01
NDA
We start with a short NDA so you can share policies and the customer questionnaire without guessing where the files go.
CiteQ · service
Done-for-you security questionnaire filling.
You keep selling. We draft the pack from the policies you already have — with a citation on every filled row, and an explicit gap when evidence is missing. Built for small B2B SaaS (about 30–200 staff) that are starting to win enterprise and mid-market deals.
This site sells a service engagement, not a monthly SaaS login. Internal software may assist drafting; you do not buy a self-serve subscription here. Stripe checkout is not live yet — we invoice (checkout coming).
How it works
NDA. Your docs. Cited answers. Your review.
02
Send materials
You send the questionnaire (XLSX, CSV, or similar) plus the security, privacy, access, and ops policies you already keep. We work only from what you provide.
03
Cited fill
We draft answers only where your documents contain evidence, pair each with a snippet and source filename, and mark rows that need a human when evidence is missing. We do not invent SOC, ISO, or other certifications.
04
You review & send
You get a spreadsheet with Answer and Citation columns. Someone on your side still reads it before it goes to the prospect. The draft is assistance, not a signed attestation.
Is production access logged and retained?
Yes. Administrative access to production is logged. Logs are retained for the period stated in the logging standard and shipped to the central store.
↳ Logging Standard.md · Retention
Do you operate an on-call security operations centre 24/7?
no evidence — needs human
↳ not in the provided set
Are laptops disk-encrypted?
Yes. Company-issued laptops use full-disk encryption, required in the endpoint standard before the machine is allowed on the corporate network.
↳ Endpoint Standard.pdf · §2
Who it is for
Small B2B SaaS selling to enterprises
Founders, first AEs, and security hires without a questionnaire factory. Roughly 30–200 people. Mid-market and enterprise deals that stall on SIG-Lite, CAIQ-style, or a customer’s custom security spreadsheet.
What it is not
Not a GRC suite. Not a SaaS plan on this site.
CiteQ does not replace your counsel or auditor. We do not claim SOC 2 for CiteQ. We are not selling a $249–$499/mo self-serve subscription as the main offer. Any software we run is internal assistance for the done-for-you engagement.
Pricing
Per questionnaire, not per seat
Typical third-party security reviews land around USD 400–600 each. Premium / urgent and custom or enterprise scopes are quoted. Nothing on this page charges a card yet.
Standard DFY
Typical$400–600/qnr
One third-party security questionnaire filled from your policies, with citations and gaps flagged.
- NDA before you share docs
- Cited answers from your materials
- Gaps marked — no invented controls
- Spreadsheet back for your review
Premium / urgent
Quote
Faster turnaround or denser packs when a deal is on the clock. Price depends on length and deadline.
- Priority scheduling
- Same citation discipline
- Agree scope and deadline by email
Custom / enterprise
Custom
Multi-pack retainers, unusually large questionnaires, or ongoing enterprise review volume — scoped with you.
- Volume or retainer options
- Custom process notes welcome
- Still cited from your policies
Payment today is by invoice to Kerdos Holding Limited. Stripe checkout / card payment is coming — it is not live on this site yet. There is no self-serve “subscribe” button that bills a monthly SaaS plan. Write to hello@getciteq.com.