Price Undisclosed. The stitch is not.
Spin.AI announced on August 31 that it has acquired DoControl, an Israeli-founded SaaS data access governance and DLP company. DoControl’s own customer note dated September 8 confirms the close framing: DoControl joins Spin.AI, brands stay independent for the foreseeable future, no migration required, and the DoControl team continues to lead its product roadmap. Deal consideration is Undisclosed in both company posts. The buyers refused to print a multiple.
What is sourced is the architecture of the tuck-in. Spin.AI’s release says the combination pairs DoControl’s automated data access governance, DLP, and AI governance with Spin.AI’s SaaS security posture management (SSPM), browser and extension security (SpinCRX), ransomware resilience, and its own DLP layer. The combined cover list, per Spin.AI: access governance and DLP; SSPM; browser security; insider and non-human identity risk; ransomware resilience. Spin.AI says it already protects more than 2,000 organizations and cites a 4.8/5 G2 rating across 127 reviews, plus a risk engine that has evaluated more than 550,000 browser extensions and applications. Those are company claims.
Public capital history: DoControl’s April 2022 Series B was $30 million led by Insight Partners, with StageOne, Cardumen, RTP Global, and CrowdStrike Falcon Fund participating (TechCrunch). Prior seed and Series A coverage puts earlier disclosed capital around $13.4 million, for roughly $43–45 million raised through Series B depending on which secondary tally you use. Spin.AI’s growth capital is K1 Investment Management, which announced its investment in Spin.AI in March 2026 and which Spin.AI credits as instrumental to this acquisition. Spin.AI also tucked Revyz (Atlassian ecosystem) earlier in 2026 — a second bolt-on in five months per CyberMerge’s Latest Deals sheet. Post-money for either side: Undisclosed.
Customer proof points in the Spin.AI release are concrete and limited: Vox Media used DoControl to identify and remediate excessive sharing across 20% of its SaaS documents; StackAdapt cut public and external asset exposure by roughly 75% with more than 55,000 automated remediations in 90 days. DoControl was named in The Forrester Wave: SaaS Security Posture Management, Q4 2023. Useful diligence color. Not a substitute for a disclosed purchase price.
POV: this is the PE-backed SaaS security version of the platform stitch CyberMerge keeps tracking — Cyera closing Oasis at $1 billion for data-plus-NHI, Proofpoint circling Varonis for email-plus-data, Spin.AI folding DAG/DLP into SSPM-plus-browser. Best-of-breed SaaS DLP is getting absorbed into layered “SaaS and AI security” platforms because buyers are tired of five consoles for one Google Workspace tenancy. The open question is whether Undisclosed means a modest tuck-in on ~$45 million of disclosed DoControl capital — or a richer check that K1 is willing to hide. Until a number prints, underwrite the product map, not a rumor multiple.
Underwrite sheet — sourced only: Spin.AI acquires DoControl; price Undisclosed (Spin.AI Aug 31 / DoControl Sep 8); Spin.AI >2,000 orgs; K1 backer (Mar 2026); DoControl Series B $30M Insight (Apr 2022); ~$43–45M disclosed raised; Revyz prior tuck-in; brands independent / no migration. Question the blank check size. Sources: the company posts. SaaS security is consolidating in layers. The close is real. The price is not on the tape.