Information Security

Security architecture

Sentrix applies defence in depth: independent controls at the edge, in the application, at the data layer and in operations, so that no single failure exposes customer data. The platform is a multi-tenant SaaS with logical isolation between workspaces, and production is segmented from development and evaluation environments.

Infrastructure & hosting

The platform runs on reputable managed cloud infrastructure — Vercel for edge/serverless application delivery and Neon for managed Postgres — with hardened, regularly patched systems. Environments are segmented, and production is separated from development and evaluation. The platform runs in a single primary region today; customer-selectable data-residency options, including UAE-region hosting, are on our roadmap and not yet generally available. Named infrastructure sub-processors, their purpose and region are listed in our Sub-processors register.

Encryption & key management

Data is encrypted in transit with TLS 1.2+ and at rest with AES-256, including backups. Secrets and keys are held in managed secret storage with restricted access; application configuration is sourced from platform secrets rather than from the code or repository. API keys are stored only as a SHA-256 hash — the plaintext key is shown once at creation and cannot be retrieved afterwards — and keys are revocable.

Identity, access control & authentication

Access is governed by role-based access control (RBAC) with least-privilege defaults, enforced server-side on every request against the authenticated workspace — not by hiding controls in the interface. Local credentials are hashed with Argon2; sessions are opaque, server-side, random tokens set in httpOnly, secure, SameSite cookies. SSO/SAML and SCIM for Institution plans are on our roadmap.

Role	Access
Owner	Full control of the workspace, billing and members. Owner protections prevent lockout and self-demotion of the last owner.
Manager	Manage members, rules and settings; cannot remove the workspace owner.
Analyst	Work cases, run decisions and dispositions; no member or billing administration.
Viewer	Read-only access to decisions, cases and audit records.

Access to production is limited to authorised personnel on a need-to-know basis and logged, with prompt deprovisioning of departing users and periodic access review. Four-eyes approval on high-impact overrides is on our roadmap.

Application security

• Server-side input validation and output encoding on all endpoints.
• CSRF protection on state-changing requests and secure session handling.
• Security headers applied at the edge — HSTS (with preload), Content-Security-Policy locked to first-party sources with framing denied, plus content-type and referrer protections.
• Authenticated API surface: unauthenticated calls are rejected with 401, and requests are scoped to the caller's workspace.
• Dependency and vulnerability management with timely patching.

Secure development lifecycle

Changes move through version control and review before release. We keep dependencies current and monitor for known vulnerabilities, separate configuration and secrets from code, and fail startup fast if the environment is misconfigured (for example, a non-production database configuration on a hosted platform is rejected rather than silently accepted). Development and evaluation environments are isolated from production data.

Tenant isolation

Customer data is logically separated per workspace so that one tenant cannot access another's data. Access checks are enforced on every request against the authenticated workspace context, and API keys are bound to a single workspace.

Logging & audit

The platform maintains an append-only audit log of decisions, overrides and case actions — the application writes audit entries and does not update or delete them — plus operational logging and monitoring for security and reliability. Audit records are structured to support the evidence regulated customers provide to examiners. Cryptographic tamper-evidence (hash-chaining / WORM export) is on our roadmap.

Availability & resilience

The platform is delivered on managed, horizontally-scaled infrastructure with regular backups and recovery procedures. We monitor system health — published at Status and exposed programmatically via a health endpoint — and maintain incident-response processes. Plan-specific availability and support-response commitments are set out in the applicable Order Form and service schedule; we do not publish an availability figure we cannot stand behind.

Incident response & breach notification

We maintain incident-response processes covering detection, triage, containment and remediation. For incidents affecting personal data, we notify affected customers without undue delay in line with our DPA and the UAE PDPL, and support customers in meeting their own notification obligations.

Vulnerability disclosure

We welcome reports from security researchers. Please report suspected vulnerabilities to security@sentrix.world with enough detail to reproduce the issue, and follow our Responsible Disclosure Policy. We ask that you avoid privacy violations, service disruption and data destruction while testing, and we will acknowledge and work with you in good faith under our safe-harbour commitment.

Data handling & minimisation

We collect and retain only what is needed to provide the Services and apply data minimisation throughout. Data handling follows our Privacy Policy and DPA, including retention controls and deletion on the terms set out there. In the evaluation environment, screening providers run in sandbox and results are simulated.

Shared responsibility

Security is a shared model. Sentrix secures the platform, infrastructure, application and the controls described above. The customer is responsible for managing its own users and roles, safeguarding API keys and credentials, configuring rules and thresholds to its risk appetite, connecting and governing its production screening providers, and the regulatory decisions it makes using the platform. Sentrix is a technology vendor, not a licensed financial institution.

Reviewing Sentrix for a security or vendor-risk assessment? See Enterprise & procurement for the documentation package, or contact security@sentrix.world — we can walk your team through architecture, controls and our attestation roadmap.