[{"data":1,"prerenderedAt":386},["ShallowReactive",2],{"navigation_docs":3,"-security-data-flows":183,"-security-data-flows-surround":381},[4,25,60,81,153,168],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting started",false,"\u002Fgetting-started","1.getting-started",[10,15,20],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart","i-lucide-zap",{"title":21,"path":22,"stem":23,"icon":24},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F3.installation","i-lucide-server",{"title":26,"icon":6,"path":27,"stem":28,"children":29,"page":6},"Concepts","\u002Fconcepts","2.concepts",[30,35,40,45,50,55],{"title":31,"path":32,"stem":33,"icon":34},"How AML works","\u002Fconcepts\u002Fhow-aml-works","2.concepts\u002F1.how-aml-works","i-lucide-book-open",{"title":36,"path":37,"stem":38,"icon":39},"Events and decisions","\u002Fconcepts\u002Fevents-and-decisions","2.concepts\u002F2.events-and-decisions","i-lucide-activity",{"title":41,"path":42,"stem":43,"icon":44},"Rules","\u002Fconcepts\u002Frules","2.concepts\u002F3.rules","i-lucide-scale",{"title":46,"path":47,"stem":48,"icon":49},"Alerts, cases and reporting","\u002Fconcepts\u002Falerts-cases-reporting","2.concepts\u002F4.alerts-cases-reporting","i-lucide-folder-search",{"title":51,"path":52,"stem":53,"icon":54},"Entities and the graph","\u002Fconcepts\u002Fentities-and-graph","2.concepts\u002F5.entities-and-graph","i-lucide-network",{"title":56,"path":57,"stem":58,"icon":59},"Audit log","\u002Fconcepts\u002Faudit-log","2.concepts\u002F6.audit-log","i-lucide-scroll-text",{"title":61,"icon":6,"path":62,"stem":63,"children":64,"page":6},"Guides","\u002Fguides","3.guides",[65,70,75],{"title":66,"path":67,"stem":68,"icon":69},"Guides by role","\u002Fguides\u002Fby-role","3.guides\u002F1.by-role","i-lucide-users",{"title":71,"path":72,"stem":73,"icon":74},"Integration plan","\u002Fguides\u002Fintegration-plan","3.guides\u002F2.integration-plan","i-lucide-list-checks",{"title":76,"path":77,"stem":78,"icon":79,"badge":80},"Connecting a rail","\u002Fguides\u002Fconnecting-a-rail","3.guides\u002F3.connecting-a-rail","i-lucide-plug","Coming soon",{"title":82,"icon":6,"path":83,"stem":84,"children":85,"page":6},"API reference","\u002Fapi","4.api",[86,91,96,101,106,111,116,121,126,129,134,139,144,149],{"title":87,"path":88,"stem":89,"icon":90},"Authentication","\u002Fapi\u002Fauthentication","4.api\u002F01.authentication","i-lucide-key-round",{"title":92,"path":93,"stem":94,"icon":95},"Errors","\u002Fapi\u002Ferrors","4.api\u002F02.errors","i-lucide-circle-alert",{"title":97,"path":98,"stem":99,"icon":100},"Idempotency","\u002Fapi\u002Fidempotency","4.api\u002F03.idempotency","i-lucide-repeat",{"title":102,"path":103,"stem":104,"icon":105},"Health","\u002Fapi\u002Fhealth","4.api\u002F04.health","i-lucide-heart-pulse",{"title":107,"path":108,"stem":109,"icon":110},"Entities","\u002Fapi\u002Fentities","4.api\u002F05.entities","i-lucide-user-round",{"title":112,"path":113,"stem":114,"icon":115},"Events","\u002Fapi\u002Fevents","4.api\u002F06.events","i-lucide-send",{"title":117,"path":118,"stem":119,"icon":120},"Decisions","\u002Fapi\u002Fdecisions","4.api\u002F07.decisions","i-lucide-gavel",{"title":122,"path":123,"stem":124,"icon":125},"Alerts","\u002Fapi\u002Falerts","4.api\u002F08.alerts","i-lucide-bell",{"title":41,"path":127,"stem":128,"icon":44},"\u002Fapi\u002Frules","4.api\u002F09.rules",{"title":130,"path":131,"stem":132,"icon":133},"Screening","\u002Fapi\u002Fscreening","4.api\u002F10.screening","i-lucide-user-search",{"title":135,"path":136,"stem":137,"icon":138},"API keys","\u002Fapi\u002Fapi-keys","4.api\u002F11.api-keys","i-lucide-key",{"title":140,"path":141,"stem":142,"icon":143},"Overview","\u002Fapi\u002Foverview","4.api\u002F12.overview","i-lucide-layout-dashboard",{"title":145,"path":146,"stem":147,"icon":148,"badge":80},"Webhooks","\u002Fapi\u002Fwebhooks","4.api\u002F13.webhooks","i-lucide-webhook",{"title":80,"path":150,"stem":151,"icon":152,"badge":80},"\u002Fapi\u002Fcoming-soon","4.api\u002F14.coming-soon","i-lucide-clock",{"title":154,"icon":6,"path":155,"stem":156,"children":157,"page":6},"Security and licensing","\u002Fsecurity","5.security",[158,163],{"title":159,"path":160,"stem":161,"icon":162},"Data flows","\u002Fsecurity\u002Fdata-flows","5.security\u002F1.data-flows","i-lucide-shield-check",{"title":164,"path":165,"stem":166,"icon":167,"badge":80},"Licensing and