Security and compliance, built into the control plane
Security in Sencai is not a layer added afterward. Every action — a firewall change, a patch rollout, an approved elevation — writes to the same tamper-evident record. Access expires by default, and changes reach the provider directly. When an auditor asks for evidence, you export it instead of assembling it from memory. Sencai is built and operated by a Czech company under EU law.
Changes reach the provider directly
Many tools manage a copy of your cloud that drifts when someone edits a security group by hand. Where Sencai has built live management, your change goes out over the provider's own API, and the response returns before the screen updates. Coverage varies: DNS reaches the most providers, firewall and security groups fewer, and virtual networks fewer still. Each integration page states what is live for that provider, and inventory and provisioning covers the rest. Nothing migrates: your account, contract, and bill stay where they are. Where live writes are missing, inventory and the audit trail still show what exists and who touched it.
Patch, harden, and run runbooks everywhere
A lightweight agent runs on any Linux server: cloud instance, bare-metal box, or a machine under a desk. It monitors the host, tracks installed software, and applies patches, so you can see what is outdated across the whole fleet. A separate agent covers Kubernetes clusters. Runbook automation lets you write a patch rollout or incident response once, gate it behind approval, and run it the same way on every matching host. Hardening does not depend on which provider a server sits on.
Access that expires by default
Sign-in goes through Microsoft Entra ID or Google Workspace, and SCIM provisions and deprovisions people as they join and leave. Role-based access control sets what each user can see and change. For sensitive work, just-in-time elevation means nobody holds standing admin rights. A person requests access for a task, someone else approves it, and the access expires on its own. The approval is recorded in the audit trail. See the features page for SSO enforcement and JIT approval together.
A ledger that only grows
Every action — a provisioned instance, a changed firewall rule, an approved elevation, a destroyed resource — writes an entry to an append-only, hash-chained log. Each entry carries the hash of the one before it, so editing or deleting a past entry breaks the chain in a detectable way. "Who changed this, and when" becomes a query, not an investigation. It is also the backbone of Sencai's NIS2 evidence. How far back you can see depends on your plan, but nothing written is ever deleted.
Evidence, not a certificate we don't have
Sencai does not hold ISO 27001 or SOC 2, and says so. A security review usually needs evidence: an exportable audit trail, a record of processing activities, a published list of sub-processors, a statement of where your data resides, and a published Data Processing Agreement. Sencai has all five. Sencai Tech s.r.o. operates under EU law from Prague. See how this fits regulated industries and government, or look up NIS2 in the glossary.
Start with the inventory you already have
Connect an account or enrol a server: both land in the same inventory, with nothing to migrate. The free organisation covers one user and five managed resources, with no card and no time limit. Beyond that you pay per resource and per person; see [pricing](/pricing/).