Security policy

Our commitment

Client findings are among the most sensitive data any organisation can hold — a report from us is effectively a map of how to attack our client. We treat it accordingly, with access limited to the assessors on the engagement and retention limited to what the contract requires.

Standards and compliance

We align our own practices with the following standards and frameworks:

• ISO 27001: information security management system.
• OWASP: application security testing and secure development standards.
• PCI-DSS: payment card industry data security standard.
• SOC 2 Type II: security, availability, and confidentiality criteria.
• GDPR: data protection and privacy obligations.

Encryption and data protection

All data transmitted between your device and our systems is protected with TLS 1.2 or above. Sensitive data is encrypted in transit and at rest using AES-256. Role-based access control ensures only authorised personnel can reach client material, and access is logged.

Vulnerability management

We run a vulnerability management programme against our own estate:

• Regular internal security assessments and independent penetration testing.
• Continuous vulnerability scanning of internet-facing systems.
• Defined patching timelines, with internet-facing systems prioritised.
• A responsible disclosure process for externally reported issues.

Incident response

We maintain and rehearse an incident response plan covering identification, containment, and remediation. Where an incident affects client data we notify the affected parties within 72 hours of confirmation, in line with applicable regulation.

Personnel

All staff undergo background verification before handling client data and receive security training covering data handling, phishing, and secure development. Access to client material is granted per engagement and revoked when the engagement closes.

Report a security issue

If you have found a vulnerability in our systems, please report it to security@sentinelwares.com. We aim to acknowledge reports within one business day and will keep you updated through to resolution. We will not pursue action against researchers who report in good faith and avoid privacy violations, service disruption, or data destruction.

Contact us

General questions about our security practices can be sent to info@sentinelwares.com.