schema.canonical_keysCore model
Canonical answer model
Different buyer phrasings map to stable security concepts, so a reviewed answer can be reused without maintaining one library per framework.
Private alpha · seller-side security review
Security answers should come with their source.
Tyrvar turns approved answers and security evidence into a reusable Trust Profile, then drafts buyer questionnaires for your team to review and export. Less re-derivation, without pretending AI is the approver.
One-minute form · no meeting required · reply from the founder
- Product stage
- Private alpha
- Human review
- Required
- Buyer participation
- Not required
claim.provenanceillustrative flow
- 01
Buyer asks
“How is customer data encrypted at rest?”
buyer_questionnaire.xlsx
- 02
Tyrvar maps
data.encryption.at_rest
canonical fact · evidence attached
- 03
Your team approves
Answer rendered in the buyer’s wording
human review required before export
The model proposes. Evidence supports. Your team represents.
The protocol problem
A questionnaire is a query. Your security posture is the state.
Teams keep materializing every buyer's version of the same answer as a new, hand-maintained artifact. The wording changes. The underlying facts usually change much less often.
Tyrvar's approach is to maintain the facts, evidence, scope, and approval history once, then project that governed state into the questionnaire a buyer still needs today.
The near-term product answers questionnaires. The long-term thesis is that the questionnaire should stop being where trust lives.
Why the work repeats
- 01
Buyer language
Each questionnaire asks in its own format and vocabulary.
- 02
Company state
Your controls, evidence, scope, owners, and approved representations.
- 03
Current workaround
Rebuild the connection in a spreadsheet, then let it go stale.
Current workflow
From evidence to a reviewed buyer response
The system does the translation work. Your team still owns scope, accuracy, and the final representation.
- 01
Build the source
Evidence inAdd approved answers and supporting material such as a SOC 2 report or security policies to a Trust Profile. Source quality determines how much the system can responsibly propose.
- 02
Normalize the facts
Reusable stateTyrvar maps source material to canonical security keys so differently phrased questions can resolve to the same governed answer.
- 03
Import the buyer’s questionnaire
Buyer formatBring in the questionnaire the buyer actually sent. The current alpha is focused on common PDF and spreadsheet-based workflows.
- 04
Review proposals and gaps
Human judgmentInspect mapped or drafted responses, confidence signals, and missing evidence. Edit or complete anything the source material cannot support.
- 05
Approve and export
You representYour team approves the rendered answers before export. The buyer gets the artifact they expect; your Trust Profile retains the reusable state behind it.
Deliberate constraint
Insufficient evidence is a useful result
A blank or escalated item is safer than a polished answer the source cannot defend. Alpha partners will help us tune where Tyrvar should propose, abstain, or ask for a human decision.
Product model
Keep the answer and the reasons to believe it together
Tyrvar is built around governed security facts, not a pile of generated prose.
answers.proposeAlpha workflow
Evidence-grounded proposals
Tyrvar uses your approved answers and uploaded evidence to propose responses, while preserving gaps when the source material is insufficient.
review.human_requiredHuman in loop
Review and confidence states
Your team can inspect, edit, approve, or escalate proposed responses before any questionnaire is treated as complete.
evidence.sourcesSource aware
Evidence workspace
Keep policies, reports, and other supporting material connected to the answer state they inform, with company-scoped access controls.
questionnaire.exportBeing validated
Buyer-format export
Return reviewed answers through the questionnaire workflow the buyer expects. Format support and fidelity are being validated during alpha.
schema → projection
One fact, many buyer phrasings
“Encryption at rest”
“Stored data protection”
“Cryptographic controls for persisted data”
↓ normalize
data.encryption.at_rest
↓ render, review, approve
Design choice
Questionnaire-centered versus fact-centered
The distinction is not “AI or no AI.” It is whether AI produces another disposable artifact or helps maintain a governed source your team can inspect.
Questionnaire-centeredTyrvar's direction
Store a finished answer for each buyer question
Tyrvar's directionStore the underlying fact, scope, evidence, and approval state
Generate a fluent response even when the source is thin
Tyrvar's directionSurface missing support and route uncertain items to review
Treat the exported spreadsheet as the system of record
Tyrvar's directionTreat the spreadsheet as a buyer-specific projection of governed state
Long-term direction, not a current credential
Trust should be portable, inspectable, and governed
Tyrvar is not an auditor, and Trust Profiles are not verified credentials today. The direction is a shared representation that carries evidence, ownership, version history, and transaction-time snapshots—so buyers can begin at judgment instead of archaeology.
The working hypothesis
Reuse should improve control, not just speed
These are the outcomes the alpha is designed to validate. They are not presented as customer results.
Security and GRC
Review exceptions, not blank spreadsheets
Start with evidence-linked proposals, then spend human attention on unsupported, ambiguous, or deal-specific questions.
Attention → gaps and judgment
Sales engineering
Keep response work in one governed loop
See which answers are reusable, which need an owner, and which still require source material before telling a buyer they are complete.
