This is the security review, answered before you ask. A total of fourteen sections, covering every question a procurement team sends us, including the ones where the answer is no. Send this to your security reviewer instead of waiting three weeks for us to fill in their spreadsheet.
CO-01Who is the legal entity behind CommitControl?
ZeusGlobal Nexus Limited, a private company limited by shares registered in Ireland, company number 820109. Registered office: 77 Camden Street Lower, Dublin D02 XE80. CommitControl is its product.
CO-02Who do we contact for security and data protection matters?
Security: security@commitcontrol.com. Data protection and GDPR: legal@commitcontrol.com. Machine-readable contact details are published at /.well-known/security.txt.
CO-03Who is accountable for security at CommitControl?
Security accountability sits with the founder directly rather than with a delegated function, and support is not tiered. In practice that means the person answering your security questions is the person who wrote the code, and there is no layer between you and a straight answer. Where this document says no, that is why it says no rather than routing you to someone who will say maybe.
CO-04Is CommitControl established in the EU, or do we need an Article 27 representative?
We are established in Ireland, inside the EU. No Article 27 representative is required.
HO-01Where is customer data hosted?
Production runs on Amazon Web Services in AWS Europe, Frankfurt (eu-central-1). Customer data is hosted within the European Union.
HO-02Is any customer data stored or processed outside the EEA?
Customer CRM and pipeline data stays in the EU. Some operational sub-processors are US or global entities. Those are named individually in section 4, with the transfer safeguard for each.
HO-03Is data encrypted at rest?
Yes. Production storage volumes are encrypted at rest, and encryption is applied across database storage, object stores, and backups.
HO-04What is the hosting model? Single tenant or multi tenant?
Multi-tenant, with logical isolation enforced at the database layer. See section 6. We do not currently offer single-tenant or on-premise deployment. If that is a hard requirement for you, say so early, because the honest answer today is that we cannot meet it.
HO-05Can we require a specific region other than Frankfurt?
Not today. Every tenant runs in eu-central-1. We would rather tell you that now than describe a regional capability we have not built.
DP-01Is CommitControl a controller or a processor?
Both, depending on the data. We are a processor for customer CRM data, uploaded business data, and forecasting inputs that you direct us to handle. We are a controller for account, billing, and our own business operations data.
DP-02How do you handle a right of access request under Article 15?
As a tested endpoint, not a manual database trawl. A tenant-scoped export returns every tenant table as structured JSON, including the audit log, stamped with the time of export and the operator who ran it. The export writes its own audit record, so the act of exporting is itself auditable.
DP-03How do you handle erasure under Article 17?
Erasure runs as a single database transaction. It cascades from child tables to parent tables and finally removes the tenant row, so there is no state in which a tenant is half deleted. If any step fails, the whole operation rolls back and nothing is removed.
Audit logs are the deliberate exception. Those are anonymised rather than deleted, because a security audit trail that can be erased on request is simply not an audit trail. The list of tables that erasure deliberately does not delete is held in code as data, with the reason recorded against each entry, so the exclusions can be reviewed rather than discovered.
DP-04How do you know erasure stays complete as the product grows?
A drift test. New tables get added to a product over time, and the usual failure mode is that erasure silently stops being complete because nobody remembered to extend it. Our test suite fails if a tenant-scoped table exists that erasure neither deletes nor explicitly excludes with a stated reason. Incomplete erasure breaks the build rather than being found during your audit.
DP-05Does erasure reach your downstream tools, or only your own database?
It reaches downstream. Deleting a tenant also deletes the corresponding profile in our marketing automation platform as part of the same operation. If that downstream deletion fails, the response says so explicitly rather than reporting success, so the operator knows there is a profile left to remove by hand before the request can be closed.
DP-06What is your response time for a data subject request?
Within 30 days, per Article 12(3). Requests go to legal@commitcontrol.com. In practice the technical work is an endpoint call, so the constraint is verification of the requester, not engineering time.
DP-07Can customers run export and erasure themselves?
Not today. Both are operator-run endpoints behind an authorisation check, executed on your written request. Customer-facing self-service is scheduled for November 2026. We are telling you it is operator-run rather than describing it as a customer-facing feature it is not.
DP-08What is your legal basis for processing?
Contract performance for providing the service, authenticating users, supporting integrations, and delivering reporting. Legitimate interests for security, fraud prevention, monitoring, and reliability, subject to balancing. Consent where law requires it. Full detail is in the Privacy Policy.
