How we protect Sentra
We sell security, so we start with our own.
Sentra is built following DevSecOps principles and industry standards. This page summarizes, without fluff, how we handle your data and secure the platform.
Argon2id password hashing
We never store passwords in plaintext. We use Argon2id, the hashing algorithm recommended by OWASP, resistant to brute-force attacks with specialized hardware.
Short-lived, rotating sessions
15-minute access tokens and opaque refresh tokens with rotation and reuse detection: if one is stolen, the entire session family is revoked automatically.
Role-based access control (RBAC)
Owner/Admin/Analyst/Member roles with permissions enforced on the server, not just hidden in the UI. Every sensitive action is recorded in an immutable audit log.
Encryption in transit
All traffic travels over HTTPS/TLS. We apply security headers (CSP, HSTS, X-Frame-Options) to mitigate XSS, clickjacking and data leakage.
Infrastructure isolation
Services run in isolated containers as a non-privileged user. The database is never exposed to the internet: only the application reaches it over an internal network.
Passive, verified scans
We only audit domains you verify ownership of via DNS, and we never exploit vulnerabilities. We observe already-public information without generating load or risk on your systems.
Cross-organization isolation
Every query is scoped to your organization at the database level (anti-IDOR protection): it's impossible to see or touch another account's data by changing an identifier.
Secrets outside the code
Keys and credentials live in server environment variables, never in the repository. Card data never touches our servers: it's processed by Lemon Squeezy's checkout.
Responsible disclosure
Found a vulnerability in Sentra? We'd appreciate a private report before you make it public. We respond to all legitimate reports and credit anyone who wishes.
Report a vulnerabilityLast updated: July 23, 2026