Security and trust
Control is operated by Finata Oy, whose information security management system is ISO/IEC 27001:2022 certified by Insight Assurance. Your data is hosted on Google Cloud in Hamina, Finland, and encrypted in transit and at rest.
- Read-only by defaultWrite-back, if you turn it on, posts only drafts an Owner or Admin approved
- EU AI processingControl’s own AI features process your data in the EU
- Signed DPAOn every plan, for GDPR-governed processing
- security@control.devThe security contact on the trust center
Finata Oy’s ISO/IEC 27001:2022 certification
Control is operated by Finata Oy, the registered Finnish legal entity (Business ID 3483671-1, Helsinki). Finata Oy’s information security management system is ISO/IEC 27001:2022 certified by Insight Assurance.
Certificate and audit reportThe scope
“The scope of the certification is the Information Security Management System (ISMS) supporting the provision of the Control.dev SaaS application and its associated implementation services.”
The certificate
Certificate number IS-IA-2026-04-20-03, issued on 20 April 2026 and valid until 19 April 2029. It is open to view on the trust center.
The audit report
The ISO 27001 Stage 2 audit report of 13 April 2026 can be requested through the trust center.
The trust center lists Finata Oy’s controls in five categories: infrastructure security, organizational security, product security, internal security procedures, and data and privacy. Lines in quotation marks on this page are those controls in the trust center’s own words, as listed on 25 October 2026; there, “the company” is Finata Oy.
Where your data lives
Google Cloud Platform processes and stores Control’s service data in an EU region in Hamina, Finland. Data is encrypted in transit and at rest.
Data Processing AgreementWithin the EU and the EEA
Under the Data Processing Agreement, your personal data does not leave the European Union and the European Economic Area without your prior written consent, unless the agreement expressly says otherwise.
Location on request
Under the same agreement, you can ask at any time where your personal data is processed.
When you leave
When the agreement ends, your data is available for return for 30 days and then deleted, unless Union or Member State law requires it to be kept.
Backup processes established
“The company’s data backup policy documents requirements for backup and recovery of customer data.”
Continuity and Disaster Recovery plans tested
“The company has a documented Business Continuity/Disaster Recovery (BC/DR) plan and tests it at least annually.”
Data retention procedures established
“The company has formal retention and disposal procedures in place to guide the secure retention and disposal of company and customer data.”
What Control may touch in your ledgers
Each entity keeps the accounting system it already uses, and your ledger stays the book of record.
Integrations and what comes inRead-only by default
Control reads each ledger through its official API, read-only by default; write-back, if you turn it on, posts only drafts an Owner or Admin approved.
Provider permissions
Some providers, QuickBooks and Fortnox among them, grant a broader permission set than Control uses.
Your data, your changes
Under the terms, you control what data comes into Control and what changes are made.
AI and your data
Control’s own AI features process your data in the EU. When you connect your own AI client over MCP, that client’s provider processes what it reads, under your agreement with that provider.
Before you connect an AI clientNo training on your data
Under the terms, Finata Oy may not use your data to improve the service or to train any AI models.
Your administrator decides
AI features are on by default for new organizations, and an administrator can turn them off at any time to stop new AI-processing requests.
Proposals first
Corrections and budget values from an AI client stay proposals until you approve them, and a locked version refuses every write.
Who can see what
Each person signs in with their own Control login. An AI client connected over MCP signs in as that person and sees only what their role in Control allows.
Control over MCPIn your workspace
Read-only connections
A read-only connection gets no write tools, and Control checks the access again on every call. It is a choice per connection, not the default, so set it before the first sign-in.
One registration per client
Your Control administrator registers each AI client once. After that, each person connects with their own login.
At Finata Oy
Production database access restricted
“The company restricts privileged access to databases to authorized users with a business need.”
Access revoked upon termination
“The company completes termination checklists to ensure that access is revoked for terminated employees within SLAs.”
Confidentiality Agreement acknowledged by employees
“The company requires employees to sign a confidentiality agreement during onboarding.”
Employee background checks performed
“The company performs background checks on new employees.”
