schema.canonical_keysCore model
Canonical answer model
Different buyer phrasings map to stable security concepts, so a reviewed answer can be reused without maintaining one library per framework.
Private alpha · seller-side security review
Security answers should come with their source.
Tyrvar turns approved answers and security evidence into a reusable Trust Profile, then drafts buyer questionnaires for your team to review and export. Less re-derivation, without pretending AI is the approver.
Sign up with Google, GitHub or Microsoft · no meeting required
By creating an account you agree to the Terms and Privacy Policy.
Want help with your first questionnaire? Reply to your welcome email and Troy will walk through it with you. A 20-minute call is optional. How the alpha works
- Product stage
- Private alpha
- Human review
- Required
- Buyer participation
- Not required
claim.provenanceillustrative flow
- 01
Buyer asks
“How is customer data encrypted at rest?”
buyer_questionnaire.xlsx
- 02
Tyrvar maps
data.encryption.at_rest
canonical fact · evidence attached
- 03
Your team approves
Answer rendered in the buyer’s wording
human review required before export
The model proposes. Evidence supports. Your team represents.
The protocol problem
A questionnaire is a query. Your security posture is the state.
Teams keep materializing every buyer's version of the same answer as a new, hand-maintained artifact. The wording changes. The underlying facts usually change much less often.
Tyrvar's approach is to maintain the facts, evidence, scope, and approval history once, then project that governed state into the questionnaire a buyer still needs today.
For a supplier that answers many buyers' questionnaires, the burden drops when each security fact is answered once from evidence and that answer is reused in every buyer's own file. The buyer keeps its format. You stop rewriting the same answer for each one.
The near-term product answers questionnaires. The long-term thesis is that the questionnaire should stop being where trust lives.
Why the work repeats
- 01
Buyer language
Each questionnaire asks in its own format and vocabulary.
- 02
Company state
Your controls, evidence, scope, owners, and approved representations.
- 03
Current workaround
Rebuild the connection in a spreadsheet, then let it go stale.
Current workflow
From evidence to a reviewed buyer response
The system does the translation work. Your team still owns scope, accuracy, and the final representation.
- 01
Build the source
Evidence inAdd approved answers and supporting material such as a SOC 2 report or security policies to a Trust Profile. Source quality determines how much the system can responsibly propose.
- 02
Normalize the facts
Reusable stateTyrvar maps source material to canonical security keys so differently phrased questions can resolve to the same governed answer.
- 03
Import the buyer’s questionnaire
Buyer formatBring in the questionnaire the buyer actually sent. The current alpha is focused on common PDF and spreadsheet-based workflows.
- 04
Review proposals and gaps
Human judgmentInspect mapped or drafted responses, confidence signals, and missing evidence. Edit or complete anything the source material cannot support.
- 05
Approve and export
You representYour team approves the rendered answers before export. The buyer gets the artifact they expect; your Trust Profile retains the reusable state behind it.
Deliberate constraint
Insufficient evidence is a useful result
A blank or escalated item is safer than a polished answer the source cannot defend. Alpha partners will help us tune where Tyrvar should propose, abstain, or ask for a human decision.
Product model
Keep the answer and the reasons to believe it together
Tyrvar is built around governed security facts, not a pile of generated prose.
answers.proposeAlpha workflow
Evidence-grounded proposals
Tyrvar uses your approved answers and uploaded evidence to propose responses, while preserving gaps when the source material is insufficient.
review.human_requiredHuman in loop
Review and confidence states
Your team can inspect, edit, approve, or escalate proposed responses before any questionnaire is treated as complete.
evidence.sourcesSource aware
Evidence workspace
Keep policies, reports, and other supporting material connected to the answer state they inform, with company-scoped access controls.
questionnaire.exportBeing validated
Buyer-format export
Return reviewed answers through the questionnaire workflow the buyer expects. Format support and fidelity are being validated during alpha.
schema → projection
One fact, many buyer phrasings
“Encryption at rest”
“Stored data protection”
“Cryptographic controls for persisted data”
↓ normalize
data.encryption.at_rest
↓ render, review, approve
Design choice
Questionnaire-centered versus fact-centered
The distinction is not “AI or no AI.” It is whether AI produces another disposable artifact or helps maintain a governed source your team can inspect.
Questionnaire-centeredTyrvar's direction
Store a finished answer for each buyer question
Tyrvar's directionStore the underlying fact, scope, evidence, and approval state
Generate a fluent response even when the source is thin
Tyrvar's directionSurface missing support and route uncertain items to review
Treat the exported spreadsheet as the system of record
Tyrvar's directionTreat the spreadsheet as a buyer-specific projection of governed state
Long-term direction, not a current credential
Trust should be portable, inspectable, and governed
Tyrvar is not an auditor, and Trust Profiles are not verified credentials today. The direction is a shared representation that carries evidence, ownership, version history, and transaction-time snapshots—so buyers can begin at judgment instead of archaeology.
The working hypothesis
Reuse should improve control, not just speed
These are the outcomes the alpha is designed to validate. They are not presented as customer results.
Security and GRC
Review exceptions, not blank spreadsheets
Start with evidence-linked proposals, then spend human attention on unsupported, ambiguous, or deal-specific questions.
Attention → gaps and judgment
Sales engineering
Keep response work in one governed loop
See which answers are reusable, which need an owner, and which still require source material before telling a buyer they are complete.
