# How Sentilai protects your data

The honest version, for the security review that will ask.

## Tenant isolation

Every query is scoped to your organization in the application layer, and that is the
control the isolation rests on today.

We are additionally rolling out **database row-level security** as a second line of
defence, so that a bug in application code would not by itself be enough to cross
organizations. At the time of writing it covers the policy-rule tables rather than the
whole schema. We would rather tell you the current state than describe the finished one —
ask us for the up-to-date coverage if this matters to your review.

## Credentials at rest

Provider API keys are encrypted and never shown again after saving — only the last four
characters. Webhook URLs are write-only for the same reason. API credential secrets are
displayed exactly once, at creation.

## Findings never contain the finding

A risk finding records the **kind and the count**, never the matched value, its offset, or
a preview. A product that detects secrets and then stores them would be a more attractive
target than the systems it protects.

## Prompt content

Not stored unless you turn on **prompt capture**. When it is on, secrets are redacted
before storage, the content follows your retention setting, and **Sentilai support cannot
read it**.

## Authentication

Passkeys only. No passwords exist to be phished, reused or leaked. Device identity is an
ECDSA P-256 key pair in the machine's secure hardware storage — Keychain or Credential
Manager — that cannot be exported.

## Transport and region

TLS everywhere. Your organization has a region — EU or US — which determines which Gateway
your developers reach and where your data lives. If you configure an Azure OpenAI key in a
different region, the console flags it, because that would send your traffic outside the
region you chose.

## What we have not claimed

We do not currently hold SOC 2 or ISO 27001. When we do, it will be stated here with the
report available — not before. Ask us for the current status and we will tell you plainly.