The next security questionnaire starts from answers your team already approved.

Paste the buyer’s file into your AI. It quotes your saved answers word for word, and it asks you only about what your record doesn’t hold.

You approve the whole set before anything goes back to the buyer.

Mei Lin answered Northshore Bank’s 64 questions for Harbor Ledger, our sample company.

Back to What it does: questionnaires

Mei LinHarbor Ledger

Using Kanonik, answer the security questionnaire I paste next for Harbor Ledger. Answer from our record.

Northshore_TPRM_2026.xlsx4 sheets, 64 questions

kanonikpropose_questionnaire_responseWorkingProposed

Reading all four sheets against your record.64 answers are ready for you to read. 61 come from your record. 3 are stated by Harbor Ledger, with no record behind them. None are open.

Northshore_TPRM_2026.xlsxVendor security questionnaire

Governance20 questions
	A	B	C	D
Row	Ref	Question	Answer	Source
	1.1	Do you have an information security policy?	Yes, version 3.1
	1.2	Do you have an acceptable use policy?	Yes
	1.3	Do you have a supplier security policy?	Yes
	1.4	Do you run a risk assessment?	Yes
	1.5	Do you hold cyber insurance?	Yes
	Stated by Harbor Ledger. No record behind it.
	1.6	Have you assessed the risk of a regional cloud outage?	Yes
	1.7	Do you accept any residual risks?	Yes, one
	1.8	Do you control the use of AI tools?	Yes
	1.9	Are key policies reviewed every year?	Yes
	1.10	Do staff complete security awareness training?	Yes
	1.11	Is training given at joining?	Yes, in the first week
	1.12	Is there an exception process?	Yes
	1.13	Are audit findings tracked to closure?	Yes
	1.14	Have you had an external readiness review?	Yes, SOC 2 Type I
	1.15	Is physical security in scope?	No
	1.16	Have you assessed the risk of an untested restore?	Yes
	1.17	Have you assessed the risk of laptop loss?	Yes
	1.18	Is phishing awareness trained?	Yes
	1.19	Is the acceptable use policy acknowledged by staff?	Yes
	1.20	Does the security policy name an owner?	Yes
15 more rows in this sheet

Access14 questions
	A	B	C	D
Row	Ref	Question	Answer	Source
	2.1	Is multi-factor authentication required for administrator access?	Yes
	2.2	Do you use single sign-on for staff?	Yes
	2.3	Is the admin sign-on policy documented?	Yes
	2.4	Are admin group members exported for review?	Yes
	2.5	Is privileged access reviewed?	Every quarter
	2.6	How quickly is access removed when someone leaves?	One working day
	2.7	Is access removal recorded?	Yes
	2.8	Do you have a joiner, mover and leaver procedure?	Yes
	2.9	Is the leaver procedure shared between People Operations and IT?	Yes
	2.10	Do you alert on unusual administrator sign-ins?	Yes
	2.11	Is source code access controlled?	Yes
	2.12	Are finance mailboxes protected against phishing?	Yes
	2.13	Are partner API keys protected?	Yes
	2.14	Is the customer portal behind single sign-on for staff?	Yes
12 more rows in this sheet

Data protection11 questions
	A	B	C	D
Row	Ref	Question	Answer	Source
	3.1	Is customer data encrypted at rest?	Yes
	3.2	Are company laptops encrypted?	Yes
	3.3	Is the device encryption status reported?	Yes
	3.4	Are encryption keys managed centrally?	Yes
	3.5	Is endpoint encryption enforced, not optional?	Yes
	3.6	Where is customer data stored?	United States
	3.7	Which system holds balances and transaction history?	The ledger database
	3.8	Where are customer identity documents kept?	The KYC document store
	3.9	Is the data warehouse encrypted?	Yes
	3.10	Are staff and contractor laptops managed centrally?	Yes
	3.11	Is the payments API on your asset inventory?	Yes
9 more rows in this sheet

