Security at CommitControl

Security philosophy

CommitControl is designed around least privilege, tenant isolation, operational transparency, and controlled access to customer data. Security and data protection principles are embedded into the design, deployment, and operation of the platform.

The platform is intentionally architected to minimise unnecessary access to customer information, isolate customer environments logically at the data layer, secure authentication and session management, reduce operational attack surface, maintain auditability of critical platform actions, and support GDPR-aligned data handling practices.

Infrastructure and hosting

CommitControl operates using modern cloud infrastructure providers and managed services selected for reliability, operational security, and scalability. The application and customer CRM storage run on Amazon Web Services in AWS Europe (Frankfurt, eu-central-1). The explanation layer has limited US processing disclosed below and in the DPA. Production storage volumes are encrypted at rest.

Core infrastructure components may include cloud infrastructure, secure frontend hosting, managed authentication, encrypted payment processing, secrets management, monitoring, and logging services. Customer data is logically segregated within the platform architecture.

Authentication and access control

CommitControl implements identity and access management controls designed to restrict access to authorised users only. Customer accounts are scoped to a single tenant, and administrative production access is limited to authorised personnel with operational need.

• Role-based access controls and least privilege access principles.
• Multi-factor authentication for privileged administrative access.
• Secure password handling through managed authentication providers.
• Session validation, token-based authentication, access logging, and monitoring.

Workspace provisioning and staff access

Your CommitControl workspace is created through our managed authentication provider, which requires a creating identity at the moment a workspace is created. That role is held by a CommitControl-controlled administrative account on our own domain. That account exists to satisfy the creation requirement and holds no standing access: when you accept your invitation and your own administrator account is established, it is automatically removed from your workspace.

After that point, CommitControl staff hold no standing administrative membership of your workspace and no route into your pipeline data through the product interface.

Access can be re-established only through a documented break-glass procedure, and only for customer-authorised support, a security investigation, or a binding legal obligation. Each grant records a reason, is logged, is limited to the work in question, and is revoked when that work is complete. Where access is granted for support, you are told what was accessed and when it ended.

Encryption and data protection

CommitControl uses encryption and secure transmission controls to protect customer information.

• In transit: TLS 1.2+ for connections to CommitControl domains.
• At rest: encryption is applied where appropriate across database storage, object stores, and backups.
• Secrets: API keys, credentials, and OAuth tokens are handled through secure secrets management procedures and are not intentionally exposed in application source code repositories.

AI processing and what reaches the model provider

Structured figures are sent without customer, opportunity or person names. This applies to the fact sheets and briefing payloads that CommitControl prepares for the model. User-entered Ledger questions are a separate input.

• Ledger chat: the fact sheet sent to the model refers to opportunities and people only by opaque handles. The mapping from handle to real name stays in your browser, and names are re-inserted into the answer after it returns.
• Briefings and scoring evidence: account name, opportunity name, and owner name are stripped from every payload before it leaves our infrastructure. Opportunities are referenced to the model by their Salesforce record id, so the reasoning stays traceable to a specific deal without the deal being named.

Both mechanisms are covered by automated tests that fail the build if the behaviour changes. The language layer describes arithmetic that has already been computed from your records. It does not produce figures and cannot alter them.

The model provider is OpenAI, processing in the US. It receives the name-stripped structured figures described above and the text of questions submitted to Ledger. OpenAI and the transfer basis are listed in the sub-processor list at /dpa.

Tenant isolation and data segregation

CommitControl is designed as a multi-tenant SaaS platform with logical tenant separation. Controls may include tenant-aware access validation, row-level security enforcement, scoped authentication tokens, tenant-bound query controls, application-layer permission checks, and isolated customer data visibility.

CommitControl is designed to prevent customers from accessing data belonging to other customers. Staff hold no standing administrative access to customer workspaces, and do not access customer CRM data except where required for customer-authorised support, reliability, security, or legal obligations, through the break-glass procedure described above.

Logging, monitoring, and auditability

CommitControl maintains operational logging and monitoring designed to support security investigations, operational troubleshooting, incident response, platform reliability, and auditability of critical actions. Logging may include authentication events, access activity, API activity, error monitoring, infrastructure telemetry, and privileged access monitoring.

Logs are retained according to operational and legal requirements.

Vulnerability management

CommitControl maintains security maintenance procedures intended to reduce known security risks. These activities may include dependency management, vulnerability scanning, security patching, configuration reviews, infrastructure hardening, secure deployment practices, and periodic security reviews.

CommitControl may engage third-party security testing providers where appropriate.

Secure development practices

CommitControl follows secure software development practices designed to reduce operational and application-layer risk. Practices may include code review procedures, controlled deployment workflows, environment separation, secrets management, dependency review, principle of minimal exposure, and production access restrictions.

Security considerations are evaluated during development and deployment workflows.

Backups and recovery

CommitControl maintains operational backup and recovery procedures designed to support platform resilience. These measures may include encrypted backups where appropriate, periodic backup validation, recovery procedures, infrastructure redundancy where operationally feasible, and disaster recovery planning.

Recovery objectives may vary depending on infrastructure providers and service tier.

Incident response

CommitControl maintains an incident response process designed to identify and contain security incidents, investigate operational impact, remediate vulnerabilities, restore affected services, and comply with applicable notification obligations.

Where required under applicable law or contractual obligations, CommitControl will notify affected customers of confirmed security incidents involving customer data.

Data protection and GDPR

CommitControl is designed with GDPR-aware operational controls and contractual safeguards. Depending on the context, CommitControl may act as a controller for account and business operations data and as a processor for customer CRM and uploaded business data.

CommitControl provides a Privacy Policy, a Security & Data Processing page, subprocessor transparency, and customer data deletion and export on request (email legal@commitcontrol.com; we respond within 30 days).

Compliance

CommitControl runs practical technical and organisational controls aligned with industry-standard SaaS security practices, and continuously evaluates its operational security posture as the product and customer requirements grow. For our full security posture, including the detail security teams assess during due diligence, request the security pack.

Shared responsibility

Customers are responsible for maintaining appropriate user access controls, securing endpoint devices, managing internal CRM permissions, protecting account credentials, and configuring lawful data usage within their organisation. Security is a shared responsibility between CommitControl and the customer.

Subprocessors

The current subprocessor list lives in our Security & Data Processing page. CommitControl uses third-party subprocessors and infrastructure providers to support operation of the Service, including hosting, authentication, billing, frontend hosting, CDN/security, secrets management, and customer-connected CRM integrations.

Full posture package

A more detailed security posture package is available on request for customer security reviews, procurement workflows, and enterprise onboarding. To request it, email security@commitcontrol.com or legal@commitcontrol.com.

Vulnerability disclosure

If you believe you've found a security issue, please email security@commitcontrol.com. We aim to acknowledge reports within two business days. Machine-readable contact details are at /.well-known/security.txt.

Please give us a reasonable window to investigate and fix before any public disclosure. We won't pursue legal action against researchers who act in good faith and stay within the scope of this policy.

Contact

Security questions: security@commitcontrol.com. Data protection / GDPR: legal@commitcontrol.com.

Last updated: Thursday, May 21, 2026.