Security posture
ControlFrame handles compliance evidence for regulated teams. Target credentials and runner request-signing private keys remain runner-side; artifact movement is protocol-specific, bounded, and subject to custody, scanning, redaction, human review, and release gates.
Tenant isolation
Each organization is created as its own tenant with org-scoped data access. Sessions carry the org and role, and project access is checked on every request.
Evidence custody
Legacy collection may submit selected, bounded raw artifacts to governed control-plane custody. Runner v2 is currently verify-only and cannot contact targets or create artifacts. No submitted artifact reaches an auditor package without separate scanner, redaction, reviewer, and release gates.
Fail-closed credentials
Connectors use a fail-closed credential model. A missing or invalid credential blocks the run rather than silently proceeding with partial or stale data.
Authentication
Email and password authentication with bcrypt-hashed credentials, short-lived signed sessions, secure cookies in production, and role-based access for owners, members, and auditors.
Review gates
Findings, narratives, and packets pass through reviewer gates before release. Redaction and approval are required before an auditor package can be exported.
Responsible disclosure
We welcome responsible security reports. See the vulnerability disclosure posture for scope, safe-reporting guidance, and triage.
Review capability