Security & Data Processing

Security overview

CommitControl is designed with a security-first architecture appropriate for enterprise CRM and commercial operations environments. Core controls include tenant-isolated architecture, role-based access controls, least privilege principles, encrypted transport using TLS 1.2+, MFA for administrative access, audit logging, infrastructure monitoring, backup and recovery procedures, secure OAuth integration handling, vulnerability management, incident response procedures, and secure software development lifecycle practices.

CommitControl continuously evaluates and improves its operational security posture.

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the principal agreement between ZeusGlobal Nexus Limited, a private company limited by shares registered in Ireland (company no. 820109), registered office 77 Camden Street Lower, Dublin D02 XE80, trading as CommitControl.com ("Processor"), and the CommitControl customer ("Controller"). This DPA governs the processing of Company Personal Data by CommitControl in connection with the provision of the Service. CommitControl acts as a Processor on behalf of the Customer, and the Customer acts as the Controller.

Services

The Services include operation of the CommitControl.com platform, CRM integrations, user management, authentication, subscription management, billing support, analytics and reporting, customer support, notifications, operational telemetry, backups, and related support services.

Categories of personal data

CommitControl may process names, email addresses, telephone numbers, job titles, CRM contact records, sales opportunity data, usage and telemetry data, IP addresses, authentication metadata, support communications, uploaded customer business data, cookies, and identifiers.

Processing purposes

Processing purposes include account provisioning, platform operation, CRM integration support, billing and subscription management, analytics and reporting, customer support, fraud prevention, security monitoring, legal compliance, and product improvement.

Processing instructions

CommitControl shall process personal data only on documented instructions from the Customer, as required by the principal agreement, or as required by applicable law. If CommitControl believes an instruction violates applicable data protection law, CommitControl shall promptly notify the Customer.

Subprocessors

CommitControl may engage approved subprocessors. CommitControl shall maintain a current subprocessor list, provide notice of material changes, impose equivalent data protection obligations, and remain responsible for subprocessor compliance. Customers may reasonably object to new subprocessors on data protection grounds.

Subprocessors of Customer Personal Data

These providers process personal data that you entrust to CommitControl under the principal agreement.

• Clerk: authentication and identity, US/EU.
• AWS: cloud infrastructure, EU (Frankfurt, eu-central-1).
• Stripe: billing and payments, global.
• Vercel: frontend hosting, global.
• Cloudflare: CDN and security, global.
• Doppler: secrets management, US.
• Customer.io: product and lifecycle email to your users, EU.
• Sentry: application error monitoring, EU. Configured with user identification and request bodies disabled, so diagnostic events carry the technical fault and not the person or the pipeline figures that triggered it.
• OpenAI: AI explanation layer (Ledger), US. Receives the figures already calculated for the view being explained, such as deal value, stage, forecast category and probability, with opportunities referenced by Salesforce record id. Account, opportunity and owner names are removed from structured figures before transmission. It also receives the text of questions submitted to Ledger. It does not calculate or change any figure. Engaged through OpenAI Ireland Limited, with onward transfer to the US under the EU Standard Contractual Clauses. Under OpenAI's API terms this data is not used to train its models, and it is retained for up to 30 days for abuse monitoring before deletion.

Website and marketing providers

These providers do not process Customer Personal Data. They are listed for transparency because they process data about visitors to commitcontrol.com and about prospective customers, where CommitControl acts as controller rather than processor. Nothing you entrust to us under the principal agreement reaches them.

• PostHog: website analytics, EU.
• Formspree: website enquiry and lead form delivery, US.
• Apollo: business contact data for our own outbound marketing, US. See our Privacy Policy for how we obtain and process prospect data, and how to object.

Where you enable an optional messaging integration, data you direct CommitControl to send (such as a Weekly Risk Briefing) is shared with that platform: Slack (US/EU) or Microsoft Teams (global). These integrations are optional, enabled by you, and can be disconnected at any time.

Security measures

CommitControl shall implement appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit, encryption at rest where appropriate, role-based access controls, least privilege access, MFA for administrative access, audit logging, vulnerability management, security monitoring, backup and recovery procedures, incident response capabilities, and secure development practices.

CommitControl personnel access

CommitControl personnel hold no standing administrative access to Customer workspaces. A CommitControl-controlled administrative account is required by our authentication subprocessor to create a workspace, and is automatically removed once the Customer's own administrator is established.

Thereafter, access to a Customer workspace is granted only under a documented break-glass procedure and only where required for Customer-authorised support, a security investigation, or a binding legal obligation. Each grant records a stated reason, is logged, is limited in scope and duration, and is revoked on completion. CommitControl shall inform the Customer where access has been exercised for support purposes.

CommitControl personnel who may be granted such access are bound by confidentiality obligations.

Personal data breaches

CommitControl shall notify the Customer without undue delay and no later than 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notifications shall include the nature of the breach, categories of data affected, approximate impact, mitigation measures, remediation steps, and contact details for follow-up.

International transfers

CommitControl shall not transfer personal data outside the EEA without appropriate safeguards. Where applicable, safeguards may include EU Standard Contractual Clauses, adequacy decisions, and contractual protections.

Data retention and deletion

Upon termination of Services, Customer may request return of data. CommitControl shall securely delete or return Customer Personal Data within 30 days unless otherwise required by law. CommitControl may retain limited archived data where legally required.

Audit rights

CommitControl shall provide reasonable information necessary to demonstrate compliance. Customers may review security documentation, rely on third-party audit reports, or request reasonable audits subject to confidentiality obligations.

Data subject requests

CommitControl shall provide reasonable assistance with access requests, deletion requests, portability requests, objection requests, and regulatory obligations.

Liability

Liability under this DPA shall align with the principal agreement except where prohibited by law. Nothing limits liability for fraud, willful misconduct, or unlawful exclusion of GDPR obligations.

Governing law

This DPA is governed by the laws of Ireland. The Irish courts shall have exclusive jurisdiction.

Contact

ZeusGlobal Nexus Limited, trading as CommitControl.com. Email: legal@commitcontrol.com.

Effective date: Sunday, May 17, 2026.