Tick off your security questionnaire in minutes, not days.

You send it the questionnaire you were sent. It sends back a full draft.

1. Drop the file in. Word, Excel, CSV or PDF. Tickbox pulls out every question, however messy the layout, and keeps the original numbering so answers map straight back.
2. Watch it draft. Answers arrive one by one in plain English while you get on with something else. Close the tab if you like, it keeps going.
3. Review and send. Edit anything, approve it, download a finished Word document ready to go back to your customer.

Judge it yourself. These are real drafts, on four questions you will almost certainly be asked.

Every answer is a draft you review and edit. Tickbox never sends anything for you, and never claims you are certified.

Three sources, in order of how much they know about you.

01 Your own policies

Upload them once and every answer draws on your real documented controls. Ask about data deletion and it cites your actual procedure, not boilerplate.

02 Your past answers

Everything you approve is saved. The second questionnaire borrows from the first, so each one is faster than the last. This is the part that compounds.

03 The frameworks

UK GDPR and Cyber Essentials, kept current, so you get a sensible answer from your very first upload with nothing uploaded at all.

UK GDPRCyber EssentialsEU GDPR, ISO 27001, NIS2 to come

No, and you can check. Every answer shows its working.

Each draft carries a tag saying which framework control or which of your policies it drew on. Click it and you read the source. Where an answer needs a fact only you have, it says so rather than inventing one.

Your original question references, the 3.2s and A5s, are preserved on every answer, so pasting them back into the customer's spreadsheet is mechanical.

You can still answer honestly, and honestly is the only way to answer these.

Tickbox drafts from the frameworks and from the details you give it about your business, describing the controls you actually have. Uploading policies sharpens the answers, but nothing is required to start. It will never claim you hold a certification you do not hold.

Your uploads are yours. They are never pooled with anyone else's and never used to train a model.

Drafting runs through Anthropic's Claude API, where content sent is not used for training. Everything is encrypted in transit and at rest, tagged to your account, and you can delete all of it whenever you like. Payments go through Stripe, so we never see your card number.

SecurityHow we use AIPrivacySub-processors

Start free on your own file. Pay only when you want the rest of it.

Cancel anytime. Prices include everything, there is no setup fee and no per-seat charge.

Because the alternative was built for somebody else.

The big compliance platforms start at thousands a year and assume you have a security team. Most small suppliers have neither. What they have is a deal on the line and a 200 question spreadsheet in the way.

Tickbox does one job for that person. It is prep and guidance tooling, not legal advice, and it never tells your customer you are compliant. You review and send every answer yourself.