ControlQuay

THE PLATFORM

The work.
The proof.
The full context.

One workspace for the tasks and records behind your security program, from the first policy to your customer’s questionnaire.

01 / Controls & evidence

Make the evidence accountable.

Give every control an owner, keep each version of the evidence and record who reviewed what, and when.

  • Controls with owners, applicability and review cycles
  • Evidence versions with expiry dates and review history
  • Encrypted PDF and image attachments
  • Import controls and evidence from CSV or JSON
CONTROLS & EVIDENCE
OWNEREngineering
RECORDControls with owners, applicability and review cycles
NEXT STEPReview supporting material ↗
Illustrative workflow
02 / Frameworks & programs

One control. Every framework that needs it.

Track SOC 2, ISO 27001, nLPD/GDPR, DORA, NIS2 or a customer’s own requirements as programs, and map each requirement to the controls that meet it.

  • Programs with scope and audit periods
  • Requirement-to-control mapping
  • Snapshots of what was in place, and when
  • Ready-made framework templates: on the roadmap
FRAMEWORKS & PROGRAMS
OWNERCompliance
RECORDPrograms with scope and audit periods
NEXT STEPReview supporting material ↗
Illustrative workflow
03 / Policies & people

A policy has a life after approval.

Keep policy versions, approvals and employee acknowledgments together, and follow people from their first day to their last.

  • Versioned policies with approval and comparison
  • Acknowledgments tied to the exact version
  • Training with short assessments
  • Onboarding and offboarding checklists
POLICIES & PEOPLE
OWNEROperations
RECORDVersioned policies with approval and comparison
NEXT STEPReview supporting material ↗
Illustrative workflow
04 / Security questionnaires

Answer once. Reuse what’s approved.

Import a customer’s questionnaire, assign the questions, link the evidence and export the answers into the customer’s own file. Or let us answer it for you.

  • Import from Excel or CSV with column mapping
  • Assignments, deadlines and progress
  • Approved answers reused as drafts
  • Export into the customer’s own workbook
Or let us answer it for you: CHF 490, 1–3 working days →
SECURITY QUESTIONNAIRES
OWNERSales & engineering
RECORDImport from Excel or CSV with column mapping
NEXT STEPReview supporting material ↗
Illustrative workflow
05 / Trust centre

Answer before they ask.

Publish a security profile and share protected documents with the customers who need them, for as long as they need them.

  • Public security profile
  • Protected documents shared on request
  • Expiry, revocation and access history
TRUST CENTRE
OWNEROperations
RECORDPublic security profile
NEXT STEPReview supporting material ↗
Illustrative workflow
06 / Risks & vendors

Keep a decision from becoming a dead end.

Assess risks and suppliers, assign the treatment and keep the reasoning behind every accepted risk.

  • Risk register with inherent and residual scores
  • Treatment plans and remediation tasks
  • Formal risk acceptance with an expiry date
  • Vendor inventory and assessments with reassessment dates
RISKS & VENDORS
OWNERManagement
RECORDRisk register with inherent and residual scores
NEXT STEPReview supporting material ↗
Illustrative workflow
07 / Access reviews

Prove that access is still right.

Import account lists, assign reviewers and keep every decision together with the evidence that access was removed.

  • Review campaigns with assigned reviewers
  • Versioned decisions for every account
  • Removal evidence checked before closing
  • Locked, exportable results
ACCESS REVIEWS
OWNERIT
RECORDReview campaigns with assigned reviewers
NEXT STEPReview supporting material ↗
Illustrative workflow
08 / Audits

Give the auditor what they need. Nothing more.

A scoped auditor role, evidence requests and comments in one place, and evidence packages frozen at the moment you share them.

  • Auditor role with scoped access
  • Requests and comments
  • Frozen evidence packages with checksums
AUDITS
OWNERCompliance
RECORDAuditor role with scoped access
NEXT STEPReview supporting material ↗
Illustrative workflow
09 / Administration & monitoring

Built for the people who run it.

Sign-in security, roles and the checks that tell you when evidence needs attention.

  • Multi-factor authentication, roles and invitations
  • Single sign-on with Microsoft Entra ID and SCIM provisioning (early access)
  • GitHub repository checks and reminders when evidence goes out of date
  • Workspace export and deletion
ADMINISTRATION & MONITORING
OWNERAdministrators
RECORDMulti-factor authentication, roles and invitations
NEXT STEPReview supporting material ↗
Illustrative workflow

SEE IT WORK

Try the actual
overview interface.

Filter the app’s sample workspace and inspect evidence records, owners and sources. Or follow a questionnaire, a policy rollout and an audit step by step.

Open the product overview ↗Explore the workflows ↗

PRICING

From CHF 990 a year.
Unlimited users.

Starter

For small teams getting their security program in order.

CHF 990per year
  • The full platform
  • Unlimited users
  • Questionnaires done for you: CHF 490 each
Choose Starter ↗

Growth Recommended

For teams that receive customer questionnaires regularly.

CHF 2,490per year
  • Everything in Starter
  • 3 questionnaires done for you
  • Answer library kept current
Choose Growth ↗

Scale

For teams selling to banks, insurers and large enterprises.

CHF 4,990per year
  • Everything in Growth
  • 8 questionnaires done for you
  • Guided setup and priority turnaround
Choose Scale ↗

The best-known compliance platforms typically cost between about CHF 6,000 and CHF 20,000 or more a year, often priced by headcount, before audit fees and add-ons. ControlQuay starts at CHF 990 with unlimited users.

Compare plans ↗

WHERE WE ARE

Available now.
Coming next.

Available now · early access

  • Controls, evidence and frameworks as programs
  • Policies, acknowledgments and training
  • Questionnaire workspace with Excel import and export
  • Risks, vendors, access reviews and audits
  • Trust centre with protected documents
  • GitHub checks and reminders when evidence goes out of date

Platform plans are in early access: we set up each workspace with you personally. The questionnaire service is available now.

YOUR NEXT STEP

See it with
your own work.

Tell us what you need to organise. We’ll show you the relevant parts of the platform and set up your workspace with you.

Get started ↗