ControlLedger helps managed service providers (MSPs) run recurring controls for each client. Each control has an assignee and a computed next due date. It includes control sets named "MSP default 8," "HIPAA lite," and "Cyber-insurance renewal basics," plus a seeded control library. Reminders go out at T-7 and on the due day. Evidence files are hashed with SHA-256 on upload. Clients can optionally co-sign by magic link, recording name, timestamp, and IP. Evidence Packs can be exported as PDF and zip with an expiring read-only share link. ControlLedger does not verify that a control was actually performed, does not pull evidence from RMM, PSA, or backup vendors, does not make anyone compliant, and is not legal, insurance, or audit advice.