Trust & policies
Security & Compliance
Last updated: November 2, 2026
Security is a shared responsibility between Sentiro, its infrastructure providers, and your workspace administrators. This page describes practical safeguards and how to request evidence for your organisation’s requirements.
Account and workspace access
Use individual accounts and grant workspace members only the access they need. Review membership regularly, remove access when people leave, and secure any external sign-in accounts. Protect API credentials and notification tokens, and rotate them if exposure is suspected.
Transport and payment handling
Use the hosted service over HTTPS. Payments are completed through Bachs hosted checkout, which handles payment entry under its own security controls. Do not send payment details through monitor configuration, incident messages, or support email.
Monitoring configuration
Only configure checks against authorised targets. Prefer dedicated health endpoints and credentials with minimal permissions. Monitor responses and alert payloads may contain operational details, so avoid secrets and review recipients before enabling an integration or publishing a status page.
Responsible disclosure
Report suspected vulnerabilities privately to security@sentiro.xyz. Include the affected feature, impact, and safe reproduction steps. Do not open a public issue containing exploit details or sensitive data. Avoid destructive testing and accessing other users’ information. We will coordinate investigation and disclosure with you.
Compliance and assurance
This page does not assert SOC 2, ISO 27001, PCI DSS certification, or blanket compliance with data protection laws. Requirements depend on your use case, deployment, and agreements. Before submitting regulated data, contact us to discuss processing locations, retention, contractual requirements, and available security evidence.
Self-hosted deployments
Self-hosted operators are responsible for infrastructure access, TLS configuration, secrets, updates, backups, and recovery testing. Review the repository’s security policy and apply security patches for supported releases. Hosting Sentiro yourself does not automatically establish compliance.
Contact
For policy questions, privacy requests, or confidential security reports, email security@sentiro.xyz. Include enough information to identify your request, but never send passwords or access tokens.