{"id":35,"date":"2025-12-17T12:02:41","date_gmt":"2025-12-17T12:02:41","guid":{"rendered":"https:\/\/balamurali.in\/blog\/?p=35"},"modified":"2026-02-23T14:26:23","modified_gmt":"2026-02-23T14:26:23","slug":"introducing-complydeck-i-built-an-ai-to-answer-security-questionnaires-10x-faster","status":"publish","type":"post","link":"https:\/\/balamurali.in\/blog\/tech-posts\/introducing-complydeck-i-built-an-ai-to-answer-security-questionnaires-10x-faster\/","title":{"rendered":"Introducing ComplyDeck: I Built an AI to Answer Security Questionnaires 10x Faster"},"content":{"rendered":"\n

If you’ve ever worked in a security or compliance role, you know the pain.<\/p>\n\n\n\n

A customer sends you a 300-question security questionnaire. It’s due in two weeks. You already have three others sitting in your inbox. Each one takes 20+ hours of digging through policy documents, copying from previous responses, and hoping you’re consistent with what you said last time.<\/p>\n\n\n\n

I’ve been there. I’ve spent countless nights copy-pasting the same answers about our encryption standards, our incident response procedures, our access control policies. It’s mind-numbing, repetitive, and\u2014frankly\u2014a terrible use of human expertise.<\/p>\n\n\n\n

So I built ComplyDeck<\/a><\/strong> to solve it.<\/p>\n\n\n\n

\n\n\n\n

The Problem Nobody Talks About<\/h2>\n\n\n\n

Here’s what happens in most companies:<\/p>\n\n\n\n

    \n
  1. Customer requests a security questionnaire<\/strong> (could be 50 questions, could be 500)<\/li>\n\n\n\n
  2. Someone in security\/compliance opens a spreadsheet<\/strong> and starts hunting through policy PDFs<\/li>\n\n\n\n
  3. They answer questions from memory<\/strong> or scroll through a folder of \u201cprevious questionnaire answers\u201d<\/li>\n\n\n\n
  4. Inconsistencies creep in<\/strong> \u2014 you say one thing to Customer A, something slightly different to Customer B<\/li>\n\n\n\n
  5. 20\u201340 hours later<\/strong>, you submit… and wait for the next one<\/li>\n<\/ol>\n\n\n\n

    The real problem? This cycle never ends.<\/strong> As your company grows, questionnaire volume grows faster. You can’t hire your way out of it.<\/p>\n\n\n\n

    \n\n\n\n

    What ComplyDeck Does<\/h2>\n\n\n\n

    ComplyDeck is an AI-powered compliance assistant that uses your own policies to answer questionnaires automatically.<\/p>\n\n\n\n

    1) Upload Your Policies Once<\/h3>\n\n\n\n

    Drop your security policies, SOC 2 reports, and compliance documentation into the Knowledge Base. ComplyDeck parses, chunks, and indexes everything so it can retrieve the right context later.<\/p>\n\n\n\n

    2) Build a Q&A Database (The Secret Sauce)<\/h3>\n\n\n\n

    This is where it gets interesting. Every time you answer a question and approve it, it goes into your Q&A database. Over time, this becomes your institutional knowledge\u2014exactly how your company answers compliance questions.<\/p>\n\n\n\n

    When a new questionnaire comes in, ComplyDeck first checks: \u201cHave we answered something like this before?\u201d If yes, it retrieves that approved answer. If not, it generates a fresh response grounded in your documentation.<\/p>\n\n\n\n

    3) Drag, Drop, Done<\/h3>\n\n\n\n

    Export your customer’s questionnaire as a CSV. Drag it into ComplyDeck. Click \u201cProcess.\u201d Watch as the AI works through each question in real-time\u2014matching against your Q&A database, pulling context from your policies, and generating answers.<\/p>\n\n\n\n

    4) Review, Edit, Export<\/h3>\n\n\n\n

    Every AI-generated response is editable. Tweak the wording if needed. When you’re satisfied, export the completed CSV and send it back.<\/p>\n\n\n\n

    \n\n\n\n

    The Tech Under the Hood<\/h2>\n\n\n\n

    Since this is my personal blog, let me nerd out for a minute.<\/p>\n\n\n\n

    ComplyDeck is built on a RAG (Retrieval Augmented Generation)<\/strong> architecture\u2014meaning it doesn\u2019t \u201cguess\u201d answers from thin air. It retrieves relevant context from your approved knowledge first, then generates responses based on that evidence.<\/p>\n\n\n\n

    The magic happens in the matching pipeline:<\/p>\n\n\n\n

    Question comes in\n    \u2193\nSearch approved Q&A knowledge (semantic similarity)\n    \u2193\nIf match found with high confidence \u2192 Return approved answer\n    \u2193\nElse: Retrieve relevant policy\/document context\n    \u2193\nGenerate response grounded in retrieved evidence\n    \u2193\nReturn answer + sources + confidence<\/code><\/pre>\n\n\n\n
    The system tracks confidence scores, flags questions that need human review, and includes references back to the source material. It\u2019s designed to be accurate and<\/em> auditable.<\/p>\n\n\n\n
    \n\n\n\n
    Why I Built This<\/h2>\n\n\n\n
    I’ve spent years dealing with security questionnaires at various companies. The inefficiency always frustrated me:<\/p>\n\n\n\n