Skip to content
firstpass
Start on DraftBook a walkthrough
F

Three teams, three Tuesdays.

The buyer is almost never the security team. It’s the person who can’t close without the spreadsheet.

F.1

Kestrel Ledger

Accounts payable automation · 64 people · on Draft since March 2026

A bank's SIG Lite, 312 rows, back in six hours.

Kestrel's first bank prospect sent a SIG Lite at 8:40 on a Thursday morning. Jonah Pike, their solutions engineer, had been the security team by default for a year.

Firstpass returned 303 answered rows drawn from Kestrel's SOC 2 report and two old questionnaires. 109 of them were new, so they went to their CTO, who signed them off in 52 minutes over lunch. The 9 open rows, mostly about backup restore testing, became the reason they finally wrote the restore runbook.

“Jonah used to lose two days to a questionnaire. Now he loses an hour, and it's an hour of checking, not typing.”
Mara Lindqvist, VP Sales
firstpassKestrel Ledger / Fenmore Savings Bank / SIG Lite 2026.xlsx312 rows
303of 312 answered, every one with a sourceTurnaround 5 h 52 m
  • House answers194From their SOC 2 report and two old questionnaires
  • Drafted, signed off109By their CTO in 52 min
  • Open9Backup restore testing (5) · Vendor offboarding (2) · Physical security (2)
  1. Received
    8:40
  2. Draft ready
    11:31
  3. Signed off
    13:22
  4. Returned
    14:32
questionnaires since March
31
median turnaround
5 h 40 m
open rows this quarter
4
F.2

Pinemark

Field service scheduling · 140 people · on House since January 2026

Four prospects asked about key rotation. They all got the same answer.

Before Firstpass, Pinemark had answered “How are encryption keys managed?” in four different ways across four questionnaires, and one of them said quarterly rotation, which wasn't true. A prospect's security team noticed.

Now there's one house answer, approved by their CTO, Lena Haas, and it's been used 22 times since.

“Getting caught contradicting yourself in a security review is worse than a slow answer. That's the thing that's gone.”
Tomás Arriaga, Solutions Engineer

The honest bit. Tomás still pastes answers into two customers' portals by hand. He tells us about it most weeks.

firstpassPinemark / House answers / Encryption key managementUsed 22 times
House answer

Keys are managed in AWS KMS with automatic annual rotation. Only the platform team's two on-call leads can administer keys, and every key operation is logged.

Approved by Lena Haas, CTO · 21 Jan 2026

Replaced wordings · 4

  • Keys are rotated quarterly.

    Untrue. Rotation is annual.

    Oct 2025

  • We use AWS KMS for key storage.

    Incomplete. No rotation or access stated.

    Aug 2025

  • Industry-standard key management practices are followed.

    Says nothing.

    Jun 2025

  • Encryption keys are managed by our cloud provider.

    Merged into current answer.

    Nov 2025
questionnaires this year
58
contradictions flagged by prospects
0
portals still pasted by hand
2
F.3

Sorrel

HR software · 38 people · on Draft since June 2026

The CTO approved it and went back to work.

Sorrel's CTO, Ade Okonkwo, wanted one thing before signing: proof that nothing went to a prospect unchecked. He owns Sign-off for infrastructure and encryption, and he checks the queue on Wednesday mornings.

“Most weeks it's a dozen rows and they're all house answers with a new date. Once it caught a pen test summary we'd replaced and nobody had told sales. That's the week I bought it for.”
Ade Okonkwo, CTO
firstpassSorrel / Sign-off / Wed 7 Oct12 rows · 11 min
6.4

Summarize findings from your most recent penetration test.

Source replaced
Current house answer cites

3 medium findings, all remediated (pen test summary, Feb 2026).

New document says

1 high, 2 medium findings; the high was remediated in 4 days (pen test summary, Sep 2026).

Update answerKeep current
  • 3.1Is customer data encrypted at rest?Re-confirmed
  • 3.2Minimum TLS version for data in transit?Re-confirmed
  • 4.5How often are access reviews performed?Re-confirmed
  • 4.9Is MFA enforced for all employees?Re-confirmed
  • 5.2Do you have an incident response plan?Re-confirmed
6 more re-confirmed · source documents unchanged
questionnaires since June
9
median weekly sign-off
11 min
stale answer caught
1