC 27001:2022 evidence — same-day, from live infrastructure telemetry, with a human signing off anything the AI isn't sure about. Hand back the buyer's own workbook, or a proof pack the buyer can verify. Cyber Essentials v3.3 built in.

Not sure what questionnaires already cost you? Work it out in a minute →

Cyber Essentials certifiedUK-hosted · LondonCyber-insuredSecurevoo Ltd · Companies House 17388176

How it works

Security questionnaire automation: telemetry in, signed-off answers out.

STEP 1

Collect

An open-source collector runs inside your estate and strips secrets, hostnames and PII locally — only sanitized, pseudonymized evidence ever leaves. Adapters for Trivy, Entra, Okta, Google Workspace, PingOne and JumpCloud.

Audit the collector on GitHub →
STEP 2

Decide

Pass/fail verdicts are computed by deterministic rules — the 14-day patching window, global MFA scope — never by an AI. Each verdict records which rule decided it and which version of that rule, so the answer stays derivable a year from now.

STEP 3

Draft & review

AI drafts the auditor-grade narrative, citing the individual telemetry facts behind it and the matching framework policy. Low-confidence drafts are flagged into a review queue for human sign-off, with a full audit trail of who approved what.

STEP 4

Hand back

Return the buyer's own workbook, filled in — or a proof pack they can verify themselves without an account. Anything nobody could answer comes out as a ranked list of work you can quote for.

Built for evidence, not spreadsheets.

Deterministic verdicts

Compliance calls are rule-based code, never an LLM's opinion — and every verdict carries the version of the rule that produced it.

Any-format intake

Drop in an Excel, PDF, Word or CSV questionnaire — we pull out the questions and triage each one. The file is parsed in your browser and never leaves it.

Their workbook, handed back

Buyers want their own spreadsheet returned, not a PDF. Approved answers are written into the original .xlsx — its formatting, dropdowns and other sheets untouched — in your browser.

Proof packs a buyer can verify

Every export carries a content hash and a verification link. The recipient opens it, recomputes the hash in their own browser, and sees who issued the pack and when. No account, no login.

Every gap becomes quotable work

Questions the engine could not answer are grouped by cause and ranked by how many answers each fix unblocks — remediation scope you can put on a quote, straight out of the run.

Recognises the buyer's template

Upload a questionnaire and we say whether that template — or a revision of it — has come through before, so you are not mapping the same buyer's spreadsheet twice.

Answered it before? We remember

Triage reports how many of the incoming questions your team has already answered here, and offers back the exact answer a person chose — kept separate from what merely looks similar.

Framework coverage

ISO/IEC 27001:2022 Annex A and Cyber Essentials v3.3 built in.

Human-in-the-loop

Flagged drafts require audit-trailed sign-off before they ship.

Bring your own policies

Import your own or your client's policy documents; drafted answers cite them alongside the built-in corpus, with their real review dates.

Hard tenant isolation

Row-level security in the database, not just app code.

Your identity provider

Sign in with Google or Microsoft — no new passwords, and removing someone ends their session immediately, not at the next expiry.

What comes out of a run

Three deliverables, not a dashboard.

The buyer's own workbook, filled in
Their .xlsx back, with the response cells completed and everything else byte-for-byte untouched. Only human-approved answers are written, and only where they fit what the cell allows — a blank with a reason beats a confident “Yes” you can't evidence.
A proof pack the buyer can verify
Answers, the evidence manifest behind them and the sign-off log, published with a SHA-256 over the whole thing and a link anyone can check without an account.
A list of work you can quote
Every question that couldn't be answered, grouped by cause and ranked by how many answers fixing it unblocks. It stays with you and your client — it is never in the pack the buyer receives.

What the buyer sees at securevoo.com/v/…

MATCHES THE ISSUED PACK
Issued by
Your consultancy
Issued on
14 September 2026
Evidence window
1–14 September 2026
Content hash (SHA-256)
e3b0c44298fc1c149afbf4c8996fb924…

Illustrative. The hash is published with the rule for recomputing it, so a recipient can check the pack in any language, years later, without us — and the page shows them no answers, only whether the document is the one we issued.

Trust you can verify

Not claims — things a security team can check.

Database-enforced isolation

PostgreSQL row-level security on a non-owner role — a missing filter can't leak data. Verified by adversarial tests run against production.

Open-source collector

The agent that runs on your machines is published under MIT — read exactly what leaves your estate before you install it.

Fresh evidence or none

Answers draft from telemetry inside an enforced freshness window; stale or missing evidence fails closed instead of guessing.

Checkable, not just signed

A proof pack publishes a SHA-256 over its own bytes and the rule for recomputing it, so a recipient can check it in any language, years later, without us.

Which rule, and which version

Every verdict is stamped with the deterministic gate that decided it and that gate's version — change a rule and packs already issued still say what they were written under.

One page of answers

Your security team's first question — “how do you handle our data?” — is answered on a single Security & Trust page.

Pricing that maps to how you bill clients.

A run is one completed questionnaire or assessment — the £500–£2,500 billable event you already charge for. Your run cost is £12–£15; keep the spread. Invoiced, VAT excluded.

Boutique

£249 / mo

3 workspaces · 10 runs/mo · +£69/ws · +£15/run

Any-format SAQ intake · deterministic verdicts · evidence bundles · review queue.

