Security and privacy at Control+S

Control+S handles assessment evidence, control decisions, recommendations, and remediation data. This page explains how we protect that data, how we use language models, which subprocessors support the service, and how to contact us about security.

Control+S processes the following categories of customer and account data:

• Customer-uploaded evidence and artifacts.
• Control mappings, maturity scores, recommendations, gaps, and notes.
• Account data, team membership, and authentication metadata.
• Support communications.
• Usage and audit metadata.

Do not upload production secrets, credentials, private keys, or regulated data unless your agreement and workspace configuration permit it.

Our current technical and organizational measures include:

• Encryption in transit: TLS 1.2 or higher for all traffic, enforced at the edge.
• Encryption at rest: provided by our managed infrastructure (Convex, Cloudflare) using industry-standard algorithms.
• Authentication: passwordless magic link, password, enterprise SSO (OIDC), and authenticator-app 2FA for password accounts.
• Authorization: role-based access control at assessment and framework level; least-privilege access to production systems.
• Sandbox isolation: evidence analysis runs in short-lived, isolated cloud sandboxes created per job and destroyed on completion.
• Secrets and tokens: scoped, time-bounded callback tokens; no long-lived credentials issued to sandboxes.
• Logging and monitoring: application, admin, and access activity logged for operational review.
• Backups and recovery: daily encrypted database backups, plus a daily encrypted offsite copy for dedicated instances, kept in the instance’s region. Stored files keep prior versions for 30 days. Restores are tested at least once a year.
• Secure development: automated code review before each production release, continuous monitoring of dependencies for known vulnerabilities, and separate development and production environments.
• Vendor management: Subprocessors are contractually bound to equivalent security and privacy obligations (see below).

• Your data is yours. Customers own the evidence, assessments, and other content they upload. We process it only to provide the Service.
• No model training. Customer Content is not used to train models.
• Enterprise model processing. Language model requests run on Microsoft Azure through ShadeSec’s enterprise account, routed by OpenRouter, which does not store them. On the main instance, fallback providers are limited to Zero Data Retention (ZDR) endpoints. Dedicated instances can be limited to Azure only.
• Tenant isolation. Customer-specific assessment context is scoped to the relevant tenant and analysis job.
• Sandbox execution. Evidence analysis runs in short-lived, isolated E2B sandboxes created per job, with scoped callback tokens.
• Reviewer responsibility. Suggested mappings and scores are draft analysis. Control+S does not treat model output as final assessment evidence. Reviewers remain responsible for accepting mappings, ratings, gaps, and recommendations.

Data residency, export, deletion, and retention are described in the Privacy Policy.

We maintain internal security controls and can provide security information for reasonable customer and prospective-customer diligence requests.

If your organization has specific compliance requirements (for example, a Data Processing Agreement, subprocessor review, or security questionnaire), write to contact@controls.run and we will work with you.

We use a small number of third-party services to operate Control+S. Where data is processed depends on the instance. The table shows where each service runs for the main instance at controls.run, and the locations available to customers with a dedicated instance. We confirm a dedicated instance’s locations in writing when it is set up.

Dedicated instances can also keep evidence files with another S3-compatible storage provider in the customer’s region. A provider not listed here is added to this list before it receives customer data.

List last reviewed 2026-10-08.

Customers authorize the subprocessors listed above when they begin using the Service or accept our DPA. We keep this list current and record material additions or replacements in the change log below and in the public Trust updates RSS feed. Customers with an active Data Processing Agreement may object on reasonable grounds as described in the DPA.

If you believe you have discovered a security vulnerability in Control+S, please report it to contact@controls.run. Do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond. We appreciate responsible disclosure and will credit researchers who prefer public acknowledgment. See our security.txt for the machine-readable contact.

We record material changes to our trust posture here, including subprocessor additions or removals, policy updates, and certification milestones.

• 2026-10-13
  • Backups: daily encrypted database backups, a daily encrypted offsite copy for dedicated instances kept in the instance's region, and restores tested at least once a year. Backup copies are permanently erased within 60 days.
  • Breach notification: we notify affected Customers no later than 72 hours after becoming aware, for every Customer, in the Trust page, Privacy Policy and DPA.
  • Secure development: automated code review before each production release and continuous monitoring of dependencies for known vulnerabilities.
  • Privacy Policy: data locations now state that dedicated instances store their database, files, and backups in the customer's agreed region.
• 2026-10-08
  • Added Microsoft Azure as a subprocessor. Language model requests run on ShadeSec's enterprise Azure account, routed through OpenRouter.
  • The subprocessor list now shows where each service runs for the main instance and the locations available to dedicated instances, including Convex database hosting in Canada (Montreal), the European Union, and Australia.
  • Cloudflare's listed purpose now includes diagnostic logs of analysis runs.
• 2026-07-17
  • Completed consolidation of all evidence-analysis inference through OpenRouter across environments. The subprocessor description now states that underlying model providers vary by task and remain restricted to ZDR-compliant endpoints, rather than naming a fixed provider list.
• 2026-07-14
  • Added PostHog (product analytics) as a subprocessor.
  • Added OVHcloud (Canadian cloud hosting and file storage) as a subprocessor.
• 2026-04-21
  • Consolidated AI inference through OpenRouter with Zero Data Retention (ZDR) enforced at the account level. Underlying providers (OpenAI, Anthropic, and others on the ZDR list) do not retain prompts or responses, and do not use them for model training.
  • Subprocessor change: removed Anthropic (direct API), added OpenRouter (inference layer).
• 2026-04-18
  • Initial publication of Terms of Service, Privacy Policy, Data Processing Agreement, and Trust page.
  • Published subprocessor list: Convex, Cloudflare, E2B, Anthropic, Stripe.
  • Published security.txt for vulnerability disclosure.

For security, privacy, trust, or compliance questions, email contact@controls.run.