User guide

Policies (Information Security, BCP, GDPR, Acceptable Use), certificates (ISO 27001, SOC 2, PCI), audit reports, sub-processor lists, code-of-conduct documents — anything you'd cite in a buyer questionnaire. Up to 25 MB per file, 200 files at once.

When you upload a newer version of a document, Demetra detects the collision (same document type + cert standard) and marks the older copy as superseded. Superseded documents are excluded from future drafts but kept in the audit log.

Documents with a validity window (e.g. ISO 27001 certs valid 3 years) show an expiry warning when within 90 days of running out. The dashboard surfaces the next-to-expire on every load.

Excel (xlsx with formulas, dropdowns, x14 extensions, sheet protection), Word (docx incl. AcroForm fields), native PDF, scanned PDF (OCR), or pasted text from a portal. Multi-tab Excel and merged cells are handled.

Demetra ships with templates for CLUSIT QSF v2.2, SIG Lite, SIG Full, EcoVadis, CAIQ v4, CDP, NIST CSF, NIS2-DSS, and DORA-ICT-RM. Untagged questionnaires are processed as 'Custom'.

Left: questions list with confidence pills + green tick once approved. Middle: the AI draft with inline [n] citation chips. Right: the per-format source preview — PDF page snippet, Excel cell with row & column headers, Word paragraph, image with bbox overlay.

High (>85%) draft is usually approve-as-is. Medium (70–85%) deserves a quick read. Low (<70%) usually means a missing or weak source — the right move is to upload more evidence or ask a teammate.

From the Gap Report tab (or directly on a low-confidence answer), click Request. A single-use email link is sent to your teammate / legal counsel / DPO. They land on a no-auth page, drop a file or type the answer in 1500 characters or fewer, and they're done.

If your colleague answers in text rather than uploading a file, the response is stored as a 'text attestation' with their name, email, and date. Citations show 'Written attestation by …' with a 180-day freshness window. Past that, the answer-drafter excludes it and prompts for a re-affirmation.

When the upload arrives, Demetra automatically re-runs only the originating question — usually within 30 seconds for files, 5–10 seconds for attestations. The answer transitions from 'no source' to 'draft' if the new content lifts confidence above the threshold.

Every time you approve an answer, it's embedded and saved. The next time a similar question comes in (cosine similarity ≤ 0.25), the matching memory entry is pre-filled before the AI even drafts. Frees you from re-answering the same NIS2 / GDPR / encryption-at-rest questions every quarter.

Use 'Save to Answer Memory' from Ask Demetra to add knowledge-base answers that aren't tied to a specific questionnaire — useful for seeding your memory layer outside of a buyer cycle.

Quick lookups outside an active questionnaire — e.g., 'When does our PCI cert expire?', 'What's our BCP RTO?', 'Who's on our sub-processor list?'. Same retrieval pipeline as the answer-drafter, with citations to the underlying chunks.

Ask Demetra answers don't auto-write into questionnaires. If a saved answer would be useful elsewhere, click 'Save to Answer Memory' — it'll be pulled in next time a matching question comes through ingestion.

For Excel and Word, the buyer's original file is repackaged byte-for-byte except for the answer cells / runs. Formulas, dropdowns, sheet protection, conditional formatting, and pivot caches are untouched.

Used when you need to convert formats (Excel in → Word out) or when the original template is too damaged to round-trip cleanly. Demetra builds a clean filled report from scratch with title page + per-section table + manual-required appendix.

Before exporting, Demetra shows you exactly how many answers are approved vs. flagged. You can still export with un-approved drafts — they're flagged in the file with a marker so the buyer (and you) can see what's pending.