DP-09Do you have a Data Protection Officer?
No, and one is not required. We do not carry out large-scale systematic monitoring or large-scale processing of special category data under Article 37. Data protection matters are handled by the founder directly.
DP-10Will you sign our DPA?
We publish our own GDPR-aligned DPA at /dpa, which most reviews accept as-is. We will review yours. Send it to legal@commitcontrol.com.
SU-01Who are your sub-processors?
The current list is maintained at /dpa and is the authoritative version. It names each provider, what it does, and where it processes. We commit to maintaining it, giving notice of material changes, imposing equivalent data protection obligations, and remaining responsible for sub-processor compliance.
SU-02Can we object to a new sub-processor?
Yes. You may reasonably object on data protection grounds, and we give notice of material changes rather than adding processors silently.
SU-03What safeguards cover transfers outside the EEA?
EU Standard Contractual Clauses, adequacy decisions, contractual protections, and technical safeguards, depending on the provider. The core data platform is EU-resident; the providers with US or global footprints are operational rather than pipeline-data services.
SU-04Do you use customer data to train models sold to other customers?
No. This is a hard architectural commitment, not a policy preference. Every number a tenant sees is derived from that tenant's own data. There is no cross-tenant training, no shared model weights learned from your pipeline, and no pooled benchmark built out of customer deals.
AC-01How is authentication handled?
Through a managed authentication provider. Password handling, session validation, and token issuance are the provider's responsibility rather than ours, which removes a category of implementation error from our surface.
AC-02Is MFA supported and enforced?
Multi-factor authentication is enforced for privileged administrative access. For your own users, MFA is available and enforcement is your configuration decision under the shared responsibility model in section 14.
AC-03Do CommitControl staff have standing access to our workspace?
No. Our authentication provider requires a creating identity at the moment a workspace is created, and that role is held by a CommitControl-controlled administrative account. It holds no standing access and is automatically removed once your own administrator is established. After that point we hold no administrative membership of your workspace and no route into your pipeline data through the product.
AC-04How does support access work when it is needed?
Through a documented break-glass procedure, and only for customer-authorised support, a security investigation, or a binding legal obligation. Each grant records a stated reason, is logged, is limited in scope and duration, and is revoked on completion. Where access is exercised for support, you are told what was accessed and when it ended.
AC-05How are secrets and credentials managed?
Through a dedicated secrets management platform. API keys, credentials, and OAuth tokens are not committed to source repositories. Integration credentials are encrypted.
TI-01How is one customer's data kept separate from another's?
Row-level security enforced in the database, not only in application code. The distinction matters: application-layer checks fail open when a developer forgets one, whereas a database policy applies to every query by default including ones written later.
TI-02What happens if the tenant context is not set on a connection?
The policy is written to fail closed. An unset or empty tenant context returns no rows rather than all rows. This specific case was hardened in a dedicated migration because it is the exact failure mode that turns a multi-tenant isolation policy into a data breach.
TI-03Are there application-layer checks as well?
Yes. Tenant-aware access validation, scoped authentication tokens, tenant-bound query controls, and permission checks operate above the database policy. The database policy is the backstop, not the only control.
EN-01What transport security do you use?
TLS 1.2 or above for all connections to CommitControl domains. HTTP Strict Transport Security is enforced with a one-year max-age, subdomain coverage, and preload.
EN-02What browser-side hardening is in place?
A strict Content Security Policy with no unsafe-inline in script-src, frame-ancestors restrictions, nosniff, a restrictive referrer policy, and a Permissions-Policy disabling camera, microphone, and geolocation. You can verify all of this yourself against our response headers without asking us.
LO-01What is logged?
Authentication events, access activity, API activity, error monitoring, infrastructure telemetry, and privileged access. Critical actions are recorded in a tenant-scoped audit log.
LO-02Does personal data end up in your error tracking?
No. Our error tracking runs with personally identifiable information disabled by default, and client-side errors are filtered out before transmission. This is a configuration default rather than a manual scrubbing step, so it holds for errors nobody anticipated.
LO-03Are audit logs preserved through a deletion request?
They are anonymised rather than deleted. See DP-03. The security value of an audit trail depends on it not being erasable on request.
AI-01Does AI generate the numbers we would present to a board?
