Data Center Security Review
AutoQ guides your review / audit team through 111 data center controls and writes the statement of fact, risk, effect and recommendation for every answer, ready for the report.
Try the sample control on the right. Choose an answer to see the finding AutoQ writes.
Determine if the network is segmented by firewalls between the internet, DMZ and internal zones, and firewall rules are reviewed at least semiannually.
Who it's for
Assign categories, watch progress by section, and issue findings that are already written in report language.
Work from one shared questionnaire. Every answer is signed with the auditor's name and time, so the audit trail builds itself.
Run a self-assessment against the same controls an auditor will use, and see the gaps ranked by risk before the audit starts.
What's covered
Every control carries a risk weight from 1 to 3 and references to NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and COBIT 2019.
| Category | Code | Controls | High risk | Main focus areas |
|---|---|---|---|---|
| Physical Security | PH | 22 | 5 | Access control, environmental protection, asset protection, monitoring |
| Data Security | DS | 27 | 10 | Encryption, network security, privileged access, access provisioning |
| Backup | BK | 19 | 7 | Backup operations, governance, storage, access |
| Recovery | RC | 20 | 6 | Disaster recovery planning, infrastructure, testing, procedures |
| Change Management | CM | 23 | 5 | Approval, configuration, governance, segregation of duties |
| All categories | 111 | 33 |
Try it
Hosted projects on the AutoQ server: each project with its own link and passwords, and an account page for your organization. Coming soon. To hear first when hosted trials open, write to sales@autoq-ai.com.
Features
AutoQ replaces the spreadsheet-and-Word routine of a data center audit with one shared workspace.
No complex database to administer. The standalone version runs everything from a standard Excel workbook, with all editing going directly to and from the spreadsheet. That makes it easy to add to and edit the questionnaire content.
Category ratings
The workbook rates each category from its answers. N/A answers are left out. The thresholds can be adjusted to your methodology.
How it works
The review follows the way auditors already work. Review loops back to testing whenever a finding needs correcting or follow-up.
Live demo
The demo is the standalone edition running on this server, with sample answers already entered. Browse the controls, change an answer and watch the findings and project status update. Use the password demo to sign on and admin for the demo's Admin tab.
This server
What to try
The demo asks you to sign in with your name and a sign-on password: on the AutoQ demo it is shown on the sign-in page; otherwise ask your administrator. Can't get in?
Screens
The layout adapts to phones and tablets, so auditors can record answers during the walkthrough instead of transcribing notes afterwards. It follows the device's light or dark setting, or the Dark mode switch next to Sign out, and stays readable with Windows high contrast turned on.
Pricing
Draft pricing for discussion. Final prices to be confirmed.
Hosted projects on the AutoQ server: each project with its own link and passwords, and an account page for your organization. Coming soon. To hear first when hosted trials open, write to sales@autoq-ai.com.
Contact us about converting your proprietary review content to an AutoQ system. It's easy and takes a minimum of time and effort.
Content packs
Each content pack is a complete Excel control questionnaire for a new subject: 100 controls with test procedures, evidence to request, generated findings and recommendations, criteria references and domain ratings. Add it to Enterprise Version 2.1 and it runs alongside your other reviews on the same server.
Content packs run on Enterprise Version 2.1. Criteria references should be checked by a qualified reviewer against the framework editions your audit uses.
| Feature | Hosted | Standalone | Enterprise Version 2.1 |
|---|---|---|---|
| 111 controls with test procedures and evidence lists | Yes | Yes | Yes |
| Generated findings, exceptions and recommendations | Yes | Yes | Yes |
| Project status by category | Yes | Yes | Yes |
| PDF and CSV exports | Yes | Yes | Yes |
| Live updates between auditors | Yes | Yes | Yes |
| Sign-in | Your Claude account | Name plus shared password | Name plus the review's own or the shared password |
| Evidence files uploaded to each control, listed by category on Findings | No | No | Yes |
| Answers saved to your Excel workbook | No | Yes | Yes |
| Runs on your own network | No | Yes | Yes |
| Workbook backups and password changes on the Admin tab | No | Yes | Yes |
| Security log of sign-ins and admin actions | No | Yes | Yes |
| Several questionnaires from one server, listed after one sign-in | No | No | Yes |
| Separate passwords for each review or client | No | No | Yes |
| Create new AI-generated control questionnaires for other subjects | No | No | Yes |
| Project reports as PDFs: opening letter, getting started guide, status report, meeting agenda, final report | No | No | Yes |
| Download a review as one .zip, and re-load it here or on another server | No | No | Yes |
Security
These protections are in the standalone edition today. The hosted edition uses claude.ai sign-in and sharing to control who can open and change a review.
