Yes, any business logic for your data should be in the appropriate model class. Preferably there will be no sql in your controller save the occational where statement to be passed to a defined model method.