No, and this is the most important answer in this document. Every figure is derived deterministically from your own data by explicit code. The AI layer explains those figures in language. It never invents a number, never changes the arithmetic, and never adjusts model weights.
If you ask our AI layer a question it cannot ground in your data, it declines to answer rather than producing something plausible. The refusal is the feature.
AI-02Can you show your working?
Yes. Figures are traceable back to the records that produced them. If a forecast moves, you can see which deals moved it. This is the difference between a system you can defend in a board meeting and one you have to trust.
AI-03Is our data sent to a third-party LLM provider?
The AI layer generates explanatory language over figures our own code has already computed. It is not given the freedom to compute or alter figures. If your review requires the specific provider, model, and data boundary in writing, email security@commitcontrol.com and we will document it for your file rather than summarise it here.
AI-04Is our data used to train models?
No. See SU-04.
AI-05How do you handle low-confidence predictions?
By saying so. Thin data produces wide confidence bands and an explicit low-confidence marker naming the number of deals behind it, rather than a narrow number that looks authoritative. Manufactured precision is a failure mode we treat as a defect.
AI-06Do you have documentation for our AI review board?
Yes. Our note on deterministic AI in procurement is at /resources/deterministic-ai-procurement and is written for exactly that audience.
VM-01Have you completed an external penetration test?
No. We have not commissioned one, and we are not going to imply otherwise by describing our internal review process in language that sounds like an audit. If a penetration test is a gating requirement for your procurement, tell us and we will scope one against your timeline.
VM-02What vulnerability management do you actually perform?
Dependency management, vulnerability scanning, security patching, configuration review, infrastructure hardening, and periodic security review of the codebase.
VM-03What are your secure development practices?
Code review, controlled deployment workflows, environment separation, secrets management, dependency review, and production access restriction. Security-relevant behaviour is covered by automated tests, including the erasure completeness test in DP-04.
VM-04Do you have a vulnerability disclosure policy?
Yes. Report to security@commitcontrol.com. We aim to acknowledge within two business days. We ask for a reasonable window to fix before public disclosure, and we will not pursue legal action against researchers acting in good faith within that policy.
IR-01What is your breach notification commitment?
We notify affected customers without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting your data. Notification includes the nature of the breach, categories of data affected, approximate impact, mitigation taken, remediation steps, and a contact for follow-up.
IR-02What does your incident response process cover?
Identification, containment, impact investigation, remediation, service restoration, and notification obligations.
IR-03Do you operate 24/7 on-call?
No. Incidents are handled promptly during Irish business hours and out of hours on a best-effort basis. If your operational requirements need a contractual 24/7 response, we are not the right supplier today, and we would rather establish that in the security review than in an incident.
BC-01Do you take backups?
Yes. Backups are encrypted, validated periodically, and covered by documented recovery procedures.
BC-02What are your committed RTO and RPO?
We do not publish committed recovery objectives, because we will not contract to a number we have not proven under test. Recovery procedures exist and are exercised. If you need contractual recovery commitments, raise it and we will discuss what we can genuinely stand behind.
BC-03What happens to our data if we leave?
You can request a full structured export of your tenant data at any time, in the same format described in DP-02. On termination, erasure runs as described in DP-03. Your data is not held hostage to a renewal conversation.
CE-01Are you SOC 2 certified?
No. We hold no SOC 2 report and we do not display the AICPA logo, because using it without a completed report would be a misrepresentation.
CE-02Are you ISO 27001 certified?
No. We intend to pursue it as scale and customer requirements justify the cost. We are not certified today.
CE-03You display a GDPR badge. Who certified it?
Nobody, and neither does anyone else's. There is no body that issues GDPR certification, so any GDPR badge on any website is a graphic rather than an accreditation. Ours makes a specific claim we can evidence: Article 15 access and Article 17 erasure are implemented as tested endpoints. That claim is answered in section 3 and can be verified in a technical review. Treat a vendor badge that does not resolve to a verifiable claim, including ours, as decoration.
Article 42 GDPR does provide for approved certification schemes. We do not hold one.
CE-04What do you claim, then?
Only what is written in this document and on our security page. Our security page states in terms that we hold no SOC 2 or ISO 27001 and do not represent ourselves as certified. If you find any claim on our site that this pack does not substantiate, tell us and we will correct it.
Related: Security overview · Data Processing Agreement and sub-processor list · Privacy Policy · Deterministic AI in procurement