Workflow → visible ownership
Company leadership
Make repeated work improve the source
A corrected answer updates the Trust Profile behind future questionnaires instead of becoming another isolated spreadsheet cell.
Correction → reusable state
Recruiting our first alpha partners
This alpha is a working relationship
Tyrvar does not have customers or case studies yet. We are looking for a small number of teams willing to test the product on real work, stay involved, and help separate a useful system from a convincing demo.
A strong fit looks like
- Your B2B team has an active buyer security questionnaire to work through.
- You can bring representative source material, such as policies or an audit report.
- A security, GRC, or technical owner can review the proposed answers.
- You are willing to share specific feedback after real workflows, including what breaks.
What Tyrvar commits to
- Founder-led onboarding and a direct support channel.
- Hands-on help with the first evidence set and questionnaire.
- Clear disclosure of current limits, rough edges, and data-handling expectations.
- A tight feedback loop in which useful findings can influence near-term priorities.
What the alpha is not
- — A buy-and-ignore tool that runs without a responsible reviewer
- — A certification, audit opinion, or verified trust credential
- — A promise that every file or question will map cleanly during alpha
Latest writing
What we are learning about security questionnaires
- Engineering note
Why we moved questionnaire mapping to a decision model
We tested TypeSafe’s Jev against our embedding mapper. It won on every human-judged case, and it showed that most of our confirmed labels had never been confirmed by anyone.
- Essay
Why security questionnaires shouldn’t exist
The full Tyrvar thesis: trust facts never got a shared home, AI makes the canonical layer bootstrappable, and the questionnaire itself can distribute its replacement.
- Working thesis
Trust should be a shared fact
Why repeated questionnaires are a state-management problem, what a reusable trust fact requires, and where automation fits.
FAQ
What is true at this stage
Straight answers about the product, the alpha, and what Tyrvar is not claiming.
What does Tyrvar do today?
Tyrvar is a seller-side security questionnaire workspace. You build a Trust Profile from approved answers and supporting evidence, import a buyer questionnaire, review Tyrvar's mapped or drafted responses, fill any gaps, and export the result. A person on your team remains responsible for every answer that leaves the system.
Who is the private alpha for?
We are looking for B2B teams with active security questionnaires, usable source material such as a SOC 2 report or security policies, and someone who can work through early workflows with us. The alpha is collaborative: expect founder-led onboarding, rough edges, and short feedback conversations after real questionnaire runs.
Do you have customers or case studies yet?
Not yet. We are recruiting our first alpha partners, so there are no customer logos, testimonials, or adoption numbers to point to. The purpose of this alpha is to test the product against real evidence, questionnaires, and review workflows before making broader performance claims.
How does the mapping work?
Tyrvar maps differently phrased buyer questions to a smaller set of canonical security facts. For example, questions about encryption of stored data can resolve to the same underlying key. The system then uses the answer and evidence attached to that key to propose questionnaire responses, with confidence and review states visible to your team.
What happens when the evidence is incomplete?
Tyrvar surfaces a gap instead of treating fluent text as proof. Thin evidence will produce more items for manual review or completion. That is intentional: the product is designed to help your team make defensible representations, not to invent a complete security posture.
Which files can I use?
The current product is built around common security evidence and questionnaire files, including PDF documents and spreadsheet-based questionnaires. Exact ingestion quality depends on the structure of the source material, which is one of the things we will evaluate with alpha partners.
Do buyers need Tyrvar?
No. Buyers do not need an account or a Tyrvar workflow. Supported output formats and fidelity are still being validated during alpha. The longer-term thesis is that governed, portable trust facts can eventually replace repeated re-derivation, but Tyrvar is not claiming that shared trust network exists today.
Is Tyrvar a compliance platform or an auditor?
No. Tyrvar does not certify your controls or replace products used to attain and monitor compliance. It uses the material your team already maintains to support questionnaire response and review. You remain responsible for the accuracy, scope, and approval of every exported answer.
How is uploaded material protected?
Tyrvar uses encryption in transit, access controls, and retention practices described in the current privacy policy. Alpha onboarding will cover what to upload, what not to upload, and the current operating limits before your team shares production material. No system is perfectly secure.
What happens after I send the alpha form?
Troy will reply by email to understand your current workflow and whether the alpha is a mutual fit. A meeting is optional, not a prerequisite to express interest. If the fit is clear, we will agree on a first evidence set, questionnaire, onboarding plan, and feedback cadence together.
Private alpha application
Bring one real questionnaire.
We are recruiting the first teams willing to work through the imperfect version with us. The form is the primary path; a calendar is optional.
- 01Send a work email, company, and role. Context is optional.
- 02Troy replies directly by email to check mutual fit.
- 03If it fits, we agree on one evidence set and one real questionnaire to start.
Not ready to apply? Email a question to [email protected] or read the response workflow guide.
Check mutual fit
Required fields are marked with an asterisk.