Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Assessment Copilot replaces manual, spreadsheet-driven workflows with a programmatic pipeline. It generates custom questionnaires, extracts controls from uploaded evidence, evaluates vendor responses, and drafts follow-ups for the gaps, routing the cases the evidence cannot settle to human reviewers.

​
What it does

Custom questionnaire generation

Generate vendor questionnaires scoped to the control sets you care about, the vendor’s risk tier, and the services in scope.

Control extraction from evidence

Parse SOC 2 reports, ISO certifications, pen test summaries, and policy documents to extract control evidence automatically.

Response analysis

Evaluate every control against the vendor’s answers and documents, flagging weaknesses as issues and marking what the evidence cannot settle for review rather than guessing.

Follow-ups and reassessments

Draft targeted follow-up questionnaires from the issues an assessment raises, flag residual risk for reviewer attention, and schedule the next reassessment from the vendor’s risk level.

​
Evidence quality controls

Copilot researches the public web when a control can’t be answered from the documents on file. That evidence is not taken on trust: every candidate page is graded for publisher accountability (Unreliable, Reputable, or Authoritative), and anything below the minimum you configured is discarded before the evaluating model sees it. Accepted citations carry their grade, the reason for it, and the page’s age at the time it was cited, both in the UI and in the Excel export.

Evidence quality and source credibility

The full guide: the grading scale, where to set the minimum per control set or per control, how the bar is enforced, and what it does and doesn’t cover.

​
How to integrate

Copilot is exposed across both API surfaces:

Export API

Pull assessment results, evaluations, and findings into your compliance dashboards or regulatory reporting pipeline.

MCP Server

Drive assessments from a conversational interface. Start a new assessment, summarize results, or find controls that need human review.

​
Common workflows

Onboarding pipeline integration

Wire Copilot into your vendor onboarding flow. When a new vendor enters intake, trigger a Copilot assessment scoped to the appropriate control set and tier. Pull results via Export API and surface them in your procurement system before contract execution.
Schedule reassessments on a recurring cadence for each risk level (annual, semi-annual, or any interval), or trigger one from an event such as a Radar alert or a jump in the vendor’s risk score. Each reassessment evaluates the controls again against the latest evidence.
Set each control set’s strictness to decide how much the evaluation may infer on the vendor’s behalf, and route assessments to named reviewers for approval. An evaluation the evidence cannot settle is marked for review rather than guessed, and issues surface for a person to accept, dismiss or follow up.
Copilot is part of the Coverbase platform and is accessed through the Export API and MCP server rather than a dedicated endpoint. See the Export API Concepts page for assessment and evaluation base objects.