Security

Access & authentication

• Email + password sign-in with password reset and email verification.
• Google OAuth for enterprise sign-in.
• Role-based access control (admin, manager, agent, viewer, builder, developer) enforced on the server.
• Session tokens are scoped per workspace and expire on sign-out.

Tenancy & data isolation

• Multi-tenant architecture with workspace-scoped identifiers on every record.
• Row-Level Security policies on every customer-facing table.
• Security-definer helpers for role checks to prevent policy recursion.

Encryption

• TLS 1.2+ for all data in transit.
• Storage-level encryption at rest for the database and file storage.
• Secrets are stored in a managed secret store, never in source code.

Application security

• Server functions validate input with Zod before any database access.
• Public API routes require signed callers or a valid workspace bearer token.
• Continuous dependency scanning; high and medium findings are remediated.

Operational security

• Audit logs for administrative and connector events.
• Least-privilege access for internal engineers.
• Backups and point-in-time recovery managed by our hosting platform.

Report a vulnerability

If you believe you've found a security issue, please write to security@sentinelfort.com. Please do not publicly disclose the issue until we've had a reasonable opportunity to investigate and remediate.