Trust & Security
Controls Star is built to protect schedule, cost, and project-controls data through secure access, encrypted infrastructure, responsible data handling, and security controls designed into the platform.
Protection in place today
Controls Star protects your project data while it moves, while it is stored, and while users access it.
01
Project data is protected while it moves between you and the platform and while it is stored.
HTTPS/TLS in transit · AES-256 encryption at rest for the database and uploaded files
How data travels
02
Workspaces are logically separated, so people can only reach the project and file information they are authorized to see. Uploaded files stay private and are never exposed through public file links.
server-side, workspace-scoped access controls on every request · private file storage — downloads require an authorized sign-in
Workspace separation
03
Multiple layers of account and session protection help prevent unauthorized access. Passwords are protected rather than stored in readable form, sign-in attempts are limited and monitored, and sessions are secured.
bcrypt password protection · Secure/HttpOnly sessions · rate limiting with sign-in alerting · cross-site request protection
Layers of protection
Security is part of how Controls Star operates today—not something waiting on a future certification.
Your data. Your control.
What you upload is used to provide your analysis, protect your data, and support the service.
You own your project data.
It is processed only to provide, secure, and support the service.
Controls Star does not sell it.
Your project data is never sold.
Controls Star does not share it across customer workspaces.
Each workspace's projects, schedules, and files stay within that workspace.
Controls Star does not train AI models on customer data.
Your data is used to run your analysis, not to build models.
Raw XER, Excel and CSV files are not sent to the AI provider.
Only the project context needed for a requested insight is used for AI analysis.
Defined retention and deletion processes apply.
Deleted data is removed from active systems on a defined schedule.
How AI insights are generated
Your XER, Excel and CSV files are parsed and stored inside Controls Star. When you request an insight or ask a question, only the project context needed to produce that answer may be sent for AI analysis.
Never sent
Your raw XER, Excel and CSV files. They are parsed and stored inside Controls Star and are not sent to the AI provider.
May be sent for AI analysis
Only the project context needed to produce the requested insight — for example project metrics, schedule summaries, activity information, project and client context, notes, and the questions you enter.
Data lifecycle
When data is deleted, Controls Star removes it from active systems according to defined retention and deletion processes. Residual copies may remain temporarily within encrypted provider backups until those backups expire according to provider schedules. Full details are in our Privacy Policy.
Operating practices
These practices govern how the platform is administered, configured, released, and paid for.
Administrative functions are restricted on the server and kept separate from normal user access. Key administrative actions are logged.
server-side privilege checks · logged administrative actions
Application credentials are kept out of the browser, and production is kept separate from development.
encrypted environment secrets · production / development separation on managed infrastructure
Security-relevant activity is logged, and repeated suspicious activity can trigger alerts. Changes are tested in a preview environment before controlled production releases, with rollback available when needed.
security event logging · threshold alerting · preview → production releases with rollback
Payments run through Stripe-hosted checkout, so full payment-card details never reach Controls Star.
Stripe-hosted checkout · signature-verified payment webhooks
Why this matters
Construction teams rely on schedule, cost, earned value, manpower, and project-performance data to make decisions that can affect millions of dollars and critical project milestones.
Controls Star is designed to protect that information while helping teams turn it into actionable project intelligence.
Security & compliance roadmap
Controls Star already protects project data through encrypted infrastructure, workspace-scoped access controls, private file storage, secure sign-in, controlled administrative access, and defined data-retention and deletion processes.
We are continuing to strengthen that foundation through recognized security frameworks and certification pathways.
Working toward readiness
Preparing controls, evidence, and operating practices against the SOC 2 trust services criteria.
Working toward alignment
Aligning the security program with the ISO/IEC 27001 information security management framework.
Planned
Planned pursuit of the UK Cyber Essentials baseline as part of our security roadmap.
Roadmap statuses reflect current preparation and alignment efforts and should not be interpreted as certification.
Responsible disclosure
If you believe you've identified a security issue involving Controls Star, email security@controls-star.com. We aim to acknowledge security reports within 72 hours and will investigate and prioritize remediation based on severity and complexity.
Please include enough detail for us to understand and reproduce the issue where possible.
Email security@controls-star.comControls Star helps project teams turn schedule, cost, and performance data into clear project intelligence—while keeping security and responsible data handling built into the platform.
Optional Analytics & Advertising
Learn MoreWe use optional analytics to improve Controls Star and measure advertising performance. Nothing optional loads unless you allow it. Learn More
