What the connector sends
The Sentinel connector sends technical information about your site, such as Drupal, module and server software versions. It does not send site content or visitor data, and it needs no database or hosting credentials.
Sentinel
Encryption
All access to the dashboard, the API and connected sites uses TLS. Sentinel encrypts your stored connection credentials, two-factor secrets and queued emails before saving them. Passwords and API keys are kept only as hashes.
Sign-in and two-factor
You can protect your account with two-factor authentication. Sign-in is rate limited, and repeated failed two-factor attempts lock the account for a time.
Your organisation stays yours
Every request for an organisation’s or site’s data is checked against the caller’s membership on the server. Roles decide what each person can do.
Audit trail
User and administrator actions are recorded in an audit log, along with exchanges with connected sites.
Backups
Your Sentinel account data is backed up every day, encrypted and stored off site.
Hosting
The Sentinel dashboard and database are hosted in Australia.
Staff access
Access to production systems is limited to the staff who run the service, who are bound by confidentiality. Platform administrators must use two-factor authentication.
Patching
You choose the repositories
On GitHub you can limit Sentinel to the repositories you select, and change that at any time.
Only what updates need
Sentinel asks only for the permissions updates need. On GitHub it cannot change your Actions workflow files, and each update job gets a short-lived token for one repository.
Credentials are protected
Unlike the connector, Patching stores credentials you give it, and copies your code to prepare updates. Credentials are write-only, encrypted with their own key, and every use is recorded. You can rotate or revoke them at any time.
Temporary build environments
Each job runs in a throwaway build environment, in the country you choose. Build environments are temporary and are deleted after use. The work they produce is saved as a pull request in your repository.
You stay in control
Updates arrive as pull requests for your own review and tests. Each website has its own deployment consent, and only your organisation administrators can connect accounts or deploy.
Customers can read the full Patching security article in the dashboard, under Support, Knowledge base.
More detail
Our Privacy Policy explains how we handle personal information and lists the service providers we use. For a vendor review, contact us and we will answer your questions directly.
Report a security issue
Email support@sentinelconnector.io with the subject “Security report”. Please do not include real customer data. A report does not give permission to test our systems.