Our Commitment
Security is our product. And our practice.
We hold ourselves to the same standards we help customers achieve. Here is how SentinelStack protects data and infrastructure.
Compliance
Certified to high standards.
SOC 2 Type II
Security | Availability | ConfidentialityIndependently audited on an annual basis across the security, availability, and confidentiality trust service criteria.
Continuously monitoredISO 27001
Information Security Management SystemThe internal ISMS is certified to ISO 27001:2022 and covers physical security, governance, and risk management.
Certified and currentGDPR Compliant
EU Data Residency | DPA AvailableFull GDPR support with EU data residency options, data processing agreements, and a dedicated privacy workflow.
DPA available on requestZero Trust Architecture
Aligned with NIST SP 800-207Internal systems follow zero-trust principles with no implicit trust, continuous verification, and least-privilege access.
Third-party verifiedZero Trust
Trust nothing. Verify everything.
Never Implicit Trust
Every request is authenticated and authorized on its own merit. Network location grants no trust.
Least Privilege Access
All human and machine identities receive only the permissions required for their function.
Assume Breach Posture
The platform is designed for blast-radius minimization, lateral movement prevention, and real-time anomaly detection.
Data Protection
Encrypted at every layer.
Encryption in Transit
All data in transit is encrypted using TLS 1.3 with forward secrecy and modern cipher enforcement.
Encryption at Rest
Customer data is encrypted at rest using AES-256-GCM with per-customer encryption keys.
Key Management
Enterprise plans support BYOK. SentinelStack never stores customer master keys.
Single-tenant Isolation
Enterprise customers run in dedicated compute environments with strict tenant isolation.
FIPS-aligned Crypto
Validated cryptographic modules are available for regulated and government workloads.
Data Residency
Choose US, EU, or APAC data residency. Data stays in-region unless customers explicitly approve otherwise.
Independent Testing
We get hacked on purpose.
External Network Pentest
Full external attack surface assessment including API endpoints, auth flows, and network perimeter review.
0 critical | 0 high findingsRed Team Exercise
A 48-hour red team engagement simulating an advanced persistent threat targeting customer data.
No data exfiltration achievedBug Bounty Program
Public bug bounty program with rewards up to 50000 USD for critical vulnerabilities.
280K+ paid to researchersVulnerability Disclosure
Found a vulnerability?
We take security reports seriously. SentinelStack commits to a 24-hour acknowledgement and a 90-day remediation target for responsible disclosures.
security@sentinelstack.io-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBGR4K...
xQEzAA/pK3nv7Bm...
9wLm+TjAa/3K...
-----END PGP PUBLIC KEY BLOCK-----
Fingerprint: A4F2 9B3C 7E1D ... 08AF