AI-assisted audit questionnaires
QueCert guides your audit team through a ready-made control questionnaire and writes the statement of fact, risk, effect and recommendation for every answer, ready for the report. Start from one of eight subjects, or build your own with AI.
·
Try the sample control on the right. Choose an answer to see the finding QueCert writes.
Example from the Data Center Security Review
Determine if the network is segmented by firewalls between the internet, DMZ and internal zones, and firewall rules are reviewed at least semiannually.
Who it's for
Assign categories, watch progress by section, and issue findings that are already written in report language.
Work from one shared questionnaire. Every answer is signed with the auditor's name and time, so the audit trail builds itself.
Run a self-assessment against the same controls an auditor will use, and see the gaps ranked by risk before the audit starts.
What's covered
Five categories, 111 controls, 33 of them high-risk.
Every control carries a risk weight from 1 to 3 and references to NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and COBIT 2019.
| Category | Code | Controls | High risk | Main focus areas |
|---|---|---|---|---|
| Physical Security | PH | 22 | 5 | Access control, environmental protection, asset protection, monitoring |
| Data Security | DS | 27 | 10 | Encryption, network security, privileged access, access provisioning |
| Backup | BK | 19 | 7 | Backup operations, governance, storage, access |
| Recovery | RC | 20 | 6 | Disaster recovery planning, infrastructure, testing, procedures |
| Change Management | CM | 23 | 5 | Approval, configuration, governance, segregation of duties |
| All categories | 111 | 33 |
Try it
Hosted projects on the QueCert server: each project with its own link and passwords, and an account page for your organization. Each subscription includes one full questionnaire built with AI for what you audit; more builds are $59 each. Coming soon. To hear first when hosted trials open, tell us on the Contact page.
·
Features
QueCert replaces the spreadsheet-and-Word routine of a data center audit with one shared workspace.
No database to run. On your own server, QueCert keeps every answer, rating and comment in one standard file that belongs to you. Open it in Excel any time for your own analysis, and add to or edit the questionnaire there if you like.
Category ratings
QueCert rates each category from its answers. N/A answers are left out. The thresholds can be adjusted to your methodology.
How it works
The review follows the way auditors already work. Review loops back to testing whenever a finding needs correcting or follow-up.
Security
These protections are built into the standalone edition and Enterprise Version 4.0, which run on your own server, so your answers and evidence stay with you. Hosted projects run on the QueCert server with the same protections: each project has its own passwords, the account has an owner and up to five administrators, and QueCert looks after HTTPS, backups and the security log.
Nothing in the review, including the answers, is sent to a browser until someone signs in.
The server records the signed-in name with every save. The browser can't change it.
Three wrong passwords in a row block that computer for 15 minutes, even with the right password. Ten wrong administrator passwords within an hour, from any addresses, lock that login everywhere for 15 minutes.
Sign-ins, failed sign-ins, lockouts, Admin unlocks, password changes and other administrative changes are logged with the time, address and name, one event per line so entries can't be forged by what someone types.
The server checks the administrator password, and the tab locks again after 30 minutes without activity.
Passwords changed in the app are stored salted and hashed, so they can't be read back from the file.
The standalone server runs on your own computer, and your answers stay on it. By default only that computer can open it.
A copy of each review is saved when the server starts, before every Clear All and before a project is re-loaded, with the 30 most recent kept. Enterprise Version 4.0 also downloads a whole review as one .zip, without passwords.
Install a certificate and the server switches to HTTPS, refuses anything older than TLS 1.2, and only sends the sign-in cookie encrypted.
Enterprise Version 4.0: each review or client can have its own passwords. Without a review's password, people can't see its name, its progress or even that it exists.
Enterprise Version 4.0: the website and store administration answers only from your local network, or from addresses you list. Anyone else sees a notice instead of a sign-in form, and every refused attempt is logged.
The website and store administration has no built-in password. You choose it on the server itself during installation, with at least 12 characters, and it is stored salted and hashed.
When an administrator login is locked by repeated wrong passwords, the server emails your notification address straight away.
