TrustCenter

Security review cost calculator

Five questions about your review load, and a Canadian dollar figure for what answering security reviews costs you each year. Nothing is emailed unless you ask.

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

This works out what security reviews cost you in staff time, from your own volume and rate rather than an industry average. The result shows the annual cost, where the hours go, and what a trust centre would remove. Every figure is Canadian dollars.

How many security questionnaires do you complete in a quarter?

Count custom spreadsheets, SIGs, CAIQs and vendor portal assessments.

How long does a typical questionnaire take, all in?

Include finding answers and chasing colleagues, not only typing.

How many document requests and one-off security emails a quarter?

SOC 2 report requests, NDA back-and-forth, single questions from sales.

Who mostly does this work?

This sets the loaded hourly rate the calculation uses.

Has a deal slipped because of a slow security answer in the last year?

How the estimate is built

Questionnaires per quarter are taken at the middle of the band you picked, multiplied by four and by the hours each takes. Document requests and one-off emails count as half an hour each. The loaded rate is $150 CAD an hour for a CTO or co-founder, $125 for a senior engineer, $110 for a security lead and $100 for sales staff. Those are planning figures, not salary data. A trust centre is assumed to remove about half of the request time and a quarter of the questionnaire time, because reviewers self-serve basic answers and some accept a standard questionnaire instead of their own.

The cost page explains every line, and managed trust centres covers handing the hours off.

Common questions

Why does the rate depend on who does the work?

Because the real cost is what that person would otherwise be doing. An hour of a CTO's time on questionnaires is an hour off the product, so the calculator uses a higher loaded rate for founders.

Does this include the cost of slipped deals?

It flags the risk but does not price it, because only you know your deal sizes. One slipped enterprise deal often outweighs a year of review hours.

Compare the figure with a managed quote

Providers quote on your review volume, so bring these numbers.

Get matched