Your private keys stay with you.
The connection starts in your network.
Sentinel requests its tasks from Nocert and sends back its observations over HTTPS. No inbound connection from Nocert into your network is needed.
Nocert, over HTTPSYour TLS traffic does not pass through Nocert.
Nocert does not sit in your TLS traffic path. Your services keep serving TLS if Nocert is unavailable.
Nocert monitors certificates. It does not issue, renew, deploy or revoke them.
You choose what Sentinel scans.
After enrollment with a token, Sentinel signs its requests with Ed25519 (RFC 9421). It polls Nocert for tasks and reports over HTTPS. Network, filesystem, local-listener and Kubernetes scans can be disabled separately.
If Nocert is compromised
A compromised Nocert service could expose workspace data and request scans enabled in your configuration. Sentinel provides no remote shell.
Access and isolation
Account accessTwo-factor authentication and organization roles.
Passwords are hashed with Argon2id; TOTP provides two-factor authentication. Owner, operator and viewer roles control access. OIDC single sign-on and role mapping are available on Business and Custom.
Data protectionIsolated parsing, organization-scoped access, encrypted secrets.
Certificates are parsed in short-lived nsjail processes with resource limits and no network access. Data queries are scoped to the authenticated organization. Connector credentials and configuration secrets are encrypted with AES-256-GCM, using a key held outside the database.
What data leaves your network?
Certificates in DER format, fingerprints and observed chains.
IP addresses, ports, TLS settings, file paths and Kubernetes object locations, according to the scan modes you enable. File scans can also report private-key permission warnings, without sending the keys.
Agent registration includes its public signing key and machine metadata, such as hostname, OS, IP address and subnets. Its private signing key and Kubernetes credentials stay local.
Nocert is not ISO 27001 certified and has no SOC 2 report.
Inspect the agent you install.
Sentinel’s source code is public under Apache 2.0. You can read it, download a signed release and build it yourself.
Where data is hosted
Application data is hosted by OVHcloud in France and Germany. Other providers handle scanning, delivery and notifications.
- OVHcloudApplication data
- France and Germany
- ScalewayScanning and alert relays
- EU · Transient processing
- CloudflareWeb protection and delivery
- Global network · US headquarters
Network, payment and email providers can process data outside the EEA under the DPA. Payment providers receive no certificate scan data; alert emails can contain certificate and hostname details.
Self-hosting is available with Custom.
Report a vulnerability
Found a security issue? Use our contact page or the reporting details in security.txt.