Security Policy

Security at Sentient

Sentient is committed to protecting the data and systems that our community and customers rely on. Security is foundational to how we build, operate, and scale our open-source AI reasoning platform. This page outlines the practices, controls, and certifications that underpin that commitment.

Compliance & Certifications

SOC 2 Type II — Sentient is pursuing SOC 2 Type II certification. Our audit scope covers production infrastructure and application services, with examination conducted by an independent third-party auditor.

We are committed to maintaining compliance with industry-recognized frameworks and will update this page as certifications are achieved.

Infrastructure Security

Sentient's production infrastructure runs on Amazon Web Services (AWS), leveraging its extensive security controls and compliance certifications.

  • Network isolation: Production workloads run in dedicated VPCs with strict security group rules and network segmentation. No direct public access to internal services.
  • Monitoring and logging: Centralized logging with AWS CloudTrail and CloudWatch, with log retention policies enforced across all accounts. Security findings are aggregated via AWS Security Hub for continuous monitoring.
  • Multi-account architecture: We use an AWS Organizations structure with separate accounts for production, development, and security operations, enforcing least-privilege boundaries at the account level.
  • Availability: Infrastructure is designed with redundancy across AWS availability zones to support uptime and resilience.

Data Protection

Encryption at Rest

All data at rest is encrypted using AES-256 encryption. This includes:

  • Database storage (Amazon DynamoDB, RDS) encrypted with AWS-managed or customer-managed KMS keys
  • Object storage (Amazon S3) with server-side encryption enabled by default
  • EBS volumes and snapshots encrypted at rest

Encryption in Transit

All data in transit is encrypted using TLS 1.2 or higher. This applies to:

  • All external-facing endpoints and APIs
  • Internal service-to-service communication
  • Administrative access to infrastructure

Secret Management

Secrets and credentials are managed through dedicated secret management tooling. Secrets are never stored in plaintext in source code or configuration files.

Identity & Access Control

  • Single Sign-On (SSO): All employee access is managed through Okta SSO with enforced multi-factor authentication (MFA).
  • Least privilege: Access to production systems follows the principle of least privilege. Permissions are granted based on role and reviewed regularly.
  • Access reviews: We conduct periodic access reviews across cloud infrastructure, source code repositories, and SaaS applications to ensure appropriate access levels.
  • Administrative access: Privileged access to production infrastructure requires MFA and is logged and auditable.

Endpoint Security

All employee devices are protected with enterprise security tooling:

  • Endpoint Detection & Response (EDR): CrowdStrike Falcon is deployed across all corporate endpoints for real-time threat detection, behavioral analysis, and incident response.
  • Mobile Device Management (MDM): All company-managed devices are enrolled in Jamf Pro, enforcing security configurations including disk encryption (FileVault), OS update policies, and screen lock requirements.
  • Device compliance: Devices must meet security baseline requirements before accessing corporate resources.

Secure Development Practices

  • Source control: All code is managed in Git with enforced branch protection rules, including required code reviews before merging to protected branches.
  • Code review: All changes to production code require peer review and approval.
  • Vulnerability scanning: We use automated tooling to scan for vulnerabilities in application dependencies and container images as part of our CI/CD pipeline.
  • Vulnerability management: Identified vulnerabilities are triaged, prioritized by severity, and tracked through resolution in our project management system with defined SLAs.

Incident Response

Sentient maintains a documented incident response plan that covers:

  • Detection: Continuous monitoring across cloud infrastructure, endpoints, and identity systems to detect potential security events.
  • Response: Defined procedures for incident classification, containment, eradication, and recovery.
  • Communication: Established protocols for internal escalation and external notification in the event of a security incident.
  • Post-incident review: After resolution, incidents are reviewed to identify root causes and drive improvements to our security posture.

Vendor & Third-Party Security

We evaluate the security posture of third-party vendors and service providers before onboarding and on an ongoing basis. Key considerations include:

  • SOC 2 or equivalent compliance certifications
  • Data handling and privacy practices
  • Access controls and encryption standards

Responsible Disclosure

If you believe you have discovered a security vulnerability in Sentient's systems, we encourage responsible disclosure. Please contact us at security@sentient.xyz to report the issue. We are committed to investigating and addressing reported vulnerabilities promptly.

Contact

For questions about our security practices, please reach out to security@sentient.xyz.

Last updated: May 2026