Security

Last updated October 22, 2026. Firms trust us with sensitive client information, so this page describes how it is protected.

Separation between firms

Every firm's data is isolated at the database level with row level security. A user can only read and write their own firm's records. Access to platform administration is limited to a small set of Controlwright administrators, and administrative actions are written to an audit log.

Roles inside a firm

Firms assign roles such as administrator, reviewer and screener, so that people only see and do what their job requires. Match reviews are recorded with the reviewer and a timestamp.

Tamper resistant records

Screening checks and reviews cannot be edited or deleted after they are written. Corrections are added as new records, so the history your examiners see is the history that happened.

Data in transit and at rest

All connections use HTTPS. Data is stored in managed databases that encrypt it at rest. Passwords are never stored in readable form.

Minimal email content

Alert emails contain counts and a link to sign in. Names and match details are never sent by email.

Providers

We rely on established providers for hosting, database, payments and email, listed in the Privacy Policy.

Reporting a concern

If you believe you have found a security issue, please contact us at controlwright.com/contact and we will respond promptly.