Conveyor vs Skypher (2026): pricing, features and verdict

Short answer: Pick Skypher if the questionnaire itself is the whole problem: it arrives as an Excel file one week, a Google Form the next, and a OneTrust or Archer portal the week after, and you want one tool that reads all of them and writes back into the original. Pick Conveyor if security reviews are the main load but not the only one: it adds an AI RFP module, a free trust-center plan you can open today, unlimited users on a usage-based Enterprise quote, and a longer CRM and support-desk integration list. Both draft from a knowledge base, both show sources and a confidence signal on every suggestion, and both hold SOC 2 Type II. Neither will tell you a price until you talk to sales.

This is a closer fight than most pairs in the directory. Put Conveyor next to a full RFP suite and the jobs barely overlap. Put it next to Skypher and you are looking at two products that grew up answering the same 300-row spreadsheet. The differences are in the edges: portal reach, what else the tool does, how you buy it, and where the data sits.

Everything below comes from each vendor’s profile and facts file in this guide, which point back to the vendors’ own pages, docs and trust centers (checked October 2026) and to G2 (July 2026).

Key takeaways

• Same core job: both import a questionnaire, draft answers from your own content, flag what needs a person, and export back to the buyer’s format. Security questionnaires are the core product at both companies.
• Portal reach: Skypher lists API integrations with 40+ TPRM platforms (OneTrust, Archer, CyberGRX, Whistic, Prevalent) plus a browser extension. Conveyor uses a browser extension for portals such as OneTrust and Whistic.
• Scope beyond questionnaires: Conveyor sells an AI RFP product for RFPs, RFIs and RFQs on the same knowledge library. Skypher treats past RFPs only as source material.
• How you start: Conveyor’s Free plan gives you a trust center with 10 credits a month and up to 15 documents, plus a free trial of the AI. Skypher offers a custom quote or a demo, with no free plan or trial listed.
• Review footprint: Conveyor holds 4.6 out of 5 on G2 from 150 reviews. Skypher holds 4.9 out of 5 from 10 reviews. Both as of July 2026.
• Limitations: Conveyor stores customer content in the United States and keeps questionnaire automation off the free plan. Skypher says some SSO options, such as custom SAML or Okta, may cost extra, and 24/7 support sits in a premium Enterprise package.

Two companies, one spreadsheet

Conveyor started in 2021 as a spin-out from Aptible. Its about page lists a Seed round at that point, a $12.5 million Series A in 2023, and a $20 million Series B in 2025. Named customers include Zapier, Zendesk, Sumo Logic, Carta, Alteryx, Hootsuite, Sprout Social, dbt Labs and Lucid. Most of those names sell software to other businesses, the kind of company that fields a security review on a large share of its enterprise deals.

Skypher is backed by Y Combinator and Kima Ventures and does not disclose amounts. Its customer page names Adobe, Deel, TeamViewer, TCN, CMA CGM, Bitrise, Swile, 1upHealth, Retool, Front, Ubble and MadKudu. Customer logos are not a capability test, but they do tell you who has been willing to put their name next to the product.

The directory files Conveyor under security questionnaires, AI-native and RFP response. Skypher sits under security questionnaires and AI-native. That one extra category is the biggest structural difference in this pair, and it comes up again in the verdict.

Getting the questionnaire in, and back out

This is where most of a security engineer’s lost hours actually go. Not drafting. Copying.

Skypher’s input list is the longest in this comparison: Excel, CSV, Apple Numbers, Word, PDF, and Microsoft or Google Forms. It says it exports back into the original document without breaking the formatting. For questionnaires that live online, it lists API integrations with more than 40 TPRM platforms and names OneTrust, Archer, CyberGRX, Whistic and Prevalent among them. Anything else on the web goes through a browser extension. If your sales team keeps forwarding portal invitations from procurement teams you have never heard of, that API-first approach is Skypher’s clearest advantage.

Conveyor imports spreadsheets, Word files, PDFs and portal questionnaires, and exports in the original format. Its portal path is a browser extension that works inside portals such as OneTrust and Whistic. Conveyor has a separate trick for the standard frameworks: its docs say it auto-detects completed SIG (Lite or Core), HECVAT (v3, v4) and CAIQ (v3, v4, AI-CAIQ v1) files and turns them into answer sources. The fine print expects the original Shared Assessments, EDUCAUSE or Cloud Security Alliance layout. If someone on your team reformatted last year’s SIG to “make it nicer,” you will be un-reformatting it.

