Security Overview

1. Architecture

Sentinel Vault is a single-tenant-per-organization SaaS product. Application logic runs as edge server functions in front of a managed Postgres database. All application-to-database traffic and all client-to-application traffic is served over TLS 1.2+ using managed certificates.

2. Cryptography

• Symmetric encryption: AES-256-GCM for every stored secret, with a per-record 96-bit random IV and 128-bit authentication tag persisted alongside the ciphertext.
• Key management: the master key is stored as a protected server secret; it never leaves the server runtime, is never logged, and is never returned by any API response.
• Password hashing: account passwords are salted and hashed by our authentication provider using an adaptive scheme; we never see the plaintext.
• Randomness: generators, tokens, and IVs are produced with a cryptographically secure RNG.

3. Tenant isolation and access control

• Row-Level Security (RLS) enforces per-organization isolation at the database.
• Roles are stored in a dedicated table and checked by a security-definer function to prevent privilege escalation.
• Shared vaults use explicit per-member permissions (view / manage); removing a member instantly revokes access.
• Emergency access requires explicit designation and a configurable wait period before activation.

4. Auditing

Every meaningful action — reveals, edits, shares, vault membership changes, member status changes, invite activity, emergency access requests, and admin actions — is written to a per-organization audit log with actor, target, IP, and timestamp. Admins can review the log in-product and export it as CSV.

5. Breach and reuse detection

The security dashboard checks stored passwords against public breach corpora using k-anonymity — only a five-character SHA-1 prefix ever leaves our server — and flags weak or reused credentials so admins can prompt rotation.

6. Authentication

• Email and Google OAuth are supported out of the box.
• Sessions are short-lived and refreshed via rotating tokens.
• Extension access is scoped through revocable per-device tokens.

7. Secure development

• Type-safe end-to-end code with strict TypeScript across the app and server functions.
• All input validated with schema parsers at the server boundary.
• Every schema change ships as a reviewed migration.
• Third-party dependencies are pinned and reviewed before adoption.

8. Backups and availability

• The managed database provider performs continuous, encrypted backups with point-in-time recovery.
• Backups inherit the same encryption at rest as the live database.
• Production uptime target: 99.9% monthly, excluding scheduled maintenance.

9. Incident response

We maintain a documented incident-response process covering detection, containment, eradication, recovery, and customer notification. Confirmed personal-data breaches affecting a customer's organization are notified without undue delay in accordance with applicable law and any signed Data Processing Addendum.

10. Responsible disclosure

We welcome coordinated disclosure of security issues at security@sentinelvault.app. We aim to acknowledge reports within two business days and ask that you give us reasonable time to remediate before public disclosure. We will credit reporters who wish to be named.

11. What we are honest about

Sentinel Vault ships two distinct storage modes and we are explicit about which applies to what:

• Team vaults (server-assisted). Organizational credentials are encrypted with AES-256-GCM using a server-held master key. This lets administrators recover company credentials when a teammate leaves. It is not end-to-end / zero-knowledge.
• Personal Vault (zero-knowledge). Each user can enable a per-user Personal Vault whose items are encrypted in the browser with a key derived from a passphrase only the user knows (PBKDF2-SHA-256, 600,000 iterations, AES-256-GCM). The server stores only ciphertext, salt, and a verifier blob. If the user forgets the passphrase, the contents are unrecoverable — by design.

We do not currently hold SOC 2, ISO 27001, HIPAA, or PCI attestations. If your organization requires a specific certification, contact us and we will tell you honestly where we are on the roadmap.