Nothing in the review, including the answers, is sent to a browser until someone signs in.
The server records the signed-in name with every save. The browser can't change it.
Three wrong passwords in a row block that computer for 15 minutes, even with the right password.
Failed sign-ins, lockouts, Admin unlocks and password changes are logged with the time, address and name.
The server checks the administrator password, and the tab locks again after 30 minutes without activity.
Passwords changed in the app are stored salted and hashed, so they can't be read back from the file.
The standalone server runs on your own computer, and answers stay in your workbook. By default only that computer can open it.
A copy of the workbook is saved when the server starts, before every Clear All and before a project is re-loaded, with the 30 most recent kept. Enterprise Version 2.1 also downloads a whole review as one .zip, without passwords.
Install a certificate and the server switches to HTTPS, refuses anything older than TLS 1.2, and only sends the sign-in cookie encrypted.
Enterprise Version 2.1: each review or client can have its own passwords. Without a review's password, people can't see its name, its progress or even that it exists.
Until a certificate is installed the standalone edition uses plain HTTP, so run it on a trusted internal network. Setting up HTTPS takes about 20 minutes, and Enterprise customers get help with it.
FAQ
Every control references NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and COBIT 2019. You can search the questionnaire by any of those references, for example PE-3, 8.13 or DSS05.
They're written in report language, and Copy report as text puts the whole report on the clipboard for Word. Before issuing, add the cause you found during testing to each recommendation.
The hosted edition runs on claude.ai: you open a shared link and sign in with your account. The standalone edition runs on one Windows computer in your office, saves answers into your Excel workbook, and adds the security log, backups and password management. See .
One computer running Windows 10 or 11 (or Windows Server 2016 or later). A single installer sets everything up, including Node.js, in about five minutes and without needing internet access. Auditors only need a current browser on a computer, tablet or phone.
Yes. Answers saved by one person appear on everyone else's screen within a few seconds, and each answer records who saved it and when.
Yes, with Enterprise Version 2.1. The Admin tab makes five reports as PDFs: the opening conference letter, a one-page getting started guide for team members, a project status report, a project review meeting agenda and the final report. The figures, exceptions, category ratings and findings come from the answers; you add your logo, the project details and your own wording. The reports are HTML templates, so their layout and standard text can be changed to your house style, for every review or just one. In every edition, the PDF, Word and Export CSV buttons are available on every tab.
Minutes. With Enterprise Version 2.1 the Admin tab makes a one-page getting started guide for your auditors, with the review's address, how to sign in and answer a control, their assignments and the deadline. Each auditor also gets a one-page User Quick Start, and administrators a one-page Administrator Quick Start covering installation to the final report, with the full manuals for detail.
Yes. The controls live in the workbook's Control Library sheet and the thresholds in its Domain Summary sheet. Changes there show up in the review. With Enterprise Version 2.1 you can also create new AI-generated control questionnaires for any subject, following our step-by-step guide, or have us set one up for you.
Yes. In the standalone edition the workbook is the record. Close it while people are saving, because Excel locks the file while it's open. Edits you save in Excel appear in the review within seconds.
Export a CSV and PDFs for the record, or with Enterprise Version 2.1 download the whole project as one .zip, then use Clear All on the Admin tab. For a separate review per site or year, Enterprise Version 2.1 runs each one side by side on the same server.
Yes, with Enterprise Version 2.1. Download project (.zip) on the Admin tab saves the review as one file: the workbook with every answer and comment, the evidence files, the reports and the site and report details. Passwords are never included. Re-load a project loads that file back, into the same review or one on another server. The server checks the file first and moves everything it replaces into the backups folder, so nothing is lost.
The edition for teams running more than one review. One server runs several questionnaires, such as one per data center, per client or per year, and lists them after a single sign-in. Each review keeps its own workbook, answers, evidence, backups and site details, and can have its own passwords so one client's team never sees another's review. It also runs your own control libraries for subjects other than data centers.
