Citesheet fills your Excel questionnaire from your own policies. Every answer quotes the exact sentence it came from, and anything your documents don't prove is flagged, not guessed.
First questionnaire free. No card needed. Sign in with your work email.
| ID | Question | Answer | Explanation and source |
|---|---|---|---|
| LOG-03.1 | Are security-related events identified and monitored within applications and the underlying infrastructure? | Answer: Yes | The company mandates capturing security-relevant events across product and infrastructure, and security logs are generated by applications and systems for monitoring and incident response. |
| BCR-01.2 | Are the policies and procedures reviewed and updated at least annually? | Answer: Yes | Policies and procedures are required to be reviewed and approved on at least an annual basis. |
| HRS-11.2 | Are regular security awareness training updates provided? | Answer: Yes | Regular security awareness training updates are provided through annual security awareness training and quarterly phishing simulations and training. |
| CCC-07.1 | Are detection measures implemented with proactive notification if changes deviate from established baselines? | Answer: Partial | The policies document that security detection controls identify events outside of established security baselines, but they do not prove that proactive notifications are implemented for these deviations. Needs review. Check: partial coverage. Evidence showing that proactive notifications are sent when changes deviate from established baselines. |
| DSP-17.1 | Are processes, procedures, and technical measures defined and implemented to protect sensitive data throughout its lifecycle? | Answer: Yes | The provided documents confirm that processes, standards, and technical measures are established to protect sensitive data throughout its lifecycle, including data classification and software development lifecycle policies. |
| HRS-07.1 | Are employees required to sign an employment agreement before gaining access to organizational information systems, resources, and assets? | Answer: — | No proof found We found nothing in your documents to support an answer, so we left it empty. |
Real rows from GitLab's public policies. Click a source to see the sentence behind the answer.
Proof for what your documents say. Flags for what they don't. Your file, back as you sent it.
Each answer shows the exact sentence it came from. Code checks it's in your document before it ships.
If your documents don't cover a question, the row says so and goes on your gap list. Nothing is guessed.
We fill your Excel file in place. Questions, layout and dropdowns are checked unchanged before you download.
The launch film· 59 s
Add your policies, drop in the spreadsheet you were sent, and check every answer against the sentence it came from.
The real product, recorded on GitLab's public policies. The voice is AI-generated.
Tested on a real CAIQ
GitLab publishes its own filled-in CAIQ. We gave Citesheet a blank copy and only GitLab's public policies, then compared every answer.
All 261 questions, one square each
158 Matched GitLab's own answer. The same Yes, No or NA that GitLab gave.
5 Differed, and were flagged. All 5 were marked Needs review, so a person checks them before anything is sent.
98 Left empty on purpose. GitLab keeps the details for these in internal pages, so the proof wasn't there. Citesheet said “No proof found” instead of guessing.
One questionnaire, one company: a first measurement, not a guarantee.
Read the full method and the missesHow it works
Your policies or SOC 2 report, as PDF, Word or Markdown. They are the only source of answers.
The Excel file you were sent, such as a CAIQ.
Same file, same layout. Each answer has a quote and its document. You review the Needs review rows before you send it.
You do it yourself in the app. Stuck? We'll help by email.
We fill your Excel file. We don't rebuild it. Questions, layout and dropdowns stay as they were, and before it goes back to you we check that nothing outside the answer cells changed.
Proof
A chatbot writes answers that sound right. Citesheet only writes what it can quote. Each answer links to the exact words in your document. Code then checks those words exist in it, word for word. We never paraphrase and call it a quote. Pick a question to see where its answer comes from.
…
Definitions
GitLab Team members: users with a gitlab.com email address
Contractors/TSPs and Consultants: Personnel who are external to GitLab who do not have a gitlab.com email address and are under a contract/agreement that involves handling, managing, storing, or transmitting GitLab data in support of GitLab's statutory, regulatory and contractual requirements.
Roles & Responsibilities
Standard
All GitLab Team members and contractors/TSPs are required to participate in GitLab's General Security Awareness Training, New Hire Training and on-going phishing simulations and training, or show evidence of equivalent training completion within the calendar year. Security Trainings that require participation include the following:
New Hire Security Training
New Hire Security Training is required to be completed by all GitLab Team Members and contractors/TSPs during their onboarding at GitLab. This security training provides new hires with the knowledge to identify cybersecurity threats, vulnerabilities, and attacks.
General Security Awareness Training (GSAT)
The GitLab security awareness training program provides ongoing training to GitLab team members that enhances knowledge and identification of cybersecurity threats, vulnerabilities, and attacks as well as satisfying external regulatory requirements. GitLab's handbook-first General Security Awareness Training is provided annually via Right Hand Cybersecurity, GitLab's third-party provider, and requires participation and completion by all GitLab Team Members and contractors/TSPs.
Exceptions during the active campaign will be made for GitLab team members on extended leave.
Phishing Training
The GitLab Phishing Training Program is designed to educate and evaluate GitLab's ability to detect and prevent phishing attempts. Ongoing phishing simulations and trainings are conducted once per quarter via Right Hand Cybersecurity, GitLab's third-party provider, and requires participation and completion by all assigned GitLab Team Members and contractors/TSPs.
