Sample AI Security Questionnaire Analysis
This example uses a fictional SaaS company and synthetic evidence. It is not a customer result, testimonial or benchmark. Its purpose is to show how ProcureDeal separates supported answers from partial evidence and gaps.
Fictional evidence pack
- AI Policy: customer prompts are not approved for shared-model training.
- Privacy Note: application logs are retained for 30 days.
- Security Policy: administrative access requires MFA.
- No evidence supplied: formal annual AI bias audit.
Example output
| Buyer question | Status | Draft answer | Evidence |
|---|---|---|---|
| Is customer data used to train shared models? | Supported | No, based on the supplied AI Policy. | AI Policy: customer prompts are not approved for shared-model training. |
| How long are application logs retained? | Supported | 30 days, based on the supplied Privacy Note. | Privacy Note: application logs are retained for 30 days. |
| Is admin access protected by MFA? | Supported | Yes, administrative access requires MFA. | Security Policy: administrative access requires MFA. |
| Do you conduct a formal annual AI bias audit? | Gap | Current supplied evidence does not establish a formal annual bias audit. | No supporting source supplied. |
Why one question becomes a gap
The fictional evidence pack contains no source establishing a formal annual AI bias audit. A generic language model could still produce a plausible-sounding answer based on what companies often do. ProcureDeal's intended behavior is different: absence of evidence should remain visible. The reviewer can then confirm whether the control exists, document it properly, or answer the buyer that it is not currently in place.
The same logic applies when evidence supports only part of a compound question. For example, a policy might document model evaluation but say nothing about evaluation frequency. The draft should preserve that distinction rather than fill the missing frequency from assumption.
What this sample demonstrates
The important behavior is not that every question receives a βyes.β It is that the output is constrained by the evidence. A missing control is visible instead of being silently converted into a positive claim.
See the full evidence methodology.