>We are a two engineer team without a SOC audit and without a third party pen test that stores medical and financial data.

>These questionnaires are time consuming and redundant.

This is how data breaches happen. You should be willing to jump through a few, usually reasonable, hoops if you're storing medical and financial data.

Instead of looking for a quick-fix that will "suffice", you may consider actually securing the sensitive data you hold on other people.

Edit: After a little googling, I'm genuinely concerned about the product you are offering, at a firm of your size, with no compliance. Yikes from me.