Order & download
Buy the site licence in our online store, by card or by purchase order. Card payments are taken by Lemon Squeezy, our reseller, which adds the right sales tax or VAT and emails your receipt; the store emails your download link.
Draft pricing and terms for discussion. Final prices and the licence agreement to be confirmed.
Hosted projects on the AutoQ server: each project with its own link and passwords, and an account page for your organization. Coming soon. To hear first when hosted trials open, write to sales@autoq-ai.com.
Tick this to enable Buy a hosted review. The store asks for it when you buy the site licence.
Online checkout for hosted reviews opens soon. Until then, and we'll send an invoice.
How ordering works
Already bought? Your order email from the store has the download link. If it has expired or gone missing, reply to that email and we'll send a new one.
Download
Your download link gives you these files. Check a file's SHA-256 fingerprint in PowerShell with Get-FileHash <file> before running it.
Enterprise Version 2.1 (2.1.0), published 2026-10-13. Includes the Data Center Security Review.
| File | Size | SHA-256 |
|---|---|---|
| DataCenterSecurityReview-Enterprise-Setup-2.1.0.exe Installer · Windows installer, Node.js included (recommended) | 72.1 MB | DA4DC90CD1A62025E830849868BF9FE4FD40AF5D774FB49C327C1979364E1532 |
| AutoQ-Enterprise-2.1.0.zip Zip package · For installing without the installer; needs Node.js 18 or later | 3.6 MB | E1E6628153E3F284A045FA9AD64D1B76AE4A7F8A6379D13E75CFACE9B5AE8ECB |
Documents
The Administrator Manual and the Administrator Quick Start come with your download, because they contain the default passwords, and so does the guide to building new questionnaires.
If AutoQ doesn't work for you, ask for a full refund within 30 days of your first licence purchase. Renewals can be cancelled before the renewal date. Refunds are issued by Lemon Squeezy to the original payment method.
A site licence covers one installation at one site, for any number of your staff and reviews, for one year. Your data stays on your network: we never receive your answers or workbooks. The licence agreement is the full and binding text.
Contact
Ask for a walkthrough, a standalone trial or a quote. Tell us how many data centers you review each year.
Admin
For the AutoQ team: the Store Manual and the online store's administration. This isn't the Admin tab of a review, which is for its audit lead.
The Admin tab works when this website is served by the AutoQ server.
Search the manuals
Find a word, phrase or section in all eight AutoQ manuals and open the master manual at that page.
View the workbooks
Every review's workbook, the content packs and the store's pack files, sheet by sheet, read-only.
A time-stamped line for every page visited: each tab of this website, the sign-in, reviews, the store, hosting sign-up and account pages, admin pages and the billing portal, kept in accesslog.txt in the server's data folder. Pictures and downloads aren't pages and aren't listed.
Loading…
On the server computer, open PowerShell with Run as administrator, go to the installation folder and run one of these. autostart.ps1 is already in the installation folder; the copy under Documents is the same file.
cd "C:\Program Files\Auto-Q" powershell -ExecutionPolicy Bypass -File .\autostart.ps1 install -Network # start at power-on, open to the network powershell -ExecutionPolicy Bypass -File .\autostart.ps1 status # is it running? powershell -ExecutionPolicy Bypass -File .\autostart.ps1 remove # stop starting automatically
Add -DryRun to see what install would do. For HTTPS add -Port 443 -HttpsPfx <file.pfx> -HttpsPassphrase <password> -HttpRedirectPort 80. Messages go to data\server.log. Administrator Manual, section 4.5.
Orders from the online store. Card payments are collected and invoiced by Lemon Squeezy. Purchase orders are invoiced here: Print invoice makes the invoice (numbered, due in 30 days) and opens it to print or save as PDF; Mark paid when the payment arrives. Hosted project subscriptions are billed by Lemon Squeezy and aren't listed.
| Order | Customer | Product | Amount | Invoice | Status |
|---|
Clients' hosted accounts on this server. Each account has an account administrator, who sees its projects' links and status and sets each project's lead and team passwords. Content packs offered for new projects are the folders in data\packs. Clients sign up themselves at /hosting/ while hosting is switched on.