[Showcase] AegisVault: SOC 2 & ISO 27001 Security Questionnaire Automation Engine (Gemini AI + n8n)

Built with n8n
, , ,
1

Hey n8n community! :waving_hand:

We just released AegisVault, an automated workflow architecture designed to solve a major engineering pain point: manually answering 100+ question B2B vendor security questionnaires (SOC 2 Type II, ISO 27001, GDPR, NIST).

Instead of copy-pasting spreadsheet answers for hours, this engine ingests multi-format vendor spreadsheets (Excel, CSV, Google Sheets), evaluates them against internal security policy documents, and outputs verbatim-cited responses in under 3 minutes.

:television: 4-Minute Architecture Walkthrough: [https://youtu.be/TdxeVKP5SIQ\]
:link: GitHub Repository & Free Community JSON: [https://github.com/theworkflowatelier/AegisVault-Enterprise-Security-Questionnaire-Engine\]

:high_voltage: How It Works & System Topology

The workflow operates across 5 asynchronous processing zones:

  1. Ground Truth Memory: Ingests policy documents (PDF, DOCX, TXT) into ephemeral memory.
  2. Multi-Format Parser: Normalizes Excel, CSV, and Google Sheets into structured JSON arrays.
  3. AI Evaluation Core: Throttles data into micro-batches using Google Gemini 1.5 Pro / 2.0 Flash via structured output parsers.
  4. Confidence Gate: Evaluates citation accuracy. If a citation is missing, it tags the row as Knowledge_Match: "Missing".
  5. Storage & Audit: Appends verified answers to a master sheet while routing low-confidence items to a Human-In-The-Loop (HITL) review queue.

:balance_scale: Dual Deployment Model

  • Community Lite Edition (Free): We pushed an 8-node stripped-down version (AegisVault_Community_Lite.json) directly to our GitHub repo so anyone can download and run the core prompt-to-sheet parsing loop locally for free.
  • Enterprise Engine ($499 Commercial License): For teams processing high-volume enterprise assessments, our commercial bundle includes the full 20-node production architecture with automated 15-row API rate-limit throttling (to prevent HTTP 429 errors), HITL review queues, immutable audit logging, and our formal Data Security Addendum (DSA).

We would love to get your feedback on the schema mapping logic and prompt structures! Let us know if you have any questions about running the lite version locally.

2

Curious about the citation-accuracy side of this — when the AI Evaluation Core matches a questionnaire question to a policy doc and generates a verbatim-cited response, what catches it if the citation is close but not actually responsive to what’s being asked? That’s usually where these tools fail quietly — technically-cited but substantively wrong answer going out under a company’s name.

1 Like