What customers should do

The practical steps that keep a SENTRA deployment as secure as it is designed to be.

Accounts#

Turn on two-factor for every administrator, and set the policy to require it (GUARD and VIEW security policy).
Give each person their own account with the least role they need; build custom roles rather than sharing an administrator account.
Keep at least two top-level administrators, so one lost phone never locks you out.
Store the glass-break account's password offline and use it only when the GUARD can't be reached.
Review users and roles every quarter; remove leavers the same day.

Install keys only from SENTRA or your own VIEW or GUARD. Treat key bundles as confidential and delete local copies once installed.
Bind stand-alone licences to the box's Installation ID.
Allow outbound HTTPS to licensing.sentra-ai.com so revocations and renewals reach your boxes, unless your policy forbids any outside contact.

Keep systems on the SENTRA release server (never a developer source).
Install offered updates promptly, at a time that suits you; read What's new and the expected downtime first.
On fleets, lock GUARDs and nodes to signed releases only once every layer runs a version that supports it.
Allow outbound HTTPS to updates.sentra-ai.com from the systems that update directly.

Back up GUARD, VIEW and box configurations regularly and keep copies off the server.
Verify the audit ledgers periodically and investigate any break.
Send security events to your own monitoring where the product supports it, and watch for alarms.
Test the fail-open and bypass procedures in a maintenance window, so the team knows them before an emergency.

Write to demo@sentra-ai.com. Please include the product, version and what you observed, and don't include passwords, keys or personal data.