[Control+S](/)[Back to app](/home) # Security and privacy at Control+S How we protect assessment data, use language models, manage subprocessors, and handle security reports. Effective 2026-10-13 [Overview](#overview)[Data](#data)[Security](#security)[Model use](#ai)[Subprocessors](#subprocessors)[FAQs](#faqs)[Report a vulnerability](#vulnerability)[Updates](#updates) Encryption in transit TLS 1.2 or higher, enforced at the edge Encryption at rest Managed by our infrastructure providers MFA support Authenticator-app 2FA for password accounts; SSO MFA via identity provider Sandbox isolation Short-lived, isolated per-job sandboxes No model training Customer data is never used to train models Least-privilege access Role-based access at assessment and framework level Audit logs Application, admin, and access activity logged for operational review Choice of region Dedicated instances can store data in Canada, the US, the EU, or Australia ## Overview Control+S handles assessment evidence, control decisions, recommendations, and remediation data. This page explains how we protect that data, how we use language models, which subprocessors support the service, and how to contact us about security. ## Data we process Control+S processes the following categories of customer and account data: - Customer-uploaded evidence and artifacts. - Control mappings, maturity scores, recommendations, gaps, and notes. - Account data, team membership, and authentication metadata. - Support communications. - Usage and audit metadata. Do not upload production secrets, credentials, private keys, or regulated data unless your agreement and workspace configuration permit it. ## Security practices Our current technical and organizational measures include: - **Encryption in transit**: TLS 1.2 or higher for all traffic, enforced at the edge. - **Encryption at rest**: provided by our managed infrastructure (Convex, Cloudflare) using industry-standard algorithms. - **Authentication**: passwordless magic link, password, enterprise SSO (OIDC), and authenticator-app 2FA for password accounts. - **Authorization**: role-based access control at assessment and framework level; least-privilege access to production systems. - **Sandbox isolation**: evidence analysis runs in short-lived, isolated cloud sandboxes created per job and destroyed on completion. - **Secrets and tokens**: scoped, time-bounded callback tokens; no long-lived credentials issued to sandboxes. - **Logging and monitoring**: application, admin, and access activity logged for operational review. - **Backups and recovery**: daily encrypted database backups, plus a daily encrypted offsite copy for dedicated instances, kept in the instance’s region. Stored files keep prior versions for 30 days. Restores are tested at least once a year. - **Secure development**: automated code review before each production release, continuous monitoring of dependencies for known vulnerabilities, and separate development and production environments. - **Vendor management**: Subprocessors are contractually bound to equivalent security and privacy obligations (see below). ## Model use - **Your data is yours.** Customers own the evidence, assessments, and other content they upload. We process it only to provide the Service. - **No model training.** Customer Content is not used to train models. - **Enterprise model processing.** Language model requests run on Microsoft Azure through ShadeSec’s enterprise account, routed by OpenRouter, which does not store them. On the main instance, fallback providers are limited to Zero Data Retention (ZDR) endpoints. Dedicated instances can be limited to Azure only. - **Tenant isolation.** Customer-specific assessment context is scoped to the relevant tenant and analysis job. - **Sandbox execution.** Evidence analysis runs in short-lived, isolated E2B sandboxes created per job, with scoped callback tokens. - **Reviewer responsibility.** Suggested mappings and scores are draft analysis. Control+S does not treat model output as final assessment evidence. Reviewers remain responsible for accepting mappings, ratings, gaps, and recommendations. Data residency, export, deletion, and retention are described in the [Privacy Policy](/privacy). ## Compliance We maintain internal security controls and can provide security information for reasonable customer and prospective-customer diligence requests. If your organization has specific compliance requirements (for example, a Data Processing Agreement, subprocessor review, or security questionnaire), write to contact@controls.run and we will work with you. ## Subprocessors We use a small number of third-party services to operate Control+S. Where data is processed depends on the instance. The table shows where each service runs for the main instance at controls.run, and the locations available to customers with a dedicated instance. We confirm a dedicated instance’s locations in writing when it is set up. Dedicated instances can also keep evidence files with another S3-compatible storage provider in the customer’s region. A provider not listed here is added to this list before it receives customer data. Service Purpose Main instance Dedicated instance options Added [Convex](https://www.convex.dev) Application database and backups; evidence file storage on the main instance United States (AWS US East, Virginia) United States (Virginia), Canada (Montreal), European Union (Ireland), or Australia (Sydney) 2026-04-18 [OVHcloud](https://www.ovhcloud.com) Evidence file storage for dedicated instances Not used Canada (Beauharnois, Quebec) or Europe 2026-07-14 [E2B](https://e2b.dev) Short-lived, isolated sandboxes for evidence analysis United States United States or European Union 2026-04-18 [Microsoft Azure](https://azure.microsoft.com) Language model processing through ShadeSec's enterprise Azure account. Prompts and outputs are not used to train models. Global Azure processing Global, United States or European Union data zone, or a single Azure region where the model is offered 2026-10-08 [OpenRouter](https://openrouter.ai) Routes model requests to ShadeSec's Azure account without storing them. On the main instance, if Azure is unavailable, requests can fall back to other providers restricted to Zero Data Retention (ZDR) endpoints. United States United States; can be limited to Azure only, with no fallback 2026-04-21 [Cloudflare](https://www.cloudflare.com) Edge routing, static asset hosting, DDoS protection, transactional email (magic links, invites, notifications), and diagnostic logs of analysis runs Global edge network; diagnostic logs in North America Global edge network 2026-04-18 [PostHog](https://posthog.com) Product analytics and error tracking European Union European Union 2026-07-14 [Stripe](https://stripe.com) Payment processing and subscription billing United States and Ireland United States and Ireland, when card billing is used 2026-04-18 List last reviewed 2026-10-08. ## Subprocessor change notices Customers authorize the subprocessors listed above when they begin using the Service or accept our DPA. We keep this list current and record material additions or replacements in the change log below and in the public [Trust updates RSS feed](/trust-updates.xml). Customers with an active Data Processing Agreement may object on reasonable grounds as described in the [DPA](/dpa). ## Frequently asked questions Where is my data stored?