What is happening
A founder describes a 250-row Excel questionnaire that arrived at the last stage of an enterprise deal and took a whole weekend. Comments in a related thread say prospects often let you answer their own questionnaire in place of a SOC 2 report, so the questionnaire is the real work.
Answer only from something you can point to
Keep one sheet with the question, the approved answer, the policy page or person that supports it, and a review date. One commenter recommends exactly this kind of master spreadsheet. An answer with no source is a guess, so leave that row blank and give it to a named person.
What not to claim
Do not say yes to a certificate, test or control you cannot show. A wrong claim is your statement to the customer, whoever or whatever typed it.
- Check the date of every policy you cite.
- Send nothing until the named person has signed.
Which paid job fits
If you have approved answers, the first-draft job fills the customer's file from them and leaves unsupported rows blank. If you have only policies, the library job builds the sheet first. In both, your named reviewer signs every answer and we never send anything to the customer.
Sources and limits
- Hacker News: "Need feedback please alternative to Vanta/Conveyor because I hate subscriptions" Checked 2026-10-12.
- A founder of a small B2B SaaS describes a security questionnaire sent as an Excel file of 250 rows at the late stage of an enterprise deal, which took their entire weekend.
- The poster says competing tools cost US$5,000 or more a year and asks what would make AI-written security answers trustworthy enough to send to a buyer.
- Hacker News comment on SOC 2 for a solo founder (17 May 2026) Checked 2026-10-12.
- The comment advises writing documentation instead of a formal audit report and keeping a "master spreadsheet" of SOC 2-style questions of your choosing paired with your answers, to send to companies that keep pressing for compliance.
- Hacker News comment on SOC 2 for a solo founder (15 May 2026) Checked 2026-10-12.
- The comment says prospective customers often let you answer their own security questionnaires in place of handing over a SOC 2 report.