Security at Sentra Scheduler

Hosting

Sentra Scheduler runs on servers in the United States, from a US-based cloud server provider, reachable only through Cloudflare.

• Cloudflare DNS, TLS, firewall and DDoS protection in front of every request; the server only accepts traffic from Cloudflare
• MySQL database with nightly backups to Amazon S3 (US West), kept 30 days
• Photos and files in a private Amazon S3 bucket, shared only through expiring links; encrypted at rest by S3
• Email through Resend with SPF, DKIM and DMARC on sentrascheduler.com
• Health checks every five minutes with alert emails when anything stops

Your company’s data

Each company only ever sees its own data.

• Every table is separated by company, and that separation is tested automatically on every API endpoint
• Encrypted in transit (TLS) everywhere
• Your customers’ contact details are visible only to roles that need them; technicians don’t see them
• Restricted teams keep their jobs private to their own staff
• Tracking pages never show names or contact details; staff choose which photos may appear on them
• An audit log of settings and job changes
• Your customers request service without an account; analytics are cookie-free and store no personal data

Staff access

• Five roles (owner or admin, team lead, dispatcher, office staff, technician) with permissions enforced by the server, not just hidden in the screen
• Every update checks the record’s version, so two people can’t silently overwrite each other
• Deactivated staff lose access; their history stays attributed
• Staff sign in through Clerk; single sign-on with Microsoft or Google is coming

Technician location

• Live location is off unless your admin turns it on, and then shared only while a technician turns sharing on in the app
• By default, a 7-day trail and the last known position for 24 hours are kept, then deleted
• Route planning sends stop coordinates to the maps provider, never names or contact details

AI

Sentra Scheduler uses Anthropic’s Claude for a few features (job type suggestions, the customer chat, chat insights, summaries and reply drafts for office staff, translation drafts and the in-product help assistant). It receives only what each feature needs, and your data is not used to train AI models. See subprocessors.

Compliance roadmap

• SOC 2: on our roadmap; ask us for current status
• A security questionnaire response is available on request: email [email protected]

Report a vulnerability

Email [email protected] with the subject “Security”. See also security.txt.