Built by people who answer security questionnaires for a living.

ControlDesk runs on Amazon Web Services in the region you choose at signup. Your data and backups stay in the region you choose. AI model calls go to OpenAI and Anthropic through their public API endpoints in the United States, under API terms that exclude training on your data; the text sent is the assessment content needed for that run, and the result is stored back in your region. Australia (Sydney) is available today; further regions are available on request.

Every customer is a tenant. Isolation is enforced inside the database with row-level security policies, so a query from one tenant cannot return another tenant’s rows even if the application layer is bypassed. Platform administrators operate under a separate identity system, and every privileged action they take is logged with their identity attached to the record.

• Multi-factor authentication is mandatory for every user, including vendors using the portal.
• Single sign-on through SAML or OIDC with your identity provider, per tenant.
• Role-based access with a permission matrix per module and action, custom roles, and separation-of-duty rules so the person who accepts a risk is not the person who raised it.
• Vendors see only the assessments sent to them, in their own portal, with no access to your environment.

• Encrypted in transit with TLS and at rest with AWS-managed keys.
• Backups run daily. Encrypted off-host copies, documented retention periods and scheduled restore testing are in progress; ask us and we will tell you exactly where they stand.
• Network access to the database is restricted to the application tier; no public database endpoints.
• Dependencies are audited on every release; a release does not ship with a known vulnerable dependency.

• Each assessment type has its own AI service with its own prompts and knowledge base. Nothing is a single general chatbot.
• AI calls pass through a gateway that meters every call against your tenant’s own credit balance. A run that fails is refunded automatically. You always know what AI cost you.
• Your data is sent to model providers under API terms that exclude training on it. They are named, with their endpoint regions, under sub-processors below.
• Every AI-generated result carries provenance: the model, the prompt version, a hash of the inputs, the confidence and the rationale. A person accepts, changes or rejects it before it becomes the record.
• Your own policies and evidence are indexed for the assistant inside your tenant only, with source citations on every answer.

Terminal changes to a risk, finding, incident, plan or assessment must go through the decision ledger with a reason; direct edits are refused by the platform. Activity on every record is logged with actor and time.

• ControlDesk does not hold a SOC 2 Type II report or an ISO 27001 certificate today. We would rather say so here than let you find out in the questionnaire.
• If your review requires one, ask us: we will tell you in writing where that work stands and when we expect it, and what compensating evidence we can give you now.
• The controls those standards test — access control, encryption, logging, change management, backup, vendor management — are described on this page, and we will answer any question about them in writing.

• Amazon Web Services — hosting, database and backups. Region chosen at signup; Sydney today.
• Amazon SES — transactional email. Same region.
• OpenAI — assessment drafting, extraction, document reading and embeddings for the assistant (GPT-5 family, GPT-4.1 family, text-embedding-3). Public API endpoint, United States.
• Anthropic — assessment drafting, and the automatic fallback when an OpenAI model is unavailable (Claude Opus, Sonnet and Haiku). Public API endpoint, United States.
• We tell customers before a new sub-processor starts handling their data.
• A written data-processing summary is with our lawyer. Until it is published, ask us and we will send the current data-processing terms in writing.

• Vulnerability disclosure: security@deteqted.com. We acknowledge within two business days.
• Security documentation and a completed questionnaire are available under NDA during evaluation. Automated vulnerability scanning runs against the platform and dependencies are audited on every release; an independent penetration test is scheduled and we will share the summary once it is done.