Skip to content
firstpass
Start on DraftBook a walkthrough
A

The security questionnaire is back before lunch.

Firstpass drafts every row from documents you already have: your SOC 2 report, your policies, the last forty questionnaires you filled out. It puts the page and line beside each answer. Anything your documents don’t cover stays blank, gets an owner, and never gets made up.

Start on Draft, $650 a monthBook a 30-minute walkthrough

For sales teams at 30 to 200 person SaaS companies who’ve just started selling upmarket.

firstpassLarchmere Health / Vendor Security Assessment v4.2.xlsx / 4 · Data protectionRow 4.12 of 280
4.11Is data encrypted in transit? Minimum TLS version?House answer
4.12

Is customer data encrypted at rest? Describe the algorithm and how keys are managed.

Yes. Customer data in production databases and object storage is encrypted at rest with AES-256. Keys are managed in AWS KMS, rotated at least annually, and administrative access to key management is limited to two named engineers.

House answer · used 14 timesPRApproved by Priya Raman · 3 Sep 2026
Sources · 2
1SOC 2 Type II reportp. 34 · CC6.1

Logical access to production data stores is restricted to authorized personnel. Customer data stored in production databases and object storage is encrypted at rest using AES-256, with keys managed in AWS Key Management Service. Encryption settings are monitored daily for drift.

2Information Security Policy v3.2§7.3, line 4

Encryption keys are rotated at least annually. Administrative access to key management is restricted to two named members of the infrastructure team. Key usage is logged to the central audit trail.

4.13Are backups encrypted, and stored separately from production?In sign-off

¹ Row 4.12 of a 280-row questionnaire: the drafted answer, and the exact sentences it came from, highlighted in their documents. That’s the product. The rest of this page is a Tuesday.

A.1

Here's a Tuesday.

Jess sells for Tallyline, an 85-person payroll API. At 9:12 she forwards a spreadsheet from Larchmere Health’s security team: 280 rows across 11 tabs, due Friday. The deal sits in security review until it goes back. Scroll through the day.

  1. Tue 9:12

    The sheet arrives.

    Vendor Security Assessment v4.2.xlsx, 280 rows. Jess drops it in, or forwards it to your Firstpass address.

  2. Tue 9:14

    251 rows match house answers.

    Questions you've already answered and approved, worded slightly differently this time. They fill first, word for word.

  3. Tue 10:31

    22 rows drafted from your documents.

    Each one cites where it came from: SOC 2 Type II report, page 34. Access Control Policy, section 4.2.

  4. Tue 11:48

    The draft is done.

    273 of 280 rows answered, every one with a source. 22 go to Priya for sign-off. 7 stay open, each with a name next to it.

  5. Wed 9:40

    Priya signs off in 26 minutes.

    She's checking each highlighted sentence against its answer, not her memory.

  6. Wed 10:05

    It goes back.

    As Larchmere's own .xlsx, attached to the opportunity in Salesforce. The deal moves to the next stage.

firstpassLarchmere HealthTue 9:12
of 280 answered
0
in sign-off
0
open
0
  1. 4.12Is customer data encrypted at rest? Describe the algorithm and key management.—
  2. 4.13Are backups encrypted, and stored separately from production?—
  3. 8.6How often do you test restoring from backup? Date of last test?—
A.2

So what is this, exactly?

Firstpass answers security questionnaires for your sales team. You point it at what your company already has. When a prospect sends a SIG Lite, a CAIQ or their own 280-row spreadsheet, you get a draft back in hours, in their format, with the source beside every answer.

A.3

What it won't do.

We don’t run audits. We don’t monitor controls, put an agent on anyone’s laptop, or give you a readiness score. If you already pay someone for continuous monitoring, keep paying them; we’d rather sit beside that tool than replace it.

Your SOC 2 report took a year and a lot of money. Firstpass makes it answer the questions prospects actually ask.

The two questions on every demo call, before anyone asks about price.

A.4

Who’s accountable if sales sends a wrong answer?

Whoever owns security signs off. Rows that aren’t already approved go to Sign-off, a short queue for the person you name, before anything can be returned. Once they approve an answer it becomes a house answer, and every questionnaire after that uses the same wording.

firstpassSign-off / Priya Raman22 rows
4.3Where is customer data stored geographically?In sign-off
4.7Is production data ever used in test environments?In sign-off
5.4Is MFA enforced for all access to production and admin consoles?In sign-off
PRPriya Raman · Head of Engineering · signs off sections 3–8
How Sign-off works, B.2
A.5

What happens to questions our documents don’t cover?

They stay empty. Firstpass marks the row as open, names an owner, and leaves it out of the draft. It doesn’t guess. 273 answers you can stand behind beat 280 that sound right.

firstpassLarchmere Health / Row 8.6
8.6

How often do you test restoring from backup? Date of last test?

No source covers this. Left out of the draft. No restore test is documented.
OpenPRPriya RamanDue Thu 15 OctWrite answer
How open rows work, B.4
A.6

What does it cost?

Draft is $650 a month, billed annually, for up to 12 questionnaires a quarter. You can start today without talking to anyone. Above that it’s a conversation, and the pricing page tells you what that conversation usually ends at.

See the full price sheet, DStart on Draft
A.7

Got one due this week?

Start on Draft and send it through Firstpass before Friday. Or bring it to a walkthrough and watch it get drafted on the call.

Start on DraftBook a walkthrough