The practical test is simple. Pick the two portals your buyers used most last quarter. Ask each vendor to run one live assessment in each, end to end, while you watch. An API connection and a browser extension can both work well. They fail in different ways, and you want to see the failure before you sign.

How each one drafts an answer

Both products follow the same broad loop: build a knowledge base from past questionnaires and policies, match each new question to it, draft, then hand the draft to a person for review.

Conveyor’s version is ConveyorAI. It extracts the questions, drafts every answer from approved answer sources, cites the source document behind each response, and attaches a confidence score so reviewers start with the shaky ones. Conveyor also describes an agent that can take a request from Slack, a CRM or a ticketing system and return a completed questionnaire. For a sales team that currently files a ticket and waits three days, that intake path is as useful as the drafting.

Skypher’s version matches each question to the knowledge base and drafts an answer that users review, edit and approve before export. It says each suggested response carries confidence and accuracy scores along with source transparency. Skypher describes its approach as “proprietary extractive AI.” The word extractive matters if your reviewers are nervous about generated prose, because it implies answers are pulled from your existing content rather than composed from scratch. This guide has no independent test of how that plays out, so treat it as the vendor’s description and check it on your own hardest questions.

The honest summary: on the drafting step itself, these two are a match. Both cite, both score, both put a human in the approval seat. The difference you are more likely to feel is in what surrounds the draft.

Keeping the knowledge base from rotting

Any questionnaire tool is only as good as the library behind it. Both vendors know this and both have built tooling for upkeep.

Conveyor’s knowledge library holds curated Q&A pairs with a verification status, a curator, tags and product lines. It syncs drives, wikis and past questionnaires into the same pool. An AI Librarian flags outdated content. Product-line tagging is handy if you sell more than one product and the SOC 2 scope differs between them, which is exactly the kind of detail that gets a wrong answer sent to a careful buyer.

Skypher organizes its knowledge base by ISO 27001, SOC 2 Type II, NIST and SIG. It runs automated review cycles, detects duplicate content, and syncs continuously from internal wikis, SharePoint, Google Drive and Notion. Framework-based organization suits a GRC team that already thinks in control families. Duplicate detection suits anyone who has inherited a library with four slightly different answers to “Do you encrypt data at rest?”

Neither approach is obviously better. Conveyor’s model is closer to an owned library with named curators. Skypher’s is closer to a framework map with scheduled review. Ask yourself who on your team will actually maintain it, and pick the structure that person will keep up.

Reviewers, owners and the trail they leave

Conveyor assigns questionnaires to assignees, collaborators and routing groups, auto-tags reviewers, and keeps an audit trail of who reviewed each answer. Its facts record notes that no multi-stage approval chain is described. Slack covers notifications, self-serve answers and questionnaire intake. Microsoft Teams is documented for notifications.

Skypher lets users assign people to questions, comment in real time, and review and approve answers. Owners, due dates and tags can be tracked in Jira, ServiceNow, Salesforce or MS Dynamics. Its Slack and Teams integration is two-way: you can upload a questionnaire from a channel and ask the Skypher bot questions about your security content.

If your subject matter experts live in Teams, Skypher’s two-way Teams integration is the stronger fit on paper. If your sales team lives in Slack and you want questionnaire requests to start there, both can do it, and Conveyor pairs that with its agent intake. If ServiceNow is where your security team tracks work, Skypher names it and Conveyor’s list does not.

Pricing: two quotes, different meters

Neither vendor will give you a number for questionnaire automation without a conversation. How they meter it differs, and that changes what you should prepare.

• Free option: Conveyor has a trust center only plan (10 credits a month, 15 documents, 15 Q&As). Skypher lists none.
• Trial: Conveyor offers a free trial of the AI. Skypher lists none.
• Paid plan: a custom quote at both. Conveyor calls its plan Enterprise.
• Meter: Conveyor bills usage as Trust Center and Questionnaire credits, with volume discounts. Skypher does not publish one.
• Users: Conveyor includes unlimited users and seats with no per-user fees. Skypher does not say.
• Known extras: Conveyor includes integrations on Enterprise. Skypher says some SSO (custom SAML, Okta) may cost extra, and 24/7 support with an account manager is a premium Enterprise package.

