Security Architecture
Last updated 25 September 2026
The short version
Sentri holds what it needs to send a person to your door: who you are, where you live, and what your sensors reported. Everything runs on managed providers in the United States. Camera video never reaches our servers at all — when you open a live view, it travels directly between your phone and your camera.
Data flow between systems
Two paths matter, and they are deliberately different. Events come to us. Video does not.
The event path. A camera provider sends a signed event to our API. The signature is verified before anything is read. The event is matched to a device the customer has linked; if it matches none, it is discarded. A matched event becomes a short record — what kind, which device, when — and is shown in the customer’s app.
The video path. When a customer opens a live view, our server passes a connection offer between the phone and the camera provider and then steps out. The video stream is established directly between those two. No frame, clip, thumbnail or recording reaches our servers, and none is stored.
Outbound. When an incident is raised, we send push notifications, email and, for high-severity events, voice and SMS through the providers listed below, and the case appears on our operator console.
Data storage locations and systems
Every system is a managed provider operating in the United States.
| System | Role | What it holds | Region |
|---|---|---|---|
| Railway | Application servers and the API | Processes all requests. Holds nothing at rest. | United States |
| Neon | Primary database (PostgreSQL) | Accounts, homes, devices, incidents, camera event records, encrypted vendor tokens | United States |
| Amazon S3 | Object storage | Incident photographs uploaded by a crew or a customer | United States |
| Vercel | Websites and web apps | Static assets and server-rendered pages. No customer records at rest. | United States |
| Resend | Transactional email | Recipient address and message content for alerts and account email | United States |
| Twilio | Voice and SMS | Phone number and message content during an incident | United States |
| Firebase | Push notifications | Device notification token and alert text | United States |
Not stored anywhere: camera video, audio, clips, thumbnails and still images. Customer passwords for connected services are never received. Passwords for Sentri itself are stored only as a one-way hash.
Vendor credentials and OAuth tokens are encrypted with AES-256-GCM before being written to the database. The encryption key is held as a platform environment variable and is never placed in source control. Traffic between every system is encrypted in transit with TLS 1.2 or above.
Camera event records are deleted automatically after ten days. Other retention periods are set out in our privacy policy.