The client questionnaire is due Friday. threep turns scattered policies, procedures, and artifacts into a reviewed record of what your company can prove, what it must qualify, and what happens next.
Built for 25–500-person B2B SaaS companies facing enterprise, government, or regulated-market requirements before they have a mature compliance organization.
The policy requires a Post-Incident Report within five business days, including root cause analysis and corrective actions with owners and due dates.
Not a confidence score. A reviewed boundary between what the evidence supports, what it narrows, and what still requires a human decision.
Customers affected by a data breach must be notified within 72 hours of confirmed breach determination. The cited evidence supports a short answer ready for review.
The Post-Incident Report requirement is supported. Evidence that procedures are updated from its findings is not.
Available evidence does not establish whether Meridian Software can export or forward product event logs to a customer-managed SIEM such as Splunk.
The available policy evidence does not address this requirement; it requires manual review before it can be answered.
When a questionnaire lands, threep turns the reviewed record into cited answers your team can approve without inventing what the evidence cannot support.
GAP and NONE are not the same operating problem. The verifier records the distinction instead of inventing certainty.
The reviewer decides whether evidence exists elsewhere, must still be created, or requires a safe revision or manual judgment.
Illustrative product view using fictional assessment data.
One pass turns a live requirement into answers your team can defend — and a record that stays useful afterwards.
A questionnaire, RFP, or control ask lands with a real deadline.
Policies, procedures, and artifacts already in your workspace.
Supported, qualified, or unsupported — STRONG, PARTIAL, GAP, or NONE.
Reviewer decisions are recorded against each answer.
The missing or stale evidence, the owner, and the next defensible action.
Reassess as evidence changes, and reuse the record on the next request.
threep is bounded on purpose. If a control needs human judgment, it stays with a human.
If a policy, procedure, or artifact is missing, threep flags the gap instead of pretending it exists.
A written policy is not the same thing as an implemented control. threep helps separate documented coverage from operational proof.
Scope, exceptions, risk acceptance, and official approvals stay with people.
Assessment answers and exports are reviewed and sent by a human.
threep does not certify compliance, audit your program, scan live infrastructure, or provide legal interpretation.
Inside that profile, four roles usually carry the work.
Get from scattered documents to a defensible readiness picture without standing up a compliance department.
See which controls are STRONG, PARTIAL, GAP, or NONE, and exactly what each answer rests on.
Track what each control needs, route gaps to the right owner, and keep the record current.
Per-client workspaces keep each engagement's evidence, gaps, and assessments separate, so one client's posture never bleeds into another's.
Early-access terms are scoped with each team.
Early access · for teams that need to know where they stand.
Early access · for teams keeping the record current.
Contact us · for teams that need private hosting or stricter data boundaries.
threepapp.threep.ai.
threep began when a compliance problem landed on my desk without a compliance team attached to it.
At a small, regulated SaaS company, I helped pull together policies, procedures, and evidence under real pressure — the kind of deadline where the work simply has to get done, and it lands on whoever is closest to it.
Getting the documentation in place felt like progress. Then the first questionnaire arrived, and the gap became obvious. I had the policies. What I did not have was a fast, reliable way to prove which policy, artifact, or evidence item actually satisfied the control in front of me.
I did not need another policy template. I needed to know whether the evidence we already had satisfied the control.
That is why threep exists.
No. threep drafts what your evidence supports and flags everything else. A reviewer signs off on each answer before it is exported, and threep never submits on your behalf.
ChatGPT can draft an answer from what you paste into a conversation. threep keeps the proposed claim, supporting evidence, claim state, source, human decision, gap, owner, and next action together—so the answer can be defended, reviewed, and reused.
The question is left unanswered, marked NONE, and routed to an owner. threep does not invent a plausible answer — that is the whole point.
Inside your own tenant in the hosted workspace. Teams that need dedicated infrastructure, custom retention, or private model routing can scope a private deployment.
No. threep is the record of what you can prove and what you cannot yet claim. It pairs with whatever you use to track controls and policies.
It benchmarks your evidence against the control, not a single standard. Teams bring TX-RAMP, SOC 2, HIPAA, NIST, ISO 27001, and client security assessments.
Someone on your team — usually the security owner, the founder, or a vCISO. The reviewer is logged per answer and shows up in the audit trail.
Hands-on onboarding, a single point of contact, and pricing that reflects you being early.
Run a readiness assessment, see the gaps and who owns them, and keep the reviewed record for the next request.