Mechanisms, not adjectives.
Sentinel governs your AI, so how we protect your data has to be answerable in detail — not with the word “secure.” Here's exactly how it works, the questions security teams ask, and an honest note on what we haven't done yet.
Every query is organization-scoped and membership-verified server-side. Cross-tenant access returns 404 — verified by an automated isolation test on every change.
TLS 1.2+ in transit with HSTS. Database volume encrypted at rest, enabled before any production data is onboarded. Region-pinnable (Mumbai / EU).
scrypt-hashed passwords (constant-time compare); signed, HttpOnly, Secure session cookies. API keys stored only as a SHA-256 hash, shown once. SSO/SAML + MFA on the roadmap.
Every governance action is written to a SHA-256 hash-chained log. Altering any past record breaks the chain and is detectable — tamper-evident, not just claimed.
The whole service is built on Node built-ins — no third-party packages. No supply-chain risk, and a codebase your team can actually audit.
Processed by Razorpay/Stripe; card data never touches Sentinel. Callbacks are signature-verified server-side.
Where is our data stored, and can we pin the region?
A single region-pinned store (deployable in Mumbai or the EU) on an encrypted volume. We confirm your region at onboarding.
How is one customer's data isolated from another's?
Every database query is scoped with WHERE org_id = ?; the org is derived from a signed session and membership is verified before access. Requesting another tenant's record returns 404. An automated 18-check isolation audit runs on every change.
How are passwords and API keys stored?
Passwords: scrypt with a per-user salt, constant-time compare — never stored in plaintext. API keys: only a SHA-256 hash and a prefix are stored; the key is shown once at creation.
Do you support SSO and MFA?
SSO/SAML and SCIM are on the enterprise roadmap; end-user MFA is planned. Today: email + scrypt password with signed, HttpOnly session cookies.
What customer data do you actually hold?
Account data (email, password hash, org metadata), the AI inventory & findings, the audit trail, and a billing reference. We do not store AI prompts/responses, document contents, or card data. With local actor-sensor mode, your raw logs never leave your environment.
Can we delete everything and offboard cleanly?
Yes. On request we delete your organization's data — including backups on the next rotation — typically within 30 days, and confirm in writing. Demo data auto-expires.
What happens during a security incident? Will you notify us?
We follow a documented incident-response process and commit to notifying affected customers without undue delay — targeting within 72 hours of confirming an incident affecting their data.
Do you have backups and disaster recovery?
Scheduled volume snapshots with practiced restores. Current targets: RPO ≤ 24h, RTO ≤ a few hours, improving with off-site backups as we scale. Because the audit log is hash-chained, a restored database can be verified end-to-end.
Are you SOC 2 / ISO 27001 certified?
Not yet. The technical controls those frameworks require are already in place; we pursue SOC 2 (Type I → II) as enterprise demand justifies it. We can share our full security package and a pen-test report (when available) under NDA.
Can you sign an NDA / DPA?
Yes — an NDA immediately, and a Data Processing Agreement at contract. A sub-processor list is part of our security package.
What is Sentinel, in one line?
The system of record for the AI in your company — it discovers every AI tool, copilot, and autonomous agent touching your data, governs the risky ones, and produces audit-ready evidence.
How does the scan work? Is it intrusive?
Read-only. You connect a source you already have (identity provider, or egress/LLM-gateway logs) and we map what's there. The actor sensor can run locally and return only findings.
Does Sentinel use AI / an LLM to decide risk?
No. Risk is a deterministic, explainable sum of named factors — not a model's guess. We never call something “AI” without a hard signal, and where evidence is missing we say “Unknown.” Auditors get a number they can trace.
How do I start?
Create a free account for the Discovery scan, or try the live demo. For a pilot on your own data, contact us and we'll run the local sensor with you in about 15 minutes.
What does it cost?
Discovery is free. Govern and Prove are paid — see pricing.