Run the controls. Keep the proof.

How it works

1. 1. Add a client, apply a control set

   Pick "MSP default 8", "HIPAA lite" or "Cyber-insurance renewal basics", assign a technician; ControlLedger computes every next-due date.

2. 2. Log each result with evidence

   The assignee records pass, fail, exception or not applicable, attaches the screenshot or export, and can request a client co-sign by magic link.

3. 3. Generate the Evidence Pack

   Choose a client and date range; the PDF carries the control matrix, attestation log, file hashes, exceptions, co-signatures and an insurer summary page.

The problem in your words

"A typical one means chasing evidence from four or five places… we were the ones digging through two platforms at 9pm to piece it together. Controls were all there, we just could not surface them cleanly under pressure."

"I work at an MSP and do 90% of the audits. Some (40%) of companies are asking for proof of tested backups. Proof of when we last did user/security audits. Proof of MFA."

"The thing neither tool handles especially well: running the actual recurring compliance work. Who does the quarterly access review… At MSP scale across multiple clients, this tends to live in spreadsheets and Slack until you outgrow it."

Features

• Seeded control library: restore tests, break-glass, access reviews, MFA exports, patch reviews, training.
• Per-client schedules with assignees, computed next-due dates, pause and resume.
• Reminders at T-7 and due day; overdue escalation to the account owner.
• Evidence files hashed with SHA-256 on upload; every pack prints the hashes.
• Optional client co-sign by magic link; records name, timestamp and IP.
• Evidence Pack PDF and zip per client, with an expiring read-only share link.

What it is not

• It does not verify that a control was performed. It records who attested to what, when, with which files.
• It does not pull evidence from your RMM, PSA or backup vendor. A technician attaches it.
• It does not make anyone "compliant" and it is not legal, insurance or audit advice. It produces the record an auditor or carrier asks for.

Pricing

Flat monthly fee per account, not per client.

Full plan limits

Questions

Where is my evidence stored and who can see it?

On our servers, hashed on upload, served only to signed-in users of your account or through expiring links. You set a retention period; an archived client's files are hard-deleted after 30 days. Details on /security.

What happens when I cancel?

Billing stops at the end of the period and the account returns to Free limits; records stay readable. Generate a final Evidence Pack and zip per client first. Email [email protected] to have the account and its files deleted.

Does it replace our GRC platform or PSA checklists?

No. GRC platforms map frameworks and policies; PSAs run tickets. ControlLedger runs the recurring controls and keeps the proof: schedule, attestation with evidence, and the pack you hand to a carrier or auditor.

Do clients, insurers or auditors need an account?

No. A client contact co-signs through a magic link that covers one attestation and expires in 14 days. Insurers and auditors receive the PDF, the zip or an expiring read-only share link. Only your technicians log in.

Is this legal, insurance or audit advice?

No. Every pack states that it records attestations made by your account. ControlLedger does not judge whether a control is adequate or make anyone compliant. Your client signs their own carrier forms; the pack is the evidence behind the signature.

How do I get my data out?

Generate an Evidence Pack for any client and date range: a PDF on every plan, plus a zip of every evidence file on Solo and MSP. Each file's SHA-256 is printed in the pack; /verify confirms a pack hash while the account exists.