SECURITY
Built to be trusted by the
teams who trust nothing.
We sell to security teams. That means our own security posture is part of the product. We hold ourselves to the standard we expect from the tools in our customers' environments.
HOW WE SECURE YOUR DATA
Tenant data isolation
Every row in our database is tagged with your organisation ID. Access is enforced at both the application layer and the database layer via Row Level Security. Your data is never co-mingled with another tenant's.
Outbound-only deployment
Sentinel's VPC scanner and endpoint agents make outbound HTTPS connections only. You never open inbound firewall rules or expose internal services. Nothing calls into your environment — everything calls out.
No raw prompt storage
The eBPF DLP monitor captures and classifies prompt content locally on the endpoint. Only redacted metadata — finding types, risk scores, counts — is transmitted. Raw prompt text never leaves the machine.
Role-based access control
Administrative actions, policy changes, scan triggers, and agent commands all require explicit role assignment. Principle of least privilege is enforced throughout the platform.
Encrypted in transit and at rest
All data transmitted between agents, scanners, and our platform uses TLS 1.2 or higher. Data at rest is encrypted using AES-256. Credentials and tokens are hashed and never stored in plaintext.
Audit logging
Every administrative action, configuration change, and policy update is logged with a timestamp and user identity. Logs are immutable and available for export.
OUR SECURITY PRACTICES
We run our own security program the same way we expect our customers to run theirs.
Accountability, not just controls. We test our assumptions, not just our configurations.
Vulnerability disclosure program with a defined response window
Dependency scanning and supply chain monitoring in our CI pipeline
Internal security reviews prior to every major feature release
Annual penetration testing by independent third parties
Incident response plan with defined SLAs for severity classifications
Security concerns or documentation requests?
If you've found a potential vulnerability or need security documentation for procurement, contact our team directly. We respond to all security-related inquiries within one business day.