# Security starts with how Sentryx operates.

> How Sentryx Monitor observes public infrastructure, handles monitoring data, and supports security reviews.

Canonical: https://sentryxmonitor.com/security/
Last updated: 2026-08-14

Security & trust

A transparent overview of how Sentryx observes public infrastructure, handles monitoring data, and supports vendor security reviews.

[Scan a public domain](https://sentryxmonitor.com/#scan)[Contact security support](mailto:support@sentryxmonitor.com)

Outside-in monitoring · No agents · No internal access required

Architecture

## Visibility without privileged access.

Sentryx is designed to answer the questions an external observer can answer: what is exposed, what changed, and what deserves attention.

01

### Outside-in architecture

Discovery uses public service-reachability signals. The separate DAST crawler uses bounded HTTP GET checks only; it does not perform port scanning or authenticated testing.

02

### No sensitive credentials required

Sentryx does not require source-code access, VPN access, administrator passwords, or agent installation to start monitoring a public domain.

03

### Defined data location

Core service workloads run in Google Cloud's Singapore region. Current architecture details are available during a vendor security review.

04

### Controlled collection, honest boundaries

Collection is scoped to the service, and Sentryx does not assess IAM permissions, cloud policies, internal segmentation, source code, secrets, employee endpoints or lateral movement.

### Cloudflare and reverse proxies

When traffic is proxied through Cloudflare, Sentryx observes the public edge and externally visible behavior. The origin may not be identifiable unless it is separately exposed.

Data handling

## Know what Sentryx can access.

Our outside-in model keeps the product useful for public exposure while limiting the access it needs to operate.

### May process

- Public DNS, TLS, HTTP, uptime, and service observations

- Domains, assets, monitors, findings, and alert settings you configure

- Account, workspace, support, and product-usage information

- Operational logs needed to keep the service reliable and secure

### Does not require

- Private network access or VPN credentials

- Source code, production databases, or internal application access

- Administrator passwords or installed agents

- Secrets that are not part of the public surface you ask us to monitor

Data residency **Google Cloud · Singapore region**

Retention **Only as needed for operation and legal obligations**

Account deletion **Request deletion through support**

For the full privacy context, see the [Privacy Policy](https://sentryxmonitor.com/privacy/). Deletion requests and security questions can be sent to [support@sentryxmonitor.com](mailto:support@sentryxmonitor.com).

Review readiness

## Clear answers for procurement teams.

We keep the current status visible and can provide additional context for a vendor or security review.

| Area | Current status |
| --- | --- |
| SOC 2 | Not currently certified |
| ISO 27001 | Not currently certified |
| Data processing agreement | Available by request |
| Vendor security review | Available |
| Responsible disclosure | Available |
| Subprocessors | Current provider list available on request |

\\n

Enterprise review

## Make the important questions explicit.

The public product surface does not imply identity controls or integrations that have not been documented. Confirm current availability and scope during procurement.

| Capability | Public status |
| --- | --- |
| SSO / SAML | Confirm current availability |
| MFA | Confirm current availability |
| RBAC | Confirm current availability |
| Audit logs | Confirm current availability |
| API / webhooks | Confirm current availability |
| Incident integrations | Confirm current availability |
| Terraform / SCIM | Confirm current availability |

## Related
- [Home](https://sentryxmonitor.com/)