Trust

Security

Last updated October 19, 2026

1.Your video

• Recordings stay on your hardware. CameraNode keeps them in a database on the computer your cameras are plugged into, with each recording and snapshot encrypted using AES-256-GCM. The key is derived from that computer's machine ID. We have no copy and no way to read them.
• Live video is relayed, not stored. Command Center keeps about the last 60 seconds per camera in memory to play it to your organization's members. It is never written to disk or backups, and it's dropped about a minute after a camera stops sending.
• The one exception is incident evidence. Snapshots and short clips attached to an incident are stored in our database. Snapshots stay until you delete the incident; clip video (at most 30 seconds a clip) is deleted after your plan’s log retention period: 30, 90 or 365 days.
• Motion detection runs on your CameraNode. We receive the time and a score, never the frames.

2.Connections

• CameraNodes only make outbound connections, so you don't need to forward ports, open firewall holes or run a VPN.
• Every connection uses HTTPS: from your CameraNode, from your browser, and from AI assistants and Home Assistant. Browsers are told never to use plain HTTP (HSTS).
• A CameraNode's own web dashboard listens only on the computer it runs on, unless you choose to open it to your local network. If you do, it requires a password.

3.Accounts and access

• Sign-in is handled by Clerk. We never see your password. Session tokens are checked on every request against Clerk's published signing keys, and must have been issued for our site.
• Organizations are kept apart. Every database query is limited to the organization of the signed-in person or key making it. We've tested this by attempting cross-organization access through every route and tool.
• Roles. Admins manage cameras, keys, settings and data. Members can watch and read notifications.
• Audit trail. Security-relevant actions, such as keys created or revoked, settings changed or data exported, are logged with who did them and from where. So is every live view and every AI-assistant call. Admins can review and export these logs.
• Rate limits on every sensitive route slow down guessing and abuse. Self-hosted sign-in attempts are limited per address.

4.Keys

• CameraNode, AI-assistant (MCP), Sentinel agent and Home Assistant keys are shown in full once. We store only a SHA-256 fingerprint, so a database leak wouldn't reveal a usable key.
• Each kind of key works only where it belongs. A Home Assistant key can't call AI-assistant tools, and the reverse is also true.
• AI-assistant keys can be limited to read-only or to tools you pick.
• Any key can be revoked at once, and CameraNode keys can be rotated.

5.Sentinel AI and assistants

• Sentinel AI is off until an admin turns it on. While it is on, it sends camera images and incident details to our AI provider so the model can describe what it sees (see the Privacy Policy). Nothing is sent while it is off.
• You choose its cameras. Cameras outside Sentinel's scope are ignored completely; it never sees their frames.
• An AI can't turn off your cameras. Sentinel's own key can't change recording settings, so a camera's view can't talk the agent into disabling that camera.
• Every tool call by Sentinel or by an assistant you connect is logged.

6.The web app

• A Content-Security-Policy lets the dashboard run scripts only from our own site and the few services it needs (sign-in, the sign-up bot check, card payments). An injected script won't run.
• The dashboard can't be embedded in another site, which blocks clickjacking.
• We run no analytics, advertising or tracking scripts, and set no tracking cookies.

7.Infrastructure and backups

• Command Center runs on Fly.io in the United States. Its database and backups are encrypted at rest by Fly.io, and our services connect to the database over TLS 1.3, checking its certificate.
• Each of our services has its own database and its own database user, with no administrator-level access. Credentials for one service can't read another's data.
• The database is backed up daily and backups are kept for up to 30 days. The copy kept outside Fly.io is encrypted with a key only we hold. We have rehearsed restoring from them.
• Errors are reported to Sentry without names, email addresses or IP addresses.
• Our full list of service providers, and what each receives, is in the Privacy Policy.

8.Code and dependencies

• The source is public. Command Center and CameraNode are open source, so anyone can audit how your data is handled.
• Every change runs through automated tests and a security scan (CodeQL) before it ships. The server code's dependencies are checked against published vulnerability databases on every change, and a newly published vulnerability fails the build.
• Dependency updates are proposed automatically and tested before merging.
• CameraNode releases come with checksums, so you can verify what you download.

9.If something goes wrong

Our services are checked automatically every few minutes, and errors alert the team. If we learn of a breach affecting your personal information, we will tell you and the authorities as the law requires, along with what happened and what we're doing about it.

10.Reporting a vulnerability

Please email security@sentinel-command.com, or report privately through GitHub. Please don't open a public issue. Our security policy lists what's in scope and what to expect. We're grateful for responsible reports.