Security & privacy
For the person who has to approve this.
This page is written for whoever on your team signs off on a new piece of software touching your network and your cameras. Plain language, no marketing gloss — and where we haven't earned a claim yet, we say that too.
Nothing inbound
One outbound HTTPS connection. No open port, no VPN, no rule to add.
Every query is scoped
Tenant isolation enforced in the query layer, with tests that try to break it.
Card data stays with Stripe
We never see or store a card number. PCI scope stays SAQ-A.
Network
Nothing connects in.
The Sentinel agent runs on a machine at your site, on your LAN, next to your cameras. It opens a single outbound HTTPS connection to Sentinel and holds it — there is no inbound firewall rule, no VPN, and no port forwarding to configure. An IT person can approve it in one sentence: outbound HTTPS to one hostname, nothing else.
What leaves the premises
- Events and heartbeats
- Detection snapshots
- Short clips, a few seconds around an event
- Thumbnails of newly discovered cameras
What never does
- The continuous video stream
- Audio — the agent never processes or reads audio
Two boxes: "Your site" — the agent and cameras, on your LAN — on the left, and "Sentinel", hosted on AWS in us-east-1, on the right. A solid arrow runs from your site to Sentinel, labelled "HTTPS, port 443, outbound." A second, dashed arrow running the other way, from Sentinel back to your site, is crossed out and labelled "Nothing inbound, ever" — no connection is ever opened in that direction.
Isolation
One tenant cannot see another's data — structurally.
Every table holding customer data carries a tenant id. Every query against it goes through one function that refuses to run against a table that isn't marked as tenant-scoped, applies the tenant filter, and narrows further for a role limited to specific sites or cameras. Routers never build a query by hand — there is no path that can silently forget the filter, because there is no other path.
We test this by trying to break it: one tenant's admin account reaching for another tenant's data by id, across every endpoint, asserting each attempt fails.
A resource outside your scope returns a plain 404, not a 403. A 403 would confirm the row exists under someone else's account; a 404 gives an attacker nothing to enumerate.
Credentials
Stream URLs, agent keys, and setup keys.
A camera's stream URL routinely carries a password or an access token — possession of the string is possession of the video feed. Stream URLs are encrypted at rest and decrypted in exactly one place: the authenticated request an enrolled agent makes for its own camera's config. No operator screen ever returns one — the panel gets a yes/no, not the URL.
Agent enrollment tokens and the long-lived agent key an agent trades it for are stored only as hashes and shown exactly once, at issuance. The one-time setup key a new install's download uses to enroll itself is single-use and expires after 24 hours.
Payments
We never see a card number.
Billing runs through Stripe Checkout and Stripe's own hosted billing portal. Card entry happens on Stripe's page, not ours — nothing resembling a card field exists on the Sentinel site or in the panel. That keeps our PCI scope at SAQ-A, the simplest tier, because we never handle, transmit, or store cardholder data ourselves.
Audit
Every change, and every view, with who and when.
Configuration changes are audited — who changed a camera's zone, a schedule, an alert rule, and what it was before. So is footage: every time someone views an event's snapshot or its clip, that view is logged too, not just the change that created it. Credential values are redacted from the trail by field name, so a camera's stream URL rotating shows up as that it changed, never the value.
Availability
An internet outage doesn't lose evidence.
If the connection to Sentinel drops, the agent keeps working — detecting, and queuing events to a local, durable buffer — and replays the backlog once the connection returns. Replays are idempotent, so a retried batch never creates duplicate events.
Sentinel also watches the watcher: if an agent or a camera goes quiet, that is itself an event — offline and the matching recovered — so a dead stream shows up as something that happened, not silence you have to notice yourself.
Data retention
Set per plan, deleted on removal.
Events and snapshots are kept for a number of days set on your plan, then swept and deleted — snapshots first, so a sweep that's interrupted never leaves a file with nothing pointing at it. Removing a camera ends its billed period immediately. Removing your account is a hard delete that cascades through everything under it — there is no soft-delete flag quietly keeping your footage around.
Hosting
AWS, one region, TLS everywhere.
Sentinel runs on AWS in us-east-1. Every connection — agent to API, browser to panel — negotiatesTLS 1.2 or newer, and the panel and this site enforce HSTS so a browser that has visited once will refuse to downgrade to plain HTTP.
What we don't claim
We'd rather say nothing than say something we can't back up.
Sentinel does not hold SOC 2, ISO 27001, or HIPAA certification, and we don't publish an uptime percentage. None of that exists yet, and an unearned badge is worse than no badge. What does exist: a published security.txt with a real contact address, and this page, updated as the product changes rather than written once and left stale. A public status page is on the list; it isn't built yet.
Questions for your IT person
The things they'll actually ask.
What ports does the agent need open?
What actually runs on the box?
Can we restrict where it is allowed to talk?
Where does our data live?
Can we get an audit export?
Something not covered here? Write to sales@sentinelpatrol.com.