Soundings
Answer the security questionnaire without guessing.
Clients send long questions about AI use, data handling and key management. Soundings reads your project on your own machine, answers what the code shows, asks you only what it can't, and drafts the documents where every statement has a source.
How it works
Local scan. Nothing uploaded.
Soundings reads your code where it sits and records what it finds as file paths, line numbers and one-sentence claims. It never stores source code or secret values, and it stops if one would end up in its output.
- Says how sure it is: stated by the code, inferred, or not found
- Asks instead of guessing: a hosting region or a provider setting becomes a question
- Checks any text: a draft from an AI assistant fails if a statement has no real source
- Reads JavaScript, TypeScript and Python, including FastAPI, Next.js and Azure
$ npx soundings-cli Soundings · notes-app · Next.js, Supabase AI providers OpenAI [stated by the code] The app uses the OpenAI SDK from server code. app/api/summarise/route.ts:1 Only you can answer these UQ-supabase-region In which region is the Supabase project hosted? Your code never left this machine.
What it writes
Drafts you can send, with the sources attached.
Every sentence about your project ends with a numbered source. Where the code and your answers can't say, the document says so and lists what is missing. Nothing is filled in to look complete.
Questionnaire answers
A standard bank of 43 questions on AI use, data, access, keys, logging, suppliers and incident response. Fill in a client's CSV questionnaire from it; rows it can't match clearly are left for you, never guessed.
Privacy notice and subprocessor list
What personal data is handled, why, where it is stored, who receives it and for how long, plus a table of the external services your code uses.
Impact assessment and AI-use statement
A draft data protection impact assessment, and a statement of which AI providers are used, with what data and what oversight.
Trust page
A short client-facing summary of how your service handles security and data. Export any document as Markdown, a single HTML page or a Word file with real footnotes.
Plans
The scan is free. The documents are Pro.
Scanning, the questions and the checker that verifies any text are free, need no account and make no network calls. Soundings Pro writes the documents. It is a subscription through Polar, our merchant of record, who handle payment, tax and invoices.
Free
- Local scan and plain-English report
- The questions only you can answer
soundings verify: check any text against your evidence
Pro
- Answers to the question bank and client questionnaires
- Privacy notice, subprocessor list, impact assessment, AI-use statement, trust page
- HTML and Word exports with footnoted sources
- Works on up to 3 machines, and in CI
Questions
The fine print, in plain English.
Does my code leave my machine?
No. The scan, the questions and the documents all run locally. The only network call Soundings ever makes is the licence check for Pro, and it sends your licence key and your computer's name, never anything about your project.
Is it legal advice or a compliance certificate?
No. Soundings produces drafts. It never says anyone is compliant with or certified to anything, and every document says so. Read each one before it goes to anyone.
What if it can't read my code?
It reads JavaScript, TypeScript and Python. If a project has a lot of code in another language, it says so and asks what that code does, rather than reporting that nothing was found.
Can I read the source?
Yes. It is source-available under the Functional Source License, and becomes Apache 2.0 after two years. Paid features have their own commercial licence. View it on GitHub.