Security Posture

By Campbell GreenUpdated 14 August 2026

Subject: Re: Security & Compliance Information Request

Thank you for reaching out.

We regularly work with organisations that require vendor security reviews and procurement approval before adopting our service. We are happy to assist with security questionnaires, risk assessments, and due diligence processes.

Control-C is a New Zealand-owned Financial Data Continuity and Assurance platform that protects historical financial and business data from cloud applications such as Xero. Our platform is designed around data protection, integrity, recoverability, auditability, and governance.

Data Residency & Sovereignty

One of the key advantages of Control-C is our focus on data residency and sovereignty. Customers can choose to host their data within New Zealand, Australia, or the United Kingdom, helping organisations meet contractual, regulatory, and internal governance requirements regarding where their data is stored and processed. This approach can simplify compliance obligations, reduce cross-border data transfer concerns, and provide greater confidence around jurisdictional control of business-critical information. ,

Control-C currently operates production environments in:

  • New Zealand

  • Australia

  • United Kingdom

In addition, our development environment is hosted in Germany. While this is not currently a dedicated production environment for customers, it provides a foundation for future European Union hosting should customer demand require an EU regional deployment. This would support organisations seeking additional alignment with EU data residency requirements.

Privacy & Regulatory Compliance

Control-C maintains compliance with applicable privacy obligations, including the Australian Privacy Principles (APPs) and Notifiable Data Breach (NDB) requirements, supported by documented incident response and breach assessment procedures.

For organisations operating internationally, our privacy and security practices are designed to align with recognised international privacy principles, including those commonly associated with GDPR and broader European data protection requirements. The platform supports data minimisation, encrypted storage, secure transmission, access controls, audit logging, and customer-authorised access models.

Security Controls

Our current security controls include:

  • AES-256 encryption for data at rest.

  • TLS 1.3 encryption for data in transit. ,

  • OAuth 2.0 authentication for platform integrations.

  • Multi-factor authentication (MFA).

  • Role-based access control (RBAC).

  • Comprehensive audit trails and access logging. ,

  • Logical data isolation between customers.

  • Documented incident response processes.

Infrastructure & Operational Security

  • Geographically distributed regional hosting options.

  • Ongoing vulnerability management and security monitoring.

  • Public service status monitoring and operational transparency.

  • Established backup integrity and continuity controls focused on preserving historical business records.

Penetration Testing

Control-C conducts regular independent security assessments and penetration testing.

Our most recent external assessment reported:

  • No critical vulnerabilities identified.

  • No high-severity vulnerabilities identified.

  • Strong TLS configuration and secure session management.

  • No SQL injection, cross-site scripting (XSS), or CSRF vulnerabilities identified during testing.

Certification Status

Control-C is currently progressing through the SMB1001 security certification programme and maintains documented security policies, operational controls, and governance procedures aligned with recognised industry best practices.

While we do not currently hold ISO 27001 or SOC 2 certification, we maintain a documented security framework and can provide supporting evidence of our security controls, penetration testing results, privacy practices, and operational procedures.

Available Documentation

We can provide:

  • Xero App Partner certification (independent annual security review)

  • Penetration Testing Executive Summary

  • Privacy & Data Handling documentation

  • Data Residency & Sovereignty overview

  • Security Architecture Summary

  • Incident Response Overview

  • Service Availability and Operational Management information

We would be happy to review any security questionnaire or procurement requirements your organisation may have.

Kind regards,

Campbell Green
Director
Control-C Limited
[email protected]
New Zealand | Australia | United Kingdom