How we protect your credentials.
This page is maintained by JLM Solutions to answer common security and privacy questions about Sentinel Vault. It describes the controls currently enabled in the product and how responsibility is shared between our team, our hosting platform, and you.
Last reviewed: August 2026
Where each layer of security lives
Provides managed Postgres, authentication primitives, TLS termination, and physical infrastructure. We rely on their platform controls; we do not operate a data center.
Designs and operates Sentinel Vault: encryption logic, RBAC policies, audit logging, session handling, and product-level access controls.
Choose a strong account password, protect your inbox, invite only trusted teammates, and offboard members promptly when they leave.
This page describes controls currently enabled in the app. It is not an independent audit, penetration test report, or third-party certification.
Passwords are never stored in plain text
AES-256-GCM at rest
Every password field is encrypted with AES-256-GCM inside a server function before it reaches the database. A per-record initialization vector and authentication tag are stored alongside the ciphertext.
Server-held master key
The AES key lives only in our server runtime as a protected secret. It is never sent to browsers, never logged, and never returned by any API response.
Decrypt-on-reveal
Ciphertext is decrypted only when an authorized user explicitly clicks Reveal. Revealed values auto-hide after 10 seconds in the UI to reduce shoulder-surfing risk.
TLS in transit
All traffic between the browser, our server functions, and the database is served over HTTPS using the hosting platform's managed TLS.
Tenant isolation enforced at the database
Row-Level Security
Every credential row is tagged with an organization id. Database policies (RLS) reject any read or write that does not match the caller's active organization — the app cannot query around them, even by mistake.
Role-based permissions
Members are either admin or user. Users see only credentials they created plus shared items or vaults they belong to. Admins can view and manage the organization's credentials so knowledge is not lost when someone leaves.
Shared vaults with granular permissions
Admins can group credentials into shared vaults and assign teammates view or manage permissions per vault. Removing a member instantly revokes access to every vault they belonged to.
Instant offboarding
Blocking a member sets their status at the database layer. The next query they issue fails RLS, so access is revoked in real time — no cache invalidation required.
Every meaningful action is logged
Organization audit log
Reveals, edits, shares, vault membership changes, member status changes, and invite activity are recorded to a per-organization audit log that admins can review and export as CSV.
Security dashboard
An admin-only dashboard scores overall vault health, flags weak or reused passwords, and checks credentials against known public breach data using k-anonymity — only a five-character hash prefix ever leaves our server.
What we collect, where it lives
Account data. Email address, display name, hashed authentication credentials, and the organizations you belong to.
Vault contents. Software name, username, URL, notes, and the encrypted password ciphertext you save.
Operational data. The audit events listed above and standard server request metadata for reliability and abuse prevention.
Where it lives. Application and database run on our managed hosting platform. Transactional email (invites, verification) is delivered fromnotify.sentinelvault.appvia our email provider.
Deletion. Deleting a credential removes it — including its ciphertext — from the database. Contact us to delete an entire organization or account.
Certifications and standards
Sentinel Vault is a young product. We do not currently hold SOC 2, ISO 27001, HIPAA, or PCI attestations, and we do not claim end-to-end (zero-knowledge) encryption today — an authorized server process holds the master key so admins can recover company credentials during offboarding.
If your organization requires a signed DPA, security questionnaire, or a specific certification before adopting Sentinel Vault, contact us and we will tell you honestly where we are on the roadmap.
Reporting a security issue
Report a suspected vulnerability. We aim to acknowledge within two business days and ask that you give us reasonable time to remediate before public disclosure.
Data export, deletion, or questions about how your organization's data is handled.
This page describes practices as of the date above and may change as the product evolves. Material changes will be reflected here.
Ready to try it with your team?
Create your organization in under a minute. No credit card required.