Subprocessors, as the trust center lists them
The list as the trust center showed it on 25 October 2026. The trust center keeps the current list.
Current list on the trust centerGoogle Cloud Platform
Cloud provider
Anthropic PBC
Data storage and processing
PostHog
Cloud monitoring
Stripe
Finance and payments
Vanta
Security: continuous security and compliance monitoring
Clerk
Identity provider
Under the Data Processing Agreement, you have the right to hear about the subprocessors in use and about changes, and to object to a new one on reasonable grounds within 14 days of the notice. The privacy policy lists who receives personal data, by category.
Documents for your security review
A signed DPA comes with every plan. The certificate, the audit report and the controls are on the trust center.
Open the trust centerData Processing Agreement
Updated 17 August 2026. Where personal data is processed, subprocessors, personal data breaches, audit rights, and the deletion and return of data.
Privacy policy
Updated 24 October 2026. What personal data Finata Oy collects and why, who receives it, where it is processed and how long it is kept.
Terms and conditions
Updated 9 April 2026. The service agreement with Finata Oy, including confidentiality, data security and what happens to your data when the agreement ends.
Under the Data Processing Agreement, you may audit Finata Oy’s compliance with it at your own cost through an independent third-party auditor, with at least two weeks’ notice.
Reporting a security issue
Write to security@control.dev, the security contact on the trust center. Under the Data Processing Agreement, Finata Oy informs you of every personal data breach related to the service without undue delay.
security@control.devIncident response plan tested
“The company tests their incident response plan at least annually.”
Incident management procedures followed
“The company’s security and privacy incidents are logged, tracked, resolved, and communicated to affected or relevant parties by management according to the company’s security incident response policy and procedures.”
Intrusion detection system utilized
“The company uses an intrusion detection system to provide continuous monitoring of the company’s network and early detection of potential security breaches.”
Log management utilized
“The company utilizes a log management tool to identify events that may have a potential impact on the company’s ability to achieve its security objectives.”
Penetration testing performed
“The company’s penetration testing is performed at least annually. A remediation plan is developed and changes are implemented to remediate vulnerabilities in accordance with SLAs.”
Vulnerabilities scanned and remediated
“Host-based vulnerability scans are performed at least quarterly on all external-facing systems. Critical and high vulnerabilities are tracked to remediation.”
The same contact is published for security tools in /.well-known/security.txt.
What is ISO/IEC 27001 certified at Control.dev?
Finata Oy’s information security management system, which supports the provision of the Control.dev SaaS application. Finata Oy operates Control, and Insight Assurance certified its information security management system to ISO/IEC 27001:2022 (certificate IS-IA-2026-04-20-03, valid until 19 April 2029). The certificate is on the trust center at trust.control.dev, and the Stage 2 audit report of 13 April 2026 can be requested there.
Where is Control.dev data hosted?
Google Cloud Platform processes and stores Control’s service data in an EU region in Hamina, Finland, encrypted in transit and at rest. Under Control’s Data Processing Agreement, personal data does not leave the EU and the EEA without your prior written consent, unless the agreement expressly says otherwise.
Can Control change our accounting data?
Control reads each ledger through its official API, read-only by default; write-back, if you turn it on, posts only drafts an Owner or Admin approved. Your ledger stays the book of record.
Where does Control process data for AI?
Control’s own AI features process your data in the EU, and under Control’s terms Finata Oy may not use your data to train any AI models. When you connect your own AI client over MCP, that client’s provider processes what it reads, under your agreement with that provider.
Who are Control.dev’s subprocessors?
As listed on Control’s trust center on 25 October 2026: Google Cloud Platform, Anthropic PBC, PostHog, Stripe, Vanta and Clerk. The current list is at trust.control.dev/subprocessors.
How do we report a security issue to Control?
Write to security@control.dev, the security contact on Control’s trust center. Under Control’s Data Processing Agreement, Finata Oy informs customers of every personal data breach related to the service without undue delay.
See Control in 30 minutes.
Book a demo with the Control team. Bring your accounting systems and one question, and we walk through how a group like yours runs on Control. Or start for free and set it up yourself.
The app works best on a desktop browser.