Company DNA for the AI era
Your AI doesn't make it up.
Every reply is a function your team signed.
Or it doesn't reply.
Cursor and ChatGPT will generate anything you prompt.
Ctrl AI composes only from your signed library — and cites the signer on every output, with an Ed25519 receipt that traces back to your signature.
“Discounts above 10% require VP approval. SDR cap is 5%.”
The primitive
A Ctrl is one signed rule.
Your AI doesn't make decisions. It invokes these.
Every answer your AI gives is the typed output of a function your expert signed. Watch one form, end to end.
Now every AI surface in your company invokes the same Ctrl.
Slack, voice, email, web chat, MCP partners — one signed library, one decision.
Provenance
Click any sentence. See what made it true.
Every factual claim your AI emits binds to the receipt of the Ctrl that produced it — whether the AI answered a question in /ask, ran an App for your team, or fired one autonomously on a schedule. Open the receipt and you see the signers, the post-conditions that passed, and the literal paragraphs the runtime read — signed and hashed alongside.
Q3 ARR is $2.87M against the $4.5M target — a $530K gap. Two deals totaling $415K are flagged at-risk — Acme renewal (champion left) and Brightline (budget freeze).
Recommend doubling down on the two at-risk deals this week and accepting that Q3 lands ~12% under plan.(uncited — synthesis)
- non-negative-arr
- currency-usd
“Total Q3 closed: $2,870,000. Target: $4,500,000. Gap: $530,000 (12% behind plan).”
The drawer your auditor opens is the drawer your team opens.
No separate compliance product. The receipt is the audit trail.
The library
Your company's brain. It grows every day.
Every doc you upload, every rule your expert signs — a new Ctrl, bound to a real human in a real department.
Every AI surface in your company gets smarter together. Green pulses are invocations happening right now.
Apps
Then your team runs Apps.
Forms in. Signed Ctrls through. Typed outputs out.
Every step is a function someone in your company authored, reviewed, and signed. There is no “inline code” for an App to ship. There is no “outside the substrate.”
ExpenseClassifier
Categorize an expense against your policy.
WeeklyComplianceSweep
Scan posture every Monday 09:00 UTC.
0 9 * * 1UTCContractRiskOnUpload
Scan contracts the moment they upload.
document.uploadedeventTriggers
Reactive Apps wait. Proactive Apps fire.
Cursor and ChatGPT only run when a human prompts them. Ctrl AI also fires Apps on a schedule, a document upload, or another Ctrl's completion. Every fire is a Mission with a “Fired by trigger” banner — never a Mission that materializes from nowhere.
WeeklyComplianceSweepEvery Monday morning, sweep posture. Flag drift. Notify the compliance owner with a summary + the list of failing controls.
cron · 0 9 * * 1ContractRiskOnUploadWhen a doc that looks like a contract uploads, scan it for risk clauses. Gate the findings for legal approval before notifying.
event · document.uploadedCustomerEscalationWhen sentiment classification returns critical, pull account context, draft a response, gate the send for owner approval.
ctrl_completed · classify-support-sentimentApp Library
Install your first App. 60 seconds.
Curated templates. Every one composed from signed primitives.
Each template carries a manifest of expected Ctrls — install warns about gaps before it runs, with one-click links to the Ctrl drafter. No surprises at runtime.
ExpenseClassifierCategorize an expense, check it against policy, flag exceptions.
WeeklyComplianceSweepSweep posture every Monday. Notify owners of failing controls.
ContractRiskOnUploadScan contracts when they upload. Gate findings to legal approval.
CustomerEscalationManual or auto-fire on sentiment=critical. Pull context, draft response, gate the send.
The hub
Every model. Every App. Every answer. Through your signed library.
/ask, an App run, a triggered fire from cron or an upload — every invocation routes through your signed library to a specific Ctrl, which decides whether to call a model, pull from data, or both, then returns as a typed reply with a sealed receipt.
Sarah ChenWhat makes this different
Every SaaS has AI now. Only one has signed Ctrls.
ChatGPT, Claude, Cursor, Slack AI, Monday AI, Glean — all run a language model that generates anything you prompt. None refuse when the question isn't covered. None cite a human signature. None emit a receipt that the regulator can verify. We do.
01 · Chat & coding AI
ChatGPT, Claude, Cursor, Gemini
An averaged voice with no company knowledge. Generates anything you prompt — including things you'd never authorize.
