Security & Trust

Our Approach

Sentinel exists to help other applications defend themselves—so we hold our own infrastructure to the same standard we ask of our customers. Security isn't a one-time checklist for us; it's an ongoing practice we revisit regularly as the product grows. This page describes what we actually do today, plainly, without overstating it.

Application Security

• A Content Security Policy (CSP) is enforced across the dashboard and API, restricting which scripts, styles, and origins the site will load.
• Standard security headers are set on every response, including HTTP Strict Transport Security (HSTS), X-Frame-Options, X-Content-Type-Options, and a strict Referrer-Policy.
• We run regular internal security reviews and dependency scanning across our codebase, and remediate findings as they're identified.
• API traffic is rate-limited at multiple layers—per tenant, and platform-wide—to contain abuse and protect service availability for everyone.
• Our detection engine is continuously tested against adversarial inputs in an automated internal red/blue-team loop, to catch regressions before they reach production.

Data Protection

• All traffic to and from Sentinel is encrypted in transit (TLS/HTTPS), enforced via HSTS.
• Customer-provided upstream API keys (e.g. your own Anthropic key) are encrypted at rest, never stored in plaintext.
• Sentinel does not store or log the content of clean requests—only requests that trigger a security action are retained, and only as needed to show you what happened.
• Secret and credential detection is built into the product itself: if a scanned request or tool result contains an API key, token, or credential, Sentinel can redact it before it's ever returned—the same protection we build for our customers applies internally too.

Infrastructure & Reliability

• Automated daily backups, replicated off-server, with a defined retention window.
• Backing services are health-checked continuously, with automated recovery if a service becomes unresponsive.
• Network-layer flood protection sits in front of our API, independent of and in addition to application-level rate limiting.

Privacy & Your Rights

If you're in the EEA or UK, you have rights under the GDPR and UK GDPR, including the right to access, export, and delete your data—account deletion is available directly from Dashboard → Settings and takes effect immediately, not just a deactivation. Full detail, including legal basis and retention periods, is in our Privacy Policy.

Where We're Headed

We haven't yet completed a formal third-party compliance certification (e.g. SOC 2, ISO 27001)—we'd rather tell you that plainly than imply something we haven't earned. As a growing company, pursuing independent third-party security validation, including external penetration testing, is on our roadmap. We'll update this page as that work lands.