Company DNA for the AI era
Build the AI tools your company needs.
Composed from your rules and verified components.
Cursor and ChatGPT generate anything you prompt. Ctrl AI composes Apps from signed primitives — your team’s rules plus a library of verified universal components. Every step typed. Every action Ed25519-receipted. Every refusal traceable to a signer.
Or book a demo
The primitives
Two signed primitives. One composition.
Your AI composes from two signed libraries.
Ctrls encode rules unique to your company — your team signs them. Verified Components encode universal capabilities — open-source, versioned, audited. Every App uses both.
Two signatures on every receipt.
Your team’s authority where the rule lives. A verifiable open-source supply chain where the substrate runs.
Provenance
Click any sentence. See what made it true.
Every factual claim your AI emits binds to the receipt of the Ctrl that produced it — whether the AI answered a question in /ask, ran an App for your team, or fired one autonomously on a schedule. Open the receipt and you see the signers, the post-conditions that passed, and the literal paragraphs the runtime read — signed and hashed alongside.
Q3 ARR is $2.87M against the $4.5M target — a $530K gap. Two deals totaling $415K are flagged at-risk — Acme renewal (champion left) and Brightline (budget freeze).
Recommend doubling down on the two at-risk deals this week and accepting that Q3 lands ~12% under plan.(uncited — synthesis)
- non-negative-arr
- currency-usd
“Total Q3 closed: $2,870,000. Target: $4,500,000. Gap: $530,000 (12% behind plan).”
The drawer your auditor opens is the drawer your team opens.
No separate compliance product. The receipt is the audit trail.
The library
Your company’s brain. It grows every day.
Every doc you upload, every rule your expert signs — a new Ctrl, bound to a real human in a real department.
Every AI surface in your company gets smarter together. Green pulses are invocations happening right now.
Composed with 19 verified universal components
Your library is your moat. The verified components are your speed.
Both signed. Both versioned. Both audited end-to-end on every run.
Apps
Then your team runs Apps.
Forms in. Signed Ctrls through. Typed outputs out.
Every step is a function someone in your company authored, reviewed, and signed. There is no “inline code” for an App to ship. There is no “outside the substrate.”
ExpenseClassifier
Categorize an expense against your policy.
WeeklyComplianceSweep
Scan posture every Monday 09:00 UTC.
0 9 * * 1UTCContractRiskOnUpload
Scan contracts the moment they upload.
document.uploadedeventTriggers
Reactive Apps wait. Proactive Apps fire.
Cursor and ChatGPT only run when a human prompts them. Ctrl AI also fires Apps on a schedule, a document upload, or another Ctrl's completion. Every fire is a Mission with a “Fired by trigger” banner — never a Mission that materializes from nowhere.
WeeklyComplianceSweepEvery Monday morning, sweep posture. Flag drift. Notify the compliance owner with a summary + the list of failing controls.
cron · 0 9 * * 1ContractRiskOnUploadWhen a doc that looks like a contract uploads, scan it for risk clauses. Gate the findings for legal approval before notifying.
event · document.uploadedCustomerEscalationWhen sentiment classification returns critical, pull account context, draft a response, gate the send for owner approval.
ctrl_completed · classify-support-sentimentApp Library
Install your first App. 60 seconds.
Curated templates. Every one composed from signed primitives.
Each template carries a manifest of expected Ctrls — install warns about gaps before it runs, with one-click links to the Ctrl drafter. No surprises at runtime.
ExpenseClassifier
Categorize an expense, check it against policy, flag exceptions.
WeeklyComplianceSweep
Sweep posture every Monday. Notify owners of failing controls.
ContractRiskOnUpload
Scan contracts when they upload. Gate findings to legal approval.
CustomerEscalation
Manual or auto-fire on sentiment=critical. Pull context, draft response, gate the send.
The hub
Every model. Every App. Every answer. Through one signed substrate.
/ask, an App run, a triggered fire from cron or an upload — every invocation routes through one signed substrate to a specific primitive (a Ctrl from your library, or a verified component from the catalog), which decides whether to call a model, pull from data, or both, then returns a typed reply with a sealed receipt.
Sarah ChenWhat makes this different
Every tool ships AI now. Only one signs the substrate.
ChatGPT and Lovable generate. Slack AI and Glean answer from chunks. Zapier and n8n compose unsigned workflows. None refuse when the question isn't covered. None cite a human signature. None emit a receipt that the regulator can verify. None ship a two-layer signed substrate with universal components plus your team's rules. We do.
01 · Generative AI
ChatGPT · Claude · Cursor · Lovable · Replit · Gemini
An averaged voice with no company knowledge. Generates anything you prompt — including things you'd never authorize. Vibecoding for the weekend; not production.
