How we protect
your security information.

Inside the platform

• Sign-in security. Multi-factor authentication, roles and invitations. Single sign-on with Microsoft Entra ID and SCIM provisioning are available in early access.
• Everything versioned. Policies, evidence, answers and decisions keep their history, so you can see who changed or approved what, and when.
• Encrypted attachments and backups. Evidence files are stored encrypted, and workspace backups are encrypted.
• Your data stays yours. Export your workspace at any time, and ask us to delete it.

Before you share anything

• NDA first. We sign your NDA, or ours, before you send any documents.
• Data processing agreement. We sign a written data processing agreement before you upload or send anything. It lists every service provider that processes your data.
• You decide what to share. We tell you exactly which documents are needed. We never ask for passwords, keys or access to your systems.

When we answer a questionnaire for you

• Your documents are used only for your questionnaires, and kept in access-restricted storage.
• Every service provider that processes your documents is named in the data processing agreement and bound to confidentiality. None of them may use your documents for their own purposes, such as model training.
• Every answer is checked against your evidence. Anything that can’t be supported is marked as a gap, never guessed.
• Nothing is sent to your customer without your approval. You send the final file yourself, unless you ask us to.
• Documents sent for a single questionnaire are deleted within 30 days of delivery. With a platform plan, your approved answers and evidence stay in your own workspace.

What we never do

• Contact your customer without your permission.
• Share your answers or documents with other customers.
• Name you as a customer or reference without your written permission.
• Claim certifications, audits or tests you don’t have.

Product status

The platform is in early access: we onboard each customer personally and agree the start date and hosting details in writing before any data is uploaded. The platform has not yet had an independent penetration test. The questionnaire service is available now.

What we are not

ControlQuay is a compliance platform and questionnaire service, not an audit firm. We don’t issue SOC 2 reports or ISO 27001 certificates, perform penetration tests or give legal advice.

Report a concern

Email [email protected] with a short description. Please don’t include passwords or detailed exploit information in the first message.

ControlQuay is operated by Isago Wind Energy Holding SA, Via Cantonale 69, 6805 Mezzovico, Switzerland (CHE-384.850.715). Updated 2 October 2026.