SOC 2
Preparing. Policies drafted, controls mapped to the Trust Services Criteria, evidence exports built. No audit yet; no report to share.
Trust centerPreparing for GovRAMP and SOC 2
What we can show you,
and what's still to do.
Our security documents, where we stand on GovRAMP and SOC 2, how data moves through SentraBridge, who processes it, and short answers to the questions on most security questionnaires.
§ 01 / Where we stand
Preparing. Not certified.
We are building the controls and evidence GovRAMP and SOC 2 ask for. We have not been audited or authorized, and we won't say otherwise. Self-hosting keeps SentraBridge inside your own authorization boundary today.
GovRAMP
Preparing. Controls mapped to NIST SP 800-53 Rev 5 moderate. Not on the GovRAMP product list. A System Security Plan is still to be written.
CJIS Security Policy
Controls that support agencies: MFA for every account, 256-bit field encryption, exportable tamper-evident logs. Staff fingerprint checks are still to do.
Penetration test
Planned. No independent penetration test has been done yet. We'll share the summary when it is.
§ 02 / Documents
What you can read.
Most of it is here. The rest we send to your security team on request.
Policy summaries
Fifteen security policies, summarized below. Full text on request.
Learn more →Control matrix summary
SOC 2, NIST 800-53 and CJIS mapped to features, evidence and gaps.
Learn more →VPAT (WCAG 2.1)
Our Accessibility Conformance Report, criterion by criterion.
Learn more →Status page
Live status, 90-day uptime, incidents and maintenance.
Learn more →Full security package
Full policies, the control matrix and sample evidence, on request (NDA if you need one).
Learn more →Penetration test report
Planned. Not available yet.
§ 03 / Data flow
How data moves through SentraBridge.
Pass-through by design: we keep settings, encrypted credentials and metadata, never the records themselves.
- 01ReadRecords are read from your system into memory.
- 02Change and checkMapped, cleaned, checked, protected in memory.
- 03DeliverSent to the destination over TLS.
- 04DropThe run ends and the records are gone.
- 05Log metadataCounts, IDs, timings and a tamper-evident log entry.
§ 04 / What we keep
Metadata, not records.
Run history keeps when, which flow, record IDs, counts, HTTP status and masked error text. Field values are never written to the database, logs or queues. Jobs sent to the on-network relay are encrypted and deleted as soon as they're read.
- Retention you set, 7 days to 10 years
- Legal hold per workspace or flow
- One-click export of everything kept
Activity logtamper-evident
| entry | time | what happened | fingerprint ← previous |
|---|---|---|---|
| #1042 | 09:14 | Pat L. changed the flow “Payments to ledger” | 3f9a… ← c81e… |
| #1043 | 09:20 | Admin turned on two-step sign-in | 77d0… ← 3f9a… |
| #1044 | 09:31 | Records export made (Oct 1–31) | b2c4… ← 77d0… |
✓ Checked: all 1,044 entries unchanged · also sent to your SIEM
§ 05 / Where it runs
Our cloud or your servers.
The hosted service runs on US-based cloud infrastructure. Or run SentraBridge on your own servers, inside your own controls, including networks with no internet access.
- Same software either way
- The relay reaches internal systems with no inbound ports
- Hosting provider named during procurement
§ 06 / Policies
Fifteen policies, plain language.
Written for a small company and honest about what is still to do. Each has an owner, a version and a review date. Staff accept every version, and we track it.
Information Security Policy
The umbrella policy: who is responsible for security, what the other policies cover, and how exceptions are approved. Version 1.0.
Access Control Policy
Least privilege, two-step sign-in for staff, the separate staff Console, and quarterly access reviews. Version 1.0.
Acceptable Use Policy
How staff may use company devices, accounts and client systems. Version 1.0.
Change Management Policy
Code review, tests before release, recorded deployments, and how client flows move between environments. Version 1.0.
Incident Response Plan
How we detect, contain and report incidents, the status page, and client and CJIS notification timelines. Version 1.0.
Business Continuity & Disaster Recovery Plan
Backups, restore tests, and recovery targets (to be confirmed). Version 1.0.
Vulnerability & Patch Management Policy
Scanning, patch timelines by severity, and dependency updates. Version 1.0.
Secure Development Policy
Design for pass-through, code review, automated tests, dependency checks and secrets handling. Version 1.0.
Vendor & Subprocessor Management Policy
How we choose and review vendors, and the list of subprocessors. Version 1.0.
Data Classification & Retention Policy
What SentraBridge keeps (settings and metadata) and does not keep (records), and for how long. Version 1.0.
Encryption & Key Management Policy
Encryption in transit and at rest, field encryption, and customer-managed keys. Version 1.0.
Logging & Monitoring Policy
What is logged, the tamper-evident chain, forwarding, and who watches the alerts. Version 1.0.
Personnel Security Policy
Hiring, training, background checks for staff with CJI access, and offboarding. Version 1.0.
