Summary

The SENTRA security architecture on one page.

SENTRA is a family of security products — SENTRA AI Threat Shield (ATS) for websites and APIs, SENTRA Network Threat Shield (NTS) for internet lines, SENTRA GUARD to run them for many customers and SENTRA VIEW to command a fleet of GUARDs — backed by two SENTRA services: the Licensing Authority (licensing.sentra-ai.com) and the release server (updates.sentra-ai.com).

The platform is built on five principles:

Principle	In practice
One root of trust, kept offline	A single Ed25519 root key. Its private half lives only in an encrypted, sealed vault (plus one offline recovery copy). Every product carries only the public half.
Everything that matters is signed	Licences, signing-authority certificates, release keys, release lists, packages and every file in them chain back to the root key. Products verify signatures themselves; they never trust a server just because they reached it.
Least privilege and two people	Roles and per-user limits everywhere; two-factor sign-in; a fresh 2FA code for sensitive actions; four-eyes approval for licences and releases.
Tamper-evident records	Administrative actions are written to hash-chained audit ledgers that reveal any edit, deletion or reordering.
Protection never stops	Licensing and update problems never switch protection off; inspection components fail open rather than cutting a customer's traffic.

The chapters#

Note

This document describes mechanisms, not operational secrets. It applies to ATS 2.26, NTS 0.18, GUARD & VIEW 1.25 and Licensing Authority 1.2.