Every page carries a content security policy and other security headers, so other sites can't frame it or inject scripts into it. On HTTPS, browsers are told never to fall back to plain HTTP, and sign-in cookies can't be read by scripts or sent from other sites.
The server sends only the files it is meant to: no folder listings, settings, logs, backups or source code. Requests by bare IP address, as internet scanners send them, get a plain "not found", and the administration pages and their code are sent only after sign-in. We test this with the same kind of crawler attackers use to copy websites.
Every page the server sends is logged with the time and address, including refused requests, so unusual activity stands out. Outside addresses can be shown with their approximate location; you can switch that lookup off.
A project downloaded as a .zip holds only that project's own answers, evidence and settings: never passwords, other projects or the server's own settings.
Enterprise Version 4.0 sets up a free Let's Encrypt certificate for HTTPS and renews it automatically, and the certificate can be checked and renewed from the Admin tab.
Until a certificate is installed the standalone edition uses plain HTTP, so run it on a trusted internal network. Setting up HTTPS takes about 20 minutes, and Enterprise customers get help with it. The shared review passwords start as the published demo passwords on a server without a demo review: change them on the Admin tab before anyone else can reach the server.
Live demo
The demo is the standalone edition running on this server, with sample answers already entered. Browse the controls, change an answer and watch the findings and project status update. Use the password demo to sign on and admin for the demo's Admin tab.
This server
Demo video
A nine-minute tour of QueCert: a review from the first control to the final report, the findings it writes, and the reports you hand over. No sign-in needed: it plays here, full window.
What to try
The demo asks you to sign in with your name and a sign-on password: on the QueCert demo it is shown on the sign-in page; otherwise ask your administrator. Can't get in?
Screens
The layout adapts to phones and tablets, so auditors can record answers during the walkthrough instead of transcribing notes afterwards. It follows the device's light or dark setting, or the Dark mode switch next to Sign out, and stays readable with Windows high contrast turned on.
Pricing
Hosted projects on the QueCert server: each project with its own link and passwords, and an account page for your organization. Each subscription includes one full questionnaire built with AI for what you audit; more builds are $59 each. Coming soon. To hear first when hosted trials open, tell us on the Contact page.
Content packs
Each content pack is a complete QueCert control questionnaire for a new subject: 100 controls with test procedures, evidence to request, generated findings and recommendations, criteria references and domain ratings. Each comes with its own installer, which adds it to QueCert Standalone or Enterprise, where it runs alongside your other reviews. One pack is included with Standalone and Enterprise; add more whenever you need them.
100 controls each, mapped to the frameworks shown, with its own installer. Choose a pack for its details and the buy link; all eight are $1,499 as the All-packs library.
Content packs run on QueCert Standalone and Enterprise Version 4.0, and in hosted projects. Criteria references should be checked by a qualified reviewer against the framework editions your audit uses.
Other options
Standalone and Enterprise include their first year of updates and support. From the second year, a yearly renewal (Renew updates and support, in the Standalone and Enterprise cards above) keeps the updates, content pack framework updates and support coming; without it, QueCert keeps working on the last version you installed.
| Feature | Hosted | Standalone | Enterprise Version 4.0 |
|---|---|---|---|
| A content pack of your choice, with test procedures and evidence lists | Yes | Yes | Yes |
| Generated findings, exceptions and recommendations | Yes | Yes | Yes |
| Project status by category | Yes | Yes | Yes |
| PDF and CSV exports | Yes | Yes | Yes |
| Live updates between auditors | Yes | Yes | Yes |
| Sign-in | Name plus the project's own password | Name plus shared password | Name plus the review's own or the shared password |
| Evidence files uploaded to each control, listed by category on Findings | Yes | No | Yes |
| Answers kept on your own network | No | Yes | Yes |
| Runs on your own network | No | Yes | Yes |
| Automatic backups and password changes on the Admin tab | Yes | Yes | Yes |
| Security log of sign-ins and admin actions | Kept by QueCert | Yes | Yes |
| Several questionnaires from one server, listed after one sign-in | Several projects on one account page | With extra content packs | Yes |
| Separate passwords for each review or client | Each project its own | No | Yes |
| Create new AI-generated control questionnaires for other subjects, of the size you choose | One build per subscription, more $59 each | Questionnaire Builder add-on | Yes |
| Project reports as PDFs: opening letter, getting started guide, status report, meeting agenda, final report | Yes | No | Yes |
| Download a review as one .zip, and re-load it here or on another server | Yes | No | Yes |
Order & download
Buy QueCert Standalone or Enterprise in our online store, with the content pack you choose, by card or by purchase order. Card payments are taken by Lemon Squeezy, our reseller, which adds the right sales tax or VAT and emails your receipt; the store emails your download link.
