Security at Sentri
Sentri holds sensitive information about your suppliers. Here is how we protect it.
Data protection
All traffic to Sentri is encrypted in transit (TLS 1.2+, HTTPS enforced). Data and uploaded documents are encrypted at rest. Each customer's supplier list is kept separate, and database rules stop one company from ever reading another's data.
Access control
Accounts are by invitation only — there is no public sign-up. Every user has their own account with only the access their role needs. Customers can remove colleagues instantly, and the Sentri owner runs regular access reviews and removes access on a person's last day.
Sign-in security
Passwords must be at least 8 characters with a letter and a number. Passwords found in known data leaks are rejected. Inactive sessions sign out automatically after 30 minutes.
Monitoring and audit trail
Sign-ins, failed sign-ins, invitations, access changes, imports and exports are recorded in a permanent security log that cannot be edited or deleted. Logs can be provided to customers' security teams after an incident.
Secure development
Sentri follows OWASP-aligned practices, runs automated security and dependency scans, and applies security updates promptly. The site sends modern browser security protections on every page.
Incident response
If we become aware of a security incident affecting your data, we will notify you within 24 hours, keep you updated, and share investigation findings and relevant logs.
Hosting
Sentri runs on managed cloud infrastructure with automated backups. Supplier risk data is only used to provide the service to you and is never used to train AI models.
Report a security issue
Email info@sentririsk.com. Security questionnaires and supporting evidence are available to customers on request.