Deterministic policy
The same policy-engine package drives enforcement, dry run and effective-policy explanation in tested POC code.
Trust and sovereignty
Verify the architecture, evidence and stated limitations.
SentraMind’s assurance position is a set of bounded, inspectable statements—not a promise that every production control already exists. This centre separates verified POC behaviour, evaluation criteria and artifacts that are not yet publicly available.
Controlled deployment direction
Designed for self-hosted and air-gap-capable operation. Runtime zero-egress is an evaluation criterion, not a proven public claim. The portal itself is built without third-party analytics, hosted fonts or runtime assets.
Customer-controlled boundary
- Approved input path
- Deterministic decision
- Event evidence
- Customer custody
Runtime egress must be verified as an acceptance criterion
Simplified evidence path
Evidence status
Claims and evidence must share the same boundary.
Hash-chain integrity
Stored canonical events form a SHA-256 chain with signed checkpoints that repository tests can independently verify. SIEM acknowledgement remains emulated.
Evidence custody
Sealing and custody primitives pass test vectors, but the verdict pipeline does not yet call the sealer. Production separation of administration and evidence-key custody remains an acceptance criterion.
Identity and roles
Role enforcement exists at POC depth through a disclosed development identity provider. AD, Kerberos and hardware officer credentials are not integrated.
Assurance artifacts
Available and missing artifacts are equally explicit.
Current limitations register
Repository document; reviewed 2026-08-29.
Deterministic browser demonstrations
Narrow, reproducible behaviour with production differences disclosed.
Sanitised audit verification report
Requires an approved public artifact and review owner.
Signed-update policy and SBOM
No approved public artifact; no download is offered.
Reproducible-build evidence
Requires a published procedure and clean-room reproduction evidence.
Current limitations
Evaluation should begin with the known gaps.
These constraints are not hidden in footnotes. They shape the test plan and procurement decision.
- 01 No endpoint agent or managed-browser extension exists in the POC.
- 02 Model classification is disabled; no model quality or latency result is claimed.
- 03 Production HA, failover and rated-QPS performance have not been measured.
- 04 Current sealed evidence rows were written by seeded tooling, not the live verdict pipeline.
- 05 AI Usage Observability uses synthetic-source validation and is coming next.
Evaluation method
Close the review with reproducible evidence.
A private assurance review begins with your intended boundary, threat assumptions and evidence needs. We agree which repository evidence can be inspected, which behaviours can be reproduced, and which production controls must become explicit acceptance criteria.