Security at ControlQore: how we protect your data

Last updated October 13, 2026

Where your data lives

ControlQore is a multi-tenant SaaS application hosted on Microsoft Azure. Its application services operate on Azure Kubernetes Service in the Azure East US region. Your data is stored in managed Azure SQL Databases and in Azure Storage, and it is replicated to a secondary Azure region.

Encryption

All web, API, and integration traffic to ControlQore uses HTTPS with TLS 1.2 or higher. Data at rest is encrypted with Azure Storage encryption, and the Azure SQL Databases use Transparent Data Encryption. Dynamic data masking prevents users who lack permission from seeing sensitive fields, such as Social Security numbers, email addresses, phone numbers, and account numbers.

Bank, card, and tax ID data

ControlQore uses a Skyflow vault to tokenize bank account numbers, vendor Social Security numbers and tax identification numbers, and corporate card details. ControlQore does not store raw bank account numbers or unencrypted personal data on its application servers. Skyflow’s security page lists Skyflow as “PCI DSS Level 1 Certified”. That certification belongs to Skyflow and does not certify ControlQore.

Sign-in and permissions

ControlQore sign-in uses Azure AD B2C with OAuth 2.0 and OpenID Connect, and it supports single sign-on (SSO) and multi-factor authentication. Access inside ControlQore is role-based, with these roles: Super Admin, Business Admin, Accountant, AP Clerk, AR Clerk, Project Manager, and Employee. Every database query is limited to your company’s own data, so one customer can’t see another customer’s records.

Staff access and monitoring

ControlQore gives its staff least-privilege access. Administrative actions are logged internally. Azure Application Insights, Log Analytics, and Azure Monitor track performance, errors, and security events, and they alert our engineering team automatically.

Backups

ControlQore takes continuous automated backups with point-in-time recovery. Point-in-time recovery lets a database be restored to its state at an earlier moment. Backups are replicated to a secondary Azure region.

Your data

You own your financial records in ControlQore. You can export reports, general ledgers, and project budgets to CSV and PDF at any time.

Security testing

The ControlQore build pipeline includes automated security scanning, dependency checks, and static code analysis.

Payments and cards: what Stripe states

The banking disclosure below sets out ControlQore’s banking relationships, including Stripe. The certifications and reports below are Stripe’s, and Stripe describes them as covering Stripe’s own systems, processes, and controls. None of them certifies ControlQore.

• Stripe states that a PCI-certified auditor evaluated Stripe and certified it to PCI Service Provider Level 1, which Stripe describes as the most stringent level of certification available in the payments industry. (Stripe security documentation)
• Per Stripe’s security documentation, Stripe’s systems, processes, and controls are audited as part of its SOC 1 and SOC 2 compliance programs, and Stripe publishes a public SOC 3 report. (Stripe security documentation)
• Stripe states that it encrypts sensitive data in transit and at rest, that all card numbers are encrypted at rest with AES-256, and that decryption keys are stored on separate machines. (Stripe security documentation)
• Stripe states that its infrastructure for storing, decrypting, and transmitting card numbers is hosted separately and shares no credentials with the rest of its services. (Stripe security documentation)
• Stripe states that it requires HTTPS for all of its services, requires at least TLS 1.2, and encrypts its internal server-to-server traffic with mutual TLS. (Stripe security documentation)
• Per Stripe’s security documentation, Stripe’s security teams scan its infrastructure for vulnerabilities and conduct penetration tests and red team exercises, and Stripe hires third-party security companies to scan its systems. (Stripe security documentation)

Banking disclosure

ControlQore partners with Stripe Payments Company for money transmission services and account services with funds held at Fifth Third Bank N.A., Member FDIC. ControlQore Visa® Commercial cards are powered by Stripe and issued by Celtic Bank.

Reporting a security issue

To report a security issue, email [email protected].

Legal terms

For full legal terms, read our Privacy Policy and our Terms and Conditions.