The short answer
The control card records the five controls per workflow: input, authority, approval, exception and evidence. That is the document you later use to explain what the workflow was allowed to do and who decided. Free, no account, everything runs in your browser and nothing is stored.
Your control card
What you fill in
The control card asks for ten fields: the process, the start signal and input, permitted and forbidden sources, permitted and forbidden actions, who checks and decides, exceptions with stop rules and an escalation owner, what goes into the log, the acceptance criterion, the regression test and the stop and recovery procedure. All fields are required, because a card with gaps proves nothing in an audit.
What the tool assumes
The card is drawn up in your browser. Your answers do not go to a server and are not stored here. The tool does not assess your process and gives no judgement on risk or legislation; it records what you decided, in a fixed order that an audit and an implementation can both use.
What comes next
If you are not yet sure the process has enough basis, start with the process check. To find out whether the process is still worth it after review and maintenance, use the baseline and the calculator. The background to the five controls is on the page about security and human control.