Security is part of the case design.
Sentendra is a security platform sold to security teams. We treat your customers' alert telemetry the way we'd expect our own to be treated, with strong defaults that keep data inside the perimeter you control.
- IsolatePostgreSQL FORCE ROW LEVEL SECURITY
- ProtectTLS, encrypted secrets, 2FA, SSO, RBAC
- ProveAppend-only activity and exportable audit logs
AI and your data
You choose where it runs.
Most "AI-powered" SOC tools quietly send your alerts, hostnames, usernames and observables to a public LLM provider the moment you log in. Sentendra never does this without an explicit decision from you.
- CommunityAI is off by default. No model runs and no data is sent anywhere for analysis. If you want AI on Community, plug in your own OpenAI or Anthropic key and the data flows to your provider under your account and DPA. We don't host a model for free-tier tenants.
- SOC & MSSPA Sentendra-hosted model runs on dedicated GPU infrastructure inside our perimeter. Your alert content stays inside Sentendra. Or bring your own LLM key if you prefer your own provider.
- EnterpriseA dedicated isolated GPU model, or a dedicated single-tenant deployment in the region of your choice for full data residency, or BYO key with a sub-processor disclosure flow built in.
Multi-tenant isolation
Sentendra enforces tenant isolation at the database layer using PostgreSQL Row-Level Security with FORCE ROW LEVEL SECURITY on every tenant-scoped table. Each request runs under a tenant-scoped role with its tenant ID set as a session GUC. A bug in application code cannot cross the tenant boundary, because the database itself rejects the query.
Encryption and access controls
All traffic is TLS-encrypted in transit: HTTPS, the internal service mesh, and database connections. Credentials and integration secrets are encrypted at rest. Authentication uses JWT with rotating refresh tokens and per-tenant nonce binding to reject cross-tenant token replay. Optional 2FA, SAML / OIDC SSO, and remember-me tokens are supported. RBAC permissions can be customised per user.
Dedicated single-tenant option
On the Enterprise plan, you can request a dedicated single-tenant deployment in the AWS, GCP or Azure region of your choice (EU, US, UAE, KSA, and others on request). Your alert data, cases, observables, AI prompts and AI responses live on infrastructure that no other Sentendra tenant shares. Private-network deployments with strict egress controls and BYOK encryption are available for SOC 2, GDPR and HIPAA-aligned environments.
Compliance posture
Sentendra is designed to slot into SOC 2, ISO 27001, GDPR and HIPAA-aligned environments. The architecture supports the technical controls these frameworks require: RLS-enforced tenant isolation, audit logging on every privileged action, encrypted secrets, configurable data retention, and on Enterprise a dedicated single-tenant deployment in the region you choose, so all processing including AI stays within that boundary. Talk to us about your specific control matrix when you contact us.
Audit and observability
Every privileged action (login, role change, integration created, case deleted, AI analysis triggered) is recorded in an append-only activity log. Logs are exportable for ingestion into your own SIEM. Uptime monitoring and integration health checks are visible to admins.
Reporting security issues
If you believe you have found a security vulnerability, please report it responsibly to [email protected]. We will acknowledge within 48 hours, work with you to validate and remediate, and credit you in the release notes if you wish.
Bring one real alert. We'll walk it to a closed case.
See Sentendra running on your own alerts in a 30-minute demo.