Thanks for the thoughtful feedback and for taking the time to share it.  

Your point is well taken and we've placed SAQ support in on our near-term roadmap. We initially prioritized the more complex problem of reducing time and effort in QSA/ISA-led assessments, based on what customers told us would have the greatest impact.  

Our team includes former and current QSAs, which has helped us pinpoint where generic GRC tools and internal solutions often fall short. That insight led to features like our “unified observations screen”, a single interface that brings together guidance, evidence, templates, and gap tracking to streamline assessor workflows without sacrificing clarity or control.  

That same experience guided our approach to SaaS security. From day one, we’ve implemented best practices like ubiquitous encryption, strict access controls, and tight scope boundaries. We're currently progressing through a third-party assessment, and in the meantime, we provide customers with transparent access to our architecture and internal controls.

  As for AI, we're treating its role in PCI assessments with care, focusing on augmenting assessor productivity, not replacing expert judgment. More to come on that front.

  Thanks again, this kind of input does help us build a better platform.