Workflow → visible ownership
Company leadership
Make repeated work improve the source
A corrected answer updates the Trust Profile behind future questionnaires instead of becoming another isolated spreadsheet cell.
Correction → reusable state
Private alpha · founder help included
Bring a real questionnaire. Get help from the founder.
Tyrvar does not have customers or case studies yet. We are looking for our first alpha users: B2B teams with a buyer security questionnaire to answer. You sign up, use Tyrvar on that questionnaire in your own account, and get direct help from Troy, the founder, along the way.
How it works
- Create an account with Google, GitHub or Microsoft.
- Upload your source documents: a SOC 2 report, security policies, or past completed questionnaires.
- Upload the questionnaire your buyer sent. Spreadsheets work best today.
- Review each drafted answer against its cited source, then export into the buyer's own file.
Founder help
- Reply to your welcome email and Troy will walk through your first questionnaire with you.
- A 20-minute call is optional. Email works just as well.
- Your documents go into your own account. You never email them to anyone.
- Straight answers about current limits, file formats, and data handling.
What Tyrvar is not
- A way to send answers without review. Every answer is a draft your team approves before it goes to a buyer.
- A certification, audit opinion, or verified trust credential.
- A guess. Where your documents do not support an answer, Tyrvar leaves the question open for your team.
Tyrvar does not train AI models on anything you upload. Not ready to sign up? Talk to the founder first with the short form below.
Latest writing
What we are learning about security questionnaires
- Buyer's guide
Whistic vs a questionnaire response tool
Which do you need as a vendor? Whistic is a risk operations platform with a Trust Center. A response tool answers the questionnaires your prospects send.
- Engineering note
Why we moved questionnaire mapping to a decision model
We tested TypeSafe’s Jev against our embedding mapper. It won on every human-judged case, and it showed that most of our confirmed labels had never been confirmed by anyone.
- Essay
Why security questionnaires shouldn’t exist
The full Tyrvar thesis: trust facts never got a shared home, AI makes the canonical layer bootstrappable, and the questionnaire itself can distribute its replacement.
FAQ
What is true at this stage
Straight answers about the product, the alpha, and what Tyrvar is not claiming.
What does Tyrvar do today?
Tyrvar is a seller-side security questionnaire workspace. You build a Trust Profile from approved answers and supporting evidence, import a buyer questionnaire, review Tyrvar's mapped or drafted responses, fill any gaps, and export the result. A person on your team remains responsible for every answer that leaves the system.
Who is the private alpha for?
B2B teams with a live buyer security questionnaire and the documents its answers come from, such as a SOC 2 report, security policies, or past completed questionnaires. You create an account, upload those documents and the questionnaire to your own workspace, and review the drafted answers. Troy, the founder, helps directly: reply to your welcome email and he will walk through the first questionnaire with you. Someone on your team approves every answer before it goes to the buyer.
Do you have customers or case studies yet?
Not yet. We are recruiting our first alpha partners, so there are no customer logos, testimonials, or adoption numbers to point to. We would rather measure the product on real questionnaires and review work before making broader performance claims.
How does the mapping work?
Tyrvar maps differently phrased buyer questions to a smaller set of canonical security facts. For example, questions about encryption of stored data can resolve to the same underlying key. The system then uses the answer and evidence attached to that key to propose questionnaire responses, with confidence and review states visible to your team.
What happens when the evidence is incomplete?
Tyrvar surfaces a gap instead of treating fluent text as proof. Thin evidence will produce more items for manual review or completion. That is intentional: the product is designed to help your team make defensible representations, not to invent a complete security posture.
Which files can I use?
The current product is built around common security evidence and questionnaire files, including PDF documents and spreadsheet-based questionnaires. Exact ingestion quality depends on the structure of the source material, which is one of the things we will evaluate with alpha partners.
Do buyers need Tyrvar?
No. Buyers do not need an account or a Tyrvar workflow. Supported output formats and fidelity are still being validated during alpha. The longer-term thesis is that governed, portable trust facts can eventually replace repeated re-derivation, but Tyrvar is not claiming that shared trust network exists today.
Is Tyrvar a compliance platform or an auditor?
No. Tyrvar does not certify your controls or replace products used to attain and monitor compliance. It uses the material your team already maintains to support questionnaire response and review. You remain responsible for the accuracy, scope, and approval of every exported answer.
How is uploaded material protected?
Tyrvar uses encryption in transit, access controls, and retention practices described in the current privacy policy. Your documents go into your own account; you do not email them to anyone. If you are unsure what to upload, ask Troy first. Tyrvar does not train AI models on uploaded content. No system is perfectly secure.
What happens after I send the alpha form?
Troy replies by email to answer your questions and hear how your team handles questionnaires today. A meeting is optional, not a prerequisite. When you are ready, you create an account and work in your own workspace, and Troy can walk through the first questionnaire with you.
Private alpha · talk to the founder
Bring one real questionnaire.
The quickest start is an account of your own. If you would rather talk first, send the short form and Troy will reply by email. A calendar is optional.
- 01Send a work email, company, and role. Context is optional.
- 02Troy replies directly by email to answer your questions about Tyrvar and the alpha.
- 03When you are ready, you create an account and work in it yourself. Troy can walk through the first questionnaire with you.
Ready to start now? Create an account and reply to your welcome email if you want help. Questions first? Email [email protected] or read the response workflow guide.
Talk to the founder first
Required fields are marked with an asterisk.