Operations19 questions
	A	B	C	D
Row	Ref	Question	Answer	Source
	4.1	Do you have an incident response plan?	Yes
	4.2	Is the incident response plan tested?	Yes, April 2026
	4.3	Do you back up production data?	Yes, nightly
	4.4	When was a restore last tested?	July 2025
	4.5	Do you log administrator activity centrally?	Yes
	4.6	Have you had a reportable security incident in the last 24 months?	No
	Stated by Harbor Ledger. No record behind it.
	4.7	Do you assess critical vendors before contract?	Yes
	4.8	Does your card processor hold a SOC 2 report?	Yes, Type II, 2025
	4.9	Who hosts your production systems?	Amazon Web Services
	4.10	Who is your identity verification provider?	Keystone Identity
	4.11	Do you keep an asset inventory?	Yes
	4.12	Can logging be turned off without an alert?	No
	4.13	Who is your card processor?	Ferrow Card Services
	4.14	Are restores tested on a schedule?	Yes
	4.15	Do you run penetration tests?	Yes, every year
	Stated by Harbor Ledger. No record behind it.
	4.16	Are production logs retained for at least a year?	Yes, 13 months
	4.17	Does the incident plan say how customers are told?	Yes
	4.18	Do you use an identity verification vendor?	Yes, Keystone Identity
	4.19	Is cloud activity logged?	Yes
16 more rows in this sheet

Governance20 questions
	A	B	C
	1.1	Do you have an information security policy?	Yes, version 3.1
	1.2	Do you have an acceptable use policy?	Yes
	1.3	Do you have a supplier security policy?	Yes
	1.4	Do you run a risk assessment?	Yes
	1.5	Do you hold cyber insurance?	Yes
	Stated by Harbor Ledger. No record behind it.
	1.6	Have you assessed the risk of a regional cloud outage?	Yes
	1.7	Do you accept any residual risks?	Yes, one
	1.8	Do you control the use of AI tools?	Yes
	1.9	Are key policies reviewed every year?	Yes
	1.10	Do staff complete security awareness training?	Yes
	1.11	Is training given at joining?	Yes, in the first week
	1.12	Is there an exception process?	Yes
	1.13	Are audit findings tracked to closure?	Yes
	1.14	Have you had an external readiness review?	Yes, SOC 2 Type I
	1.15	Is physical security in scope?	No
	1.16	Have you assessed the risk of an untested restore?	Yes
	1.17	Have you assessed the risk of laptop loss?	Yes
	1.18	Is phishing awareness trained?	Yes
	1.19	Is the acceptable use policy acknowledged by staff?	Yes
	1.20	Does the security policy name an owner?	Yes
15 more rows in this sheet

Access14 questions
	A	B	C
	2.1	Is multi-factor authentication required for administrator access?	Yes
	2.2	Do you use single sign-on for staff?	Yes
	2.3	Is the admin sign-on policy documented?	Yes
	2.4	Are admin group members exported for review?	Yes
	2.5	Is privileged access reviewed?	Every quarter
	2.6	How quickly is access removed when someone leaves?	One working day
	2.7	Is access removal recorded?	Yes
	2.8	Do you have a joiner, mover and leaver procedure?	Yes
	2.9	Is the leaver procedure shared between People Operations and IT?	Yes
	2.10	Do you alert on unusual administrator sign-ins?	Yes
	2.11	Is source code access controlled?	Yes
	2.12	Are finance mailboxes protected against phishing?	Yes
	2.13	Are partner API keys protected?	Yes
	2.14	Is the customer portal behind single sign-on for staff?	Yes
12 more rows in this sheet

Data protection11 questions
	A	B	C
	3.1	Is customer data encrypted at rest?	Yes
	3.2	Are company laptops encrypted?	Yes
	3.3	Is the device encryption status reported?	Yes
	3.4	Are encryption keys managed centrally?	Yes
	3.5	Is endpoint encryption enforced, not optional?	Yes
	3.6	Where is customer data stored?	United States
	3.7	Which system holds balances and transaction history?	The ledger database
	3.8	Where are customer identity documents kept?	The KYC document store
	3.9	Is the data warehouse encrypted?	Yes
	3.10	Are staff and contractor laptops managed centrally?	Yes
	3.11	Is the payments API on your asset inventory?	Yes
9 more rows in this sheet

