Trust Center
How the platform protects customer data
Trust and security are fundamental to the design of Kontrol Sentinel. This Trust Center provides transparency into how the platform protects customer data, maintains operational resilience, and aligns with regulatory frameworks. Kontrol Sentinel is designed for organisations that require secure, compliant, and reliable digital engagement tools.
Compliance
Compliance framework
Kontrol Sentinel aligns with widely recognised regulatory and security standards.
GDPR
The platform is built according to the requirements of the General Data Protection Regulation. Key principles implemented include:
- Privacy by design
- Data minimisation
- Encryption of sensitive information
- Data subject rights support
- Transparent processing practices
European data residency
Customer data is hosted on infrastructure located within the European Economic Area (EEA). This ensures:
- Compliance with European data protection expectations
- Controlled international data transfers
- Reduced exposure to extraterritorial regulations
Security
Security architecture
Kontrol Sentinel follows modern security architecture principles.
Infrastructure security
- HTTPS encryption (TLS 1.2 or higher)
- Hardened server configurations
- Continuous security updates
- Firewall and traffic filtering
Access control
- Role-based access control
- Secure authentication workflows
- Administrative logging
Monitoring & detection
The platform continuously monitors:
- System activity
- Abnormal usage patterns
- Suspicious authentication attempts
Email authentication
All outbound campaign email from verified custom domains is protected by a full authentication stack:
- Per-domain RSA-2048 DKIM signing keys (BYODKIM)
- SPF authorisation scoped to the sending infrastructure
- DMARC policy enforcement with reporting
- DKIM private keys are unique per sender domain and stored server-side only — never exposed to end users
Data protection
Data protection
Kontrol Sentinel processes data strictly for the purpose of providing the platform services. We apply the following protections:
- Encrypted communications
- Controlled access policies
- Limited retention periods
- Privacy-by-design architecture
- Cryptographic email signing keys generated and stored in isolation per customer domain
Kontrol Sentinel does not sell customer data.
Incident response
Incident response
Kontrol Sentinel maintains internal procedures to respond to security incidents. These procedures include:
- Detection and containment protocols
- Internal escalation procedures
- Client notification where required by regulation
- Post-incident review and mitigation
Subprocessors
Subprocessors
Kontrol Sentinel relies on a small number of trusted infrastructure and service providers for specific technical functions. Core infrastructure subprocessors are located within the European Union and are selected based on strict security and compliance criteria. Sanctions, PEP and watchlist screening for the Kontrol Reputation module is delivered through eupeak.io, an affiliated risk-intelligence API operated by Samarkand Industries OÜ — the same parent entity as Kontrol Sentinel — so all processing of monitored-entity names remains within the Samarkand Industries group and within the European Union.
Core infrastructure
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | DDoS protection, CDN, and static asset delivery | EU |
| Mailgun (Sinch) | Campaign email delivery and domain verification | EU (Frankfurt) |
| Neon (Neon Inc.) | Serverless PostgreSQL database hosting for platform data | EU (Frankfurt) |
| Vercel Inc. | Application hosting and serverless edge runtime | EU (Frankfurt) |
| Resend | Transactional email delivery for system notifications | EU (Ireland) |
| Amazon Web Services (AWS Rekognition) | Face detection and biometric indexing for the Digital Assets module. Processed only when face recognition is explicitly enabled by the account holder (opt-in). Involves special category data under GDPR Art. 9 — user consent is required prior to activation. | EU (Frankfurt) |
| eupeak.io (Samarkand Industries OÜ, intra-group) | Sanctions, PEP and watchlist screening API for the Kontrol Reputation module. Receives monitored-entity names (and GLEIF legal names where available) and returns pre-merged matches across 300+ international sources. Operated by Samarkand Industries OÜ, the same parent entity as Kontrol Sentinel — no data leaves the Samarkand Industries group. | EU (Estonia) |
Kontrol Reputation — sanctions & watchlist data providers
When a Reputation alert scan runs, the monitored entity name (and legal name if available) is transmitted to the service below for sanctions and watchlist screening. This data consists solely of the entity's name — no personal user data, credentials, or customer records are shared. Screening is performed only if the provider's API key is configured in the installation.
| Provider | Coverage | Location |
|---|---|---|
| eupeak.io | Samarkand Industries group risk-intelligence API — federates OpenSanctions (329+ lists), direct OFAC SDN + UN Security Council feeds, sanctions.io (1M+ PEP records, Interpol, FBI Most Wanted), dilisense (130+ official sources) and NameScan adverse media into a single pre-merged screening call. | EU (Estonia) |
eupeak.io is operated by Samarkand Industries OÜ, the same parent entity as Kontrol Sentinel, and all processing takes place within the European Union. Where the monitored entity is a natural person, the data shared is limited to the entity name used to build the alert, and processing is carried out under the same legal basis as Kontrol Sentinel itself. When no API key is configured, no sanctions screening is performed.
Disclosure
Responsible disclosure
Security researchers are encouraged to report vulnerabilities responsibly. We commit to reviewing reports promptly and addressing verified vulnerabilities.
Please contact: [email protected]
Contact
Questions about security or compliance?
For security or compliance questions: [email protected]