Help

ControlLedger keeps a dated record of the recurring controls you run for each client and turns it into an Evidence Pack. This page takes you from signup to your first pack. Email [email protected] for anything else.

1. Start

After signup you land on /start. To see the finished product first, choose "Use sample data": two clearly labeled fictional clients with three months of attestations. Otherwise choose "Add a client" and enter the name, an industry tag and at least one contact. Contacts never get accounts; they only receive co-sign requests and share links. Solo? Create one client named after your own company.

2. Apply controls

On the client page choose "Apply controls" and pick a set ("MSP default 8", "HIPAA lite", "Cyber-insurance renewal basics") or choose from the library of 14 seeded controls, from the monthly file restore test to the annual policy review. Each control carries a frequency, evidence guidance such as "attach: screenshot of restored file with timestamp", and the insurer question it answers. Set an assignee and start date; ControlLedger computes the next due date, which is one period after the start date. Edit any control in /library; pause and resume controls as clients change services.

Dates are calendar days in UTC. Monthly, quarterly, semi-annual and annual controls add calendar months to the start date (the 31st becomes the last day of a shorter month); weekly and custom controls add days.

3. Log a result

When a control is done, open it and choose "Log result". Record when it was performed, choose pass, fail, exception or not applicable, add notes, and attach evidence (up to 10 MB per file); every file is hashed with SHA-256 when stored. Each result covers one scheduled due date; overdue periods are offered first, and a result performed after its due date is recorded as late, never hidden. A fail or exception requires a remediation note and creates a follow-up due date. To put the client on record, choose "Request co-sign": the contact gets a link that works for 14 days and covers only that attestation; their name, the timestamp and IP address are recorded.

4. Stay on schedule

Assignees are reminded seven days before the due date and on the day. Overdue controls escalate to the account owner at one, three and seven days, and every Monday the owner gets a digest such as "12 controls due this week, 3 overdue" (Solo and MSP). The dashboard shows overdue controls across clients, each client's health (on-time attestations over the trailing 90 days) and the next 14 days.

5. Generate the Evidence Pack

On the client page choose "Evidence Pack", pick a date range (default: trailing 12 months) and generate. The PDF has a cover, a control matrix (done, late or missed per period), the attestation log with thumbnails and every file's SHA-256, exceptions and remediation, co-signatures, an insurer summary page and an integrity footer with the document hash and chain head. Solo and MSP add a zip of all evidence files; MSP adds an expiring read-only share link and your logo.

Verifying a hash

Go to Verify and paste a hash: the SHA-256 of a pack file, the body hash printed on its integrity page, or any event hash. The page reports whether it exists, its position in the chain and when it was recorded. No account is needed and nothing about the content is revealed. To compute a file's SHA-256: sha256sum file.pdf on Linux, shasum -a 256 file.pdf on macOS, Get-FileHash file.pdf in PowerShell.

Accounts and team

Signing up creates an account and makes you its owner. Owners and admins invite technicians from Team on paid plans; an invitation link expires after seven days and can be used once. Roles: owner manages billing and roles and receives overdue escalations and digests, admin manages the team and settings, member logs results.

Good to know

Verify your email before ControlLedger sends anything to a third party. Set an evidence retention period in Settings; archived clients' files are hard-deleted after 30 days. Anyone can check a pack's hash at /verify. The pack records attestations made by your account; it does not verify them, and it is not legal, insurance or audit advice. Help: [email protected].