Security and privacy at Control+S

Control+S handles assessment evidence, control decisions, recommendations, and remediation data. This page explains how we protect that data, how we use AI, which subprocessors support the service, and how to contact us about security.

Control+S processes the following categories of customer and account data:

• Customer-uploaded evidence and artifacts.
• Control mappings, maturity scores, recommendations, gaps, and notes.
• Account data, team membership, and authentication metadata.
• Support communications.
• Usage and audit metadata.

Do not upload production secrets, credentials, private keys, or regulated data unless your agreement and workspace configuration permit it.

Our current technical and organizational measures include:

• Encryption in transit — TLS 1.2 or higher for all traffic, enforced at the edge.
• Encryption at rest — provided by our managed infrastructure (Convex, Cloudflare) using industry-standard algorithms.
• Authentication — passwordless magic link, password, enterprise SSO (OIDC), and authenticator-app 2FA for password accounts.
• Authorization — role-based access control at organization and project level; least-privilege access to production systems.
• Sandbox isolation — AI analysis runs in short-lived, single-tenant cloud sandboxes with automatic cleanup.
• Secrets and tokens — scoped, time-bounded callback tokens; no long-lived credentials issued to sandboxes.
• Logging and monitoring — application, admin, and access activity logged for operational review.
• Backups and recovery — managed by our hosting provider, rotated on a standard cycle.
• Secure development — code review, automated dependency monitoring, and separation of development and production environments.
• Vendor management — Subprocessors are contractually bound to equivalent security and privacy obligations (see below).

• Your data is yours. Customers own the evidence, assessments, and other content they upload. We process it only to provide the Service.
• No model training. Customer Content is not used to train generative AI models.
• Zero Data Retention inference. AI inference is routed through OpenRouter with ZDR enforced, restricting traffic to endpoints where prompts and responses are not stored by the model provider.
• Tenant isolation. Customer-specific assessment context is scoped to the relevant tenant and analysis job.
• Sandbox execution. Evidence analysis runs in short-lived, single-tenant E2B sandboxes with scoped callback tokens.
• Reviewer responsibility. AI suggestions are draft analysis. Control+S does not treat model output as final assessment evidence. Reviewers remain responsible for accepting mappings, ratings, gaps, and recommendations.

Data residency, export, deletion, and retention are described in the Privacy Policy.

Control+S is not currently certified under SOC 2, ISO 27001, or similar third-party audit frameworks. We maintain internal security controls and can provide security information for reasonable customer and prospective-customer diligence requests. We do not claim compliance that has not been independently verified.

If your organization has specific compliance requirements (for example, a Data Processing Agreement, subprocessor review, or security questionnaire), write to contact@controls.run and we will work with you.

We use a small number of third-party services to operate Control+S. Each is listed below with its purpose and data location.

List last reviewed 2026-04-21.

Customers authorize the subprocessors listed above when they begin using the Service or accept our DPA. We keep this list current and record material additions or replacements in the change log below and in the public Trust updates RSS feed. Customers with an active Data Processing Agreement may object on reasonable grounds as described in the DPA.

If you believe you have discovered a security vulnerability in Control+S, please report it to contact@controls.run. Do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond. We appreciate responsible disclosure and will credit researchers who prefer public acknowledgment. See our security.txt for the machine-readable contact.

We record material changes to our trust posture here, including subprocessor additions or removals, policy updates, and certification milestones.

• 2026-04-21
  • Consolidated AI inference through OpenRouter with Zero Data Retention (ZDR) enforced at the account level. Underlying providers (OpenAI, Anthropic, and others on the ZDR list) do not retain prompts or responses, and do not use them for model training.
  • Subprocessor change: removed Anthropic (direct API), added OpenRouter (inference layer).
• 2026-04-18
  • Initial publication of Terms of Service, Privacy Policy, Data Processing Agreement, and Trust page.
  • Published subprocessor list: Convex, Cloudflare, E2B, Anthropic, Stripe, Kong Konnect, Mailtrap.
  • Published security.txt for vulnerability disclosure.

For security, privacy, trust, or compliance questions, email contact@controls.run. For postal correspondence: ShadeSec Inc., Toronto, Ontario, M6K 3N4, Canada.