# FillTrust > FillTrust answers vendor security questionnaires (CAIQ, SIG Lite, ISO 27001 Annex A, bespoke spreadsheets) from a company's own SOC 2, ISO 27001 and policy documents. Every generated answer cites the passage it came from, and an answer whose citation cannot be verified against the source is graded down rather than published. ## Our own security posture If you are assessing FillTrust as a vendor, these are the answers, including the ones that are "no". - [Trust Center](https://www.filltrust.com/trust): our own posture, answered on the same page a customer's buyers see. Last reviewed 2026-08-30. - [Posture as JSON](https://www.filltrust.com/trust/posture.json): the same answers, sub-processors and contacts in one document. - [Posture as OSCAL](https://www.filltrust.com/trust/oscal.json): NIST OSCAL component-definition, mapped to SP 800-53 rev 5. A vendor self-assessment, not an audit. - [Security overview](https://www.filltrust.com/security): encryption, tenant isolation, residency, retention, deletion, auditability. - [Sub-processors](https://www.filltrust.com/legal/subprocessors): every third party that touches customer data, and what it receives. - [Data Processing Agreement](https://www.filltrust.com/legal/dpa): GDPR Article 28 terms and the Standard Contractual Clauses, published rather than sent on request. - [Security contact](https://www.filltrust.com/.well-known/security.txt): RFC 9116. FillTrust holds no SOC 2 report and no ISO 27001 certificate. That is stated on the Trust Center rather than left for an assessor to discover. ## The product - [How it works](https://www.filltrust.com/how-it-works): documents in, questionnaire in, cited answers out in the format it arrived in. - [Features](https://www.filltrust.com/features): the parts around the drafting. Formats in and out, sending one question to a colleague without buying them a seat, the answer library, the audit trail, the Trust Center. - [Accuracy](https://www.filltrust.com/accuracy): what the grades mean, and why no percentage is published. - [Worked example](https://www.filltrust.com/demo): a real questionnaire answered, no account needed. - [Analyse a questionnaire](https://www.filltrust.com/analyze): upload the spreadsheet you were sent and get the question count, which tabs actually carry questions, and what it is asking about. Free, no account, no model call, nothing stored. - [Pricing](https://www.filltrust.com/pricing): two plans, from $19/month, or $29 once for a single questionnaire. No free tier of the answering product. - [Publish a Trust Center](https://www.filltrust.com/trust-center): a public posture page anyone can publish without paying. The answers are typed by the company itself, not generated, which is why it costs nothing. - [FAQ](https://www.filltrust.com/faq) - [Compared to Vanta](https://www.filltrust.com/alternatives/vanta): how this differs from Vanta, including what Vanta does better. Claims checked against their own page on 2026-08-30. - [Compared to SafeBase](https://www.filltrust.com/alternatives/safebase): how this differs from SafeBase, including what SafeBase does better. Claims checked against their own page on 2026-08-30. - [Compared to Conveyor](https://www.filltrust.com/alternatives/conveyor): how this differs from Conveyor, including what Conveyor does better. Claims checked against their own page on 2026-09-03. ## Answering specific questionnaire questions One page per question, at https://www.filltrust.com/questions/: what the question is really asking, which document answers it, what evidence to attach, and how it usually goes wrong. - [Are background checks performed on employees with access to customer data?](https://www.filltrust.com/questions/background-checks) - [Are backups tested by performing restores?](https://www.filltrust.com/questions/backup-and-restore-testing) - [Are user access rights reviewed periodically?](https://www.filltrust.com/questions/access-reviews) - [Are you FedRAMP authorized?](https://www.filltrust.com/questions/fedramp-authorization) - [Are you PCI DSS compliant?](https://www.filltrust.com/questions/pci-dss-compliance) - [Can customers access audit logs of activity in their account?](https://www.filltrust.com/questions/audit-logs-for-customers) - [Can we execute a Data Processing Agreement (DPA)?](https://www.filltrust.com/questions/data-processing-agreement) - [Do employees and contractors sign confidentiality agreements?](https://www.filltrust.com/questions/confidentiality-agreements) - [Do employees complete security awareness training?](https://www.filltrust.com/questions/security-awareness-training) - [Do you allow customers to audit your security controls?](https://www.filltrust.com/questions/right-to-audit) - [Do you assess the security of your vendors and sub-processors?](https://www.filltrust.com/questions/vendor-risk-management) - [Do you carry cyber liability insurance, and what is the coverage limit?](https://www.filltrust.com/questions/cyber-liability-insurance) - [The full index](https://www.filltrust.com/questions) The same questions grouped by the questionnaire that asks them: - [SIG Lite](https://www.filltrust.com/standards/sig-lite): 55 questions - [CAIQ v4.0](https://www.filltrust.com/standards/caiq-v4-0): 50 questions - [ISO 27001 Annex A](https://www.filltrust.com/standards/iso-27001-annex-a): 33 questions - [GDPR](https://www.filltrust.com/standards/gdpr): 4 questions - [VSA Core](https://www.filltrust.com/standards/vsa-core): 3 questions - [Every questionnaire](https://www.filltrust.com/standards) - [Browser extension](https://www.filltrust.com/extension): fills a questionnaire in any portal from answers the customer has already approved. Recall rather than generation: it offers nothing when nothing is close enough, and matching happens in the browser. - [MCP server](https://www.filltrust.com/mcp): the same corpus over the Model Context Protocol at https://www.filltrust.com/api/mcp. Free, read-only, no account. Five tools: search_questions, get_question, list_standards, get_filltrust_posture, and get_questionnaire_statistics, which returns measured counts from 146 real vendor security questionnaires (17,697 questions) and profiles of named ones such as HECVAT and CAIQ. Every result carries the URL of the page it came from. ## Contact FillTrust does not do outbound sales, cold email or sales calls. There is no calendar link. [Written contact](https://www.filltrust.com/support) is the only channel, and it is answered by a person.