Interactive demo · sample data · no signupWatch a real bank DDQ get answered — start to finish.
The scenario: Novapay (a fictional payments fintech) just received a 58-question security & compliance questionnaire from Meridian Bank, the sponsor bank it needs to close. This is the exact workflow your team would run.
All companies, documents, and answers below are synthetic — built to show the workflow, not real client data.
Meridian_Bank_Vendor_Security_DDQ.xlsx
58 questions · received this morning · due in 14 days
Novapay's evidence library (already in RAVIQ)
SOC 2 Type II report
Audited Jan–Dec 2025 · all five criteria
Current
PCI DSS attestation (AoC)
QSA-signed · v4.0
Current
Information security policy
v4.2 · board-approved
Current
Penetration test report
External firm · May 2025
14 months old
Prior DDQ answers (3 banks)
212 previously approved answers
Reusable
The documents you already have. RAVIQ never invents an answer — it only uses these.
Reading Meridian's questionnaire…
● Found 58 questions across 6 sections
● Matched 49 to documents in your evidence library
● Flagged 1 document as possibly out of date
● Found 3 questions your current evidence can’t support
Meridian Bank — Security DDQ · 58 questions
✓ 49 answered from your evidence⚠ 6 need review3 need evidence you don't have yet
Checked against the rulebooks banks examine on:
FFIEC IT Handbook ✓
GLBA Safeguards ✓
BSA / AML —
OFAC —
PCI DSS v4.0 ✓
SOC 2 ✓
NYDFS 500 ⚠
GDPR ✓
Green = validated by current evidence. Amber = validation pending a reviewer decision. Red = blocked until missing evidence arrives. How RAVIQ performs this mapping is proprietary — what you get is the verdict.
🔒
Closed loop: every word below comes from Novapay's 5 uploaded documents — nothing else.
No open-internet content, no AI model memory, no other company's answers. If the evidence isn't in your library, RAVIQ says "cannot answer yet" — it never fills the gap with plausible text. Expand any answer to see the exact source passage it was built from.
Showing 10 of 58 questions in detail — the full set is in the exported pack.
Governance & Oversight
Q3. Describe board-level oversight of your information security and risk program.
Ready
The security program is owned by the CISO with quarterly reporting to the board risk committee. Charter, meeting cadence, and escalation paths are documented in our governance policy.
Backed by 2 current documents ✓
See the proof — source passages & framework validation ▾
"The Chief Information Security Officer reports quarterly to the Board Risk Committee on program effectiveness, material incidents, and emerging threats…"
Governance Policy v3.0 · §1.2 · board-approved Nov 2025 · valid
Governance Policy v3.0 §1–2
Board committee charter
Validated against: FFIEC Management booklet · GLBA §314.4(a) · SOC 2 CC1.2
Governance & Oversight
Q9. How are security policies reviewed, approved, and exceptions tracked?
Ready
All policies are reviewed annually and board-approved; exceptions require CCO sign-off and carry a 90-day remediation window tracked in the risk register.
Backed by 1 current document ✓ · reused from a previously approved answer
See the proof — source passages & framework validation ▾
"Exceptions to any information security policy require documented CCO approval and shall be remediated within ninety (90) days…"
Policy Management Standard v2.2 · §4.1 · valid
Policy Management Standard v2.2
Validated against: FFIEC Management · NYDFS 500.03 · ISO 27001 A.5.1
Information Security
Q14. Describe your encryption of data at rest and in transit.
Ready
All customer data is encrypted at rest using AES-256 and in transit using TLS 1.2+. Encryption keys are managed in a dedicated key-management service with automatic rotation.
Backed by 2 current documents ✓ · reused from a previously approved answer
See the proof — source passages & framework validation ▾
"Customer data at rest is encrypted using AES-256; data in transit is protected via TLS 1.2 or higher across all production systems…"
SOC 2 Type II report · CC6.1, p. 41 · audit period Jan–Dec 2025 · valid
"Cryptographic keys are stored in the managed KMS with automatic 90-day rotation and split administrative control…"
InfoSec Policy v4.2 · §4.3 · valid
SOC 2 Type II — CC6.1, p. 41
InfoSec Policy v4.2 §4
Validated against: GLBA §314.4(c) · PCI DSS 3.5 · FFIEC InfoSec · NYDFS 500.15
Information Security
Q18. Describe access controls, MFA enforcement, and privileged access reviews.
Ready
Production access requires SSO with MFA; privileged access is role-based, reviewed quarterly, and revoked within 4 hours of offboarding.
Backed by 2 current documents ✓
See the proof — source passages & framework validation ▾
"Access to production environments requires SSO with hardware-backed MFA. Privileged roles are re-certified quarterly by system owners…"
IAM Standard v3.1 · §2 · last access review 14 Jun 2026 · valid
IAM Standard v3.1
Quarterly access review log Q2
Validated against: FFIEC InfoSec · GLBA §314.4(c) · NYDFS 500.07 · SOC 2 CC6.1–6.3
Information Security
Q22. Provide your most recent penetration test summary and remediation status.
Needs your call
Annual external penetration test completed May 2025; all critical and high findings remediated within 30 days. Summary letter available under NDA.
⚠ The pen test on file is 14 months old — your reviewer decides if it still goes out
See the proof — source passages & framework validation ▾
"Testing was performed 12–23 May 2025 against the production perimeter… all critical and high findings verified closed 18 Jun 2025."