metering","\u002Fsecurity\u002Flicensing","5.security\u002F2.licensing","i-lucide-file-badge",{"title":169,"icon":6,"path":170,"stem":171,"children":172,"page":6},"Reference","\u002Freference","6.reference",[173,178],{"title":174,"path":175,"stem":176,"icon":177},"Glossary","\u002Freference\u002Fglossary","6.reference\u002F1.glossary","i-lucide-book-a",{"title":179,"path":180,"stem":181,"icon":182},"FAQ","\u002Freference\u002Ffaq","6.reference\u002F2.faq","i-lucide-circle-help",{"id":184,"title":159,"body":185,"description":374,"extension":375,"links":376,"meta":377,"navigation":378,"path":160,"seo":379,"stem":161,"__hash__":380},"docs\u002F5.security\u002F1.data-flows.md",{"type":186,"value":187,"toc":365},"minimark",[188,192,197,200,284,288,317,321,343,347,358,362],[189,190,191],"p",{},"Sentinel isn't a service you send customer data to. It runs wherever your own systems already run: your servers or your cloud account. Your data lives there, in a database you control.",[193,194,196],"h2",{"id":195},"what-leaves-your-network","What leaves your network",[189,198,199],{},"Today, nothing. The binary talks only to your PostgreSQL database and, if you configure it, your Redis. It makes no calls to Somu Labs or anyone else.",[201,202,203,219],"table",{},[204,205,206],"thead",{},[207,208,209,213,216],"tr",{},[210,211,212],"th",{},"Data",[210,214,215],{},"Leaves your network?",[210,217,218],{},"How",[220,221,222,234,243,259,269],"tbody",{},[207,223,224,228,231],{},[225,226,227],"td",{},"Customer records, events, decisions, alerts, screenings",[225,229,230],{},"Never",[225,232,233],{},"Stored and processed on your infrastructure",[207,235,236,238,240],{},[225,237,135],{},[225,239,230],{},[225,241,242],{},"Created and checked in your install. Only a hash is stored. Somu Labs never sees them.",[207,244,245,248,251],{},[225,246,247],{},"Usage totals",[225,249,250],{},"Not today",[225,252,253,254,258],{},"Planned: daily signed counts, with no transactions, names or account numbers. See ",[255,256,257],"a",{"href":165},"Licensing",".",[207,260,261,264,266],{},[225,262,263],{},"STRs and CTRs",[225,265,250],{},[225,267,268],{},"Planned: to your FIU only, submitted by your analysts",[207,270,271,274,276],{},[225,272,273],{},"Sanctions lists, rule packs, releases",[225,275,250],{},[225,277,278,279,283],{},"Planned: signed, pulled by your install, applied when you choose. Today you load lists with ",[280,281,282],"code",{},"sentinel-admin screening load"," and deploy releases yourself.",[193,285,287],{"id":286},"what-runs-where","What runs where",[201,289,290,300],{},[204,291,292],{},[207,293,294,297],{},[210,295,296],{},"Somu Labs",[210,298,299],{},"Your install",[220,301,302,310],{},[207,303,304,307],{},[225,305,306],{},"The source code, the container build and these docs",[225,308,309],{},"Everything that touches transactions: the API, rules engine, alerts, screening, audit log and API key store",[207,311,312,315],{},[225,313,314],{},"Planned: a licence server and an update server",[225,316],{},[193,318,320],{"id":319},"access","Access",[322,323,324,331,334,337,340],"ul",{},[325,326,327,328,330],"li",{},"People and services authenticate with ",[255,329,135],{"href":88},". Each key belongs to one organisation and can do everything in it. There are no scopes, roles or user accounts yet, and no SSO.",[325,332,333],{},"Alert closures and rule activations need a second key. The key that asked can't approve.",[325,335,336],{},"Only a SHA-256 hash of each key is stored. Revoking a key takes effect on the next request.",[325,338,339],{},"The binary serves plain HTTP. Terminate TLS in front of it. Encryption at rest comes from your disks and database configuration.",[325,341,342],{},"There's no request body size limit or rate limiting yet, so keep the API on your internal network.",[193,344,346],{"id":345},"audit","Audit",[189,348,349,350,353,354,357],{},"Changes to alerts, rules and keys are written to an append-only, hash-chained ",[255,351,352],{"href":57},"audit log",". ",[280,355,356],{},"sentinel-admin audit verify"," checks the chain.",[193,359,361],{"id":360},"tipping-off","Tipping off",[189,363,364],{},"Sentinel never exposes why an account was blocked or frozen through anything a customer can see. Make sure your customer-facing systems show a generic error.",{"title":366,"searchDepth":367,"depth":367,"links":368},"",2,[369,370,371,372,373],{"id":195,"depth":367,"text":196},{"id":286,"depth":367,"text":287},{"id":319,"depth":367,"text":320},{"id":345,"depth":367,"text":346},{"id":360,"depth":367,"text":361},"What leaves your network, what comes in, and who can touch what.","md",null,{},{"icon":162},{"title":159,"description":374},"kJdlCdYgmuqxLPubt-UfRwDEWZfAzFKHzy8tE8bWJ-s",[382,384],{"title":80,"path":150,"stem":151,"description":383,"icon":152,"badge":80,"children":-1},"What the API has today, and what is planned but not built yet.",{"title":164,"path":165,"stem":166,"description":385,"icon":167,"badge":80,"children":-1},"How the licence works, what usage the install reports, and what happens at limits and expiry.",1792169656546]