Security & Trust
Project Sentinel is built with enterprise-grade security practices for regulated and high-value products. Below is a summary of our security architecture and compliance roadmap.
Data Protection
- All data encrypted at rest (AES-256-GCM) and in transit (TLS 1.3)
- Passwords hashed with a modern memory-hard algorithm and a per-user salt
- Tenant isolation enforced in the database itself, not only in application code
- Tamper-evident, cryptographically chained audit log
- ERP credentials encrypted at rest with field-level encryption
- CSRF protection on all state-mutating API endpoints
Access Control
- Multi-factor authentication (TOTP) enforced for admin accounts
- Role-based access control (RBAC) with per-brand isolation
- Session fingerprinting with device validation
- Rate limiting on all authentication endpoints
- Brute-force protection with exponential back-off
Compliance Roadmap
- SOC 2 Type I — evidence collection in progress
- External penetration test — planned
- ISO 27001 — planned post-SOC 2
Responsible Disclosure
Found a vulnerability? Please report it to security@project-sentinel.io. We aim to respond within 48 hours.