EU-hosted • Frankfurt data region • Mistral AI (EU)
Send back security questionnaires with cited answers your team approved.
Draft security questionnaires from sources you approved. If a source is missing, the row is flagged as GAP, not filled with a guess.
Import the buyer's Excel, draft from your approved knowledge base, and export in the same file. Your team reviews before anything is sent.
Card required. The first month is billed at checkout and the plan renews monthly. Cancel in billing before the next renewal.
Open a knowledge pack. Run the cited engine.
Havskrona Group is fictional. Nothing is saved.
Havskrona Group
Sample
Knowledge pack
Havskrona-Group-komplett-kunskapsbas.pdf
Policy
Access control policy
All administrative and privileged access to production systems requires multi-factor authentication.
Fact
Production hosting
Production systems for Havskrona Group run in the EU, in Stockholm and Frankfurt.
Document note
ISO 27001 certificate
Havskrona Group holds ISO/IEC 27001 certification. This sample does not state a penetration-test date.
Security and how we handle your data
Short answers for vendor reviews. Questionnaire content is stored in Frankfurt on Vercel and Neon, and drafted by Mistral AI in the EU. Provider certifications, encryption, the DPA, and the sub-processor list are on Security and in the Privacy Policy.
CISO Summary
| Question | Answer |
|---|---|
| Where is my data hosted? | In the EU: storage in Frankfurt (Vercel, Neon on AWS), AI drafting by Mistral AI in the EU. Vercel and Neon are US companies; see the sub-processor list. |
| Is AI trained on our data? | Qlara does not train models on your data. The data processing agreement is published at /dpa. |
| Are our source files stored permanently? | No. Policy documents are kept only as extracted text, and buyer Excel files are kept so answers can be written back. You can delete them at any time, and all workspace content is deleted 30 days after the account closes. |
| Do we get our original Excel back? | Yes. XLSX export into the original file is included in both plans. |
Cited drafts, or a GAP
Drafts are built from sources in your knowledge base and cite them. If there is no source for a question, the row is flagged as GAP instead of a guess. Answers that claim a certification your sources do not support are flagged for review.
Customer data is not used to train AI models
Qlara does not train AI models on your knowledge base, questionnaires, or answers. Our data processing agreement is published at /dpa.
EU-hosted
The app and database run in Frankfurt (Vercel, Neon on AWS), and drafts are generated by Mistral AI in the EU. Vercel and Neon are US companies; transfers are covered by their data processing agreements.
Your files, your formatting
XLSX export into the buyer's original file is included in both plans. Workspace content is deleted within 30 days of account closure, per our Privacy Policy and Terms.
Data isolation
Knowledge bases, questionnaires, and drafts are stored per organization. Other customers cannot see your workspace.
What Qlara does
01
Cited drafts, or a GAP
Qlara drafts ISO 27001, SOC 2, and vendor risk assessments from sources in your knowledge base. Missing evidence is flagged as GAP, and certification claims without a source are flagged for review.
02
Keep the buyer's Excel formatting, with citations on every row
Import the XLSX you just received, keep columns and formatting, and return completed answers in the same file. Every row can carry a source citation.
03
EU hosting without US model APIs
Storage in Frankfurt and AI drafting by Mistral AI in the EU. No OpenAI or Anthropic. Sub-processors and transfer safeguards are listed on the Security page.
Plans and question packs
8
standard packs: CAIQ, GDPR, ISO 27001, SE public sector, VSA, SOC 2, DORA, NIS2
€99
Qlara Start, up to 2 questionnaires a month
€249
Qlara Growth, unlimited questionnaires
Not a chatbot. Automated vendor risk assessments from sources you approved.
01
Load the knowledge base for ISO 27001 & SOC 2
Policies, controls, subprocessors, and hosting. Approved by a human. That is the only material the engine may cite.
02
Drop in the vendor risk assessment
CAIQ-lite, GDPR Art. 28, ISO 27001, Swedish public sector, VSA-Core, SOC 2, DORA, NIS2, or paste or upload the Excel the buyer just sent.
03
Review cited drafts with source excerpts
Every row shows the source excerpt, or is flagged as GAP if a source is missing. Qlara does not fill that row with a guess. Approve, edit, or skip. A strong answer can be saved back to the knowledge base.
For the questionnaires you actually get: ISO 27001, SOC 2, GDPR, VSA, DORA, NIS2, and more.
EN
CAIQ-lite
Cloud security controls most enterprise buyers start with.
15 questions
EN
GDPR Art. 28 processor pack
Processor obligations enterprises and public buyers ask for under GDPR.
12 questions
EN
ISO 27001 control interview
High-frequency ISO 27001 questions from security reviews.
