Sample
The first 25 answers Rendro drafted for Example Co. (fictional). The questions are the first 25 in our free starter kit of common security questions. Each answer shows the document it came from and how confident the draft is.
Sample with a fictional company; your sample uses your own documents.
1 of 25 · Company and governance
Yes. Example Co. keeps a written information security policy that the CEO approves and the team reviews once a year.
Source: Example Co. Information Security Policy (fictional), section 1 (Purpose and approval)
2 of 25 · Company and governance
The CTO owns the security programme and reports to the CEO.
Source: Example Co. Information Security Policy (fictional), section 2 (Roles)
3 of 25 · Company and governance
Yes. New staff complete security training when they join, and everyone repeats it once a year.
Source: Example Co. HR and Onboarding Policy (fictional), section 5 (Training)
4 of 25 · Company and governance
Yes, for new employees before they start, where local law allows.
Source: Example Co. HR and Onboarding Policy (fictional), section 3 (Hiring checks)
The policy says "new employees". Contractors are not mentioned.
5 of 25 · Company and governance
Yes. Employees sign a confidentiality agreement before they get access to company systems.
Source: Example Co. HR and Onboarding Policy (fictional), section 4 (Agreements)
6 of 25 · Certifications and audits
No SOC 2 report is mentioned in the documents. Needs the company's answer before it goes out.
Source: No source found
No source found. Never guessed.
7 of 25 · Certifications and audits
No ISO 27001 certificate is mentioned in the documents. Needs the company's answer.
Source: No source found
No source found. Never guessed.
8 of 25 · Certifications and audits
The Security Overview page mentions an independent test but gives no date, so the 12-month window can't be confirmed.
Source: Example Co. Security Overview page (fictional), "Testing" paragraph
Source found, but it doesn't answer the question as asked.
9 of 25 · Certifications and audits
Yes. Reports go to security@example-co.example, and Example Co. acknowledges them within two business days.
Source: Example Co. Security Overview page (fictional), "Reporting a vulnerability"
10 of 25 · Hosting and infrastructure
On a major cloud provider, in a United States region.
Source: Example Co. Security Overview page (fictional), "Where your data lives"
The provider is not named in the source, so the answer doesn't name it either.
11 of 25 · Hosting and infrastructure
Yes. Example Co. publishes its list of subprocessors and what each one does.
Source: Example Co. Subprocessors page (fictional)
12 of 25 · Hosting and infrastructure
Yes. Each record belongs to one customer account, and access rules in the database keep one customer's users away from another's data.
Source: Example Co. Security Overview page (fictional), "Customer data separation"
13 of 25 · Hosting and infrastructure
No. Example Co. runs on a cloud provider, which is responsible for the physical security of its data centres.
Source: Example Co. Security Overview page (fictional), "Where your data lives"
The source implies this without saying it outright.
14 of 25 · Hosting and infrastructure
Not currently. All customer data is stored in the United States.
Source: Example Co. Security Overview page (fictional), "Where your data lives"
15 of 25 · Encryption
Yes. The database and file storage are encrypted at rest.
Source: Example Co. Information Security Policy (fictional), section 6 (Encryption)
16 of 25 · Encryption
Yes. Connections use TLS 1.2 or higher, and plain HTTP is redirected to HTTPS.
Source: Example Co. Information Security Policy (fictional), section 6 (Encryption)
17 of 25 · Encryption
Keys are managed by the cloud provider's key management service. The documents don't say who can access them.
Source: Example Co. Information Security Policy (fictional), section 6 (Encryption)
Half of the question is answered. The company should confirm the rest.
18 of 25 · Encryption
Yes. Backups are encrypted in the same way as live data.
Source: Example Co. Information Security Policy (fictional), section 7 (Backups)
19 of 25 · Access control
Yes, for the identity provider, cloud console and code hosting.
Source: Example Co. Access Control Policy (fictional), section 2 (Authentication)
"All production systems" isn't stated, so the answer stops at what the source says.
20 of 25 · Access control
Not yet. Customers sign in with email and password.
Source: Example Co. Help Centre, "Signing in" (fictional)
21 of 25 · Access control
Two engineers have access for operations and support. The CTO approves access.
Source: Example Co. Access Control Policy (fictional), section 3 (Production access)
22 of 25 · Access control
Every quarter. People who leave lose access on their last day.
Source: Example Co. Access Control Policy (fictional), section 4 (Reviews and offboarding)
23 of 25 · Access control
Yes. Customers assign roles to their users, and employees get only the access their job needs.
Source: Example Co. Access Control Policy (fictional), section 1 (Least privilege)
The role names are not listed in the source.
24 of 25 · Access control
The policy sets a minimum length but the documents don't give the number. Needs the company's answer.
Source: Example Co. Access Control Policy (fictional), section 2 (Authentication)
Source found, but the detail is missing.
25 of 25 · Access control
Accounts are disabled on the last day, and company laptops are returned and wiped.
Source: Example Co. Access Control Policy (fictional), section 4 (Reviews and offboarding)
4 of the 25 answers are marked Needs review because the documents don't support them. Rendro flags those instead of guessing, and you check them before you export.
Your sample works the same way, with your blank questionnaire and answers drawn from your own public pages, returned within 48 hours.