Security and privacy at CTRL
CTRL holds your thinking, so this page says plainly what protects it, what we are still building, and what we have not done. Everything below is checkable, and there are no badges we have not earned.
Last reviewed 2026-08-20
In place today
- Row-level security on every tableLiveRecords are scoped to their owner in the database itself, not only in application code. A query that is not yours returns nothing.
- Field-level AES-256-GCM on stored factsLiveSensitive memory writes carry an encrypted payload at rest, alongside Supabase-managed disk encryption. Plaintext fields are retained so the product can display and search your memory, so this is not end-to-end encryption and we will not describe it as such.
- TLS in transitLiveEverything between your browser and CTRL is encrypted in flight, behind a CDN and edge boundary with rate limiting on AI endpoints.
- Export everything, any timeLiveYour profile, memory, assessments and conversations download as structured JSON, Markdown, or a format your other AI tools read directly.
- Delete your account for realLiveA server-side cascade removes your data rather than flagging it hidden, and cancels any active subscription on the way out. Backups age out on their retention schedule.
- Retention you choose, enforced on a scheduleLiveKeep your memory for 30 days, 90 days, or indefinitely. A nightly job applies the window you picked, and changing it re-stamps what is already stored.
- Only your own personal dataLiveWhen you mention someone else, CTRL stores their role rather than their name. A fact whose subject is another person is not stored at all.
- Off the recordLiveThink something through without any of it being kept. No memory, no evidence, no influence on tomorrow's briefing, and CTRL says plainly when a session saved nothing.
- Consent you can changeLiveGranular, timestamped consent toggles with an audit record. We do not sell personal data.
- Published privacy notice and processing recordLiveA GDPR Article 13/14 and CCPA/CPRA notice, an Article 30 record of processing, and a maintained subprocessor register.
- Versioned, reviewed change historyLiveEvery schema change ships as a git-versioned migration, so the state of the database has a written history.
In progress
- Data-access and AI-usage audit loggingBuildingStructured edge logging is live. Comprehensive per-record access trails are being built out.
- Enforced MFA and a stronger password policyBuildingIncluding a breached-password check at sign-up.
- Centralized log aggregation and alertingBuildingWith retention, monitoring, and a tested restore drill.
- Automated dependency and secret scanning in CIBuildingAlongside regression tests that prove row-level security stays enforced.
Not done yet
We are not certified. CTRL holds no SOC 2 report and no ISO/IEC 27001 certificate, and has not completed a third-party security audit. Work toward them is at the planning stage.
HIPAA does not apply to CTRL. We do not process protected health information, and CTRL is not intended for it.
- SOC 2 Type I or Type II reportNoneSOC 2 is an attestation issued by a licensed CPA firm, not a certification. We have not engaged one.
- ISO/IEC 27001:2022 certificateNoneNo accredited certification body has audited CTRL.
- Independent penetration testNoneNot yet commissioned.
- Signed DPAs and SCCs with every subprocessorPartialThe register is maintained and current. The paperwork is not complete across all vendors.
Something went wrong once
- Row-level security misconfiguration, May to June 2026RemediatedAn over-permissive policy on several profile and chat tables was found and fixed. It is written up as a worked example in our incident response plan rather than quietly dropped.
Questions, a data processing agreement, or the current subprocessor list: privacy@themindmaker.ai. Common questions are answered at /faq. Signed in? Your live control status is at /compliance. Back to makeyourmindup.ai.