Skip to content
Security

How we secure SentinelPanda

A compliance product has to clear the bar it asks customers to clear. The commitments here apply to every tenant, regardless of plan, and they describe how we protect customer data, how we run our own compliance program, and how to report a vulnerability.

Six commitments

A compliance product has to clear the bar it asks customers to clear. The commitments below are non-negotiable and apply to every tenant, regardless of plan.

  • HMAC-signed audit log. Every state change, comment, and approval is written to an append-only log, signed and chained so tampering is detectable.
  • AES-256-GCM credentials. Integration secrets are encrypted at rest and decrypted only inside the sync worker, at the moment a sync runs.
  • SSO + MFA (org-enforceable). Per-tenant OIDC single sign-on, or email + password — with TOTP multi-factor authentication your organization can require, plus an idle session timeout.
  • Per-tenant isolation. Every record is scoped to a tenant and access is enforced server-side on every call — never at render time.
  • Three-layer RBAC. Role, tenant, and resource. Permissions are checked on every server call.
  • QSA + auditor visibility. External auditors and your QSA join your workspace with auditor-layer seats. Every approval, rejection, and request-for-info is recorded to the HMAC-signed audit log.

How we protect customer data

Customer content is encrypted in transit (TLS 1.2+) and at rest. Logical access is gated by SSO with org-enforceable MFA; access to production systems is recorded in the audit log. Operational changes to the platform follow the same change-management process we ask customers to implement for their own programs — peer-reviewed pull requests, automated testing, separation of environments, and a documented emergency-change procedure with post-hoc review.

How we run our own compliance

We use the product to run the controls we publish. A SOC 2 readiness pass and an ISO 27001 risk assessment are in progress; certification timelines will be published here when they are confirmed with the assessor. The same continuous evidence collection that ships to customers feeds our own program.

Reporting a vulnerability

If you believe you have found a security vulnerability, please report it through our responsible disclosure programme. We respond to every report we receive.

Contact

Security questions: security@sentinelpanda.com. A signed PGP version of this address is published in /.well-known/security.txt.