+ It depends on your instance. The main instance at controls.run stores application data, evidence, and backups in the United States (AWS US East) with our backend provider, Convex. Dedicated instances can keep their database in the United States, Canada (Montreal), the European Union (Ireland), or Australia (Sydney), and their evidence files with an S3-compatible storage provider in the same region, such as OVHcloud in Quebec. The [Subprocessors](#subprocessors) section lists where each service runs for the main instance and the options for dedicated instances. Is my data used to train models?+ No. Customer Content (evidence, assessments, uploads) is never used to train models. Language model requests run on Microsoft Azure through ShadeSec’s enterprise account, where prompts and outputs are not used for training. On the main instance, if Azure is unavailable, OpenRouter can send requests to other providers, limited to its Zero Data Retention (ZDR) endpoints, which do not store prompts or responses. OpenRouter publishes those endpoints at [openrouter.ai/docs/guides/features/zdr](https://openrouter.ai/docs/guides/features/zdr). Dedicated instances can be limited to Azure only. What is your breach notification timeline?+ If a breach affects Customer Personal Data, we notify affected Customers without undue delay and no later than 72 hours after becoming aware. Full terms are in the [Data Processing Agreement](/dpa). Can I export my data? What happens if I cancel?+ You can download supported reports and evidence files where those product features are available. Broader current-state workspace export is planned but not yet generally available. If you need reasonable assistance retrieving supported workspace data before cancellation or termination, contact us. We delete Customer Content from live systems within 90 days after termination, and backup copies are permanently erased within 60 days, unless law requires retention. Full retention schedule is in the [Privacy Policy](/privacy). Do you offer a Data Processing Agreement (DPA)?+ Yes. Our standalone [DPA](/dpa) is designed to address Article 28-style processor terms, incorporates the EU Standard Contractual Clauses where applicable, and is accepted alongside the Terms of Service. A counter-signed copy is available on request to contact@controls.run. How do you handle access control within my assessment?+ Role-based access at the assessment and framework level. Owners can invite, remove, and change roles for members. Authentication supports passwordless magic link, password, and enterprise SSO (OIDC). Password accounts can enable authenticator-app 2FA; SSO customers can enforce MFA through their identity provider. How do I get a security questionnaire answered?+ Send your questionnaire (SIG Lite, CAIQ, or custom) to contact@controls.run. We typically respond within five business days. For common enterprise questions, much of the information you need is already on this page. ## Reporting a vulnerability If you believe you have discovered a security vulnerability in Control+S, please report it to contact@controls.run. Do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond. We appreciate responsible disclosure and will credit researchers who prefer public acknowledgment. See our [security.txt](/.well-known/security.txt) for the machine-readable contact. ## Updates We record material changes to our trust posture here, including subprocessor additions or removals, policy updates, and certification milestones. - 2026-10-13 - Backups: daily encrypted database backups, a daily encrypted offsite copy for dedicated instances kept in the instance's region, and restores tested at least once a year. Backup copies are permanently erased within 60 days. - Breach notification: we notify affected Customers no later than 72 hours after becoming aware, for every Customer, in the Trust page, Privacy Policy and DPA. - Secure development: automated code review before each production release and continuous monitoring of dependencies for known vulnerabilities. - Privacy Policy: data locations now state that dedicated instances store their database, files, and backups in the customer's agreed region. - 2026-10-08 - Added Microsoft Azure as a subprocessor. Language model requests run on ShadeSec's enterprise Azure account, routed through OpenRouter. - The subprocessor list now shows where each service runs for the main instance and the locations available to dedicated instances, including Convex database hosting in Canada (Montreal), the European Union, and Australia. - Cloudflare's listed purpose now includes diagnostic logs of analysis runs. - 2026-07-17 - Completed consolidation of all evidence-analysis inference through OpenRouter across environments. The subprocessor description now states that underlying model providers vary by task and remain restricted to ZDR-compliant endpoints, rather than naming a fixed provider list. - 2026-07-14 - Added PostHog (product analytics) as a subprocessor. - Added OVHcloud (Canadian cloud hosting and file storage) as a subprocessor. - 2026-04-21 - Consolidated AI inference through OpenRouter with Zero Data Retention (ZDR) enforced at the account level. Underlying providers (OpenAI, Anthropic, and others on the ZDR list) do not retain prompts or responses, and do not use them for model training. - Subprocessor change: removed Anthropic (direct API), added OpenRouter (inference layer). - 2026-04-18 - Initial publication of Terms of Service, Privacy Policy, Data Processing Agreement, and Trust page. - Published subprocessor list: Convex, Cloudflare, E2B, Anthropic, Stripe. - Published security.txt for vulnerability disclosure. ## Contact For security, privacy, trust, or compliance questions, email contact@controls.run. [Terms](/terms)[Privacy](/privacy)[DPA](/dpa)[Trust](/trust)[security.txt](/.well-known/security.txt)© 2026 ShadeSec Inc. Canonical page: https://controls.run/trust