Security Policy

01Overview

Security is at the center of everything Sentiva Solutions does. It is a service we sell, and it is also how we run our own business. This policy describes how we protect our systems, our team, and the client data entrusted to us.

Found a vulnerability? Report it responsibly to [email protected]. We respond within 48 hours.

02Access Controls

We strictly control who has access to what, and when:

• Role-based access control (RBAC) across all internal systems
• Multi-factor authentication (MFA) required for all Sentiva staff accounts
• Least privilege: employees only get access to what they need
• Client environments accessed only by assigned engineers with explicit authorization
• Access credentials rotated regularly and revoked immediately upon role change or departure
• All privileged access logged and reviewed periodically

03Data Protection

Client data is treated with the highest level of care:

• All data in transit encrypted using TLS 1.2 or higher
• Data at rest encrypted using AES-256 or equivalent
• Client data stored only in systems approved by our security team
• Data minimization: we collect and keep only what is necessary
• Client data never used for any purpose beyond delivering agreed services
• Data securely deleted upon contract termination within 60 days

04Network Security

Our internal network environment is hardened and continuously monitored:

• Next-generation firewalls with IDS/IPS at all network perimeters
• Network segmentation to isolate client environments and internal systems
• VPN required for all remote access to internal infrastructure
• DNS filtering and web content inspection to block malicious traffic
• 24/7 SIEM monitoring with automated alerting for anomalous activity
• Regular vulnerability scans and penetration testing

05Endpoint Security

All Sentiva-managed devices are secured to enterprise standards:

• Next-generation EDR deployed on all devices
• Full-disk encryption enforced on all laptops and workstations
• Automated OS and software patching, with critical patches applied within 72 hours
• Mobile Device Management (MDM) for all mobile devices used for work
• Remote wipe capability enabled on all managed devices
• USB and removable media controls enforced

06Personnel Security

Our team is a key part of our security posture:

• Background checks performed on all employees prior to hire
• Security awareness training required at onboarding and annually thereafter
• Phishing simulation exercises conducted quarterly
• All staff sign confidentiality and acceptable use agreements
• Clear offboarding process ensures all access revoked immediately upon departure
• Dedicated security champion program within engineering teams

07Incident Response

We have a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review:

• 24/7 monitoring for security events across all managed and internal systems
• Defined escalation procedures and on-call security staff
• Clients notified within 24 hours of any confirmed incident affecting their environment
• Post-incident reports provided to affected clients within 5 business days
• Annual tabletop exercises to test and improve response procedures
• Coordination with law enforcement when legally required

08Vendor Security

We apply the same security standards to our technology vendors and partners:

• All vendors reviewed for security posture before engagement
• Vendors with access to client data required to sign data processing agreements
• Vendor access logged and limited to what is necessary
• Periodic review of vendor security certifications (SOC 2, ISO 27001)
• Vendor relationships terminated if security requirements are not met

09Audits & Compliance

We hold ourselves to rigorous internal and external standards:

• Annual internal security audits conducted by our security team
• Periodic third-party penetration tests of our infrastructure
• Adherence to NIST Cybersecurity Framework as our internal baseline
• Experience supporting HIPAA, SOC 2, PCI-DSS, and CMMC compliance
• This policy reviewed and updated at least annually or after any significant incident

10Vulnerability Reporting

We welcome responsible disclosure of any security vulnerabilities discovered in our systems or website. Contact us at [email protected] with the subject line "Security Vulnerability Report." We commit to:

• Acknowledging your report within 48 hours
• Investigating all credible reports promptly
• Keeping you informed as we work to resolve the issue
• Not pursuing legal action against good-faith security researchers

Please do not publicly disclose a vulnerability until we've had the opportunity to address it.