Remember: If you see something, say something, and always report suspicious emails via PhishArm.
Secure Coding Training
The GitLab Secure Coding Training is a required training completed by a sub-group of GitLab Team Members and contractors/TSPs in the Engineering Department. This training contains descriptions and Secure Coding Guidelines from OWASP (Open Web Application Security Project) addressing security vulnerabilities commonly identified in the GitLab codebase. This training is intended to help developers identify potential security vulnerabilities early, with the goal of reducing the number of vulnerabilities released over time.
Exceptions during the active campaign will be made for GitLab team members on extended leave.
Other Security Trainings
…
Real rows from GitLab's public policies. If the words are not in the document, the answer does not ship.
When the proof isn't there
When your documents say nothing, the row stays empty and says so. When they only half-prove it, the row says what to check. Nothing is guessed.
Unanswered questions in one place, so you know which policy to write next. In the app, each one is marked “No proof found”.
You decide: edit or approve any answer. A re-run never overwrites what you changed.
HRS-07.1
Are employees required to sign an employment agreement before gaining access to organizational information systems, resources, and assets?
Nothing in your documents supports an answer, so it stays empty and goes on your gap list.
Needs review · CCC-07.1
Are detection measures implemented with proactive notification if changes deviate from established baselines?
Check: partial coverage. Evidence showing that proactive notifications are sent when changes deviate from established baselines.
What you get
Answers you can defend, a file you can send, and documents that are handled with care.
Each answer comes with a quote and the document it came from. Code checks that the quote exists in your document, word for word. We never paraphrase and call it a quote.
When your documents say nothing, the row stays empty and says so. Unanswered questions go on a gap list, so you know which policy to write next.
We fill your file. We don't rebuild it. Before it goes back to you, we check that nothing outside the answer cells changed.
No library to build or keep up to date: answers come from your current documents. Answers you approve are saved, so near-identical questions are answered from them directly; similar ones get a “use your earlier answer?” suggestion while you review.
A document that contains something like an API key or a private key is quarantined: never indexed, never sent to the AI step. Invisible or white-on-white text is stripped before a document is read.
Delete a document, a questionnaire or your whole company account from the app. Deleted items disappear at once and are then purged from storage and search.
Trust center
What happens to the policies and questionnaires you send us, in plain words. The full details, every subprocessor and our DPA are public.
Your documents answer your questionnaires. Nothing else.
The AI step runs on Google's paid Gemini API, which is not used to train Google's models.
Connections use HTTPS. Stored files and answers are encrypted.
A document with something like an API key is quarantined and never indexed.
Remove a document, a questionnaire or your whole account from the app.
We'll sign yours before you send anything.
Security page last updated 9 November 2026.
B2B software teams without a dedicated security person, whose customers send security questionnaires before they buy. Usually the founder, CTO or sales engineer who answers them from the company's own policies.
ChatGPT writes answers that sound right, but it can't show where each one came from, so you have to check every line yourself. Citesheet answers only from your documents. Each answer shows the exact sentence it is based on, code checks that sentence is in your document word for word, and anything your documents don't prove is flagged instead of guessed. It also fills your Excel file in place, so you review quotes instead of rewriting answers.
Excel security questionnaires, such as the CAIQ. We measured it on a 261-question CAIQ filled from GitLab's public policies. If yours is a different Excel questionnaire, send it and we'll tell you how it does.
It can draft one, but a quote is required, and code checks that the quote exists word for word in your document. If there is no proof, the row says “No proof found.”
Partial evidence and conflicting documents are marked Needs review, with a “Check:” line saying why. You review those rows. Missing proof goes on the gap list.
Yes, for flagged rows and anything sensitive, such as legal commitments or breaches. You can edit or approve each answer, and a re-run never overwrites what you changed.
No. Your questions, layout and dropdowns come back unchanged. We verify that before you download.
They are used only for your questionnaires. The AI step is Google Gemini on the paid tier, which is not used for training. Data is encrypted in transit and at rest, deleted on request, and we sign an NDA on request.
Your first questionnaire is free, no card needed. Then Starter is $79 a month (5 questionnaires a month) or Growth $199 a month (unlimited, fair use up to 50 a month). Tax included, cancel anytime.
Click Start free and sign in with your work email: we email you a link, no password. Upload your policies and your Excel questionnaire, then review and download the filled file. Want a walkthrough or a security review first? Contact sales.
Get started
Your first questionnaire is free, so you can judge Citesheet on your own policies before you pay. See pricing.
We email you a link. No password, no card.
Upload your policies and one Excel questionnaire, up to 300 questions, and judge it on that.
Starter $79 a month, or Growth $199 a month for unlimited. Cancel anytime.
Who's behind Citesheet
I build and run Citesheet myself, and I answer every email. If something looks wrong, you tell me directly and I fix it.
Sign in with your work email, no card needed. Then $79 or $199 a month, cancel anytime.
A walkthrough, an NDA or a security review first? Contact sales or email hello@citesheet.com.