Here is precisely what we access, and what we can't do.
No assurances, no badges. The exact read-only role you deploy, what we store and where, and how tenants are isolated. Verify it yourself before connecting anything.
What Sentasity can and cannot do in your account
- We cannot start, stop, resize, terminate, or modify any resource.
write access: none - We cannot read your application data, your code, the contents of your secrets, or your customers' data.
data access: none - We only read billing data, resource configuration metadata, and security posture: the signals needed to price waste and flag risk.
Describe* · List* · Get*
You grant this with one CloudFormation role, and you can revoke it in one click, anytime.
§ 01
The actual roles, shown.
The CloudFormation template creates two cross-account roles built on AWS-managed read-only policies. This is the substance of what you deploy. Read the full template before you do.
Cost optimization and security scanning
- Trust: sts:AssumeRole from Sentasity only ("arn:aws:iam::886557787053:root")
- arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
- arn:aws:iam::aws:policy/SecurityAudit
- Plus a supplemental statement of additional reads: Describe*, List*, Get* actions only
Cost and usage data access
- Trust: sts:AssumeRole from Sentasity only ("arn:aws:iam::886557787053:root")
- arn:aws:iam::aws:policy/ReadOnlyAccess
- Plus CUR discovery reads (cur:DescribeReportDefinitions, bcm-data-exports:List/GetExport)
The templates are public. Inspect them before deploying; that's the point:
- SentasityAccessStandalone.yamlThe two access roles, single account
- SentasityAccessOrganization.yamlThe same roles, deployed org-wide via StackSets
- SentasityOrgBootstrap.yamlMinimal role for browsing your AWS Organizations structure
- SentasityCostUsageReport.yamlCost and Usage Report delivery for Spend Explorer (optional)
Prefer to read them with history? github.com/sentasity/aws-assessment-templates
§ 02 · Compliance posture
Our security posture, stated plainly.
Sentasity holds no SOC 2, ISO 27001, or other third-party certification today. We won't display a badge we haven't earned. What a SOC 2 report would summarize about a vendor, this page already shows you directly, not as assurances, but as the actual mechanics you can verify before you connect anything.
- How access is controlled§01: the exact read-only roles you deploy
- How data is handled and encrypted§03: what we store and how it's protected
- How long data is kept§04: our retention and deletion terms
- Who else touches your data§06: the full subprocessor list
If we ever undergo a formal audit, this is the section that will say so, with the report available on request. We won't imply an audit is underway before it is.
§ 03
What we store, and where
Your AWS account
SentasityReadOnly role
The one door in: you deploy it, you delete it.
Sentasity AWS · US regions
Bedrock inference: runs inside AWS
Outbound
- VercelApp & site hosting
- SentryError diagnostics: not cost data
- ZohoContact-form submissions only
What we store
Billing and cost data, resource configuration metadata, and security findings: the outputs of the scans. We never collect your application data or code.
Where it lives
In AWS, in United States regions. Executive summaries are generated using AWS Bedrock.
Encryption
Encrypted in transit with TLS, and at rest with AWS-managed encryption everywhere it's stored: SSE-S3 on the buckets holding your scan outputs and reports, and AWS-managed storage encryption on the PostgreSQL database behind the portal.
Tenant isolation
Access is scoped by a strict tenant hierarchy. For MSPs, private discounts and margins are filtered so sub-customers can never see them.
§ 04
How long we keep your data, and how to remove it.
We retain your scan data only while your account is active: it's what makes your trends, recommendations, and reports work over time.
- Cut access instantly: delete the CloudFormation stack and our access to your account ends immediately. The role is the only path in; there is no second door.
- Deletion on request or closure: ask us to delete your stored scan data, or close your account, and we remove it within 60 days. That window covers our encrypted backups rotating out, not just the live database.
- What's left: once deleted, your cost and configuration data is gone. We may retain routine business records of the engagement (such as invoices) where we're required to.
§ 05
Who at Sentasity can see your data.
We're a small team, and we treat your data accordingly.
- Access is limited: a small number of engineers can reach production systems, and only to operate, debug, and support the platform, not to browse customer data.
- Our own access is logged: administrative actions in Sentasity's AWS accounts are recorded through our organization's CloudTrail, managed centrally across the org. Our access leaves a trail the same way we help you watch yours.
- Tenant isolation still holds: even internally, MSP private discounts and margins stay filtered from sub-customer views: the same boundary described in §03.
How your team signs in.
- Passwords must be at least 12 characters and include upper- and lower-case letters, a number, and a symbol.
- Multi-factor authentication is available using an authenticator app (TOTP).
- Sessions are short-lived: access tokens expire after one hour, so a stale session can't linger.
- Sign-in is email-based over Amazon Cognito, and we never see or store your password.
§ 06
Subprocessors
The honest list: every third party that touches data, and why.
- Amazon Web ServicesAll infrastructure, data storage, and Bedrock model inference for report generation
- VercelWeb application and website hosting
- SentryError monitoring (technical diagnostics, not your cost data)
- Zoho CRMContact and sales inquiries you submit through our forms
- CloudflareBot protection (Turnstile) on public forms
We update this page before we add a subprocessor, so this list is always current.
§ 07
If something goes wrong, you'll hear it from us.
If we confirm a security incident that affects your data, we'll notify you within 72 hours, with what we know, what we're doing about it, and anything we need from you. We'd rather reach you early with an incomplete picture than wait for a tidy story. As we learn more, we'll keep you updated until it's resolved.
§ 08
Found a security issue? Tell us.
Email security@sentasity.com with enough detail to reproduce it: the affected URL or feature, the steps you took, and what you observed. We acknowledge every good-faith report within five business days and will keep you updated as we investigate. We will not pursue or support legal action against researchers who report vulnerabilities in good faith, avoid privacy violations and service disruption, and give us a reasonable chance to fix the issue before disclosing it publicly.
Please do not:
- Run denial-of-service, load, or automated-scanning attacks that degrade the service for others.
- Attempt social engineering, phishing, or any access to Sentasity staff, customers, or their accounts.
- Attempt physical access to Sentasity or its providers' facilities or hardware.
Looking for the product's security scanning?
This page is about our access to your account. Security findings (Prowler across 30 frameworks) are a product feature with their own page.
Security & compliance findingsNeed a security review for procurement?
We'll answer your security questionnaire directly. Ask and we'll work through it with your team. A DPA is available on request.
Request our security package