Trust & Security
Your Source Code Stays Yours.
Sentinel is a security platform. We hold ourselves to the standards we scan for.
Security posture
Sentinel is built on the principle that a security vendor must be trustworthy with source code. We design every system—from authentication to data storage to inference—assuming the data we touch is as sensitive as the vulnerabilities we find. Our infrastructure, access controls, and operational practices reflect that responsibility.
Data handling
- •Repository access: Source code is accessed read-only via GitHub OAuth. Sentinel never clones entire repositories into storage; only scan results are persisted.
- •Finding storage: Security findings and metadata are stored in a Postgres database (Neon) with encryption at rest.
- •Transit encryption: All data in transit is encrypted with TLS.
- •Secrets protection: Secrets detected in scans are never written to PR bodies, logs, or external systems. Detections are recorded as findings, not stored as plaintext.
Subprocessors
| Subprocessor | Purpose | Data |
|---|---|---|
| Vercel | Application hosting and deployment | Application runtime, request logs, deployment metadata |
| Neon | Postgres database for findings and metadata | Security findings, user configuration, scan results, metadata |
| Anthropic | AI inference for synthesis and ranking | Finding summaries and context for synthesis; ranking input |
| Resend | Transactional email | User email addresses, alert notifications |
| GitHub | OAuth authentication and repository access | GitHub user identity; repository contents (read-only via OAuth) |
Compliance mappings
Sentinel's findings map to industry standards and regulatory frameworks:
- •SOC 2 Type II: Security, availability, processing integrity controls
- •PCI-DSS: Payment Card Industry standards for cardholder data protection
- •NIST: Cybersecurity Framework and Special Publications
- •HIPAA: Health Insurance Portability and Accountability Act controls
- •CIS: Center for Internet Security Benchmarks
Sentinel's own SOC 2 Type II audit is in progress.
Responsible disclosure
We take security reports seriously. If you discover a vulnerability, please report it confidentially via our waitlist contact form with the subject line "Security Report." We will acknowledge your report within 48 hours and work with you toward a fix. We do not disclose vulnerabilities publicly until a fix is available.
Questions
Want to learn more?
Reach out via the waitlist form with your security questions. We are happy to discuss our practices in detail or connect with your security team.
Join waitlist →