What it monitors
Sentinelleai runs deterministic scanners first — static analysis, dependency and secrets checks, six on-chain engines, known-pattern web and DNS tooling, cloud and container posture checks, host file-integrity monitoring. A multi-model AI panel reviews after that, as a second pass over what the tools already found; nothing in the inline protection path waits on a model call.
What a scan produces is kept: findings, severity, the reasoning behind them, tracked from one scan to the next. What it was given is not — a cloned repository or a staged upload lives in a temporary directory for the duration of the scan and is erased in a finally block regardless of how the scan ends.
What it is not
- Not an audit — a smart-contract verification is an automated check; it gives no assurance or guarantee.
- Not a penetration test — web and DNS scans run known-pattern tools, not a human tester's business-logic exploration.
- Not a compliance opinion — the control map is an evidence map, never a conclusion that a control is adequate.
- Not an incident-response retainer — forensics and remediation tooling exist here, but no one is on call for you.
- Not a guarantee — "no findings" means the tools that ran found nothing, never that nothing is there.
Sentinelleai is an automated security monitoring platform. Nothing it produces is an audit, a penetration test, a compliance opinion, or a guarantee that a system is secure. "No findings" means the tools that ran found nothing, never that nothing is there; anything a tool could not check is reported as unknown, not as clean. For decisions that carry real money or real liability, engage qualified professionals and treat Sentinelleai's output as their starting material.
Explore the docs
Overview
- What Sentinelleai is
What the platform monitors, what runs before an AI ever sees a finding, and what it doesn't claim to be.
- How a scan works
The path from a submitted target to a stored finding: deterministic tools first, a multi-model panel after, source erased.
- Reading a report
Severities, the score and grade, PASS/CAUTION/FAIL verdicts, degraded and unknown results, and the lifecycle of a finding.
- Limitations & responsible use
Every disclaimer on this site in one place: what each scan family stops short of proving.
Getting started
- Accounts & access
How accounts are created, signing in, two-factor authentication, organisations, and who can see what.
- Proof of possession
Why a web or DNS target must be proven before it can be scanned, and the two ways to prove it.
- Plans & billing
How forfaits map to functions, what's billed per event versus per month, and what's shown but not yet billable.
Scans
- Code & supply chain
Static analysis, dependency and secrets scanning over a repository, an archive, or an upload.
- Smart contracts
Six on-chain engines and a multi-model panel against a deployed address or verified source — not an audit.
- Web & DNS
Known-pattern tooling and an optional read-only reasoning pass over a proven web or DNS target — not a penetration test.
- Cloud, containers & IaC
Read-only posture checks across cloud accounts, container images, and infrastructure-as-code.
- Hosts & ransomware
Agent-based file-integrity monitoring and ransomware detection on a host you enrol.
- AI & agents
Static and runtime checks for applications that embed LLMs, tools and agents: OWASP LLM Top 10, MCP and tool security, provenance, guardrails, RAG.
- Human factor
Awareness content, prompted phishing simulations, and insider-risk signals — consent-gated, never covert.
Watch & respond
- Monitors & alerts
Recurring scans, the channels an alert can reach, and how a baseline becomes a drift notification.
- Auto-pause
The pause-only circuit breaker: what it can stop, the key it needs, and what it deliberately can't do.
- Site lockdown
The lock-only proxy circuit breaker for your own site: enrol, verify, rehearse, arm, and why release is always your decision.
- Host containment
Killing the attributed process and isolating a host's network on its own CRITICAL alert: the two conditions required to act, and what it stops short of.
- Incidents, forensics & remediation
Declaring an incident, the forensic artefacts collected, and how a remediation quote is produced.
- Evidence ledger & timeline
The append-only activity log, its chaining and anchoring, and the per-account timeline built from it.
- Lockdown & inline protection
The deterministic filters that sit in front of a request, and the staged, reversible lockdown response.
Govern
- Compliance & governance
The control map: which artefacts Sentinelleai holds against a control, and what each one stops short of proving.
Reference
- What each function does
Every function each plan covers, defined in one line, marked in place or in observation. No amounts — those live on the pricing page.
- Data handling & retention
What's stored, for how long, what's erased at the end of a scan, and where the data lives.
- API reference
The full OpenAPI surface, browsable with Redoc — requires an admin session.
How to read every page
Every page in this guide follows the same discipline as the product it describes: it says what a function does, what it stops short of, and it marks anything still in observation — shown on the pricing table, never billed as delivered. Where a scan family carries a specific limitation, the page repeats the disclaimer rather than assuming you read it once on this hub.