How ordering works
Already bought? Your order email from the store has the download link. If it has expired or gone missing, reply to that email and we'll send a new one.
Download
Your download link gives you these files. Check a file's SHA-256 fingerprint in PowerShell with Get-FileHash <file> before running it.
Version 4.0 (4.0.0), published 2026-11-07. Install QueCert first, then your content pack. If you can't use the installers, alternative .zip files for installation are available from support@quecert.com.
| File | Size | SHA-256 |
|---|---|---|
| QueCert-Standalone-Setup-4.0.0.exe Installer · QueCert Standalone: Windows installer, Node.js included | 74.3 MB | B94D4C619ABCB9FFB2D79D568E80A9E20697EEF2C0AF186EFE5267F6C0AF7D0A |
| QueCert-Enterprise-Setup-4.0.0.exe Installer · QueCert Enterprise: Windows installer, Node.js included | 74.6 MB | 73BE1635E7C2D2281958FC3FA3CA0EC9889C0E0D0E40E605BBFF5D8EDA1ADBCA |
| QueCert-Pack-ConstructionSiteSafety-Setup-4.0.0.exe Content pack · Construction Site Safety Review: adds it to QueCert | 2.1 MB | F3A48B2469C1BD78A760F6B651324054EDE868690F8636C2C92EAF368FD0011A |
| QueCert-Pack-CyberSecurity-Setup-4.0.0.exe Content pack · Cyber Security Review: adds it to QueCert | 2.1 MB | 07B3380625C18134F98BC2F8B686340B4B2023CBFBF24EC9F172F372558D3B2A |
| QueCert-Pack-DangerousChemicalSafety-Setup-4.0.0.exe Content pack · Dangerous Chemical Safety Review: adds it to QueCert | 2.1 MB | E89712153090B4E306E258CC9089C3C1017EA4B55B7ECE9322AEBAC4FD57CE3E |
| QueCert-Pack-DataCenterSecurity-Setup-4.0.0.exe Content pack · Data Center Security Review: adds it to QueCert | 2.1 MB | 18D3CBE1120DB700B70D6270188D81AE35D660BC321B4E33E5374E9DA1A0A8BE |
| QueCert-Pack-NetworkAdministration-Setup-4.0.0.exe Content pack · Network Administration Review: adds it to QueCert | 2.1 MB | B4DB7AF39D6225856795E7A2A65DA217DED61F6E8DC658D25B80A42796C6E41C |
| QueCert-Pack-NuclearMaterialsSafety-Setup-4.0.0.exe Content pack · Nuclear Materials Safety Review: adds it to QueCert | 2.1 MB | 81634A4A8B774552112A37CD6A5583C8CE07C382EC3F44200240F037BC65FD10 |
| QueCert-Pack-SoftwareDevelopmentLifeCycle-Setup-4.0.0.exe Content pack · Software Development Life Cycle Review: adds it to QueCert | 2.1 MB | D6C3B42A27C599BB34900C709744D2CD6B46A66089D7CAE4BCBDB515C835E05B |
| QueCert-Pack-SoftwareDevelopment-Setup-4.0.0.exe Content pack · Software Development Review: adds it to QueCert | 2.1 MB | 81D18F0412CB3084FF9F600C1A2408822360B1F64FE32C90974F55CC46094241 |
| QueCert-Questionnaire-Builder-Setup-4.0.0.exe Add-on · Questionnaire Builder for Standalone (Enterprise includes it): turns on Build Questionnaires with Claude | 2.4 MB | AB8238EE83A44FA791BC7FCD0FE6D438017101FC1F16D10C3628EB75B3321D1B |
Documents
The Administrator Manual and the Administrator Quick Start come with your download, because they contain the default passwords, and so does the guide to building new questionnaires.