13 questions
SV
Swedish public sector: information security
Questions aligned with MSB guidance for secure procurement.
12 questions
EN
VSA-Core
Core vendor security assessment questions most enterprise buyers start with.
16 questions
EN
SOC 2 Security & Availability
Security and availability criteria from SOC 2 Type II reviews.
18 questions
EN
DORA ICT Third-Party Risk
ICT third-party risk questions for financial entities under DORA.
14 questions
EN
NIS2 Supplier Security
Supplier security obligations under the NIS2 Directive.
13 questions
Priced for questionnaire work, not a full GRC platform
Start
€99 / mo
For the first enterprise vendor review.
- 1 knowledge base
- Up to 2 questionnaires / month
- Cited answers + human review
- Full XLSX export with preserved formatting
- CSV export
- Standard packs (CAIQ, GDPR, ISO 27001, SE, VSA, SOC 2, DORA, NIS2)
- 250 AI calls / month
Card required. The first month is billed at checkout and the plan renews monthly. Cancel in billing before the next renewal.
Growth
€249 / mo
Default for SaaS, FinTech, HealthTech, and consultancies.
- Everything in Start
- Unlimited questionnaires
- Full XLSX export with preserved formatting
- Standard packs (CAIQ, GDPR, ISO 27001, SE, VSA, SOC 2, DORA, NIS2)
- 2000 AI calls / month
Card required. The first month is billed at checkout and the plan renews monthly. Cancel in billing before the next renewal.
Compare plans, AI calls, and renewal terms
Prefer to talk before a card goes on file? Talk to us first.
Questions about vendor risk assessments and security questionnaire automation
Does Qlara invent ISO 27001 or SOC 2 certifications?
It is built not to. The engine drafts only from your knowledge base, flags rows with no source as GAP, and flags any certification claim the cited sources do not support. AI can still make mistakes, so your team reviews every answer before it is sent.
What happens if the knowledge base has no source for a question?
The row is flagged as GAP instead of a guess. Qlara does not fill in an answer when evidence is missing. Your team reviews cited drafts before anything is sent.
Is Qlara legal advice, an audit, or a certification?
No. Qlara is decision support for automated vendor risk assessments and security questionnaires. It is not legal advice, not an auditor, and not an ISO 27001 or SOC 2 certification. Your team owns every published answer.
Can we answer GDPR, NIS2, and DORA vendor assessments?
Yes. Load policies, controls, and hosting facts into the knowledge base. Qlara drafts cited answers for GDPR, NIS2, DORA, ISO 27001, and SOC 2. If a source is missing, the row is flagged as GAP instead of a guess. You review before export to the buyer's Excel.
Does export keep the buyer's Excel formatting with citations?
Yes. XLSX export into the buyer's original file is included in both plans, including Start. Return answers in the buyer's file. Every approved answer can cite the knowledge base.
How does checkout work?
Checkout bills the first month today, and the plan renews monthly until you cancel. Growth is EUR 249 per month and Start is EUR 99 per month. A started month is not refunded; after you cancel, the paid month runs to its end.
Who is Qlara built for?
B2B SaaS, FinTech, HealthTech, and IT consultancies. Inside those companies the buyers are CTOs, CISOs, founders, and revenue teams who sell to enterprise or public-sector accounts and get recurring security questionnaires.
Is our data used to train AI models?
No. Qlara does not use your knowledge base, questionnaires, or answers to train AI models. Drafts are generated by Mistral AI in the EU. We do not use OpenAI or Anthropic. The data processing agreement is published at /dpa.
What happens to our data if we cancel?
After you cancel, customer content is deleted or anonymized within 30 days, unless a longer period is required for legal claims or bookkeeping. Invoice records are kept for as long as Swedish accounting law requires, typically seven years. Download your data from Settings while the account is still open.
Where does our data live?
In the EU. Storage on Vercel and Neon in Frankfurt, AI processing by Mistral AI in the EU. Vercel and Neon are US companies, so their data processing agreements use EU Standard Contractual Clauses or the EU-US Data Privacy Framework for any access from outside the EU. The sub-processor list is on the Security page and in the DPA.
Who at Qlara can access our knowledge base?
Nobody has a built-in way to browse customer knowledge bases inside the product. The only theoretical access is the founder logging into the database directly (Neon) with infrastructure-level admin credentials, and that only happens if a customer reports an issue and asks for help. This is not routine.
Is Qlara itself SOC 2 or ISO 27001 compliant?
No. Qlara itself holds no SOC 2 report or ISO 27001 certificate. Our hosting, database, and AI providers publish their own reports for their services. Encryption, the DPA, and the sub-processor list are on the Security page.