Security at Sentrivox

Encryption Everywhere

All data in transit is protected with TLS. Endpoint upload payloads are additionally encrypted at the source using AES-256-GCM, with keys derived per payload via PBKDF2-HMAC-SHA256 (unique salt and nonce per payload).

Data at rest is encrypted using industry-standard cloud key management.

Least-Privilege Architecture

Every service runs under a dedicated identity scoped to only the permissions it needs. We do not use broad or shared administrative credentials for automated processes.

Cloud integrations (AWS, Azure, GCP) use read-only, scoped credentials for discovery and posture assessment.

Data Minimisation

The Sentrivox agent collects security-relevant metadata — installed software, patch state, configuration, and vulnerability findings. It does not collect file contents, keystrokes, or browsing activity.

Raw upload data is processed and removed from staging storage promptly after ingestion rather than being retained indefinitely.

Secure Development

Our code is continuously scanned for vulnerabilities and dependency risks. Container images are scanned before deployment, and we follow secure-by-default configuration practices aligned to the OWASP Top 10.

Access to production systems is restricted, logged, and audited.

Responsible Disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in Sentrivox, please email security@sentrivox.com with details so we can investigate and remediate quickly.

We ask that you give us reasonable time to address the issue before public disclosure, and that testing does not disrupt our services or access other customers’ data.

Questions

For any security enquiry, contact security@sentrivox.com.