Sencai manages access to your infrastructure, so the bar is higher than for most SaaS. This page explains how the audit trail works, how access is controlled, where data lives and which documents we publish.
You get a published data processing agreement that forms part of our Terms, a published register of every company that processes data on our behalf, and export and erasure handled inside the product instead of by email ticket.
The platform records what changed, who approved it and when, and turns that record into something you can put in front of a regulator. We do not sell you a certificate - we give you the evidence your own obligations require.
Every entry carries a SHA-256 digest of its own content and of the entry before it, and the record is append-only, with immutability enforced by the database itself. Alter or remove one entry and every link after it stops adding up.
The platform runs in EU regions. Error tracking, product analytics, billing metering and observability all run on our own infrastructure, so your operational data is not handed to a telemetry vendor on the way past.
Most vendors ask you to trust their audit log. This one is built so you do not have to. Each entry binds the hash of the entry before it, so a single altered, inserted or deleted record breaks every link that follows - and you can prove it on your own machine, with your own tools, whenever you like.
Sencai manages access to your infrastructure, so our security bar has to be higher than most SaaS. Here's how we protect your accounts, your data, and your audit evidence.
Every action in the platform is recorded in an append-only audit log protected by cryptographic hash chaining. Tampering is detectable, and the complete history can be verified at any time - exactly the evidence trail NIS2 and GDPR reviews ask for.
Cloud credentials you connect are encrypted at rest, are not displayed back or written to logs, and are scoped to the organisation that added them, with that scoping covered by regression tests. Every use is audit-logged, and you can revoke access at any time.
Single sign-on with Microsoft Entra ID and Google Workspace, SCIM user provisioning, two-factor authentication, and fine-grained role-based access with just-in-time elevation and approval workflows - so day-to-day access stays scoped to what's actually needed.
Automated CVE scanning, CIS benchmark checks, automatic SSL/TLS certificate renewal, and per-organisation scoping covered by regression tests. Security runs continuously in the platform - not as a yearly checkbox exercise.
Built and operated by an EU company under EU law. Platform data is stored in the EU, and your workloads run wherever you choose - including EU-only providers.
NIS2-oriented evidence collection, governance scoring and GDPR-aligned data handling. For enterprise procurement and vendor reviews we provide records of processing, a verifiable export of your audit trail, our published sub-processor register, a written data-residency statement, our published Data Processing Agreement, and direct answers to your security questionnaires. We do not list certifications we do not hold.
Found a vulnerability? Email security@sencai.space - we respond within two business days and credit reporters who want to be credited.
Preparing a vendor review? Our Data Processing Agreement is published at sencai.space/legal/dpa/ and forms part of our Terms - questions about it go to privacy@sencai.space. For security documentation, write to sales@sencai.space.
Join the teams building on European-sovereign infrastructure. Start today - no sales call required.
Sencai uses only cookies that are strictly necessary to operate this site. We don't currently use analytics, marketing, or third-party tracking - if that ever changes, your preference below will already be on record.