02 · SaaS AI + automation
Slack AI · Monday · Glean · Zapier · n8n · UiPath
Each app decides independently. Zapier composes workflows, but nothing is signed; Glean answers from chunks, but nothing cites a human. No substrate across systems.
03 · Ctrl AI
Two signed libraries · one composition
Composes only from rules your team signed and a catalog of verified universal components. Refuses when no signed primitive applies. Every action emits a receipt with the chain of signatures intact.
SarahMarcusJiaAlexYukiThey generate. They silo. They compose unsigned.
We compose from two signed libraries — your rules and a verified universal catalog.
Lifecycle
When your docs change, your AI changes.
But only after a human signs.
No silent updates. No drift. When the policy moves, the Ctrls bound to it move to review pending. Your AI keeps the old rules until your expert reads the diff and re-signs. The receipts chain shows every version forever — and every past receipt is replayable against the new policy. Drift shows up automatically, before your auditor asks.
Today
Signed and current
discount-policy v3 is signed. All bound Ctrls are verified.
Ctrls bound to this policy · 3
The standard
Your signed Ctrls live in version control.
A signed Ctrl exports as .ctrl — a canonical YAML file with the schema, the signature, the fixtures, the regulatory citations. Commit it to your repo. PR review for policy. CI fixture runs gate every change. Merge to deploy.
The verified components catalog lives in the open at ctrl-ai/components-v1 (Apache-2.0) — the same canonical-file discipline, the same audit story. Both signed. Both versioned. Both inspectable on disk.
apiVersion: ctrl.dev/v0 kind: Ctrl metadata: slug: commons-kyc-check name: KYC Check (Commons v0) description: | Returns a KYC verification status, including PEP and sanctions screening. version: 1 domain: compliance dataSensitivity: confidential containsPii: true riskClass: high appliesToJurisdictions: [EU, UK, US] satisfiesClauses: - framework: amld6 clause: art-13 spec: inputSchema: { … } outputSchema: { … } implementation: kind: data_lookup connectorId: PLACEHOLDER-kyc-connector toolName: verify postConditions: - id: review-required-on-pep severity: error expr: outputs.pepStatus !== "pep" || outputs.reviewRequired === true fixtures: - name: clear-customer - name: pep-flag-triggers-review signatures: author: userId: usr_sarah signedAt: 2026-05-01T12:00:00Z
- Ctrl AI Fixtures· 3 .ctrl files validated · 6 fixtures green
- typecheck· No type errors
- build· next build · 38s
- lint· 0 errors · 0 warnings
Same artifact your auditor verifies. Same artifact the GitHub Action runs fixtures against on every PR. Same artifact any W3C VC verifier can validate offline. Same discipline applies to the verified components catalog on disk.
Cross-org by construction
Audit by graph. Authority by passport.
Every decision an AI makes for your company traces back to the chain of signed primitives — your Ctrls and the verified components they compose with — that produced it. And every external agent — your consultant's Claude Code, your vendor's Cursor — carries one passport across every client org, with per-primitive grants signed independently by each.
Click any answer. See the chain that produced it.
From the receipt drawer → "Why this decision?" → opens /decisions/[invocationId]
One agent. Every client. One passport.
Ed25519-signed by the issuing org. Each client grants per-Ctrl access, independently.
- liveAcme Corp7 Ctrls granted · read · forecast Ctrls
- liveBeta Industries12 Ctrls granted · read · audit Ctrls
- liveGamma Holdings4 Ctrls granted · read · KYC pack
The audit story isn't a separate product.
The Decision DAG falls out of the receipt chain. The grants matrix falls out of the passport table. Compliance is shape, not feature.
Pricing
Every tier ships the same receipts.
Three tiers. The transparency log, the signed Ctrls, the audit trail — every tier gets the full system. Tier is signers and library size, never features.
Team
- ✓Up to 5 signers
- ✓25 signed Ctrls
- ✓Community packs
- ✓BYOK
Company
Recommended- ✓Up to 25 signers
- ✓100 signed Ctrls
- ✓Premium packs (SOC 2, GDPR)
- ✓Slack · voice · email · web · MCP surfaces
- ✓Audit-grade transparency log
Enterprise
- ✓Unlimited signers + Ctrls
- ✓SSO + SAML + audit roles
- ✓Dedicated infrastructure
- ✓Custom packs + co-signed by your experts
- ✓Procurement / DPA / red team support
Start in 60 seconds
Drop a doc.
Be running in 60 seconds.
Upload 3–5 foundational docs. Sign the Ctrls the extraction agent drafts. Your team installs Apps from the library — reactive and proactive — composed entirely from signed primitives.
Or fork a Ctrl Commons pack — KYC, AML, sanctions screening, FX, audit-cadence — signed scaffolds you re-sign for your jurisdiction.
Or book a demo