How it works
You send two things: the questionnaire and your evidence. Each question is matched to the passages that address it, answered only from those passages, checked against the source, and reviewed by a person if anything is uncertain.
Use your work Google account. Turnflow receives your name and email address and nothing else: no password to create, nothing to install, and no access to your Drive or inbox.
Drop in the spreadsheet exactly as your customer sent it, plus what you'd normally point them to: a SOC 2 Type II or ISO 27001 report, security policies, a company fact sheet. Add a note if some tabs don't apply.
Your documents are split into passages, including each row of an auditor's control-testing tables. Every question is matched to the passages most likely to answer it. If the auditor recorded an exception against a related control, that row is always included, so it can't be overlooked.
Each answer is drafted using only the matched passages, and must cite the document, control and page with an exact quote. A separate check then looks for that quote in your original document. If it can't be found word for word, the citation is removed and the answer is held back.
[Document, Control, Page, "exact quote"]. See the deliverable for how to read one.Answers with weak support, partial coverage, or an auditor exception are held for a person to approve, correct or leave blank. The file can't be released while any of them is undecided.
The finished spreadsheet appears in your workspace with a download button, and you get an email with a private link. Send it straight to your customer.