Read-only access. Nothing is written back. Ever.
Centinel uses read-only ERP API credentials to review journal entries and flag exceptions. We never write to your ledger, alter records, or retain raw entry data beyond the rule evaluation requirement.
What enters Centinel, what stays, and why.
Your ERP holds sensitive financial data. See what Centinel accesses and how long it stays.
-
Read-only API connections
Centinel uses read-only ERP credentials to access journal entries and chart-of-accounts data. No write, delete, or admin rights are requested or used.
-
Exception details kept, raw entries are not
If a journal entry meets a rule condition, Centinel saves an exception record containing the rule name, entry reference, account, amount, severity, and timestamps. Complete raw payloads remain in memory only during evaluation.
-
Transit and storage encryption
Data in transit uses TLS 1.3. Stored exceptions and configuration use AES-256. Credentials sit in a dedicated secrets manager, not application files.
-
EU data residency by default
Centinel operates its infrastructure in EU data centres, with exception metadata stored and processed within the EU. Enterprise customers may request residency documentation for their vendor assessment.
-
Retention follows your subscription
Exception records stay through your subscription for close reporting and audit requests. After termination, data is deleted within 30 days after written request.
Permissions assigned by role.
Centinel divides account access by role, giving external auditors, internal reviewers, and controllers visibility into only the information required for their work.
Permissions by role
Controller, reviewer, and auditor roles have separate scopes. Admins can add or remove team members without contacting Centinel support.
SSO and MFA
Enterprise plans support SAML 2.0 SSO. MFA is required for users on Control and Enterprise tiers. SCIM handles team provisioning.
Activity and audit log
Logins, permission updates, rule changes, and exception resolutions are recorded with a timestamp and user ID. Account admins can view logs, but users cannot remove them.
Auditor read-only access
External auditors get read-only access to the exception queue and close reports, without seeing rule settings or user management. Access ends after a configurable period.
Rotate credentials
Rotate ERP service credentials whenever needed from the integrations panel. Centinel can remind you according to your credential policy and supports automated rotation through an API.
Vendor assessment support
Enterprise customers may request vendor risk assessment materials such as data residency confirmation, the sub-processor list, and an architecture overview. Contact us to begin the review.
Security questions? Speak with our team.
Whether you need vendor assessment materials, have a data handling question, or want to review our security approach before subscribing, we respond within one business day.
Or email directly: [email protected]