Your fleet’s installed versions
See the Drupal core and module versions reported by each connected site, including disabled modules. Use each site’s inventory as the starting point for maintenance reviews.
A clear view for every customer.
Bring each customer’s websites and users together in an organisation. Invite their team to review security updates and patching SLA results for the sites they can access.
On Agency, switch between customer organisations from one account. An organisation can also be a department within your own business. SLA means a security-patching SLA: it is not an uptime guarantee.
Explore AgencySLA compliance and customer reporting
Set a security patching target for each site, from 6 hours to 28 days. Review the last 30 days against that target and see which sites are in breach. Monthly reports show met and missed targets, open findings and confirmed changes. Recorded times show when resolution was observed, rather than when a patch was installed.
Print monthly reports or download them as PDFs. Enterprise can have custom SLA terms by agreement. Every plan, Free included, shows a 30-day history of outstanding security and maintenance updates, without targets or breach tracking. The example policy is illustrative, not a service guarantee.
Explore customer reportingWhat you can review
Updates that need attention
Review available updates against each site’s reported versions. Drupal core is checked once, and packaged submodules are matched to their Drupal.org project.
Known advisory evidence
See known security advisories that apply to reported versions. Checks use Composer advisory constraints and Drupal.org release information. Findings remain visible if a refresh is partial or fails.
Clear gaps in the evidence
See complete, partial or unknown coverage and fresh or stale results. Custom code and missing metadata stay unassessed.
Results you can trace
See which installed versions a result describes and when the check ran. Queued and running checks are marked separately, so new inventory does not look like a completed assessment.
TLS certificate monitoring
A daily outside-in check of each HTTPS site confirms the certificate is trusted, matches the hostname and has not expired. Organization administrators are told 30, 14, 7 and 1 days before expiry, in Sentinel and by email. Included on every plan.
Monthly SLA reports
Review patching commitments site by site. Monthly reports separate met targets, breaches, open findings and insufficient data, with confirmed changes and the days each site reported data. A site with no data at the end of the period is never reported as met.
Access for the right people
Group websites and users in an organisation. Site API keys and user roles limit each person to the organisations and sites they are authorised to access.
Assessment informs your next step.
Sentinel monitors and reports. Your team reviews the findings and applies updates. The connector does not install updates, assess custom code or guarantee the absence of vulnerabilities.