Your data, and where it goes
Last updated 6 August 2026
This page is written for the person who has to sign off on the tool rather than use it. Every claim on it is checkable against the code, and the ones that matter most are held in place by tests rather than by intent.
Where the work happens
ctrlPlanner runs in your browser. Drawings are read from your drive, rendered locally, and stored in files you keep. There is no server-side copy of a plan, because there is no server that holds plan content at all: the only things served are the application itself and a sample plan.
What leaves your machine
| Leaves | Never leaves |
|---|---|
| Your account email | Drawings |
| Your shop name | Characteristics, tolerances and limits |
| Your license key, when a subscription is checked | Operations, routings and vendors |
| Your shop settings | Annotations and marked-up prints |
| Inspection records and first article reports |
That is the whole list. A license check transmits a token identifying the account and nothing else. There is no telemetry, no analytics, no third-party script and no beacon, and there will not be: a page that loads a tag manager on a network inside CMMC or ITAR scope is a conversation nobody wants to have.
The build measures this rather than asserting it. One check drives the export menu with the network watched and fails on any outbound request; another loads the public pages cold and reports every external request, which is how three calls to a font host were found and removed.
Your files are yours
A plan is a .cplan.zip: an ordinary ZIP holding readable JSON, ordinary PNGs, and a plain-text README that says what all of it is. You can open it, read it, archive it and migrate it without ctrlPlanner and without our permission, during a subscription and after one.
Working offline
ctrlPlanner keeps working with no network. A signed license is cached locally with a fourteen-day grace period and re-checked quietly whenever there is a connection, so a laptop taken to a customer site keeps authoring, and a shop that renewed yesterday gets a fresh fourteen days the next time it connects.
This is a design constraint rather than a convenience. A tool that must reach a server to open a file is a tool a shop with blocked egress cannot use, and that shop is exactly who this is for.
If a subscription ends
The reason is not generosity. A shop under AS9100 has to be able to reproduce a control plan or a first article report when an auditor asks for one, whether or not it is still a customer of ours, and a lapsed shop correcting its address so a reprinted report carries the right header is precisely the case that promise exists to cover. Opening and exporting are unconditional in the code, and a test sweeps every possible license state asserting neither can be switched off.
What stops is authoring: creating and changing plan content. That is what is sold.
For an IT or quality reviewer
- No installation. It runs in a current browser.
- No inbound connections, no agent, no local service.
- No workspace content crosses the network, so the tool does not widen the assessment boundary of a system already in scope.
- Records are held in open files in your own storage, under your own retention and backup policy.
- Availability of the vendor is not a dependency for reading past records: the file format is documented and the plans open without us.
If a questionnaire needs answering that this page does not cover, write to support@ctrlplanner.com and say what is being asked.