Trust & Security
Sentinel Core produces tamper-evident, independently timestamped records of the AI interactions an organization routes through it. OAIS receives fingerprints and metadata, not prompt or response content.
Content stays with the client
Sentinel Core fingerprints each AI interaction inside the client's environment before anything is sent to OAIS.
- HMAC-SHA3-256 fingerprints, keyed with a secret the client holds
- OAIS stores fingerprints and metadata, not prompt or response text
- Sentinel Guard data handling is configured per deployment and agreed during scoping
Tamper-evident ledger
Each record is signed and chained so that any later change is detectable.
- Ed25519 signatures and canonical JSON serialization (RFC 8785)
- Merkle batching with RFC 6962 domain separation
- Inclusion proofs for individual records
Independent timestamps
Merkle roots are timestamped by independent RFC 3161 timestamp authorities, DigiCert and Sectigo. By default, if no authority can be reached, the batch is left unanchored and the verifier reports it as incomplete.
Regulatory fit
Sentinel produces evidence of control over AI interactions. It addresses the evidence and record-keeping part of these frameworks; the compliance determination stays with the institution and its auditors.
- OSFI Guideline E-23: model risk management, effective May 1, 2027
- EU AI Act, Article 12: record-keeping for high-risk AI systems
- ISO/IEC 42001: AI management systems
Why platform logs and write-once buckets fall short
Raw logs that cannot be deleted
Write-once buckets full of raw prompts lock in customer personal information. That makes deletion and correction obligations under PIPEDA and Quebec Law 25 hard to meet.
The same team holds both sides
When the people who run the AI platform also control its logs, the record is not independent of the system it describes. Model risk reviews look for that separation.
What Sentinel does instead
Keyed fingerprints instead of plaintext, signed and chained records, and timestamps from outside authorities. It is designed so a third party can check the chain without trusting OAIS.
Security reviews
Evaluating Sentinel for your institution? We can take your security and risk teams through the architecture, data flows and controls in a technical session. Request a session. To report a vulnerability, . Reports go straight to the on-call engineer.