Something is wrong. Start here.
A hosted forensic analyst for a real incident, on top of a platform that watches code, contracts, surface, cloud and hosts the rest of the time. Detection and forensics first: nothing on your side is ever paused, locked or killed unless you armed that protection yourself and signed for it.
- The moment it opensForensic artefacts are acquired right then, each hashed as it is captured. An artefact that could not be captured is recorded as absent, never quietly dropped.
- Then, where it is analysedA hosted analyst takes it from there — small cases on an always-on CPU server in the United States, a larger one on a GPU rented in the EU for the duration.
- And on the recordContainment is recorded only once an effect was actually observed. If events reappear afterwards, the incident reopens rather than closing quietly.
Pick the surfaces you have.
13 plans, one per surface. Each tile opens the definition of every function that plan covers; a plan only ever sells what is marked in place, and anything still in observation is shown there and never billed as delivered. Amounts are on the pricing page.
Code & Software Supply Chain
Static analysis and taint tracking, dependencies, secrets, SBOM, provenance and install-hook behaviour on your repositories.
21 functions in place
Application
Scanning of a running application you have proven you control: authenticated crawling, authorization tests, fuzzing, browser and API security.
9 functions in place
Surface & Network
Ports, TLS, headers, DNS posture, exposure and certificates on your targets, and the intrusion-detection sensor you supply.
13 functions in place · 4 in observation
Cloud & Containers
Read-only posture of a cloud account, container images, Kubernetes and infrastructure-as-code, with drift and effective permissions.
9 functions in place
Host & Ransomware
File integrity, ransomware detection and decoys on each host. Containment of a process is a separate add-on, behind its own consent.
8 functions in place
Identity & Data
Authority matrix, exposed credentials, sessions, OAuth, personal-data discovery and encryption posture.
11 functions in place · 3 in observation
Compliance & Governance
Control map for SOC 2 and ISO 27001, evidence over a declared period, risk register and remediation tracking.
8 functions in place
Operations & Response
Log collection and correlation, detection rules, threat hunting, incidents, forensics, playbooks and vulnerability feeds.
16 functions in place · 1 in observation
Offensive Validation
Exploitation run rather than asserted, mutation testing, symbolic execution, exploit chains and validation of your own detections.
5 functions in place · 4 in observation
Smart Contract Verification
Eight on-chain ecosystems, a multi-model panel with a judge, and on-chain proof on a fork of the target chain. Automated verification — not an audit, and it carries no assurance or guarantee.
10 functions in place
Web3 Monitoring
Continuous watch of a deployed protocol: drift against the reviewed source, governance and upgradability, scam shapes and wallet approvals.
5 functions in place
AI & Agents
OWASP LLM Top 10 read from the code, tool and MCP security, model provenance, agent guardrails and retrieval pipelines.
5 functions in place · 2 in observation
Email & CEO Fraud
Executive-fraud and impersonation detection on a mailbox you connect read-only, with the pretext surface an attacker can see.
1 function in place · 4 in observation
Sentinelleai Complete
every monthly plan at its base cap; contract audits billed per use. The three protections stay standalone, each behind its own signed consent.
See every functionEntered, analyzed, erased.
Nothing of your code accumulates here. Disk usage is bounded by how many scans run at once, not by how many have ever run.
A repository, an archive, or an address
An https git repository, an uploaded archive, or a deployed contract address read from the chain's own explorer. A web or DNS target has to be proven yours first.
Deterministic scanners first, models after
Static analysis and taint, dependency and supply-chain checks, secrets and the on-chain engines produce the findings on their own. The multi-model panel reviews afterwards; no protective decision waits on a model.
Findings are kept, the source is not
A cloned repository or a staged upload lives in a temporary directory for the scan and is removed whether the scan succeeds or fails. What stays is the findings: severity, file, line, reasoning.
Sold only when it is actually in place.
Every function the catalogue could sell is tracked in one atlas of 149 entries, checked against the code that runs it. A forfait sells only the functions marked en place (in place); functions still partiel (partial) are shown as in observation, never billed as delivered; functions marked absent are not listed at all.
Not an audit, not a penetration test, not a compliance opinion. A PASS is not a certification. Before a mainnet deployment, a public launch or a certification, engage a qualified professional — what this platform produces is their starting material, not a replacement for them.
Frequently asked.
- Do you keep my code?
- No. The checkout is temporary and removed whether the scan succeeds or fails. What the database keeps is the findings, deduplicated from one scan to the next. See data handling.
- Can I scan any website?
- Only one you can prove you control: a DNS TXT record or a well-known file, checked live before anything touches the target. See proof of possession.
- Is the AI in the inline path?
- No. Deterministic scanners produce the findings on their own and the multi-model panel reviews afterwards, as a second pass. Online protection never waits on a model call.
- Will you lock my site or pause my contract?
- Only if you enrolled that protection, rehearsed it, armed it and signed its consent. Auto-pause never unpauses, site lockdown is never released automatically, and containment acts only on a host you armed.
- Where does it run?
- In the United States. For a real incident, a mid-sized or larger case bursts to a GPU rented in the EU for the duration of the analysis. No hyperscaler and no Chinese-origin model sits in that path.
- What do I get after an incident?
- A short notice as soon as a protection acts, then the full signed report — with the consent you signed attached — to your account address, kept on your timeline. See the evidence ledger.
Put one sentinel on your whole surface.
One plan per surface, priced against what is delivered today. Every action a protection takes is recorded with your identity and your stated reason, and you read the same record the operator does.
Talk to a person.
The assistant in the corner of this page answers from the documentation. For anything it cannot answer — a question about your own account, a real incident, or something the site does not cover — write to us.
Already a customer with an incident in progress? Open an incident from your account — that path is recorded in the evidence ledger, an e-mail is not.