Penetration test report · May 2025 · ⚠ outside 12-month validity window
Pen test report — May 2025 (validity window exceeded)
Remediation tracker · closed 100%
Validated against: FFIEC InfoSec · NYDFS 500.05 · PCI DSS 11.3 — validation blocked while source is stale
Incident Response
Q29. Describe your incident response plan, testing cadence, and bank notification commitments.
Ready
ISO 27035-aligned IR plan with annual tabletop exercises. Material incidents affecting your bank are notified within contractually agreed windows, including the 36-hour standard for banking partners.
Backed by 2 current documents ✓
See the proof — source passages & framework validation ▾
"Material incidents affecting banking partners are escalated to the partner’s designated contact no later than 36 hours after determination…"
IR Plan v2.2 · §3.4 · tabletop-tested Jan 2026 · valid
IR Plan v2.2 §3
Tabletop report Jan 2026
Validated against: Interagency 36-hour rule · FFIEC · GDPR Art. 33 · SOC 2 CC7.3
Vendor & Fourth-Party Risk
Q31. Do you maintain a vendor risk management program covering your critical suppliers?
Ready
Yes. Critical vendors are tiered by materiality, reviewed annually, and monitored continuously. Vendor register and review cadence documented in our TPRM policy.
Backed by 1 current document ✓ · drafted from your TPRM policy
See the proof — source passages & framework validation ▾
"Vendors classified Tier 1 (material) undergo annual reassessment including SOC 2 review, financial health check, and continuous monitoring…"
TPRM Policy v2.1 · §2.3 · valid
TPRM Policy v2.1 §2–3
Vendor register export
Validated against: Interagency TPRM guidance (2023) · FFIEC Outsourcing · SOC 2 CC9.2
Resilience & Continuity
Q38. State your RTO/RPO for critical services and your DR testing evidence.
Ready
RTO 15 minutes / RPO 1 minute for critical payment services, verified in the most recent full DR failover test. Quarterly tabletop exercises documented.
Backed by 2 current documents ✓
See the proof — source passages & framework validation ▾
"Full regional failover executed 2 Mar 2026: RTO achieved 11 minutes (target 15), RPO 43 seconds (target 60)…"
DR test report · Mar 2026 · valid
BCP v4.0 §5
DR test report Mar 2026
Validated against: FFIEC BCM booklet · SOC 2 A1.2–3 · GLBA §314.4
Privacy & Data Handling
Q44. Describe data retention, deletion, and customer data rights handling.
Ready
Retention schedules per data class; deletion within 30 days of verified request; data subject rights fulfilled within statutory windows. Sub-processor list maintained and shared on request.
Backed by 1 current document ✓
See the proof — source passages & framework validation ▾
"Verified deletion requests are completed within 30 calendar days across production and backup systems, with certificate of deletion on request…"
Data Retention Policy v2.0 · §5 · valid
Data Retention Policy v2.0
Validated against: GLBA Privacy · GDPR Art. 17/28 · SOC 2 P-series
AML & Financial Crime
Q47. Describe your AML transaction monitoring and sanctions screening controls.
Needs evidence
RAVIQ found no supporting document for this question in your library. Rather than guess, it lists this as an open item with a request: upload your AML/CFT program policy.
○ Cannot answer yet — evidence request generated for your AML policy
See the proof — source passages & framework validation ▾
No source found — answer blocked from export
Required validation: BSA/FinCEN five pillars · OFAC screening · FFIEC BSA/AML — cannot pass without evidence
Approve the flagged answers to continue. Nothing leaves RAVIQ without a human sign-off.
Every action, on the record.
09:02
RAVIQ parsed 58 questions; drafted 49 answers from 5 source documents
09:02
RAVIQ flagged pen test report as outside its 12-month validity window
09:14
S. Okafor (Compliance) approved Q14 — encryption · answer v2 · sources: SOC 2 p.41, InfoSec Policy §4
09:21
J. Reyes (Security) approved Q22 with note: “new pen test scheduled Aug — include remediation letter”
09:30
S. Okafor (Compliance) approved final pack · export manifest #NP-2041 recorded
Why this matters to your bank
Meridian's risk team doesn't just read your answers — they ask "prove it." Every RAVIQ answer traces to a named document, a validity date, and the person who approved it. That's the difference between a response pack a bank accepts and one that triggers three more weeks of follow-up questions.
What got caught before it shipped
⚠ Pen test report was 14 months old → flagged, not silently reused
⚠ 3 questions had no supporting evidence → marked "cannot answer yet," with a request list — not filled with plausible text
✓ 49 answers reused from previously approved responses — 6 hours of typing avoided
RESPONSE PACK · PDF + XLSX
Novapay → Meridian Bank
Security DDQ Response
Security DDQ Response
55 of 58 questions answered, each with named sources
3 open items listed transparently with remediation dates
Approval record: S. Okafor (Compliance) · J. Reyes (Security)
Appendix: evidence index with document versions & validity dates
Sent on day 3 of a 14-day deadline. The previous Meridian questionnaire took Novapay 4 weeks and 40+ hours of senior staff time.
Now run it with your real questionnaire.
Upload one DDQ, RFP, or security questionnaire and see your own coverage in minutes — which questions your existing SOC 2, PCI, and policies already answer, and exactly what's missing. No sales call. No demo booking.
Upload your questionnaire — freeYour file stays private and is deleted in 7 days unless you create an account.
Head of Sales / Revenue: the security review stops being the longest stage in your pipeline.
Compliance / Risk: nothing ships without your sign-off, and every answer has a source you chose.
Partnerships: bank-ready response packs make you the easiest partner to onboard.
Procurement / vendor teams: the same evidence library answers every new questionnaire — it compounds.