02 · SaaS AI
Slack AI · Monday AI · HubSpot AI · Glean
Each app makes decisions independently. No signed rules. No audit trail across systems.
03 · Ctrl AI
Your signed library
Composes only from rules your team signed — and refuses when no signed rule applies. Every action emits a receipt.
SarahMarcusJiaAlexYukiThey build AI on their data.
We build the library your data signs.
Lifecycle
When your docs change, your AI changes.
But only after a human signs.
No silent updates. No drift. When the policy moves, the Ctrls bound to it move to review pending. Your AI keeps the old rules until your expert reads the diff and re-signs. The receipts chain shows every version forever — and every past receipt is replayable against the new policy. Drift shows up automatically, before your auditor asks.
Today
Signed and current
discount-policy v3 is signed. All bound Ctrls are verified.
Ctrls bound to this policy · 3
The standard
Your signed Ctrls live in version control.
A signed Ctrl exports as .ctrl — a canonical YAML file with the schema, the signature, the fixtures, the regulatory citations. Commit it to your repo. PR review for policy. CI fixture runs gate every change. Merge to deploy.
apiVersion: ctrl.dev/v0 kind: Ctrl metadata: slug: commons-kyc-check name: KYC Check (Commons v0) description: | Returns a KYC verification status, including PEP and sanctions screening. version: 1 domain: compliance dataSensitivity: confidential containsPii: true riskClass: high appliesToJurisdictions: [EU, UK, US] satisfiesClauses: - framework: amld6 clause: art-13 spec: inputSchema: { … } outputSchema: { … } implementation: kind: data_lookup connectorId: PLACEHOLDER-kyc-connector toolName: verify postConditions: - id: review-required-on-pep severity: error expr: outputs.pepStatus !== "pep" || outputs.reviewRequired === true fixtures: - name: clear-customer - name: pep-flag-triggers-review signatures: author: userId: usr_sarah signedAt: 2026-05-01T12:00:00Z
- Ctrl AI Fixtures· 3 .ctrl files validated · 6 fixtures green
- typecheck· No type errors
- build· next build · 38s
- lint· 0 errors · 0 warnings
Same artifact your auditor verifies. Same artifact the GitHub Action runs fixtures against on every PR. Same artifact any W3C VC verifier can validate offline.
Cross-org by construction
Audit by graph. Authority by passport.
Every decision an AI makes for your company traces back to the chain of Ctrls that produced it. And every external agent — your consultant's Claude Code, your vendor's Cursor — carries one passport across every client org, with per-Ctrl grants signed independently by each.
Click any answer. See the chain that produced it.
From the receipt drawer → "Why this decision?" → opens /decisions/[invocationId]
One agent. Every client. One passport.
Ed25519-signed by the issuing org. Each client grants per-Ctrl access, independently.
- liveAcme Corp7 Ctrls granted · read · forecast Ctrls
- liveBeta Industries12 Ctrls granted · read · audit Ctrls
- liveGamma Holdings4 Ctrls granted · read · KYC pack
The audit story isn't a separate product.
The Decision DAG falls out of the receipt chain. The grants matrix falls out of the passport table. Compliance is shape, not feature.
Pricing
Every tier ships the same receipts.
Three tiers. The transparency log, the signed Ctrls, the audit trail — every tier gets the full system. Tier is signers and library size, never features.
Team
- ✓Up to 5 signers
- ✓25 signed Ctrls
- ✓Community packs
- ✓BYOK
Company
Recommended- ✓Up to 25 signers
- ✓100 signed Ctrls
- ✓Premium packs (SOC 2, GDPR)
- ✓Slack · voice · email · web · MCP surfaces
- ✓Audit-grade transparency log
Enterprise
- ✓Unlimited signers + Ctrls
- ✓SSO + SAML + audit roles
- ✓Dedicated infrastructure
- ✓Custom packs + co-signed by your experts
- ✓Procurement / DPA / red team support
Start in 60 seconds
Drop a doc.
Be running in 60 seconds.
Upload 3–5 foundational docs. Sign the Ctrls the extraction agent drafts. Your team installs Apps from the library — reactive and proactive — composed entirely from signed primitives.
Or fork a Ctrl Commons pack — KYC, AML, sanctions screening, FX, audit-cadence — signed scaffolds you re-sign for your jurisdiction.
Or book a demo