Risk Assessment Policy
A yearly risk assessment and a risk register reviewed each quarter. Version 1.0.
Privacy Policy (platform)
What personal information SentraBridge handles, why, and the rights of clients and residents. Version 1.0.
§ 07 / Controls
The control matrix, in short.
The full matrix maps SOC 2 (CC1 to CC9, A1, C1), NIST 800-53 moderate families and CJIS areas to features, evidence and gaps. Ask for it with the security package.
| Area | What SentraBridge does | Status |
|---|---|---|
| Sign-in and access | MFA for every account, SAML SSO, SCIM, roles and departments, network allow-lists, quarterly access review | In place |
| Audit and logging | Hash-chained activity log, export, SIEM forwarding (syslog, OTLP, webhook) | In place |
| Encryption | TLS in transit; secrets and fields encrypted with AES-256; optional AWS KMS keys | In place (TLS evidence to collect) |
| Retention and records | Retention per workspace, legal hold, records-request export | In place |
| Change management | Version history, promotion with diff, Git sync, tested releases | Partial: CI and release records to add |
| Incident response | Written plan, status page, client and CJIS notification timelines | Partial: first exercise to hold |
| Backup and recovery | Daily backups, restore tests recorded in our staff console | Partial: recovery targets to confirm |
| Vulnerability management | Patch timelines by severity, dependency checks | Planned: monthly scans, penetration test |
| Personnel | Background checks; CJIS fingerprint checks before any CJI access | Planned |
§ 08 / Subprocessors
Who else touches data.
Optional ones are used only when a client or our configuration turns them on. We give at least 30 days' notice before adding one that receives client data (to be confirmed in contracts).
| Who | Why | Data | Where |
|---|---|---|---|
| Cloud hosting provider (US data centers) | Runs the hosted SentraBridge service: servers, database, backups. | Settings, encrypted credentials, run metadata, activity log. Records pass through memory only. | United States |
| Anthropic (Claude) (optional) | Optional AI features: build or explain a flow, suggest field mappings, and the "Ask AI about each record" step. | Flow settings and field names; record fields only when a client admin turns on the Ask AI step and lists the fields. | United States |
| Clerk (optional) | Optional sign-in service (accounts, two-step sign-in, invitations). | Staff and client user names, email addresses and sign-in events. | United States |
| Resend (optional) | Optional delivery of email: invitations, password resets, failure alerts, notifications. | Recipient email addresses and message text (alerts carry flow names and counts, never records). | United States |
§ FAQ
Common questionnaire answers
Do you have a SOC 2 report or GovRAMP authorization?
No. We're preparing for both and will say so plainly until an auditor or GovRAMP says otherwise. We can share our policies, control matrix and sample evidence.
Where is data stored and processed?
In the United States. The hosted service stores settings, encrypted credentials and metadata. Records pass through memory only. Self-hosted installs keep everything on your servers.
Do you store our records?
No. Records exist in memory while a flow runs. Run history keeps counts, timings, record IDs and masked error text.
Is data encrypted?
In transit with TLS (HTTPS, database TLS, SFTP with pinned host keys). At rest, credentials are encrypted with AES-256, and fields you protect use AES-256-GCM, optionally with your own AWS KMS key.
Do you support SSO and MFA?
Yes: SAML 2.0 single sign-on, SCIM 2.0 provisioning, and two-step sign-in with an authenticator app, which an admin can require for everyone.
Can we get audit logs?
Yes. Export the tamper-evident activity log as CSV or JSON, or forward each entry to your SIEM by syslog, OpenTelemetry or signed webhook.
How long do you keep logs and history?
You decide, per workspace: run history from 7 days, the activity log from 90 days, up to 10 years. A legal hold stops removal.
How do you handle incidents?
We follow a written plan, post service incidents on the public status page, and tell affected clients within 24 hours of confirming a security incident. CJIS agencies are told within 1 hour (both to be confirmed in contracts).
Do you test backups?
Backups run daily. Restore tests are recorded with how long they took. Our recovery targets are still being confirmed, and we'll share them when they are.
Do you run vulnerability scans and penetration tests?
Monthly scanning and a yearly independent penetration test are planned, not yet running. Dependency advisories are checked before releases.
Are staff background-checked?
Background checks are being set up. Staff will complete CJIS fingerprint checks before supporting any workspace with criminal justice information.
Who are your subprocessors?
A US cloud hosting provider, and optionally Anthropic (AI features), Clerk (sign-in) and Resend (email). The list is above.
Can we host it ourselves?
Yes, on your own servers or in your own cloud, including air-gapped networks. That keeps SentraBridge inside your own security boundary.
How do we get the full security package?
Use the contact form and choose "A security questionnaire". We'll send the policies, the control matrix and sample evidence, under NDA if you need one.
Bring your security questionnaire.
We'll send our security package and walk your IT and security team through how SentraBridge handles data.