Operations19 questions
	A	B	C
	4.1	Do you have an incident response plan?	Yes
	4.2	Is the incident response plan tested?	Yes, April 2026
	4.3	Do you back up production data?	Yes, nightly
	4.4	When was a restore last tested?	July 2025
	4.5	Do you log administrator activity centrally?	Yes
	4.6	Have you had a reportable security incident in the last 24 months?	No
	Stated by Harbor Ledger. No record behind it.
	4.7	Do you assess critical vendors before contract?	Yes
	4.8	Does your card processor hold a SOC 2 report?	Yes, Type II, 2025
	4.9	Who hosts your production systems?	Amazon Web Services
	4.10	Who is your identity verification provider?	Keystone Identity
	4.11	Do you keep an asset inventory?	Yes
	4.12	Can logging be turned off without an alert?	No
	4.13	Who is your card processor?	Ferrow Card Services
	4.14	Are restores tested on a schedule?	Yes
	4.15	Do you run penetration tests?	Yes, every year
	Stated by Harbor Ledger. No record behind it.
	4.16	Are production logs retained for at least a year?	Yes, 13 months
	4.17	Does the incident plan say how customers are told?	Yes
	4.18	Do you use an identity verification vendor?	Yes, Keystone Identity
	4.19	Is cloud activity logged?	Yes
16 more rows in this sheet

61from your record

3stated

0open

Mei reads the set and approves it once. Try it below.

Northshore Bank’s workbook, answered from Harbor Ledger’s record. Harbor Ledger is our sample company; the questions and answers are sample data. Select any answer to see where it came from.

Mei
She pasted all four sheets into her AI.
They stayed in the bank’s own layout. She’d started the job Answer a security questionnaire in Kanonik, so her AI worked through the form with Kanonik’s questionnaire skill.
Mei’s AI
The record answered most of it.
For 61 questions, the AI found an answer the team had already approved and quoted it exactly, with the source beside it. Kanonik marks those From your record.
Mei
A few answers only the company can give.
Three questions, the cyber insurance limit among them, had nothing on the record behind them. Mei answered them, and Kanonik labeled them Stated. Where nobody has an answer yet, a question stays marked Open, and the buyer’s file gets no placeholder for it.
Mei
She approved the set once.
One tick covers the whole set, with the counts in front of her as she ticks.
Kanonik
The bank’s own file gets filled in.
Once she’d approved, Kanonik’s export put the answers into the bank’s own spreadsheet, and Mei downloaded it. Anything marked under NDA stayed out. Each answer comes with a proof file the bank can check for itself.

The Northshore Bank answer set in Kanonik on a phone, for Harbor Ledger, a sample company: question 1.5, Do you hold cyber insurance, answered yes with a 2 million US dollar limit and marked as stated by the company, with the decision open under it: the box that says all 64 answers are read, including 3 stated, and the buttons Approve, Send back and Reject.

Three of the 64 answers are the company’s own word, marked Stated.

Sixty-one of the 64 answers carry their source.

A questionnaire answer set in Kanonik, with sample data from Harbor Ledger. It plays once; then it’s yours to click through.

An approved answer is saved, so you don’t write it twice.

Each approved answer becomes a saved answer, tied to the record it rests on. When the next buyer asks about encryption, your AI uses the same sentence, with the same proof behind it. Every buyer who asks should hear one answer from you. If it rewords an answer to fit a buyer’s form, Kanonik labels it as reworded by your AI and stops treating it as From your record.

When two answers in one set contradict each other, nobody can approve the set until one of them is fixed.

Paste the next questionnaire a buyer sends you into your AI.

Start your trial

The next security questionnaire starts from answers your team already approved.

Mei Lin answered Northshore Bank’s 64 questions for Harbor Ledger, our sample company.

She pasted all four sheets into her AI.

The record answered most of it.

A few answers only the company can give.

She approved the set once.

The bank’s own file gets filled in.

An approved answer is saved, so you don’t write it twice.

Read next

Paste the next questionnaire a buyer sends you into your AI.