Security and licensing
Data flows
What leaves your network, what comes in, and who can touch what.
Sentinel isn't a service you send customer data to. It runs wherever your own systems already run: your servers or your cloud account. Your data lives there, in a database you control.
What leaves your network
Today, nothing. The binary talks only to your PostgreSQL database and, if you configure it, your Redis. It makes no calls to Somu Labs or anyone else.
| Data | Leaves your network? | How |
|---|---|---|
| Customer records, events, decisions, alerts, screenings | Never | Stored and processed on your infrastructure |
| API keys | Never | Created and checked in your install. Only a hash is stored. Somu Labs never sees them. |
| Usage totals | Not today | Planned: daily signed counts, with no transactions, names or account numbers. See Licensing. |
| STRs and CTRs | Not today | Planned: to your FIU only, submitted by your analysts |
| Sanctions lists, rule packs, releases | Not today | Planned: signed, pulled by your install, applied when you choose. Today you load lists with sentinel-admin screening load and deploy releases yourself. |
What runs where
| Somu Labs | Your install |
|---|---|
| The source code, the container build and these docs | Everything that touches transactions: the API, rules engine, alerts, screening, audit log and API key store |
| Planned: a licence server and an update server |
Access
- People and services authenticate with API keys. Each key belongs to one organisation and can do everything in it. There are no scopes, roles or user accounts yet, and no SSO.
- Alert closures and rule activations need a second key. The key that asked can't approve.
- Only a SHA-256 hash of each key is stored. Revoking a key takes effect on the next request.
- The binary serves plain HTTP. Terminate TLS in front of it. Encryption at rest comes from your disks and database configuration.
- There's no request body size limit or rate limiting yet, so keep the API on your internal network.
Audit
Changes to alerts, rules and keys are written to an append-only, hash-chained audit log. sentinel-admin audit verify checks the chain.
Tipping off
Sentinel never exposes why an account was blocked or frozen through anything a customer can see. Make sure your customer-facing systems show a generic error.