Wealth Managers
Security & Privacy
How Sentinel protects your data, controls access, and ensures compliance.
Security & Privacy
Your client data is protected by bank-grade encryption, strict access controls, and SEBI-aligned compliance practices.
Data Residency
| Data Type | Location | Notes |
|---|---|---|
| Document binaries | AWS S3 (ap-south-1) |
Tenant-scoped buckets |
| Structured extractions | MongoDB (ap-south-1) |
Encrypted at rest |
| Search indices | OpenSearch (ap-south-1) |
Vector + lexical |
| Auth & audit logs | PostgreSQL (ap-south-1) |
Immutable append-only |
No data leaves India. All compute, storage, and LLM inference (via AWS Bedrock) stays within Indian jurisdiction.
Encryption
| Layer | Standard |
|---|---|
| In transit | TLS 1.3 |
| At rest (S3) | AES-256 (SSE-S3) |
| At rest (databases) | AES-256 |
| Backup | Encrypted with tenant-specific keys |
Access Control
What You Can See
- Your own uploaded documents
- Documents shared with you by your team lead
- Chat sessions you created
- Reports you generated
What You Cannot See
- Other advisors’ client data
- Platform-wide analytics (unless you’re an Admin)
- Raw LLM prompts or system prompts
- Other tenants’ data (guaranteed by architecture)
Role-Based Access
| Role | Permissions |
|---|---|
| Viewer | Read own data only |
| Analyst | Upload, process, chat, export |
| Admin | User management, tenant config, audit export |
PII Protection
Sentinel automatically masks the following before any AI processing:
- Aadhaar numbers
- PAN cards
- UPI IDs
- IFSC codes
- Mobile numbers (in chat context)
Masked data is unmasked only in your final view, never in LLM logs.
Data Retention
| Data Type | Default Retention | Configurable |
|---|---|---|
| Documents | 7 years | Yes (per tenant) |
| Chat sessions | 3 years | Yes |
| Audit logs | 7 years | No (regulatory) |
| Exported reports | Client’s responsibility | N/A |
Compliance Alignment
| Regulation | How Sentinel Aligns |
|---|---|
| SEBI IA Regulations | Investment adviser registration workflow, suitability documentation, risk disclosure |
| SEBI PMS Guidelines | Portfolio reporting standards, performance attribution |
| RBI Data Localization | All data in India; no cross-border transfer |
| IT Act 2000 | Reasonable security practices, breach notification |
Reporting a Security Concern
- Email: security@centricity.co.in
- Subject:
[SENTINEL-SECURITY] Brief description - Include: tenant name, timestamp, affected document IDs (if any)
- Response SLA: 4 hours during business days