If QueCert doesn't work for you, ask for a full refund within 30 days of your first licence purchase. Renewals can be cancelled before the renewal date. Refunds are issued by Lemon Squeezy to the original payment method.
A site licence covers one installation at one site, for any number of your staff and reviews, for one year. Your data stays on your network: we never receive your answers or files. The licence agreement is the full and binding text.
·
FAQ
Every control references NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and COBIT 2019. You can search the questionnaire by any of those references, for example PE-3, 8.13 or DSS05.
They're written in report language, and Copy report as text puts the whole report on the clipboard for Word. Before issuing, add the cause you found during testing to each recommendation.
Hosted projects run on the QueCert server: nothing to install, each project with its own link and passwords, an account page for your organization, and a monthly or yearly subscription. The standalone edition runs on one Windows computer in your office, keeps your answers there in a file you own, and adds the security log, backups and password management. See .
One computer running Windows 10 or 11 (or Windows Server 2016 or later). A single installer sets everything up, including Node.js, in about five minutes and without needing internet access. Auditors only need a current browser on a computer, tablet or phone.
Yes. Answers saved by one person appear on everyone else's screen within a few seconds, and each answer records who saved it and when.
Yes, with Enterprise Version 4.0. The Admin tab makes five reports as PDFs: the opening conference letter, a one-page getting started guide for team members, a project status report, a project review meeting agenda and the final report. The figures, exceptions, category ratings and findings come from the answers; you add your logo, the project details and your own wording. The reports are HTML templates, so their layout and standard text can be changed to your house style, for every review or just one. In every edition, the PDF, Word and Export CSV buttons are available on every tab.
Minutes. With Enterprise Version 4.0 the Admin tab makes a one-page getting started guide for your auditors, with the review's address, how to sign in and answer a control, their assignments and the deadline. Each auditor also gets a one-page User Quick Start, and administrators a one-page Administrator Quick Start covering installation to the final report, with the full manuals for detail.
Yes. Edit the controls in the questionnaire's Control Library and the rating thresholds in its Domain Summary, for example in Excel. Changes show up in the review within seconds. With Enterprise Version 4.0, or Standalone with the Questionnaire Builder add-on, you can also create new control questionnaires for any subject with Claude, of the size you choose, from a page on the Admin tab that writes the prompt and checks the result, or have us set one up for you.
Yes. With Standalone and Enterprise, each review's record is a standard spreadsheet file on your own server: open it in Excel for your own analysis or records, and edits you save there appear in QueCert within seconds. Every edition also exports CSV and PDF.
Export a CSV and PDFs for the record, or with Enterprise Version 4.0 download the whole project as one .zip, then use Clear All on the Admin tab. For a separate review per site or year, Enterprise Version 4.0 runs each one side by side on the same server.
Yes, with Enterprise Version 4.0. Download project (.zip) on the Admin tab saves the review as one file: the questionnaire with every answer and comment, the evidence files, the reports and the site and report details. Passwords are never included. Re-load a project loads that file back, into the same review or one on another server. The server checks the file first and moves everything it replaces into the backups folder, so nothing is lost.
The edition for teams running more than one review. One server runs several questionnaires, such as one per data center, per client or per year, and lists them after a single sign-in. Each review keeps its own questionnaire, answers, evidence, backups and site details, and can have its own passwords so one client's team never sees another's review. It also runs your own control libraries for subjects other than data centers.
Contact
Ask for a walkthrough, a standalone trial or a quote. Tell us how many data centers you review each year.
Admin
The Admin tab works when this website is served by the QueCert server.
The Admin sign-in is only available from the QueCert team's own network.