MOST POPULAR

Growth

£649 / mo

10 workspaces · 40 runs/mo · +£59/ws · +£12/run

Everything in Boutique · custom policy imports · per-tenant API keys for CI.

Agency

£1,299 / mo

25 workspaces · fair-use unlimited runs

Multi-client switcher · priority support · volume answer-runs across your book.

See full pricing →One urgent questionnaire? Same-day Emergency Unblock →Work out what questionnaires cost you today →

FAQ

Questions buyers actually ask.

What does Securevoo do?
Securevoo answers supplier security questionnaires from your real infrastructure telemetry. It computes deterministic pass/fail verdicts against ISO/IEC 27001:2022 and Cyber Essentials v3.3, drafts an evidence-cited answer for each question, and holds anything uncertain for human sign-off. You export the result as a proof pack to attach to a buyer's email.
How much does Securevoo cost?
There are three invoiced consultancy plans, billed monthly: Boutique at £249/month (3 client workspaces, 10 answer-runs/month), Growth at £649/month (10 workspaces, 40 runs/month), and Agency at £1,299/month (25 workspaces, fair-use runs). A run is one completed questionnaire or assessment; extra workspaces and runs are opt-in add-ons, and the platform hard-caps at your included allowance so there is never a surprise bill. Prices exclude VAT and are billed by invoice — there is no card checkout. There is also a same-day Emergency Unblock one-off at £150–£300.
How long does it take to complete a security questionnaire?
With the Emergency Unblock service, a live-deal questionnaire is returned the same day with human sign-off and evidence bundles attached. On a subscription you run questionnaires yourself in minutes, then review the drafted answers instead of writing them.
Do you serve companies outside London?
Yes. Securevoo is a UK-hosted SaaS used by companies anywhere in the United Kingdom; Securevoo Ltd is registered in London (195 Wood Street, E17 3NU). Nothing needs to be installed on-site beyond the open-source collector, which runs inside your own network.
What makes Securevoo different?
Compliance verdicts are decided by deterministic code, not by an AI, and answers are drafted only from telemetry inside an enforced freshness window — stale evidence fails closed rather than being guessed. The data collector is open source, so you can audit exactly what leaves your estate before you trust it. Every low-confidence answer is queued for audit-trailed human sign-off before it can be exported.
Can a buyer check that an answer really came from us?
Yes. Every proof pack carries a content hash and a verification link of the form securevoo.com/v/<token>. The recipient drops their copy of the pack onto that page; the hash is recomputed in their own browser — the file is never uploaded — and the page tells them whether it matches the pack that was issued, who issued it and when. They need no account, and they are shown no answers: the page confirms integrity and provenance and nothing else. The published hash rule covers the answer and evidence files, so a recipient can recompute it in any language years from now without us.
Can Securevoo fill in the buyer's own spreadsheet?
Yes. Upload the buyer's .xlsx and you get that same workbook back with the response cells filled in — original formatting, dropdowns and untouched sheets preserved — rather than a PDF or a reformatted copy. A cell is only filled where the workspace already holds a human-approved answer that maps onto a value the cell allows; everything else is left blank with the reason beside it. The workbook is parsed, filled and downloaded in your browser; only question text and cell coordinates reach the server.
What happens to questions you can't answer?
They become work you can quote for. Each unanswered question is traced to its cause — telemetry not connected, coverage not extended, evidence gone stale, a control genuinely failing, or a question only a human can answer — then grouped and ranked by how many answers each fix would unblock. Securevoo puts no hours or prices on that list, because those numbers would be invented; it gives you the scope, and you price it.
Which compliance frameworks does Securevoo support?
ISO/IEC 27001:2022 (Annex A) and Cyber Essentials v3.3 are built in. You can also import your own or your client's policy documents, and drafted answers will cite them alongside the built-in corpus.
Does an AI decide whether I pass or fail?
No. Pass/fail verdicts are computed by deterministic rules — for example the Cyber Essentials 14-day patching window and MFA scope. The AI only writes the narrative around an already-decided verdict and cites its evidence, and low-confidence drafts are held for human review.
What data leaves my network?
Only sanitized, pseudonymized evidence summaries and the answers derived from them. The open-source collector runs inside your estate, makes zero network calls, and strips secrets, hostnames and personal data locally. If sensitive data survives its final sweep, the collector refuses to emit output at all.
Who is Securevoo for?
UK compliance consultancies and MSPs that answer security questionnaires and ISO 27001 evidence requests for their clients. Each client gets its own isolated workspace, and the consultancy reviews and signs off every answer it hands back, so Securevoo adds capacity to your practice rather than replacing it. A company with one urgent questionnaire and no consultant on retainer can use the same-day Emergency Unblock service instead.
How do I pay for Securevoo?
Payment is by invoice on net-30 terms via bank transfer or Bacs Direct Debit. There is no card checkout form, because procurement teams do not buy that way, but a card can be paid against the invoice if your finance team prefers. Plans are monthly or annual, and prices exclude VAT.

Stop hand-writing your clients' questionnaires.

If your consultants burn days on client security questionnaires, run them through Securevoo and review evidence-backed answers instead of writing them. See how it works for consultancies →

Request a demo