Conveyor publishes its plan structure, if not its prices. The Free plan is a trust center with Conveyor-branded clickwrap NDA and watermarking, and the pricing page states it has “No access to Questionnaire Automation” and no integrations. Enterprise is “as many users and seats as needed,” with integrations, analytics, enterprise settings and dedicated support included, billed on usage. No per-questionnaire rate is published. Walk into the call knowing how many questionnaires and trust center requests you handled last year, or the credit conversation will be one-sided.

Skypher publishes nothing beyond “Flexible pricing for companies of all sizes.” The quote is the only path. Two lines from its own pages belong in your request for that quote: SSO options such as custom SAML or Okta may cost extra, and 24/7 support with a dedicated account manager is a premium package for Enterprise customers. Ask for both to be priced up front, so the first surprise is not at rollout.

For finance, the useful framing is this. Conveyor’s meter is volume. Skypher’s meter is unknown until the demo. If your questionnaire count swings a lot quarter to quarter, ask each vendor how a spike month gets billed.

Security paperwork and where the data sits

Both list SOC 2 Type II. Conveyor’s trust center describes annual audits covering Security, Availability and Confidentiality. Skypher’s trust center makes the report available on request, does not list an ISO 27001 certificate, and says its security program is based on ISO 27002. Conveyor’s record does not show an ISO 27001 certificate either.

Hosting is where they split. Conveyor’s subprocessor notice says customer content is stored in the United States, and that LLM inference may route through providers’ global networks without storage at rest outside the US. No EU region is named. Skypher states EU and US hosting for Trust Center data (“Choose where your Trust Center data lives”) and names AWS as its cloud. It does not give regions for the questionnaire product itself. If you are an EU company with a residency clause, Skypher has the better opening answer, but it is an answer about the trust center. Get the questionnaire data location in writing too.

Subprocessors: a long list against a short one

Conveyor publishes 27 subprocessors with processing locations, last updated July 14, 2026. The clouds are AWS and GCP, with Aptible for infrastructure. OpenAI and Anthropic are the LLM providers, under zero data retention agreements per the pricing FAQ. Pinecone holds the vector embeddings. LangChain is listed for debugging, testing and monitoring ConveyorAI. That last one deserves a question: which questionnaire content reaches the monitoring tool, and how long is it kept?

Skypher’s trust center lists AWS for hosting and says SendGrid, for transactional email, is the only other third-party vendor involved in operating the product. No AI model provider is named. A short list is easier to review. It also leaves an obvious follow-up: where does the “proprietary extractive AI” run, and does any third party see the text? Ask it once, get it in the DPA, move on.

The trust center half

Both products pair questionnaire response with a buyer-facing trust center, and in both cases the idea is the same: publish your posture so fewer questionnaires arrive at all.

Conveyor’s trust center offers NDA-gated documents and a buyer-facing AI agent that answers from the same knowledge library the questionnaire product uses. That shared library is a real design advantage. The answer a buyer reads in your trust center and the answer your team pastes into a spreadsheet come from one place. You can also start it for free, which no other option in this pair allows.

Skypher’s trust center offers NDA-gated documents, click-wrap or DocuSign approval, and access analytics. Its trust center page also names Dropbox Sign and Confluence as connections. The EU or US hosting choice for trust center data is a genuine differentiator for European sellers.

Integrations beyond the portals

Conveyor lists Salesforce, HubSpot, Slack, Microsoft Teams, Jira, Zendesk, DocuSign, Ironclad, Google Drive, SharePoint, Notion, Confluence and Front, plus an MCP server for ChatGPT, Claude and Gemini, a public API and webhooks. HubSpot and Zendesk matter if requests start with a sales rep or a support agent rather than a security engineer. The MCP server matters if your team already asks an AI assistant for answers and you would rather it pulled from the approved library.

Skypher lists ServiceNow, Salesforce, MS Dynamics, Jira, Slack, Teams, Google Drive, Microsoft 365, SharePoint and Notion, plus Okta and Microsoft Entra ID, and the 40+ TPRM portal connections covered above. Dynamics and ServiceNow are the names a larger enterprise IT shop will look for first.

The overlap is Salesforce, Slack, Teams, Jira, Google Drive, SharePoint, Notion, Confluence and DocuSign. Past that, Conveyor leans toward the go-to-market stack and Skypher leans toward the enterprise IT and TPRM stack.

