Your data, and what stays on-premises
Traffic is inspected where it lands. What leaves a SENTRA system, when, and how to switch it off.
SENTRA inspects traffic on the box it arrives at. Customer traffic, request contents and logs stay on your infrastructure. The shields only contact outside services that you switch on.
What stays on your systems#
- All traffic and its inspection: requests, responses, packets, flows.
- Events, incidents, bans, audit ledgers, reports and backups (unless you add an off-box backup destination).
- User accounts, password hashes and two-factor secrets.
- Licence keys and the box's Installation ID.
What leaves, and why#
| What | Sent by | Sent to | Contents | Can it be switched off? |
|---|---|---|---|---|
| Licence check-in | Stand-alone ATS and NTS | Licensing Authority | Installation ID, box name, version and the IDs of the licence keys it holds | Yes (SENTRA_LICENSING_CHECK=0, or licensing_check: false in ATS settings). Licences keep working offline. |
| Authority reports | VIEW / GUARD authorities | Licensing Authority | The licence keys they issued, signed with the authority's key | Reports can also be delivered as a ledger file |
| Release checks | VIEW, stand-alone ATS and NTS | Release server | A request for the signed release list and packages | Updates can be installed by hand |
| Fleet snapshot | GUARD | Its own VIEW (your infrastructure) | Customers, nodes, services, invoices, users | Unlink the GUARD |
| Threat feeds and signatures | ATS, NTS (when enabled) | The feed publishers you enable (for example Emerging Threats, Spamhaus DROP, abuse.ch, CINS) | Download only | Yes, per feed |
| Breached-password check | ATS (when enabled) | Have I Been Pwned range API | The first 5 hex characters of a password's SHA-1 hash only — never the password | Yes (breached_passwords: off / flag / block) |
| AI analyst | ATS, NTS (when enabled) | The AI provider you configure — which can be a private, on-premises model (Ollama, vLLM, LM Studio, NIM or any OpenAI-compatible server) | The details of the traffic being assessed | Yes; licensed separately (sentra-ai on ATS) |
| Alerts and reports | ATS, NTS, GUARD (when configured) | Your channels — ATS: e-mail (SMTP), Telegram, WhatsApp; NTS: e-mail, Telegram, webhook (Slack, Teams…), syslog / SIEM; GUARD: alert webhook | Alert text and reports | Yes, per channel |
| Off-box backup | ATS (when configured) | Your S3-compatible storage, SFTP server or folder | An encrypted backup sealed with the shield's backup key | Yes |
Tip
For sovereign or air-gapped environments, run the AI analyst against a private model on your own hardware, disable external feeds you do not want, and install signed releases and licences by hand. Every product works fully offline.
SENTRA's own services#
The Licensing Authority stores everything — even customer names — encrypted in its vault (AES-256-GCM), and the release server only serves public, signed release files. Neither ever receives customer traffic.