The security questionnaire arrives at an awkward moment. A buyer has liked the product, discussed the price and perhaps imagined how it will work. Then someone sends a spreadsheet with 200 questions about encryption, subcontractors, incident response and data retention. The salesperson cannot answer them. The security team can, but it has answered a large fraction of them before. Somewhere in that chain, a promising deal acquires a new hobby: waiting.
- Conveyor gives vendors a Trust Center where buyers can find documents, clear access gates and ask security questions.
- Its AI drafts cited answers for questionnaires and RFPs, then routes uncertain work to people.
- Zapier reports 75% less time spent on questionnaires and three times the response capacity after adoption.
This is the delay Conveyor wants to sell its way out of. The San Francisco company, founded in 2021 by Chas Ballew, makes software for the peculiar job of proving that one company can safely buy from another. Its customers are the teams on the selling side: security, governance, risk and compliance, presales and proposals. Their audience is the buyer who needs evidence before signing a contract.
The room that became a company
Ballew had watched the problem from inside Aptible, where he was CEO. Aptible had built a document room called “Rooms” to share trust material. Conveyor spun out of that experiment in 2021 and took its first customers along. The original idea was practical: put the SOC 2 report, policies and other sensitive evidence somewhere a prospect could reach it without another round of emails.
A room, though, does not read the questionnaire. The buyer still has its own questions, formats and approval habits. Conveyor’s answer grew from a Trust Center into an AI-assisted workflow: locate the approved fact, draft a response, show where it came from and return the finished document. The company added large language models to questionnaires in 2023, raised a $12.5 million Series A led by Cervin Ventures in 2024, then raised a $20 million Series B led by SignalFire in June 2025. Its later products also tackle requests for proposals, or RFPs.
A PDF folder with a pulse
Conveyor’s Trust Center is the public-facing door. Vendors can publish certifications, policies, penetration test summaries and common answers. They can ask visitors to authenticate, sign an NDA or request access to particular documents. A buyer can search by topic and, when the seller enables it, ask a built-in agent a question or upload a whole questionnaire. The answer is linked back to material the seller has approved.
The distinction is small until it is repeated a thousand times. A static document page may tell a buyer that the answer exists. Conveyor tries to deliver the answer in the buyer’s preferred form. Internally, its questionnaire agent handles spreadsheets, Word documents, PDFs and web portals; its RFP tool drafts longer proposal responses from the same pool of evidence, adjusted for the deal’s brief and themes. The Trust Center, answer library, access rules and analytics occupy one system.
What changed at Zapier
Zapier makes an especially telling customer because it sells automation to others. Its own move toward larger enterprise buyers brought more requests for detailed security evidence. Its old arrangement included a PDF folder and questions that landed on security colleagues. Annie Stankiewicz, Zapier’s GRC program manager, tested Conveyor alongside another option. Conveyor’s automation and integrations fit the workflow; the quality of support during the trial helped settle the choice.
Within 30 days of kickoff, Zapier had launched its public Trust Center. More than 100 document views appeared in the first week. Its solutions architects could upload customer requests, let Conveyor prepare initial answers and bring the GRC team into Slack only when review was needed. Zapier says security documents have since been downloaded more than 5,000 times from the center. Its knowledge library was linked to hundreds of source items and thousands of past answers, giving the AI something firmer than an empty prompt.
The outcome Zapier reports is sharp: the share of questions needing a security team member fell from 90% to 20%; questionnaire time dropped 75%; capacity tripled without a corresponding increase in security headcount. Those are different measures, and together they say more than the familiar promise that AI writes fast. They say fewer questions reached the specialist at all.
The useful part of the agent story
Conveyor has given its agents human names: Sue for security reviews and Phil for RFPs. The names are lighthearted; the constraints are not. Security answers need to be exact, current and defensible. Proposal writing needs the same facts, but also room for context and persuasion. Conveyor’s bet is that both jobs can draw from one maintained evidence base while being written differently.
It has also pushed the Trust Center toward a stranger visitor: the buyer’s AI agent. In 2026, Conveyor introduced a visitor connector using the Model Context Protocol. The agent authenticates as the person behind it, then sees the documents that person is allowed to see. NDA gates and permissions still apply, and its activity enters the audit trail. Without that identity step, an agent that reaches a login screen is simply a fast machine waiting politely outside.
This is also where Conveyor sits in a crowded market. Compliance platforms help companies collect proof that they meet controls. Trust centers package that proof for buyers. Questionnaire and RFP tools help fill in the forms that follow. Conveyor spans the buyer-facing portal and the seller’s response desk. That breadth is useful when a security answer is needed in a document, a portal and a live buyer conversation, all on the same afternoon.
Copy the sequence, not the slogan
There is a workable lesson here for any vendor that repeatedly answers the same due-diligence questions. It is less glamorous than “deploy an agent.” Start by making the evidence usable. Then count which requests still require a specialist. The AI is only as helpful as the materials, permissions and escalation rules around it.
- Publish the common evidence. Put current policies, certifications and standard answers where buyers can find them under appropriate access rules.
- Connect the sources. Let answer drafting draw from approved documents and past responses, with citations a reviewer can check.
- Route the exceptions. Ask people to inspect ambiguous, unsupported or especially sensitive questions rather than making them retype every routine answer.
- Measure the queue. Track document requests, questionnaires, time to return and the share that still needs a security teammate.
The method depends on a company having reliable source material and the willingness to keep it current. A disputed policy cannot become trustworthy by appearing in a polished AI sentence. Unusual buyer requirements still call for judgment. Conveyor’s free Trust Center tier lowers the cost of starting; the broader Enterprise plan is priced through sales, with usage volume affecting the bill. The public price of that plan is undisclosed.
Conveyor’s stated ambition is instant trust between companies. “Instant” may be too grand a word for a careful risk review, but there is something persuasive in the smaller result. Zapier did not eliminate security expertise. It made that expertise show up where it was needed - on the questions the software could not settle, rather than on the ones the company had answered last Tuesday.