Feature · Audits · Written by Yobel Tzegai · Last checked 22 October 2026

Can we answer a customer's whole security review, not only its AI questions?

In Complipath (complipath.io), an audit reads the questions in a customer's security review, as Excel, Word or PDF. A question on one of 17 security topics that nothing in your workspace answers yet is marked Needs your answer and names the file that would answer it, such as the latest penetration test report. A person confirms every answer.

Check your AI systems, free

What it does today, and its limits

In an audit made from a customer's file, a question on one of 17 security topics that nothing in the workspace answers yet is marked Needs your answer and names the file that would answer it, or one of your own files with a matching name; answers come only from what the workspace holds, and a person confirms every answer.

Illustration · not your dataQuestion 31 Do you run penetration tests, and how often?Status Needs your answerIt names Your file “Pentest_2026_Q2.pdf” may answer this.

What it does

Reads the questions in their file, PDF, Word or Excel up to 4 MB, and shows what it found before anything is saved. Rows it could not read as a question are listed, and you can add any of them.
Answers what your workspace already holds: an earlier audit's confirmed answer, your data answers, your register and your files. Each answer shows where it came from.
Knows 17 security topics, such as encryption, backups, penetration tests and incident response. An open question on one of them, one nothing else answers yet, names the file that would answer it.
If a file of yours has a matching name, it names that file instead: Your file “Incident response plan 2026.pdf” may answer this.
Writes the confirmed answers into their own Excel or Word file, in their layout, from the copy kept with the audit. A PDF comes back as a Word file.

What a person confirms

Every answer. Answers taken from an earlier audit or your data answers are confirmed together. Anything drafted from your register, your files or by AI is checked and confirmed one at a time.
Only confirmed answers reach their file. The others read Not answered yet.
A question nothing answers is never guessed. It stays Needs your answer, and counts as a gap until a person answers it or a source does.

What it does not do

Naming a file is not reading it. A drafted answer stands on your statements, your register and passages of your system files that are linked to a requirement. A company file kept with no system is not read for an audit answer.
A topic outside the 17 names no file. A question is found by its shape, a question mark, a question word or a request verb, so an unusual phrasing can be missed. Check the list it shows.
It does not claim a certification. A drafted sentence that says you hold ISO 27001, ISO 27701, ISO 42001, SOC 1 or SOC 2 is removed unless a source it cites names one of them.

Which plan

Starter and the trial. On Free the page says Audits are part of Starter and offers Starter. In the app, Audits is a Growth feature, included in Starter until Growth launches. Growth is not available yet, so Starter is the plan to buy.

Who sees what

Their file is read by code on our server. Only when AI drafting is on does one question go to Anthropic, with its sources, to be drafted. The full list is on the subprocessors page. With the AI switch off, nothing is drafted and you write each answer.

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Does it answer every security question by itself?

No. It answers from what your workspace holds and marks the rest Needs your answer. For 17 topics it also names the file that would answer the question. A person confirms every answer before it counts, and only confirmed answers are written into the customer's file.

Which security topics does it recognise?

Seventeen: certifications, penetration testing, vulnerability management, multi-factor authentication, access control, encryption, backups, business continuity, incident response, logging and monitoring, data retention, subprocessors, security awareness, secure development, vendor risk, physical security and security policy. Any other topic gets no file named.

Will it say we are ISO 27001 or SOC 2 certified?

No. A drafted sentence that claims ISO 27001, ISO 27701, ISO 42001, SOC 1 or SOC 2 is removed unless a source it cites names one of those standards. The sources are your own: files, statements and register. Complipath holds no certificate of yours and invents none.

Which plan includes it?

Starter, at €499 a month, and the trial. Prices exclude VAT. In the app, Audits is a Growth feature, included in Starter until Growth launches: Growth is not available yet, so Starter is the plan to buy. Free does not include it.