Security

Our approach

Sentinel Shield is built with security at its foundation. As a compliance platform handling sensitive regulatory data, we hold ourselves to the same standards our customers must meet. This page summarises our security posture.

Data encryption

All data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Database connections are encrypted and access is restricted to authenticated application services.

Access control

Role-based access control (RBAC) ensures users only see data their organisation has created. Administrators can manage user roles, and all actions are recorded in a tamper-evident audit trail with hash-chained integrity verification.

Infrastructure

Our infrastructure runs on hardened cloud providers with regular patching, network segmentation, and automated monitoring. We follow least-privilege principles for all service accounts and secrets management.

Audit & integrity

Every action within the platform — from policy approvals to incident reports — is logged with a cryptographic hash chain. This makes tampering detectable and provides auditors with a verifiable record of compliance activity.

Compliance certifications

We align with SOC 2, ISO 27001, and GDPR requirements. Our compliance programme includes regular internal audits, vulnerability scanning, and penetration testing.

Incident & breach response

We maintain a documented incident response plan with defined escalation, triage, and containment procedures. Where a personal data breach occurs, we notify affected customers without undue delay and within 72 hours of confirming the breach, in line with UK GDPR Article 33. Notifications describe the nature of the breach, the likely consequences, and the measures taken or proposed. Customers are responsible for assessing and meeting their own notification obligations to data subjects and supervisory authorities where they are the controller.

Data retention & deletion

Customer data is retained for the duration of the subscription and deleted within 30 days of termination, unless a longer retention period is legally required. Data export is available at any time.

Vulnerability disclosure

If you believe you've found a security vulnerability, please report it to sentinelshield-help@mail.uk. We respond to all good-faith reports within 5 business days and work with researchers to understand and resolve the issue. We will not pursue legal action against researchers who act in good faith — that is, who report a genuine vulnerability responsibly, avoid accessing or modifying data that is not their own, and do not publicly disclose the issue before we have had a reasonable opportunity to address it.