Known issues and limitations

Conveyor

• Free plan excludes the main product: the pricing page says the Free plan has no questionnaire automation and no integrations, with up to 15 documents and 15 knowledge-base Q&As.
• No published rate: Enterprise is billed on usage credits with volume discounts, and no per-questionnaire price appears on the page.
• US storage: the subprocessor notice on the trust center says customer content is stored in the United States. No EU region is named.
• Framework parsing needs clean files: SIG, HECVAT and CAIQ auto-detection expects the original layouts, per the docs.
• No dedicated DDQ workflow: Conveyor imports questionnaires in any format but does not market an investor due-diligence workflow.

Skypher

• Quote only: the pricing page lists no plans, prices, free plan or trial.
• SSO may cost extra: Skypher’s trust center says some SSO options, such as custom SAML or Okta, may incur an extra cost.
• Premium support is a package: 24/7 support with a dedicated account manager is part of a premium package for Enterprise customers.
• No RFP workflow: RFPs and DDQs appear only as source material for the knowledge base.
• Thin public review sample: 4.9 out of 5 on G2 is a strong score, but it rests on 10 reviews as of July 2026.

Choose Conveyor when

• Security questionnaires are your main load, but RFPs, RFIs or RFQs land on the same team and you want one knowledge library behind both.
• You want to open a trust center this week without a sales call, and add questionnaire automation later.
• Sales engineers, lawyers and product leads all need access, and you would rather not count seats.
• Requests start in Salesforce, HubSpot, Zendesk or Slack, and an agent that picks them up there would save a ticket queue.
• You want a large public review base (150 reviews on G2) before you shortlist.
• US data storage is acceptable for your customers.

Choose Skypher when

• Questionnaires arrive in every format you can name, including Apple Numbers and Google Forms, and through a long tail of TPRM portals.
• OneTrust, Archer, CyberGRX, Whistic or Prevalent assessments show up often enough that an API connection beats a browser extension.
• Your team tracks work in ServiceNow or MS Dynamics, or talks in Teams more than Slack.
• European buyers ask where your trust center data lives, and an EU option answers them.
• You like the idea of a framework-organized knowledge base with scheduled review and duplicate detection.
• A demo-first buying process is fine, and you will get SSO and support pricing into the first quote.

Verdict

Same job, different edges. On the drafting itself, these two are close: cited suggestions, confidence scoring, human approval, SOC 2 Type II on both sides. Pretending one writes dramatically better answers would be making something up.

Conveyor’s genuine strength is breadth around the questionnaire. A free trust center to start, an RFP module on the same library, unlimited users on Enterprise, and an integration list that reaches into the sales and support stack. The trade-offs are US-only storage and a usage meter with no published rate.

Skypher’s genuine strength is depth inside the questionnaire. The widest input list in this pair, API connections to 40+ TPRM portals, two-way Teams, and an EU hosting choice for trust center data. The trade-offs are a fully opaque price, possible SSO extras, and a review base of 10.

If your security reviews arrive mostly as files and you can see RFP work coming, start with Conveyor. If they arrive mostly through portals and from European buyers, start with Skypher. Either way, bring last quarter’s ugliest questionnaire and one live portal invite to the demo, and buy the one whose drafts your reviewers change least.

Read the full Conveyor review or Skypher review, or browse all RFP & DDQ software.

Sources checked

• Conveyor pricing page (checked October 2026)
• Conveyor about page (checked October 2026)
• Conveyor security questionnaire automation (checked October 2026)
• Conveyor AI RFP software (checked October 2026)
• Conveyor integrations page (checked October 2026)
• Conveyor customers page (checked October 2026)
• Conveyor trust center (checked October 2026)
• Conveyor docs: importing questionnaires (checked October 2026)
• Conveyor docs: SIG, HECVAT and CAIQ (checked October 2026)
• Conveyor docs: integrations overview (checked October 2026)
• Conveyor docs index (checked October 2026)
• Conveyor reviews on G2 (checked July 2026)
• Skypher about page (checked October 2026)
• Skypher pricing page (checked October 2026)
• Skypher security questionnaire automation (checked October 2026)
• Skypher features page (checked October 2026)
• Skypher trust center product (checked October 2026)
• Skypher customers page (checked October 2026)
• Skypher trust center (security posture) (checked October 2026)
• Skypher on G2 (checked July 2026)